Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-6493

Assertion `table->file->stats.records > 0 || error' failure, or 'Invalid write' valgrind warnings, or crash on scenario with Aria table, view, LOCK TABLES

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 5.1.67, 5.2.14, 5.3.12, 5.5.38, 10.1.0
    • Fix Version/s: 5.5.38, 10.0.13
    • Component/s: None
    • Labels:

      Description

      --source include/have_partition.inc
       
      --disable_abort_on_error
       
      CREATE TABLE t1 (pk INT PRIMARY KEY) ENGINE=Aria PARTITION BY KEY() PARTITIONS 2;
      CREATE VIEW v1 AS SELECT * FROM t1;
       
      LOCK TABLE v1 WRITE;
      CREATE TABLE v1 (i INT);
      INSERT INTO v1 VALUES (1);
      UNLOCK TABLES;
       
      SELECT * FROM t1;

      The provided test case ends with the assertion failure on 5.5 and higher:

      mysqld: 5.5/sql/sql_select.cc:17280: int join_read_const_table(JOIN_TAB*, POSITION*): Assertion `table->file->stats.records > 0 || error' failed.
      140727 17:55:00 [ERROR] mysqld got signal 6 ;
       
      #6  0x00007fc057e22621 in *__GI___assert_fail (assertion=0xd99138 "table->file->stats.records > 0 || error", file=<optimized out>, line=17280, function=0xd9a940 "int join_read_const_table(JOIN_TAB*, POSITION*)") at assert.c:81
      #7  0x000000000068a891 in join_read_const_table (tab=0x7fc052948fe0, pos=0x7fc052949510) at 5.5/sql/sql_select.cc:17280
      #8  0x0000000000669943 in make_join_statistics (join=0x7fc0529488f0, tables_list=..., conds=0x0, keyuse_array=0x7fc052948bf8) at 5.5/sql/sql_select.cc:3410
      #9  0x00000000006620be in JOIN::optimize (this=0x7fc0529488f0) at 5.5/sql/sql_select.cc:1229
      #10 0x0000000000668927 in mysql_select (thd=0x7fc056749060, rref_pointer_array=0x7fc05674ccc8, tables=0x7fc052948258, wild_num=1, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fc0529488d0, unit=0x7fc05674c380, select_lex=0x7fc05674ca58) at 5.5/sql/sql_select.cc:3080
      #11 0x000000000065f489 in handle_select (thd=0x7fc056749060, lex=0x7fc05674c2d0, result=0x7fc0529488d0, setup_tables_done_option=0) at 5.5/sql/sql_select.cc:319
      #12 0x0000000000638a9f in execute_sqlcom_select (thd=0x7fc056749060, all_tables=0x7fc052948258) at 5.5/sql/sql_parse.cc:4688
      #13 0x0000000000631c81 in mysql_execute_command (thd=0x7fc056749060) at 5.5/sql/sql_parse.cc:2233
      #14 0x000000000063b1ae in mysql_parse (thd=0x7fc056749060, rawbuf=0x7fc052948078 "SELECT * FROM t1", length=16, parser_state=0x7fc0533b5630) at 5.5/sql/sql_parse.cc:5799
      #15 0x000000000062f1f9 in dispatch_command (command=COM_QUERY, thd=0x7fc056749060, packet=0x7fc053afa061 "SELECT * FROM t1", packet_length=16) at 5.5/sql/sql_parse.cc:1079
      #16 0x000000000062e385 in do_command (thd=0x7fc056749060) at 5.5/sql/sql_parse.cc:793
      #17 0x0000000000730006 in do_handle_one_connection (thd_arg=0x7fc056749060) at 5.5/sql/sql_connect.cc:1266
      #18 0x000000000072fac5 in handle_one_connection (arg=0x7fc056749060) at 5.5/sql/sql_connect.cc:1181
      #19 0x0000000000b65105 in pfs_spawn_thread (arg=0x7fc0547fa8e0) at 5.5/storage/perfschema/pfs.cc:1015
      #20 0x00007fc059382b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
      #21 0x00007fc057ed1a7d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

      Stack trace from:

      revision-id: jplindst@mariadb.org-20140727054445-c4dp836fcgt69e8w
      revno: 4244
      branch-nick: 5.5

      Without the last SELECT, the same test case causes valgrind warnings:

      ==31970== Thread 5:
      ==31970== Invalid write of size 8
      ==31970==    at 0xBCFA69: _ma_new (ma_page.c:406)
      ==31970==    by 0xBF7216: _ma_enlarge_root (ma_write.c:573)
      ==31970==    by 0xBF6FB9: _ma_ck_real_write_btree (ma_write.c:527)
      ==31970==    by 0xBF6E57: _ma_ck_write_btree_with_log (ma_write.c:491)
      ==31970==    by 0xBF6CD6: _ma_ck_write_btree (ma_write.c:449)
      ==31970==    by 0xBF6C4F: _ma_ck_write (ma_write.c:434)
      ==31970==    by 0xBF64A6: maria_write (ma_write.c:188)
      ==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
      ==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
      ==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==  Address 0xb929e90 is 144 bytes inside a block of size 256 free'd
      ==31970==    at 0xD3441D: free (jemalloc.c:1273)
      ==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
      ==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
      ==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
      ==31970==    by 0xCB342E: delete_dynamic (array.c:303)
      ==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
      ==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
      ==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
      ==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
      ==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
      ==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970== Invalid read of size 4
      ==31970==    at 0xBF6587: maria_write (ma_write.c:286)
      ==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
      ==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
      ==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
      ==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
      ==31970==    by 0x6320A7C: clone (clone.S:112)
      ==31970==  Address 0xb929ea0 is 160 bytes inside a block of size 256 free'd
      ==31970==    at 0xD3441D: free (jemalloc.c:1273)
      ==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
      ==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
      ==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
      ==31970==    by 0xCB342E: delete_dynamic (array.c:303)
      ==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
      ==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
      ==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
      ==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
      ==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
      ==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970== Invalid write of size 4
      ==31970==    at 0xBF6599: maria_write (ma_write.c:286)
      ==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
      ==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
      ==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
      ==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
      ==31970==    by 0x6320A7C: clone (clone.S:112)
      ==31970==  Address 0xb929ea0 is 160 bytes inside a block of size 256 free'd
      ==31970==    at 0xD3441D: free (jemalloc.c:1273)
      ==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
      ==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
      ==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
      ==31970==    by 0xCB342E: delete_dynamic (array.c:303)
      ==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
      ==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
      ==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
      ==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
      ==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
      ==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970== Invalid read of size 8
      ==31970==    at 0xBF6677: maria_write (ma_write.c:298)
      ==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
      ==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
      ==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
      ==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
      ==31970==    by 0x6320A7C: clone (clone.S:112)
      ==31970==  Address 0xb929e70 is 112 bytes inside a block of size 256 free'd
      ==31970==    at 0xD3441D: free (jemalloc.c:1273)
      ==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
      ==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
      ==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
      ==31970==    by 0xCB342E: delete_dynamic (array.c:303)
      ==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
      ==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
      ==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
      ==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
      ==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
      ==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970== Invalid write of size 8
      ==31970==    at 0xBF667E: maria_write (ma_write.c:298)
      ==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
      ==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
      ==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
      ==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
      ==31970==    by 0x6320A7C: clone (clone.S:112)
      ==31970==  Address 0xb929e70 is 112 bytes inside a block of size 256 free'd
      ==31970==    at 0xD3441D: free (jemalloc.c:1273)
      ==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
      ==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
      ==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
      ==31970==    by 0xCB342E: delete_dynamic (array.c:303)
      ==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
      ==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
      ==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
      ==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
      ==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
      ==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970== Invalid read of size 1
      ==31970==    at 0xBF66D9: maria_write (ma_write.c:303)
      ==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
      ==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
      ==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
      ==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
      ==31970==    by 0x6320A7C: clone (clone.S:112)
      ==31970==  Address 0xb929ea4 is 164 bytes inside a block of size 256 free'd
      ==31970==    at 0xD3441D: free (jemalloc.c:1273)
      ==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
      ==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
      ==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
      ==31970==    by 0xCB342E: delete_dynamic (array.c:303)
      ==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
      ==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
      ==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
      ==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
      ==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
      ==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970== Invalid write of size 1
      ==31970==    at 0xBF66E0: maria_write (ma_write.c:303)
      ==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
      ==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
      ==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
      ==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
      ==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
      ==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
      ==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
      ==31970==    by 0x6320A7C: clone (clone.S:112)
      ==31970==  Address 0xb929ea4 is 164 bytes inside a block of size 256 free'd
      ==31970==    at 0xD3441D: free (jemalloc.c:1273)
      ==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
      ==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
      ==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
      ==31970==    by 0xCB342E: delete_dynamic (array.c:303)
      ==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
      ==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
      ==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
      ==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
      ==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
      ==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
      ==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
      ==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
      ==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
      ==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
      ==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)

      Please also note that CREATE TABLE v1 ends with ER_TABLE_NOT_LOCKED, even though there was LOCK TABLE v1 before.

      For the record, the same scenario also fails on 5.1-5.3, only there it causes a crash on UNLOCK TABLES:

      #2  0x00000000007fd86d in handle_fatal_signal (sig=11) at signal_handler.cc:249
      #3  <signal handler called>
      #4  malloc_consolidate (av=0x7fa18058ce60) at malloc.c:5155
      #5  0x00007fa1802804d4 in _int_malloc (av=0x7fa18058ce60, bytes=2092) at malloc.c:4373
      #6  0x00007fa180282b90 in *__GI___libc_malloc (bytes=2092) at malloc.c:3660
      #7  0x0000000000b8b24b in _mymalloc (size=2048, filename=0xde12d0 "thr_mutex.c", lineno=179, MyFlags=0) at safemalloc.c:140
      #8  0x0000000000b99f73 in init_dynamic_array2 (array=0x348db50, element_size=16, init_buffer=0x0, init_alloc=128, alloc_increment=64, sFile=0xde12d0 "thr_mutex.c", uLine=179) at array.c:67
      #9  0x0000000000b986b2 in _my_hash_init (hash=0x348db28, growth_size=64, charset=0x1216360, size=128, key_offset=40, key_length=8, get_key=0, free_element=0, flags=1, sFile=0xde12d0 "thr_mutex.c", uLine=179) at hash.c:94
      #10 0x0000000000baee6d in safe_mutex_lazy_init_deadlock_detection (mp=0x162e768) at thr_mutex.c:175
      #11 0x0000000000baf2e9 in safe_mutex_lock (mp=0x162e768, my_flags=0, file=0xd8ba00 "ma_loghandler.c", line=1617) at thr_mutex.c:325
      #12 0x00000000009887ae in translog_buffer_lock (buffer=0x152e6e8) at ma_loghandler.c:1617
      #13 0x0000000000997d29 in translog_force_current_buffer_to_finish () at ma_loghandler.c:7380
      #14 0x0000000000998912 in translog_flush (lsn=4294976781) at ma_loghandler.c:7642
      #15 0x0000000000965150 in ma_commit (trn=0x34291b8) at ma_commit.c:65
      #16 0x000000000094bdde in ha_maria::external_lock (this=0x342b2b0, thd=0x3383618, lock_type=2) at ha_maria.cc:2555
      #17 0x00000000007e8d8d in handler::ha_external_lock (this=0x342b2b0, thd=0x3383618, lock_type=2) at handler.cc:4754
      #18 0x00000000007f1893 in ha_partition::external_lock (this=0x342ad30, thd=0x3383618, lock_type=2) at ha_partition.cc:2991
      #19 0x00000000007e8d8d in handler::ha_external_lock (this=0x342ad30, thd=0x3383618, lock_type=2) at handler.cc:4754
      #20 0x0000000000692b73 in unlock_external (thd=0x3383618, table=0x3429820, count=1) at lock.cc:829
      #21 0x0000000000691b19 in mysql_unlock_tables (thd=0x3383618, sql_lock=0x34297e8) at lock.cc:390
      #22 0x00000000006f702d in close_thread_tables (thd=0x3383618) at sql_base.cc:1353
      #23 0x00000000006a901e in unlock_locked_tables (thd=0x3383618) at sql_parse.cc:162
      #24 0x00000000006b1d74 in mysql_execute_command (thd=0x3383618) at sql_parse.cc:3687
      #25 0x00000000006b9666 in mysql_parse (thd=0x3383618, rawbuf=0x3411680 "UNLOCK TABLES", length=13, found_semicolon=0x7fa177332ca0) at sql_parse.cc:6231
      #26 0x00000000006aba69 in dispatch_command (command=COM_QUERY, thd=0x3383618, packet=0x33f0b19 "UNLOCK TABLES", packet_length=13) at sql_parse.cc:1303
      #27 0x00000000006aa93d in do_command (thd=0x3383618) at sql_parse.cc:906
      #28 0x00000000006a78da in handle_one_connection (arg=0x3383618) at sql_connect.cc:1238
      #29 0x00007fa180597b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
      #30 0x00007fa1802e1a7d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

      Stack trace from:

      revision-id: elenst@montyprogram.com-20140422211641-fc02411zu0z1wgyk
      revno: 3221
      branch-nick: 5.1

        Attachments

          Activity

            People

            • Assignee:
              monty Michael Widenius
              Reporter:
              elenst Elena Stepanova
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: