Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41025

SIGSEGV in row_upd_set_vcol_data / Assertion `fts_id_index->fields[1].col->vers_sys_end()' failed

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      CREATE TABLE t (pk INT PRIMARY KEY, c VARCHAR(8), a INT, v1 INT AS (pk) VIRTUAL, v2 INT AS (pk) VIRTUAL, KEY(a), FULLTEXT(c)) ENGINE=InnoDB WITH SYSTEM VERSIONING;
      CREATE TABLE t1 (a INT, KEY(a), FOREIGN KEY (a) REFERENCES t (a)) ENGINE=InnoDB;
      ALTER TABLE t FORCE;
      INSERT INTO t (pk,c,a) VALUES (1,'a',1);
      INSERT INTO t1 VALUES (1);
      DELETE FROM t;
      

      Leads to:

      CS 11.8.9 e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54 (Optimized, Clang 22.1.8-20260621) Build 03/09/2026

      Core was generated by `/test/MD030926-mariadb-11.8.9-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005b3e1aa9fa17 in row_upd_set_vcol_data (row=0x6d4794028c50, field=<optimized out>, len=<optimized out>, vcol=0x6d87940383c8)at /test/11.8_opt/storage/innobase/row/row0upd.cc:993
       
      [Current thread is 1 (LWP 3602040)]
      (gdb) bt
      #0  0x00005b3e1aa9fa17 in row_upd_set_vcol_data (row=0x6d4794028c50, field=<optimized out>, len=<optimized out>, vcol=0x6d87940383c8)at /test/11.8_opt/storage/innobase/row/row0upd.cc:993
      #1  row_upd_replace_vcol (row=0x6d4794028c50, table=0x6d4794047fd8, update=<optimized out>, upd_new=<optimized out>, undo_row=0x0, ptr=0x6d48406a415b "")at /test/11.8_opt/storage/innobase/row/row0upd.cc:1094
      #2  0x00005b3e1aa9ab45 in row_undo_mod_parse_undo_rec (node=0x6d4794081b38, dict_locked=false) at /test/11.8_opt/storage/innobase/row/row0umod.cc:1292
      #3  row_undo_mod (node=node@entry=0x6d4794081b38, thr=thr@entry=0x6d479404a7b0)at /test/11.8_opt/storage/innobase/row/row0umod.cc:1314
      #4  0x00005b3e1aa9ddec in row_undo (node=0x6d4794081b38, thr=0x6d479404a7b0)at /test/11.8_opt/storage/innobase/row/row0undo.cc:401
      #5  row_undo_step (thr=thr@entry=0x6d479404a7b0)at /test/11.8_opt/storage/innobase/row/row0undo.cc:442
      #6  0x00005b3e1aa5391c in que_thr_step (thr=0x6d479404a7b0)at /test/11.8_opt/storage/innobase/que/que0que.cc:551
      #7  que_run_threads_low (thr=0x6d479404a7b0)at /test/11.8_opt/storage/innobase/que/que0que.cc:609
      #8  que_run_threads (thr=0x6d479404a7b0)at /test/11.8_opt/storage/innobase/que/que0que.cc:629
      #9  0x00005b3e1aabc99f in trx_t::rollback_low (this=0x754891810b80, savept=0x7548902f2798)at /test/11.8_opt/storage/innobase/trx/trx0roll.cc:123
      #10 0x00005b3e1aa7d094 in row_mysql_handle_errors (new_err=new_err@entry=0x7548902f27b4, trx=trx@entry=0x754891810b80, thr=thr@entry=0x6d479407d2c0, savept=savept@entry=0x7548902f2798)at /test/11.8_opt/storage/innobase/row/row0mysql.cc:683
      #11 0x00005b3e1aa7efdb in row_update_for_mysql (prebuilt=0x6d4794034788)at /test/11.8_opt/storage/innobase/row/row0mysql.cc:1695
      #12 0x00005b3e1a9d8cfb in ha_innobase::update_row (this=<optimized out>, old_row=0x6d4794036348 "\374\001", new_row=0x6d4794036300 "\374\001")at /test/11.8_opt/storage/innobase/handler/ha_innodb.cc:8585
      #13 0x00005b3e1a727aa2 in handler::ha_update_row (this=0x6d4794035aa8, old_data=0x6d4794036348 "\374\001", new_data=0x6d4794036300 "\374\001")at /test/11.8_opt/sql/handler.cc:8394
      #14 0x00005b3e1a480106 in TABLE::delete_row<false> (this=this@entry=0x6d4794012528, treat_versioned=<optimized out>)at /test/11.8_opt/sql/sql_delete.cc:342
      #15 0x00005b3e1a47d333 in TABLE::delete_row (this=0x6d4794012528)at /test/11.8_opt/sql/table.h:2016
      #16 Sql_cmd_delete::delete_from_single_table (this=this@entry=0x6d47940185b8, thd=thd@entry=0x6d4794000c68) at /test/11.8_opt/sql/sql_delete.cc:962
      #17 0x00005b3e1a47fd34 in Sql_cmd_delete::execute_inner (this=0x6d47940185b8, thd=0x6d4794000c68) at /test/11.8_opt/sql/sql_delete.cc:2152
      #18 0x00005b3e1a53392c in Sql_cmd_dml::execute (this=0x6d47940185b8, thd=0x6d4794000c68) at /test/11.8_opt/sql/sql_select.cc:34658
      #19 0x00005b3e1a4c14c6 in mysql_execute_command (thd=thd@entry=0x6d4794000c68, is_called_from_prepared_stmt=false) at /test/11.8_opt/sql/sql_parse.cc:4455
      #20 0x00005b3e1a4bcd4d in mysql_parse (thd=thd@entry=0x6d4794000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7548902f3510)at /test/11.8_opt/sql/sql_parse.cc:7938
      #21 0x00005b3e1a4bb42d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x6d4794000c68, packet=packet@entry=0x6d47940088c9 "DELETE FROM t", packet_length=packet_length@entry=13, blocking=true)at /test/11.8_opt/sql/sql_parse.cc:1923
      #22 0x00005b3e1a4bd1d0 in do_command (thd=thd@entry=0x6d4794000c68, blocking=true) at /test/11.8_opt/sql/sql_parse.cc:1431
      #23 0x00005b3e1a5de5ed in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5b3e54177d48, put_in_cache=true)at /test/11.8_opt/sql/sql_connect.cc:1515
      #24 0x00005b3e1a5de422 in handle_one_connection (arg=arg@entry=0x5b3e54177d48)at /test/11.8_opt/sql/sql_connect.cc:1427
      #25 0x00005b3e1a949113 in pfs_spawn_thread (arg=0x5b3e54177db8)at /test/11.8_opt/storage/perfschema/pfs.cc:2198
      #26 0x000075489489cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #27 0x0000754894929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      CS 11.8.9 e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54 (Debug, Clang 22.1.8-20260621) Build 03/09/2026

      mariadbd: /test/11.8_dbg/storage/innobase/fts/fts0fts.cc:3430: void fts_add_doc_by_id(fts_trx_table_t *, doc_id_t): Assertion `fts_id_index->fields[1].col->vers_sys_end()' failed.
      

      CS 11.8.9 e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54 (Debug, Clang 22.1.8-20260621) Build 03/09/2026

      Core was generated by `/test/MD030926-mariadb-11.8.9-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 3602124)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x000070397764527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x00007039776288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x000070397762881b in __assert_fail_base (fmt=0x7039777d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5f5be0b80e35 "fts_id_index->fields[1].col->vers_sys_end()", file=file@entry=0x5f5be0b7f6ad "/test/11.8_dbg/storage/innobase/fts/fts0fts.cc", line=line@entry=3430, function=function@entry=0x5f5be0b80df9 "void fts_add_doc_by_id(fts_trx_table_t *, doc_id_t)") at ./assert/assert.c:96
      #6  0x000070397763b517 in __assert_fail (assertion=0x5f5be0b80e35 "fts_id_index->fields[1].col->vers_sys_end()", file=0x5f5be0b7f6ad "/test/11.8_dbg/storage/innobase/fts/fts0fts.cc", line=3430, function=0x5f5be0b80df9 "void fts_add_doc_by_id(fts_trx_table_t *, doc_id_t)") at ./assert/assert.c:105
      #7  0x00005f5be066b1a4 in fts_add_doc_by_id (ftt=0x68387803feb8, doc_id=1)at /test/11.8_dbg/storage/innobase/fts/fts0fts.cc:3430
      #8  0x00005f5be066abf5 in fts_add (ftt=0x68387803feb8, row=0x6838780283c0)at /test/11.8_dbg/storage/innobase/fts/fts0fts.cc:2820
      #9  0x00005f5be066bd1a in fts_commit_table (ftt=0x68387803feb8)at /test/11.8_dbg/storage/innobase/fts/fts0fts.cc:2982
      #10 0x00005f5be066bb1b in fts_commit (trx=0x703974e38b80)at /test/11.8_dbg/storage/innobase/fts/fts0fts.cc:3031
      #11 0x00005f5be051a759 in trx_t::commit_persist (this=0x703974e38b80)at /test/11.8_dbg/storage/innobase/trx/trx0trx.cc:1564
      #12 0x00005f5be051bb17 in trx_t::commit (this=0x703974e38b80)at /test/11.8_dbg/storage/innobase/trx/trx0trx.cc:1612
      #13 0x00005f5be051c9db in trx_commit_for_mysql (trx=0x703974e38b80)at /test/11.8_dbg/storage/innobase/trx/trx0trx.cc:1727
      #14 0x00005f5be028cef0 in innobase_commit_low (trx=0x703974e38b80)at /test/11.8_dbg/storage/innobase/handler/ha_innodb.cc:4378
      #15 0x00005f5be02b422e in innobase_commit_ordered_2 (trx=0x703974e38b80, thd=0x683878000d58)at /test/11.8_dbg/storage/innobase/handler/ha_innodb.cc:4470
      #16 0x00005f5be02ad193 in innobase_commit (thd=0x683878000d58, commit_trx=false)at /test/11.8_dbg/storage/innobase/handler/ha_innodb.cc:4616
      #17 0x00005f5bdfef1ecd in commit_one_phase_2 (thd=0x683878000d58, all=false, trans=0x683878004900, is_real_trans=true)at /test/11.8_dbg/sql/handler.cc:2267
      #18 0x00005f5bdfef2515 in ha_commit_one_phase (thd=0x683878000d58, all=false)at /test/11.8_dbg/sql/handler.cc:2190
      #19 0x00005f5bdfef0d52 in ha_commit_trans (thd=0x683878000d58, all=false)at /test/11.8_dbg/sql/handler.cc:1980
      #20 0x00005f5bdfcf8abd in trans_commit_stmt (thd=0x683878000d58)at /test/11.8_dbg/sql/transaction.cc:496
      #21 0x00005f5bdfb28afb in mysql_execute_command (thd=0x683878000d58, is_called_from_prepared_stmt=false) at /test/11.8_dbg/sql/sql_parse.cc:5995
      #22 0x00005f5bdfb19958 in mysql_parse (thd=0x683878000d58, rawbuf=0x683878019e70 "INSERT INTO t (pk,c,a) VALUES (1,'a',1)", length=39, parser_state=0x703950e84a10)at /test/11.8_dbg/sql/sql_parse.cc:7938
      #23 0x00005f5bdfb1713a in dispatch_command (command=COM_QUERY, thd=0x683878000d58, packet=0x68387800b0b9 "INSERT INTO t (pk,c,a) VALUES (1,'a',1)", packet_length=39, blocking=true) at /test/11.8_dbg/sql/sql_parse.cc:1923
      #24 0x00005f5bdfb1a3da in do_command (thd=0x683878000d58, blocking=true)at /test/11.8_dbg/sql/sql_parse.cc:1431
      #25 0x00005f5bdfcdd7fe in do_handle_one_connection (connect=0x5f5bfb0fe778, put_in_cache=true) at /test/11.8_dbg/sql/sql_connect.cc:1515
      #26 0x00005f5bdfcdd5e1 in handle_one_connection (arg=0x5f5bfb1bb328)at /test/11.8_dbg/sql/sql_connect.cc:1427
      #27 0x000070397769cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #28 0x0000703977729d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.11  dbg  030926  1bc9eca856a32065fddce1db68edcfa6f4342578  No bug found                  
      CS  10.11  opt  030926  1bc9eca856a32065fddce1db68edcfa6f4342578  No bug found                  
      CS  11.4   dbg  030926  79f96bf15d2538cb78201cc85681571f56548957  fts_id_index->fields[1].col->vers_sys_end()|SIGABRT|fts_add_doc_by_id|fts_add|fts_commit_table|fts_commit
      CS  11.4   opt  030926  79f96bf15d2538cb78201cc85681571f56548957  SIGSEGV|row_upd_set_vcol_data|row_upd_replace_vcol|row_undo_mod_parse_undo_rec|row_undo_mod
      CS  11.8   dbg  030926  e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54  fts_id_index->fields[1].col->vers_sys_end()|SIGABRT|fts_add_doc_by_id|fts_add|fts_commit_table|fts_commit
      CS  11.8   opt  030926  e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54  SIGSEGV|row_upd_set_vcol_data|row_upd_replace_vcol|row_undo_mod_parse_undo_rec|row_undo_mod
      CS  12.3   dbg  030926  ab9657491197ac6a32f4f325388badda974f2fe2  fts_id_index->fields[1].col->vers_sys_end()|SIGABRT|fts_add_doc_by_id|fts_add|fts_commit_table|fts_commit
      CS  12.3   opt  030926  ab9657491197ac6a32f4f325388badda974f2fe2  SIGSEGV|row_upd_set_vcol_data|row_upd_replace_vcol|row_undo_mod_parse_undo_rec|row_undo_mod
      CS  13.0   dbg  030926  b2c4e675049e23ce8c7346985f40840fcd4e583f  fts_id_index->fields[1].col->vers_sys_end()|SIGABRT|fts_add_doc_by_id|fts_add|fts_commit_table|fts_commit
      CS  13.0   opt  030926  b2c4e675049e23ce8c7346985f40840fcd4e583f  SIGSEGV|row_upd_set_vcol_data|row_upd_replace_vcol|row_undo_mod_parse_undo_rec|row_undo_mod
      CS  13.1   dbg  030926  b2a8c2234dbc276fe3947633c9ffea454badf48f  fts_id_index->fields[1].col->vers_sys_end()|SIGABRT|fts_add_doc_by_id|fts_add|fts_commit_table|fts_commit
      CS  13.1   opt  030926  b2a8c2234dbc276fe3947633c9ffea454badf48f  SIGSEGV|row_upd_set_vcol_data|row_upd_replace_vcol|row_undo_mod_parse_undo_rec|row_undo_mod
      ES  10.6   dbg  030926  47e099839c30841f59054ff738662d3fd5f58a08  fts_id_index->fields[1].col->vers_sys_end()|SIGABRT|fts_add_doc_by_id|fts_add|fts_commit_table|fts_commit
      ES  10.6   opt  030926  47e099839c30841f59054ff738662d3fd5f58a08  SIGSEGV|row_upd_set_vcol_data|row_upd_replace_vcol|row_undo_mod_parse_undo_rec|row_undo_mod
      ES  11.4   dbg  030926  e953e9092e7e78da74eec4a80ead7b67d55f3772  fts_id_index->fields[1].col->vers_sys_end()|SIGABRT|fts_add_doc_by_id|fts_add|fts_commit_table|fts_commit
      ES  11.4   opt  030926  e953e9092e7e78da74eec4a80ead7b67d55f3772  SIGSEGV|row_upd_set_vcol_data|row_upd_replace_vcol|row_undo_mod_parse_undo_rec|row_undo_mod
      ES  11.8   dbg  030926  72bfb892c8537baa3e0e5ea16e24e79171a9be22  fts_id_index->fields[1].col->vers_sys_end()|SIGABRT|fts_add_doc_by_id|fts_add|fts_commit_table|fts_commit
      ES  11.8   opt  030926  72bfb892c8537baa3e0e5ea16e24e79171a9be22  SIGSEGV|row_upd_set_vcol_data|row_upd_replace_vcol|row_undo_mod_parse_undo_rec|row_undo_mod
      ES  12.3   dbg  030926  31a1c7393d7f943ff9e335c84923988876681b44  fts_id_index->fields[1].col->vers_sys_end()|SIGABRT|fts_add_doc_by_id|fts_add|fts_commit_table|fts_commit
      ES  12.3   opt  030926  31a1c7393d7f943ff9e335c84923988876681b44  SIGSEGV|row_upd_set_vcol_data|row_upd_replace_vcol|row_undo_mod_parse_undo_rec|row_undo_mod
      

      Attachments

        Issue Links

          Activity

            People

              saahil Saahil Alam
              saahil Saahil Alam
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1.5h
                  1.5h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.