Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.11, 11.4, 11.8, 12.3, 13.1
-
None
-
Can result in hang or crash
-
Q4/2026 Server Development
Description
A debug build on ppc64le (Ubuntu) aborted in buf_flush_discard_page() at
ut_ad(bpage->oldest_modification()). A concurrent connection was running
ALTER TABLE … IMPORT TABLESPACE. The failure was seen on 13.x, and
I believe all branches that have this code are affected.
https://buildbot.mariadb.org/#/builders/915/builds/30111/steps/6/logs/stdio
Root cause:
1. The page cleaner (buf_flush_LRU_list_batch() or
buf_do_flush_list_batch()) takes the U latch on a dirty page. It then calls buf_flush_space(), which releases buf_pool.mutex
2. In that window, ALTER TABLE … DISCARD TABLESPACE calls
buf_flush_remove_pages(). That function removes the tablespace's
dirty pages from buf_pool.flush_list through delete_from_flush_list().
It does not take the page latch, so it does not wait for the cleaner. The page's oldest_modification becomes 0.
3. buf_flush_space() returns no tablespace, and the cleaner reaches
its no_space path. It retakes flush_list_mutex and calls
buf_flush_discard_page().
4. buf_flush_discard_page() assumes the page is still on the flush list.
It asserts oldest_modification() (debug builds) and calls delete_from_flush_list() again.
[Current thread is 1 (Thread 0x73bff5ecee00 (LWP 244091))]
|
#0 0x000073bffe4286cc in pthread_kill () from /lib/powerpc64le-linux-gnu/libc.so.6
|
#1 0x000015b3ea50cd28 in my_write_core (sig=6) at /home/buildbot/ppc64le-ubuntu-2204-debug/build/mysys/stacktrace.c:424
|
#2 0x000015b3e96665b8 in handle_fatal_signal (sig=6) at /home/buildbot/ppc64le-ubuntu-2204-debug/build/sql/signal_handler.cc:300
|
#3 <signal handler called>
|
#4 0x000073bffe4286cc in pthread_kill () from /lib/powerpc64le-linux-gnu/libc.so.6
|
#5 0x000073bffe3c1dfc in raise () from /lib/powerpc64le-linux-gnu/libc.so.6
|
#6 0x000073bffe39d260 in abort () from /lib/powerpc64le-linux-gnu/libc.so.6
|
#7 0x000073bffe3b4ef4 in ?? () from /lib/powerpc64le-linux-gnu/libc.so.6
|
#8 0x000073bffe3b4f94 in __assert_fail () from /lib/powerpc64le-linux-gnu/libc.so.6
|
#9 0x000015b3ea27bc34 in buf_flush_discard_page (bpage=0x6bbfe80144e0) at /home/buildbot/ppc64le-ubuntu-2204-debug/build/storage/innobase/buf/buf0flu.cc:1254
|
#10 0x000015b3ea27c934 in buf_flush_LRU_list_batch (max=2000, n=0x73bff5ece0e0, to_withdraw=0) at /home/buildbot/ppc64le-ubuntu-2204-debug/build/storage/innobase/buf/buf0flu.cc:1412
|
#11 0x000015b3ea27ce34 in buf_do_LRU_batch (max=2000, n=0x73bff5ece0e0) at /home/buildbot/ppc64le-ubuntu-2204-debug/build/storage/innobase/buf/buf0flu.cc:1476
|
#12 0x000015b3ea27e6b0 in buf_flush_LRU (max_n=2000) at /home/buildbot/ppc64le-ubuntu-2204-debug/build/storage/innobase/buf/buf0flu.cc:1820
|
#13 0x000015b3ea2823d8 in buf_flush_page_cleaner () at /home/buildbot/ppc64le-ubuntu-2204-debug/build/storage/innobase/buf/buf0flu.cc:2959
|
#14 0x000015b3ea28b6dc in std::__invoke_impl<void, void (*)() noexcept>(std::__invoke_other, void (*&&)() noexcept) (__f=@0x15b411c95158: 0x15b3ea28197c <buf_flush_page_cleaner()>) at /usr/include/c++/11/bits/invoke.h:61
|
#15 0x000015b3ea28b5e4 in std::__invoke<void (*)() noexcept>(void (*&&)() noexcept) (__fn=@0x15b411c95158: 0x15b3ea28197c <buf_flush_page_cleaner()>) at /usr/include/c++/11/bits/invoke.h:96
|
#16 0x000015b3ea28b4e4 in std::thread::_Invoker<std::tuple<void (*)() noexcept> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) (this=0x15b411c95158) at /usr/include/c++/11/bits/std_thread.h:259
|
#17 0x000015b3ea28b46c in std::thread::_Invoker<std::tuple<void (*)() noexcept> >::operator()() (this=0x15b411c95158) at /usr/include/c++/11/bits/std_thread.h:266
|
#18 0x000015b3ea28b418 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (*)() noexcept> > >::_M_run() (this=0x15b411c95150) at /usr/include/c++/11/bits/std_thread.h:211
|
#19 0x000073bffe8e8950 in ?? () from /lib/powerpc64le-linux-gnu/libstdc++.so.6
|
#20 0x000073bffe425864 in ?? () from /lib/powerpc64le-linux-gnu/libc.so.6
|
#21 0x000073bffe4e0e50 in clone () from /lib/powerpc64le-linux-gnu/libc.so.6
|
