Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
13.2
-
None
-
Can result in hang or crash
Description
Seen once on buildbot, in a RelWithDebInfo build of main on amd64-centos-stream9:
https://buildbot.mariadb.org/#/builders/495/builds/39268
Test versioning.insert (timestamp combination) on MTR worker 7 crashed during the server shutdown of the first restart_mysqld.inc in the test
(insert.test line 214). The server had been started 2 seconds earlier from a fresh MTR datadir and had run period.versioning, versioning.autoinc,
versioning.create and versioning.delete before versioning.insert. Both retries of the test passed.
|
CS 13.2.0 4641beb5f8d00d645d94362b6a031ecca6fb7269 (RelWithDebInfo, GCC 11.5.0) Build 31/10/2026 |
2026-10-31 7:39:19 0 [Note] /home/buildbot/amd64-centos-stream9/build/sql/mariadbd (initiated by: root[root] @ localhost []): Normal shutdown
|
2026-10-31 7:39:19 0 [Note] InnoDB: FTS optimize thread exiting.
|
2026-10-31 7:39:19 0 [Note] InnoDB: Starting shutdown...
|
261031 7:39:19 2026-10-31 7:39:19 0 [Note] InnoDB: Dumping buffer pool(s) to /dev/shm/var_auto_5eHG/7/mysqld.1/data/ib_buffer_pool
|
[ERROR] /home/buildbot/amd64-centos-stream9/build/sql/mariadbd got signal 11 ;
|
|
Backtrace of the core, from the test log (https://buildbot.mariadb.org/#/builders/495/builds/39268/steps/6/logs/stdio):
|
CS 13.2.0 4641beb5f8d00d645d94362b6a031ecca6fb7269 (RelWithDebInfo, GCC 11.5.0) Build 31/10/2026 |
Core was generated by `/home/buildbot/amd64-centos-stream9/build/sql/mariadbd --defaults-group-suffix=.1
|
--defaults-file=/home/buildbot/amd64-centos-stream9/build/mysql-test/var/7/my.cnf --log-output=file --default-storage-engine=innodb --innodb --innodb-cmpmem
|
--innodb-cmp-per-index --innodb-trx --innodb-locks --innodb-lock-waits --innodb-metrics --innodb-buffer-pool-stats --innodb-buffer-page --innodb-buffer-page-lru
|
--innodb-sys-columns --innodb-sys-fields --innodb-sys-foreign --innodb-sys-foreign-cols --innodb-sys-indexes --innodb-sys-tables --innodb-sys-virtual --innodb
|
--innodb-cmpmem --innodb-cmp-per-index --innodb-trx --innodb-locks --innodb-lock-waits --innodb-metrics --innodb-buffer-pool-stats --innodb-buffer-page
|
--innodb-buffer-page-lru --innodb-sys-columns --innodb-sys-fields --innodb-sys-foreign --innodb-sys-foreign-cols --innodb-sys-indexes --innodb-sys-tables
|
--innodb-sys-virtual --plugin-load-add=test_versioning.so --core-file --loose-debug-sync-timeout=300'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x00007fa4a34db34c in __pthread_kill_implementation () from /lib64/libc.so.6
|
[Current thread is 1 (Thread 0x7fa4977fe640 (LWP 152390))]
|
#0 0x00007fa4a34db34c in __pthread_kill_implementation () from /lib64/libc.so.6
|
#1 0x000056488d9903a0 in handle_fatal_signal (sig=11) at /home/buildbot/amd64-centos-stream9/build/sql/signal_handler.cc:300
|
#2 <signal handler called>
|
#3 0x000056488ddaaae3 in buf_pool_t::page_hash_table::remove (bpage=0x77a49000ec40, chain=..., this=<optimized out>) at
|
/home/buildbot/amd64-centos-stream9/build/storage/innobase/buf/buf0lru.cc:993
|
#4 buf_LRU_block_remove_hashed (bpage=bpage@entry=0x77a49000ec40, chain=..., zip=zip@entry=true, id=...) at
|
/home/buildbot/amd64-centos-stream9/build/storage/innobase/buf/buf0lru.cc:1078
|
#5 0x000056488ddab888 in buf_LRU_free_page (bpage=bpage@entry=0x77a49000ec40, zip=zip@entry=true) at
|
/home/buildbot/amd64-centos-stream9/build/storage/innobase/buf/buf0lru.cc:812
|
#6 0x000056488dda6dcc in buf_flush_discard_page (bpage=bpage@entry=0x77a49000ec40) at /home/buildbot/amd64-centos-stream9/build/storage/innobase/buf/buf0flu.cc:1263
|
#7 0x000056488dda7dff in buf_do_flush_list_batch (lsn=<optimized out>, max_n=<optimized out>) at
|
/home/buildbot/amd64-centos-stream9/build/storage/innobase/buf/buf0flu.cc:1595
|
#8 buf_flush_list_holding_mutex (lsn=<optimized out>, max_n=<optimized out>) at /home/buildbot/amd64-centos-stream9/build/storage/innobase/buf/buf0flu.cc:1661
|
#9 buf_flush_list_holding_mutex (max_n=<optimized out>, lsn=<optimized out>) at /home/buildbot/amd64-centos-stream9/build/storage/innobase/buf/buf0flu.cc:1642
|
#10 0x000056488d56b395 in buf_flush_list (lsn=847679, max_n=2000) at /home/buildbot/amd64-centos-stream9/build/storage/innobase/buf/buf0flu.cc:1687
|
#11 buf_flush_sync_for_checkpoint (lsn=lsn@entry=847679) at /home/buildbot/amd64-centos-stream9/build/storage/innobase/buf/buf0flu.cc:2517
|
#12 0x000056488d56b5a1 in buf_flush_page_cleaner () at /home/buildbot/amd64-centos-stream9/build/storage/innobase/buf/buf0flu.cc:2839
|
#13 0x00007fa4a3830ae4 in execute_native_thread_routine () from /lib64/libstdc++.so.6
|
#14 0x00007fa4a34d9529 in start_thread () from /lib64/libc.so.6
|
#15 0x00007fa4a355dc54 in clone () from /lib64/libc.so.6
|
|
The buildbot cross-reference for 2025-11-01 to 2026-11-03 (main, 13.1, 13.0, 12.3, 12.2, 12.1, 12.0, 11.8, 11.4, 10.11, 10.6) shows no other crash in
page_hash_table::remove.
What was tried to reproduce it (no crash in any run):
- MTR, the same test sequence as worker 7 (period.versioning, versioning.autoinc, versioning.create, versioning.delete, each with timestamp and
trx_id, then versioning.insert,timestamp, with --noreorder): 17,760 runs on main bdf154a3638 with GCC 13.3 RelWithDebInfo, clang 18 RelWithDebInfo and
clang Debug builds, 3,360 of them under rr record --chaos. - The source tarball of this build (https://ci.mariadb.org/76955/mariadb-13.2.0.tar.gz), built in the buildbot image
quay.io/mariadb-foundation/bb-worker:centosstream9 (GCC 11.5.0) with the builder's cmake options. The crash frames from the log map to the same source lines in this
build. Runs in that container, with io_uring:- 7,200 runs of the same MTR sequence.
- 7,200 runs of the same sequence with innodb_buffer_pool_dump_at_shutdown=1 and innodb_buffer_pool_dump_pct=100.
- 12 runs of the builder's full MTR command, with a /dev/shm vardir in place of --mem: all 6805 tests passed in each run, 60 runs of versioning.insert in
total.
- RQG, InnoDB combinations without ROW_FORMAT=COMPRESSED (innodb_read_only_compressed=ON) and without DISCARD TABLESPACE or IMPORT TABLESPACE: 1,440
trials on main bdf154a3638 (GCC 13.3 RelWithDebInfo) and 741 trials on the container build of 4641beb5f. No crash in buf_flush_discard_page() or
page_hash_table::remove().
