Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40324

use-of-uninitialized-value in create_index(trx_t*, TABLE const*, dict_table_t*, unsigned int)

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Q4/2026 Server Maintenance

    Description

      CS 10.11.19 9b6fdee3456df8e979f91ffdd727ba85fc491442 (Debug, MSAN, Clang 20.1.8-20250804) Build 08/07/2026

      # 2026-07-09T04:29:06 [746395] | SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:10941:3 in create_index(trx_t*, TABLE const*, dict_table_t*, unsigned int)
      

      StackTrace

      # 2026-07-09T04:29:06 [746395] | 2026-07-09  4:22:33 90 [ERROR] InnoDB: Transaction was aborted due to Lock wait timeout
      # 2026-07-09T04:29:06 [746395] | 2026-07-09  4:22:33 110 [Note] InnoDB: Online DDL : Start reading clustered index of the table and create temporary files
      # 2026-07-09T04:29:06 [746395] | 2026-07-09  4:22:33 110 [Note] InnoDB: Online DDL : End of reading clustered index of the table and create temporary files
      # 2026-07-09T04:29:06 [746395] | 2026-07-09  4:22:35 110 [Note] InnoDB: Trying to shrink innodb_buffer_pool_size=8m (1949 pages) from 32m (7796 pages, to withdraw 5633)
      # 2026-07-09T04:29:06 [746395] | 2026-07-09  4:22:35 115 [Warning] InnoDB: Failed to create FTS index table test/FTS_0000000000000c54_0000000000000fe4_INDEX_4: Lock structs have exhausted the buffer pool
      # 2026-07-09T04:29:06 [746395] | ==748802==WARNING: MemorySanitizer: use-of-uninitialized-value
      # 2026-07-09T04:29:06 [746395] | 2026-07-09  4:22:39 110 [Note] InnoDB: Resizing hash tables
      # 2026-07-09T04:29:06 [746395] |     #0 0x57dbf1fa1cc5 in create_index(trx_t*, TABLE const*, dict_table_t*, unsigned int) /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:10941:3
      # 2026-07-09T04:29:06 [746395] |     #1 0x57dbf1f63c1c in create_table_info_t::create_table(bool) /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:12868:19
      # 2026-07-09T04:29:06 [746395] |     #2 0x57dbf1f66c54 in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*, bool, trx_t*) /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:13288:17
      # 2026-07-09T04:29:06 [746395] |     #3 0x57dbf0a75702 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.11_dbg_msan/sql/handler.cc:5680:14
      # 2026-07-09T04:29:06 [746395] |     #4 0x57dbf0a79813 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*, bool) /test/10.11_dbg_msan/sql/handler.cc:6158:22
      # 2026-07-09T04:29:06 [746395] |     #5 0x57dbf1752970 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /test/10.11_dbg_msan/sql/sql_table.cc:11548:7
      # 2026-07-09T04:29:06 [746395] |     #6 0x57dbf193587a in Sql_cmd_alter_table::execute(THD*) /test/10.11_dbg_msan/sql/sql_alter.cc:688:11
      # 2026-07-09T04:29:06 [746395] |     #7 0x57dbf145c079 in mysql_execute_command(THD*, bool) /test/10.11_dbg_msan/sql/sql_parse.cc:6199:26
      # 2026-07-09T04:29:06 [746395] |     #8 0x57dbf14506ef in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_dbg_msan/sql/sql_parse.cc:8219:18
      # 2026-07-09T04:29:06 [746395] |     #9 0x57dbf144a126 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_dbg_msan/sql/sql_parse.cc:1924:7
      # 2026-07-09T04:29:06 [746395] |     #10 0x57dbf14511ae in do_command(THD*, bool) /test/10.11_dbg_msan/sql/sql_parse.cc:1434:17
      # 2026-07-09T04:29:06 [746395] |     #11 0x57dbf191d22c in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_msan/sql/sql_connect.cc:1482:11
      # 2026-07-09T04:29:06 [746395] |     #12 0x57dbf191cbb6 in handle_one_connection /test/10.11_dbg_msan/sql/sql_connect.cc:1394:5
      # 2026-07-09T04:29:06 [746395] |     #13 0x754bc509caa3 in start_thread nptl/pthread_create.c:447:8
      # 2026-07-09T04:29:06 [746395] |     #14 0x754bc5129a63 in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:100
      # 2026-07-09T04:29:06 [746395] | 
      # 2026-07-09T04:29:06 [746395] |   Uninitialized value was created by a heap deallocation
      # 2026-07-09T04:29:06 [746395] |     #0 0x57dbf0975174 in free (/data/Server_bin/MSAN_MD080726-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd+0xfee174) (BuildId: 9ac4fa3f4478741e712ebd6016da11b676c29367)
      # 2026-07-09T04:29:06 [746395] |     #1 0x57dbf220efd3 in mem_heap_free(mem_block_info_t*) /test/10.11_dbg_msan/storage/innobase/include/mem0mem.inl:419:3
      # 2026-07-09T04:29:06 [746395] |     #2 0x57dbf220efd3 in dict_mem_table_free(dict_table_t*) /test/10.11_dbg_msan/storage/innobase/dict/dict0mem.cc:231:2
      # 2026-07-09T04:29:06 [746395] | 
      # 2026-07-09T04:29:06 [746395] | SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:10941:3 in create_index(trx_t*, TABLE const*, dict_table_t*, unsigned int)
      

      RQG startup options

       
      # $RQG_HOME/rqg.pl \
      # --gendata=conf/mariadb/table_stress.zz \
      # --gendata_sql=conf/mariadb/table_stress.sql \
      # --grammar=conf/mariadb/table_stress_innodb.yy \
      # --redefine=conf/mariadb/redefine_innodb_log_archive.yy \
      # --mysqld=--loose-innodb_log_archive=ON \
      # --mysqld=--loose-innodb_log_file_size=8M \
      # --mysqld=--loose-innodb_log_file_mmap=OFF \
      # --reporters=LogArchiveRecovery \
      # --mysqld=--loose-innodb_lock_schedule_algorithm=fcfs \
      # --mysqld=--loose-idle_write_transaction_timeout=0 \
      # --mysqld=--loose-idle_transaction_timeout=0 \
      # --mysqld=--loose-idle_readonly_transaction_timeout=0 \
      # --mysqld=--connect_timeout=60 \
      # --mysqld=--interactive_timeout=28800 \
      # --mysqld=--slave_net_timeout=60 \
      # --mysqld=--net_read_timeout=30 \
      # --mysqld=--net_write_timeout=60 \
      # --mysqld=--loose-table_lock_wait_timeout=50 \
      # --mysqld=--wait_timeout=28800 \
      # --no_mask \
      # --queries=10000000 \
      # --seed=random \
      # --reporters=None \
      # --reporters=ErrorLog \
      # --reporters=Deadlock \
      # --validators=None \
      # --mysqld=--log_output=none \
      # --mysqld=--log_bin_trust_function_creators=1 \
      # --mysqld=--loose-debug_assert_on_not_freed_memory=0 \
      # --engine=InnoDB \
      # --restart_timeout=240 \
      # --mysqld=--plugin-load-add=file_key_management.so \
      # --mysqld=--loose-file-key-management-filename=$RQG_HOME/conf/mariadb/encryption_keys.txt \
      # --mysqld=--plugin-load-add=provider_lzo.so \
      # --mysqld=--plugin-load-add=provider_bzip2.so \
      # --mysqld=--plugin-load-add=provider_lzma.so \
      # --mysqld=--plugin-load-add=provider_snappy.so \
      # --mysqld=--plugin-load-add=provider_lz4.so \
      # --mysqld=--loose-innodb_compression_level=1 \
      # --duration=300 \
      # --mysqld=--loose-innodb_fatal_semaphore_wait_threshold=300 \
      # --mysqld=--lock-wait-timeout=86400 \
      # --mysqld=--innodb-lock-wait-timeout=50 \
      # --mysqld=--sql_mode=STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION \
      # --mysqld=--loose-innodb_read_only_compressed=OFF \
      # --mysqld=--loose-innodb-sync-debug \
      # --mysqld=--innodb_stats_persistent=on \
      # --mysqld=--innodb_adaptive_hash_index=on \
      # --mysqld=--innodb_random_read_ahead=ON \
      # --mysqld=--innodb_read_ahead_threshold=0 \
      # --mysqld=--loose-innodb_evict_tables_on_commit_debug=off \
      # --threads=9 \
      # --rr=rr record --wait \
      # --mysqld=--innodb_undo_log_truncate=OFF \
      # --mysqld=--innodb_undo_tablespaces=0 \
      # --mysqld=--innodb_rollback_on_timeout=ON \
      # --mysqld=--innodb_page_size=4K \
      # --mysqld=--innodb-buffer-pool-size=256M \
      # --vardir_type=fast \
      # --no_mask \
      # --batch \
      # --basedir1=/Server_bin/MSAN_MD080726-mariadb-10.11.19-linux-x86_64-dbg \
      # --basedir2=/Server_bin/MSAN_MD080726-mariadb-10.11.19-linux-x86_64-dbg \
      # --script_debug=_nix_ \
      # --major_runid=1783593674 \
      # --minor_runid=72
      

      RR trace is present on SDP :-
      /data/results/1783593674/TBR-2455

      Attachments

        Activity

          People

            thiru Thirunarayanan Balathandayuthapani
            saahil Saahil Alam
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 1.5h
                1.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.