Details
-
Bug
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
-
11.4
-
Can result in hang or crash
Description
--source include/have_innodb.inc
|
--source include/have_partition.inc
|
CREATE TABLE t1 (c1 INT PRIMARY KEY, c2 INT, KEY ci2(c1), KEY idx_(c1,c2)) ENGINE=InnoDB PARTITION BY HASH(c1) PARTITIONS 2; |
INSERT INTO t1 VALUES (0,1); |
ALTER TABLE t1 CHANGE c2 c2 TINYBLOB, DROP PRIMARY KEY; |
SET SESSION optimizer_switch='mrr=on'; |
SELECT 1 FROM t1 WHERE c2<>1 AND c1<>15; |
Leads to:
|
CS 11.4.13 5af13b65a3277f7e57aadf9ef43e90fac4af4b13 (Debug, MSAN, Clang 20.1.8-20250804) Build 21/08/2026 |
==3289893==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x5c5b2aaa2fe7 in dtuple_validate(dtuple_t const*) /test/msan_slow_src/11.4_dbg_msan/storage/innobase/data/data0data.cc:210:4
|
#1 0x5c5b2af55d13 in page_cur_search_with_match(dtuple_t const*, page_cur_mode_t, unsigned long*, unsigned long*, page_cur_t*, rtr_info*) /test/msan_slow_src/11.4_dbg_msan/storage/innobase/page/page0cur.cc:314:2
|
#2 0x5c5b2ab19213 in btr_cur_t::search_leaf(dtuple_t const*, page_cur_mode_t, btr_latch_mode, mtr_t*) /test/msan_slow_src/11.4_dbg_msan/storage/innobase/btr/btr0cur.cc:1410:9
|
#3 0x5c5b2b1645fd in btr_pcur_open_with_no_init(dtuple_t const*, page_cur_mode_t, btr_latch_mode, btr_pcur_t*, mtr_t*) /test/msan_slow_src/11.4_dbg_msan/storage/innobase/include/btr0pcur.inl:322:26
|
#4 0x5c5b2b1645fd in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /test/msan_slow_src/11.4_dbg_msan/storage/innobase/row/row0sel.cc:4810:10
|
#5 0x5c5b2a9df1b4 in ha_innobase::index_read(unsigned char*, unsigned char const*, unsigned int, ha_rkey_function) /test/msan_slow_src/11.4_dbg_msan/storage/innobase/handler/ha_innodb.cc:8970:3
|
#6 0x5c5b29483940 in handler::ha_rnd_pos(unsigned char*, unsigned char*) /test/msan_slow_src/11.4_dbg_msan/sql/handler.cc:3823:3
|
#7 0x5c5b2a439190 in Mrr_ordered_rndpos_reader::get_next(void**) /test/msan_slow_src/11.4_dbg_msan/sql/multi_range_read.cc:1081:16
|
#8 0x5c5b2a43d7bd in DsMrr_impl::dsmrr_next(void**) /test/msan_slow_src/11.4_dbg_msan/sql/multi_range_read.cc:1741:26
|
#9 0x5c5b2a97333e in ha_partition::handle_unordered_scan_next_partition(unsigned char*) /test/msan_slow_src/11.4_dbg_msan/sql/ha_partition.cc:7843:20
|
#10 0x5c5b2a97de88 in ha_partition::multi_range_read_next(void**) /test/msan_slow_src/11.4_dbg_msan/sql/ha_partition.cc:6923:11
|
#11 0x5c5b299db081 in QUICK_RANGE_SELECT::get_next() /test/msan_slow_src/11.4_dbg_msan/sql/opt_range.cc:13324:5
|
#12 0x5c5b29a3362e in rr_quick(READ_RECORD*) /test/msan_slow_src/11.4_dbg_msan/sql/records.cc:402:34
|
#13 0x5c5b29f3bd5b in sub_select(JOIN*, st_join_table*, bool) /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:24368:12
|
#14 0x5c5b29fb669a in do_select(JOIN*, Procedure*) /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:23882:14
|
#15 0x5c5b29fb4422 in JOIN::exec_inner() /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:5102:50
|
#16 0x5c5b29fb2403 in JOIN::exec() /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:4893:8
|
#17 0x5c5b29f3dcb7 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:5416:21
|
#18 0x5c5b29f3d132 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/msan_slow_src/11.4_dbg_msan/sql/sql_select.cc:643:10
|
#19 0x5c5b29e7dca1 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/msan_slow_src/11.4_dbg_msan/sql/sql_parse.cc:6222:12
|
#20 0x5c5b29e6e35e in mysql_execute_command(THD*, bool) /test/msan_slow_src/11.4_dbg_msan/sql/sql_parse.cc:4010:12
|
#21 0x5c5b29e627df in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/msan_slow_src/11.4_dbg_msan/sql/sql_parse.cc:7941:18
|
#22 0x5c5b29e5c1d8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/msan_slow_src/11.4_dbg_msan/sql/sql_parse.cc:1925:7
|
#23 0x5c5b29e6329e in do_command(THD*, bool) /test/msan_slow_src/11.4_dbg_msan/sql/sql_parse.cc:1433:17
|
#24 0x5c5b2a34b2bc in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/11.4_dbg_msan/sql/sql_connect.cc:1508:11
|
#25 0x5c5b2a34ac56 in handle_one_connection /test/msan_slow_src/11.4_dbg_msan/sql/sql_connect.cc:1420:5
|
#26 0x77dda169cb83 in start_thread nptl/pthread_create.c:447:8
|
#27 0x77dda1729d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Memory was marked as uninitialized
|
#0 0x5c5b29397731 in __msan_allocated_memory (/test/MSAN_MD210826-mariadb-11.4.13-linux-x86_64-dbg/bin/mariadbd+0x1030731) (BuildId: ed04c7471478a7fac3d871b6d6d5d1a390369f6d)
|
#1 0x5c5b2a43a9f4 in Lifo_buffer::set_buffer_space(unsigned char*, unsigned char*) /test/msan_slow_src/11.4_dbg_msan/sql/sql_lifo_buffer.h:87:7
|
#2 0x5c5b2a43a9f4 in DsMrr_impl::dsmrr_init(handler*, st_range_seq_if*, void*, unsigned int, unsigned int, st_handler_buffer*) /test/msan_slow_src/11.4_dbg_msan/sql/multi_range_read.cc:1279:20
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/msan_slow_src/11.4_dbg_msan/storage/innobase/data/data0data.cc:210:4 in dtuple_validate(dtuple_t const*)
|
|
CS 11.4.13 5af13b65a3277f7e57aadf9ef43e90fac4af4b13 (Optimized, MSAN, Clang 20.1.8-20250804) Build 21/08/2026 |
==3289892==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x5f4c41f2d2b0 in memcmp (/test/MSAN_MD210826-mariadb-11.4.13-linux-x86_64-opt/bin/mariadbd+0xe432b0) (BuildId: 02b653d1f963b8a5651bd801fb6d0c24246653b4)
|
#1 0x5f4c43814c8c in cmp_data(unsigned long, unsigned long, bool, unsigned char const*, unsigned long, unsigned char const*, unsigned long) /test/msan_slow_src/11.4_opt_msan/storage/innobase/rem/rem0cmp.cc:321:10
|
#2 0x5f4c438154ff in cmp_dtuple_rec_with_match_low(dtuple_t const*, unsigned char const*, dict_index_t const*, unsigned short const*, unsigned long, unsigned long*) /test/msan_slow_src/11.4_opt_msan/storage/innobase/rem/rem0cmp.cc:405:9
|
#3 0x5f4c4379eed0 in page_cur_search_with_match(dtuple_t const*, page_cur_mode_t, unsigned long*, unsigned long*, page_cur_t*, rtr_info*) /test/msan_slow_src/11.4_opt_msan/storage/innobase/page/page0cur.cc:473:9
|
#4 0x5f4c4348cee2 in btr_cur_t::search_leaf(dtuple_t const*, page_cur_mode_t, btr_latch_mode, mtr_t*) /test/msan_slow_src/11.4_opt_msan/storage/innobase/btr/btr0cur.cc:1410:9
|
#5 0x5f4c438f3491 in btr_pcur_open_with_no_init(dtuple_t const*, page_cur_mode_t, btr_latch_mode, btr_pcur_t*, mtr_t*) /test/msan_slow_src/11.4_opt_msan/storage/innobase/include/btr0pcur.inl:322:26
|
#6 0x5f4c438f3491 in row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long) /test/msan_slow_src/11.4_opt_msan/storage/innobase/row/row0sel.cc:4810:10
|
#7 0x5f4c4339b0cc in ha_innobase::index_read(unsigned char*, unsigned char const*, unsigned int, ha_rkey_function) /test/msan_slow_src/11.4_opt_msan/storage/innobase/handler/ha_innodb.cc:8970:3
|
#8 0x5f4c41ffda62 in handler::ha_rnd_pos(unsigned char*, unsigned char*) /test/msan_slow_src/11.4_opt_msan/sql/handler.cc:3823:3
|
#9 0x5f4c42e5fde4 in Mrr_ordered_rndpos_reader::get_next(void**) /test/msan_slow_src/11.4_opt_msan/sql/multi_range_read.cc:1081:16
|
#10 0x5f4c42e63b4d in DsMrr_impl::dsmrr_next(void**) /test/msan_slow_src/11.4_opt_msan/sql/multi_range_read.cc:1741:26
|
#11 0x5f4c43338e0d in ha_partition::handle_unordered_scan_next_partition(unsigned char*) /test/msan_slow_src/11.4_opt_msan/sql/ha_partition.cc:7843:20
|
#12 0x5f4c43341fd0 in ha_partition::multi_range_read_next(void**) /test/msan_slow_src/11.4_opt_msan/sql/ha_partition.cc:6923:11
|
#13 0x5f4c424ce90b in QUICK_RANGE_SELECT::get_next() /test/msan_slow_src/11.4_opt_msan/sql/opt_range.cc:13324:5
|
#14 0x5f4c42521de3 in rr_quick(READ_RECORD*) /test/msan_slow_src/11.4_opt_msan/sql/records.cc:402:34
|
#15 0x5f4c429b8709 in sub_select(JOIN*, st_join_table*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:24368:12
|
#16 0x5f4c42a2840c in do_select(JOIN*, Procedure*) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:23882:14
|
#17 0x5f4c42a260b1 in JOIN::exec_inner() /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:5102:50
|
#18 0x5f4c429baad5 in JOIN::exec() /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:4893:8
|
#19 0x5f4c429baad5 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:5416:21
|
#20 0x5f4c429b9aa7 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:643:10
|
#21 0x5f4c4290942a in execute_sqlcom_select(THD*, TABLE_LIST*) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:6222:12
|
#22 0x5f4c428fd5e3 in mysql_execute_command(THD*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:4010:12
|
#23 0x5f4c428f3645 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:7941:18
|
#24 0x5f4c428ed6b2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:1925:7
|
#25 0x5f4c428f4228 in do_command(THD*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:1433:17
|
#26 0x5f4c42d7d85c in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_connect.cc:1508:11
|
#27 0x5f4c42d7d1e2 in handle_one_connection /test/msan_slow_src/11.4_opt_msan/sql/sql_connect.cc:1420:5
|
#28 0x7b818109cb83 in start_thread nptl/pthread_create.c:447:8
|
#29 0x7b8181129d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Memory was marked as uninitialized
|
#0 0x5f4c41f28aa1 in __msan_allocated_memory (/test/MSAN_MD210826-mariadb-11.4.13-linux-x86_64-opt/bin/mariadbd+0xe3eaa1) (BuildId: 02b653d1f963b8a5651bd801fb6d0c24246653b4)
|
#1 0x5f4c42e60c28 in Lifo_buffer::set_buffer_space(unsigned char*, unsigned char*) /test/msan_slow_src/11.4_opt_msan/sql/sql_lifo_buffer.h:87:7
|
#2 0x5f4c42e60c28 in DsMrr_impl::dsmrr_init(handler*, st_range_seq_if*, void*, unsigned int, unsigned int, st_handler_buffer*) /test/msan_slow_src/11.4_opt_msan/sql/multi_range_read.cc:1279:20
|
#3 0x5f4c433c69c9 in ha_innobase::multi_range_read_init(st_range_seq_if*, void*, unsigned int, unsigned int, st_handler_buffer*) /test/msan_slow_src/11.4_opt_msan/storage/innobase/handler/ha_innodb.cc:20167:18
|
#4 0x5f4c4334193f in ha_partition::multi_range_read_init(st_range_seq_if*, void*, unsigned int, unsigned int, st_handler_buffer*) /test/msan_slow_src/11.4_opt_msan/sql/ha_partition.cc:6874:11
|
#5 0x5f4c424ce4dc in QUICK_RANGE_SELECT::reset() /test/msan_slow_src/11.4_opt_msan/sql/opt_range.cc:13291:16
|
#6 0x5f4c42a203f2 in join_init_read_record(st_join_table*) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:25390:64
|
#7 0x5f4c429b8709 in sub_select(JOIN*, st_join_table*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:24368:12
|
#8 0x5f4c42a2840c in do_select(JOIN*, Procedure*) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:23882:14
|
#9 0x5f4c42a260b1 in JOIN::exec_inner() /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:5102:50
|
#10 0x5f4c429baad5 in JOIN::exec() /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:4893:8
|
#11 0x5f4c429baad5 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:5416:21
|
#12 0x5f4c429b9aa7 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:643:10
|
#13 0x5f4c4290942a in execute_sqlcom_select(THD*, TABLE_LIST*) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:6222:12
|
#14 0x5f4c428fd5e3 in mysql_execute_command(THD*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:4010:12
|
#15 0x5f4c428f3645 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:7941:18
|
#16 0x5f4c428ed6b2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:1925:7
|
#17 0x5f4c428f4228 in do_command(THD*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:1433:17
|
#18 0x5f4c42d7d85c in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/11.4_opt_msan/sql/sql_connect.cc:1508:11
|
#19 0x5f4c42d7d1e2 in handle_one_connection /test/msan_slow_src/11.4_opt_msan/sql/sql_connect.cc:1420:5
|
#20 0x7b818109cb83 in start_thread nptl/pthread_create.c:447:8
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value (/test/MSAN_MD210826-mariadb-11.4.13-linux-x86_64-opt/bin/mariadbd+0xe432b0) (BuildId: 02b653d1f963b8a5651bd801fb6d0c24246653b4) in memcmp
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:
|
-DWITH_MSAN=ON # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
|
Set before execution:
|
export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
|
|
MSAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.11 dbg 210826 6415902490b1b0a9a500cee9bc0a41c342190605 No bug found
|
CS 10.11 opt 210826 6415902490b1b0a9a500cee9bc0a41c342190605 No bug found
|
CS 11.4 dbg 210826 5af13b65a3277f7e57aadf9ef43e90fac4af4b13 MSAN|use-of-uninitialized-value|storage/innobase/data/data0data.cc|dtuple_validate|page_cur_search_with_match|btr_cur_t::search_leaf|btr_pcur_open_with_no_init
|
CS 11.4 opt 210826 5af13b65a3277f7e57aadf9ef43e90fac4af4b13 MSAN|use-of-uninitialized-value|storage/innobase/rem/rem0cmp.cc|memcmp|cmp_data|cmp_dtuple_rec_with_match_low|page_cur_search_with_match
|
CS 11.8 dbg 210826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e No bug found
|
CS 11.8 opt 210826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e No bug found
|
CS 12.3 dbg 210826 add63991988734383c5e942de2a19c6c45f511f7 No bug found
|
CS 12.3 opt 210826 add63991988734383c5e942de2a19c6c45f511f7 No bug found
|
CS 13.0 dbg 210826 be111d2cd60d035d555b71da019765cfb42ea0d3 No bug found
|
CS 13.0 opt 210826 be111d2cd60d035d555b71da019765cfb42ea0d3 No bug found
|
CS 13.1 dbg 210826 bab03b0fc44e7aeac869b20b0055c6a8f2083eb6 No bug found
|
CS 13.1 opt 210826 bab03b0fc44e7aeac869b20b0055c6a8f2083eb6 No bug found
|
ES 10.6 dbg 210826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 10.6 opt 210826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 11.4 dbg 210826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.4 opt 210826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.8 dbg 210826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 11.8 opt 210826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 12.3 dbg 210826 31a1c7393d7f943ff9e335c84923988876681b44 No bug found
|
ES 12.3 opt 210826 31a1c7393d7f943ff9e335c84923988876681b44 No bug found
|
