Details
-
Bug
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
-
10.6
-
Can result in hang or crash
Description
CREATE TABLE t (a INT NOT NULL); |
CREATE UNIQUE INDEX i ON t (a) USING HASH; |
SELECT SLEEP(2); |
INSERT INTO t VALUES (1); |
Leads to:
|
CS 10.6.28 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 (Optimized, MSAN, Clang 20.1.8-20250804) Build 17/07/2026 |
==708281==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x555557c10768 in dict_table_n_rows_inc(dict_table_t*) /test/10.6_opt_msan/storage/innobase/include/dict0dict.h:686:12
|
#1 0x555557c10768 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /test/10.6_opt_msan/storage/innobase/row/row0mysql.cc:1388:2
|
#2 0x5555576ca2de in ha_innobase::write_row(unsigned char const*) /test/10.6_opt_msan/storage/innobase/handler/ha_innodb.cc:7825:10
|
#3 0x5555563339cd in handler::ha_write_row(unsigned char const*) /test/10.6_opt_msan/sql/handler.cc:7779:3
|
#4 0x555556b71600 in write_record(THD*, TABLE*, st_copy_info*, select_result*) /test/10.6_opt_msan/sql/sql_insert.cc:2310:12
|
#5 0x555556b6a258 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.6_opt_msan/sql/sql_insert.cc:1170:14
|
#6 0x555556c3fcab in mysql_execute_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:4633:10
|
#7 0x555556c2fd95 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_opt_msan/sql/sql_parse.cc:8199:18
|
#8 0x555556c29e4b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1911:7
|
#9 0x555556c30988 in do_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1421:17
|
#10 0x5555570c9b0c in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_msan/sql/sql_connect.cc:1393:11
|
#11 0x5555570c9432 in handle_one_connection /test/10.6_opt_msan/sql/sql_connect.cc:1305:5
|
#12 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
|
#13 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Memory was marked as uninitialized
|
#0 0x555556248f71 in __msan_allocated_memory (/test/MSAN_MD170726-mariadb-10.6.28-linux-x86_64-opt/bin/mariadbd+0xcf4f71) (BuildId: c54cd201b0905cfceb6742c33d28a95089229adb)
|
#1 0x555557774baf in dict_stats_deinit(dict_table_t*) /test/10.6_opt_msan/storage/innobase/include/dict0stats.inl:185:2
|
#2 0x555557774a60 in dict_table_close(dict_table_t*) /test/10.6_opt_msan/storage/innobase/dict/dict0dict.cc:216:9
|
#3 0x555557c0c3d8 in row_prebuilt_free(row_prebuilt_t*) /test/10.6_opt_msan/storage/innobase/row/row0mysql.cc:984:3
|
#4 0x5555576c3c1c in ha_innobase::close() /test/10.6_opt_msan/storage/innobase/handler/ha_innodb.cc:6244:2
|
#5 0x555556fe211d in closefrm(TABLE*) /test/10.6_opt_msan/sql/table.cc:4685:24
|
#6 0x55555737f57b in THD::close_temporary_table(TABLE*) /test/10.6_opt_msan/sql/temporary_tables.cc:1248:3
|
#7 0x55555737f57b in THD::free_temporary_table(TABLE*) /test/10.6_opt_msan/sql/temporary_tables.cc:1499:3
|
#8 0x55555737f57b in THD::drop_temporary_table(TABLE*, bool*, bool) /test/10.6_opt_msan/sql/temporary_tables.cc:665:5
|
#9 0x555556f2000c in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /test/10.6_opt_msan/sql/sql_table.cc:11170:8
|
#10 0x555556c3c6b3 in mysql_execute_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:4278:10
|
#11 0x555556c2fd95 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_opt_msan/sql/sql_parse.cc:8199:18
|
#12 0x555556c29e4b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1911:7
|
#13 0x555556c30988 in do_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1421:17
|
#14 0x5555570c9b0c in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_msan/sql/sql_connect.cc:1393:11
|
#15 0x5555570c9432 in handle_one_connection /test/10.6_opt_msan/sql/sql_connect.cc:1305:5
|
#16 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.6_opt_msan/storage/innobase/include/dict0dict.h:686:12 in dict_table_n_rows_inc(dict_table_t*)
|
|
CS 10.6.28 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 (Debug, MSAN, Clang 20.1.8-20250804) Build 17/07/2026 |
==708172==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x574f503abdad in dict_table_n_rows_inc(dict_table_t*) /test/10.6_dbg_msan/storage/innobase/include/dict0dict.h:686:12
|
#1 0x574f503abdad in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /test/10.6_dbg_msan/storage/innobase/row/row0mysql.cc:1388:2
|
#2 0x574f4fca3599 in ha_innobase::write_row(unsigned char const*) /test/10.6_dbg_msan/storage/innobase/handler/ha_innodb.cc:7825:10
|
#3 0x574f4e7f91fa in handler::ha_write_row(unsigned char const*) /test/10.6_dbg_msan/sql/handler.cc:7779:3
|
#4 0x574f4f0ed3da in write_record(THD*, TABLE*, st_copy_info*, select_result*) /test/10.6_dbg_msan/sql/sql_insert.cc:2310:12
|
#5 0x574f4f0e4e47 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.6_dbg_msan/sql/sql_insert.cc:1170:14
|
#6 0x574f4f1c120e in mysql_execute_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:4633:10
|
#7 0x574f4f1ad2c8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_dbg_msan/sql/sql_parse.cc:8199:18
|
#8 0x574f4f1a6cee in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1911:7
|
#9 0x574f4f1addd4 in do_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1421:17
|
#10 0x574f4f67f1ec in do_handle_one_connection(CONNECT*, bool) /test/10.6_dbg_msan/sql/sql_connect.cc:1393:11
|
#11 0x574f4f67eaf9 in handle_one_connection /test/10.6_dbg_msan/sql/sql_connect.cc:1305:5
|
#12 0x75b5b829caa3 in start_thread nptl/pthread_create.c:447:8
|
#13 0x75b5b8329c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Memory was marked as uninitialized
|
#0 0x574f4e6f71a1 in __msan_allocated_memory (/test/MSAN_MD170726-mariadb-10.6.28-linux-x86_64-dbg/bin/mariadbd+0xe561a1) (BuildId: 4011ad30767736203cf12c5ae5c14a6940a07c5f)
|
#1 0x574f4fd7de58 in dict_stats_deinit(dict_table_t*) /test/10.6_dbg_msan/storage/innobase/include/dict0stats.inl:185:2
|
#2 0x574f4fd7dcb0 in dict_table_close(dict_table_t*) /test/10.6_dbg_msan/storage/innobase/dict/dict0dict.cc:216:9
|
#3 0x574f503a7a66 in row_prebuilt_free(row_prebuilt_t*) /test/10.6_dbg_msan/storage/innobase/row/row0mysql.cc:984:3
|
#4 0x574f4fc9b804 in ha_innobase::close() /test/10.6_dbg_msan/storage/innobase/handler/ha_innodb.cc:6244:2
|
#5 0x574f4f588ded in closefrm(TABLE*) /test/10.6_dbg_msan/sql/table.cc:4685:24
|
#6 0x574f4f944898 in THD::close_temporary_table(TABLE*) /test/10.6_dbg_msan/sql/temporary_tables.cc:1248:3
|
#7 0x574f4f944898 in THD::free_temporary_table(TABLE*) /test/10.6_dbg_msan/sql/temporary_tables.cc:1499:3
|
#8 0x574f4f93f75d in THD::drop_temporary_table(TABLE*, bool*, bool) /test/10.6_dbg_msan/sql/temporary_tables.cc:665:5
|
#9 0x574f4f4b6ac1 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /test/10.6_dbg_msan/sql/sql_table.cc:11170:8
|
#10 0x574f4f1bac09 in mysql_execute_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:4278:10
|
#11 0x574f4f1ad2c8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_dbg_msan/sql/sql_parse.cc:8199:18
|
#12 0x574f4f1a6cee in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1911:7
|
#13 0x574f4f1addd4 in do_command(THD*, bool) /test/10.6_dbg_msan/sql/sql_parse.cc:1421:17
|
#14 0x574f4f67f1ec in do_handle_one_connection(CONNECT*, bool) /test/10.6_dbg_msan/sql/sql_connect.cc:1393:11
|
#15 0x574f4f67eaf9 in handle_one_connection /test/10.6_dbg_msan/sql/sql_connect.cc:1305:5
|
#16 0x75b5b829caa3 in start_thread nptl/pthread_create.c:447:8
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.6_dbg_msan/storage/innobase/include/dict0dict.h:686:12 in dict_table_n_rows_inc(dict_table_t*)
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O2 -march=native -mtune=native'" and:
|
-DWITH_MSAN=ON # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
|
Set before execution:
|
export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
|
|
MSAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 170726 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 MSAN|use-of-uninitialized-value|include/dict0dict.h|dict_table_n_rows_inc|row_insert_for_mysql|ha_innobase::write_row|handler::ha_write_row
|
CS 10.6 opt 170726 85ab366da3fc5d13b61d9e491e63e2b62c017cf4 MSAN|use-of-uninitialized-value|include/dict0dict.h|dict_table_n_rows_inc|row_insert_for_mysql|ha_innobase::write_row|handler::ha_write_row
|
CS 10.11 dbg 170726 50faece416f0642b57a515d546f20cefd9062379 No bug found
|
CS 10.11 opt 170726 50faece416f0642b57a515d546f20cefd9062379 No bug found
|
CS 11.4 dbg 200726 17fe060a549d2bfa56f6efb82456b20146ac569f No bug found
|
CS 11.4 opt 200726 17fe060a549d2bfa56f6efb82456b20146ac569f No bug found
|
CS 11.8 dbg 170726 bf58d4cb5fccd4078ec91c065a2de86be3b46281 No bug found
|
CS 11.8 opt 170726 bf58d4cb5fccd4078ec91c065a2de86be3b46281 No bug found
|
CS 12.3 dbg 160726 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c No bug found
|
CS 12.3 opt 160726 f9d797f1ccb8bbdbad0b50005644f29cd6125a6c No bug found
|
CS 13.0 dbg 160726 84c246ca5387c0611f75097136ff4f4bea092aa3 No bug found
|
CS 13.0 opt 160726 84c246ca5387c0611f75097136ff4f4bea092aa3 No bug found
|
CS 13.1 dbg 160726 7322a6656a5357b4574b7413493c76ba2fc41f84 No bug found
|
CS 13.1 opt 160726 7322a6656a5357b4574b7413493c76ba2fc41f84 No bug found
|
ES 10.6 dbg 170726 fcecb2620f25965723d640decede7c018bcb1dcc MSAN|use-of-uninitialized-value|include/dict0dict.h|dict_table_n_rows_inc|row_insert_for_mysql|ha_innobase::write_row|handler::ha_write_row
|
ES 10.6 opt 170726 fcecb2620f25965723d640decede7c018bcb1dcc MSAN|use-of-uninitialized-value|include/dict0dict.h|dict_table_n_rows_inc|row_insert_for_mysql|ha_innobase::write_row|handler::ha_write_row
|
ES 11.4 dbg 170726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.4 opt 170726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.8 dbg 170726 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 11.8 opt 170726 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 12.3 dbg 160726 9d8abb61e913bec023cd8caeccad4b42717151cb No bug found
|
ES 12.3 opt 160726 9d8abb61e913bec023cd8caeccad4b42717151cb No bug found
|
