Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.0.14
Description
10.0 fails in valgrind like
innodb.innodb 'innodb_plugin' w6 [ fail ] Found warnings/errors in server log file!
|
Test ended at 2014-09-18 19:41:40
|
line
|
==10503== Thread 19:
|
==10503== Invalid free() / delete / delete[] / realloc()
|
==10503== at 0x4C257D8: free (vg_replace_malloc.c:446)
|
==10503== by 0xA25EDF: mem_area_free(void*, mem_pool_t*) (mem0pool.cc:519)
|
==10503== by 0xA2528F: mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) (mem0mem.cc:521)
|
==10503== by 0xB7FBDA: mem_heap_free_func(mem_block_info_t*, char const*, unsigned long) (mem0mem.ic:510)
|
==10503== by 0xB91317: dict_foreign_remove_partial std::for_each<std::_Rb_tree_const_iterator<dict_foreign_t*>, dict_foreign_remove_partial>(std::_Rb_tree_const_iterator<dict_foreign_t*>, std::_Rb_tree_const_iterator<dict_foreign_t*>, dict_foreign_remove_partial) (dict0mem.h:804)
|
==10503== by 0xBFF4450: dict_table_rename_in_cache(dict_table_t*, char const*, unsigned long) (dict0dict.cc:1664)
|
==10503== by 0xC089A56: commit_cache_rebuild(ha_innobase_inplace_ctx*) (handler0alter.cc:5027)
|
==10503== by 0xC0817D0: ha_innodb::commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) (handler0alter.cc:5705)
|
==10503== by 0x686E19: mysql_inplace_alter_table(THD*, TABLE_LIST*, TABLE*, TABLE*, Alter_inplace_info*, enum_alter_inplace_result, MDL_request*, Alter_table_ctx*) (sql_table.cc:7054)
|
==10503== by 0x68A460: mysql_alter_table(THD*, char*, char*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) (sql_table.cc:8803)
|
==10503== by 0x5EC4D2: mysql_execute_command(THD*) (sql_parse.cc:3078)
|
==10503== by 0x5EDBD9: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:6415)
|
==10503== by 0x5EF5EB: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1307)
|
==10503== by 0x5F0DD1: do_command(THD*) (sql_parse.cc:1004)
|
==10503== by 0x6E025E: do_handle_one_connection(THD*) (sql_connect.cc:1379)
|
==10503== by 0x6E0384: handle_one_connection (sql_connect.cc:1293)
|
==10503== Address 0xc90a478 is 623,672 bytes inside a block of size 8,388,640 alloc'd
|
==10503== at 0x4C25DD6: malloc (vg_replace_malloc.c:270)
|
==10503== by 0xC1BE9F6: ut_malloc_low(unsigned long, unsigned long) (ut0mem.cc:117)
|
==10503== by 0xC0CD027: mem_pool_create(unsigned long) (mem0pool.cc:231)
|
==10503== by 0xC0CBD3B: mem_init(unsigned long) (mem0dbg.cc:177)
|
==10503== by 0xC184280: srv_boot() (srv0srv.cc:1033)
|
==10503== by 0xC18B4DA: innobase_start_or_create_for_mysql() (srv0start.cc:1823)
|
==10503== by 0xC06845B: innobase_init(void*) (ha_innodb.cc:3369)
|
==10503== by 0x7A099B: ha_initialize_handlerton(st_plugin_int*) (handler.cc:502)
|
==10503== by 0x5F83A9: plugin_initialize(st_mem_root*, st_plugin_int*, int*, char**, bool) (sql_plugin.cc:1378)
|
==10503== by 0x5FA3AB: plugin_init(int*, char**, int) (sql_plugin.cc:1665)
|
==10503== by 0x53C6D4: init_server_components() (mysqld.cc:4811)
|
==10503== by 0x53D39D: mysqld_main(int, char**) (mysqld.cc:5405)
|
==10503== by 0x6242585: (below main) (in /lib64/libc-2.9.so)
|
^ Found warnings in /dev/shm/var_auto_HweU/6/log/mysqld.1.err
|
ok
|
All tests below fail in a very similar fashion:
innodb.innodb 'innodb_plugin'
|
innodb.innodb-index 'innodb_plugin'
|
innodb.innodb_bug12902967 'innodb_plugin'
|
innodb.innodb_bug47621 'innodb_plugin'
|
main.alter_table 'innodb_plugin'
|
main.subselect2 'innodb_plugin'
|
vcol.vcol_ins_upd_innodb 'innodb_plugin'
|
Attachments
Issue Links
- relates to
-
-
- Closed
-
-
-
- Closed
-
Activity
One can repeat this as follows:
ssh work.askmonty.org
|
git clone https://github.com/MariaDB/server.git 10.1
|
cd 10.1
|
cmake . -DWITH_VALGRIND:BOOL=ON
|
make
|
cd mysql-test
|
./mysql-test-run --valgrind t/alter_table.test
|
The output is:
main.alter_table 'innodb_plugin' [ fail ] Found warnings/errors in server log file!
|
Test ended at 2014-10-27 14:01:28
|
line
|
==828== Conditional jump or move depends on uninitialised value(s)
|
==828== at 0x5B8CD6A: BN_bin2bn (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5B90408: ??? (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5BB207D: ??? (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
|
==828== by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
|
==828== by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
|
==828== by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
|
==828== by 0x6825585: (below main) (in /lib64/libc-2.9.so)
|
==828== Conditional jump or move depends on uninitialised value(s)
|
==828== at 0x5B8C15D: BN_num_bits_word (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5B8C2A4: BN_num_bits (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5B8AF29: BN_mod_exp_mont_consttime (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5BB20DB: ??? (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
|
==828== by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
|
==828== by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
|
==828== by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
|
==828== by 0x6825585: (below main) (in /lib64/libc-2.9.so)
|
==828== Conditional jump or move depends on uninitialised value(s)
|
==828== at 0x5B8C16C: BN_num_bits_word (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5B8C2A4: BN_num_bits (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5B8AF29: BN_mod_exp_mont_consttime (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5BB20DB: ??? (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
|
==828== by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
|
==828== by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
|
==828== by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
|
==828== by 0x6825585: (below main) (in /lib64/libc-2.9.so)
|
==828== Conditional jump or move depends on uninitialised value(s)
|
==828== at 0x5B8C17B: BN_num_bits_word (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5B8C2A4: BN_num_bits (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5B8AF29: BN_mod_exp_mont_consttime (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5BB20DB: ??? (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
|
==828== by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
|
==828== by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
|
==828== by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
|
==828== by 0x6825585: (below main) (in /lib64/libc-2.9.so)
|
==828== Use of uninitialised value of size 8
|
==828== at 0x5B8C18C: BN_num_bits_word (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5B8C2A4: BN_num_bits (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5B8AF29: BN_mod_exp_mont_consttime (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5BB20DB: ??? (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
|
==828== by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
|
==828== by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
|
==828== by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
|
==828== by 0x6825585: (below main) (in /lib64/libc-2.9.so)
|
==828== Use of uninitialised value of size 8
|
==828== at 0x5B8B42B: BN_mod_exp_mont_consttime (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x5BB20DB: ??? (in /usr/lib64/libcrypto.so.0.9.8)
|
==828== by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
|
==828== by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
|
==828== by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
|
==828== by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
|
==828== by 0x6825585: (below main) (in /lib64/libc-2.9.so)
|
==828== Thread 21:
|
==828== Invalid free() / delete / delete[] / realloc()
|
==828== at 0x4C257D8: free (vg_replace_malloc.c:446)
|
==828== by 0x9CB412: mem_area_free(void*, mem_pool_t*) (mem0pool.cc:519)
|
==828== by 0x9CA317: mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) (mem0mem.cc:521)
|
==828== by 0xABB371: dict_foreign_remove_partial std::for_each<std::_Rb_tree_const_iterator<dict_foreign_t*>, dict_foreign_remove_partial>(std::_Rb_tree_const_iterator<dict_foreign_t*>, std::_Rb_tree_const_iterator<dict_foreign_t*>, dict_foreign_remove_partial) (mem0mem.ic:510)
|
==828== by 0xCDB3211: dict_table_rename_in_cache(dict_table_t*, char const*, unsigned long) (dict0dict.cc:1666)
|
==828== by 0xCEA0288: row_rename_table_for_mysql(char const*, char const*, trx_t*, bool) (row0mysql.cc:5099)
|
==828== by 0xCE1B449: ha_innodb::rename_table(char const*, char const*) (ha_innodb.cc:12023)
|
==828== by 0x625EB2: mysql_rename_table(handlerton*, char const*, char const*, char const*, char const*, unsigned int) (sql_table.cc:5187)
|
==828== by 0x634579: mysql_alter_table(THD*, char*, char*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) (sql_table.cc:9008)
|
==828== by 0x67C9FB: Sql_cmd_alter_table::execute(THD*) (sql_alter.cc:329)
|
==828== by 0x5AD617: mysql_execute_command(THD*) (sql_parse.cc:5461)
|
==828== by 0x5B41DD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:6953)
|
==828== by 0x5B7217: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1466)
|
==828== by 0x5B756E: do_command(THD*) (sql_parse.cc:1095)
|
==828== by 0x678FB6: do_handle_one_connection(THD*) (sql_connect.cc:1351)
|
==828== by 0x6790EF: handle_one_connection (sql_connect.cc:1262)
|
==828== Address 0xd231878 is 714,808 bytes inside a block of size 8,388,640 alloc'd
|
==828== at 0x4C25DD6: malloc (vg_replace_malloc.c:270)
|
==828== by 0xCEEDE9D: ut_malloc_low(unsigned long, unsigned long) (ut0mem.cc:117)
|
==828== by 0xCE53499: mem_pool_create(unsigned long) (mem0pool.cc:231)
|
==828== by 0xCE5275B: mem_init(unsigned long) (mem0dbg.cc:177)
|
==828== by 0xCEC60C8: srv_general_init() (srv0srv.cc:1084)
|
==828== by 0xCEC657F: srv_boot() (srv0srv.cc:1131)
|
==828== by 0xCECC4E6: innobase_start_or_create_for_mysql() (srv0start.cc:1837)
|
==828== by 0xCE107B4: innobase_init(void*) (ha_innodb.cc:3569)
|
==828== by 0x72B306: ha_initialize_handlerton(st_plugin_int*) (handler.cc:523)
|
==828== by 0x5BCC12: plugin_initialize(st_mem_root*, st_plugin_int*, int*, char**, bool) (sql_plugin.cc:1359)
|
==828== by 0x5BF66B: plugin_init(int*, char**, int) (sql_plugin.cc:1630)
|
==828== by 0x52D103: init_server_components() (mysqld.cc:5020)
|
==828== by 0x52F3AD: mysqld_main(int, char**) (mysqld.cc:5606)
|
==828== by 0x6825585: (below main) (in /lib64/libc-2.9.so)
|
^ Found warnings in /home/psergey/dev-git/10.1/mysql-test/var/log/mysqld.1.err
|
revno: 4464
committer: Jan Lindström <jplindst@mariadb.org>
branch nick: 10.0
timestamp: Mon 2014-10-27 16:58:16 +0200
message:
MDEV-6759: innodb valgrind failures
Fix failure seen on dict_foreign_remove_partial().
For which SQL statement was the double free reported?
The ‘fix’ here introduced memory leaks. For example, the following simple tests case will leak the dict_foreign_t when table t2 is dropped:
--source include/have_innodb.inc
|
CREATE TABLE t1 (id INT PRIMARY KEY) ENGINE=INNODB;
|
CREATE TABLE t2 (id INT PRIMARY KEY, t1_id INT, FOREIGN KEY (t1_id) REFERENCES t1(id)) ENGINE=INNODB;
|
DROP TABLE t2,t1;
|
With the patch for MDEV-11602 (effectively reverting this change) applied to 10.1 and 10.0, I did not observe any double free in main.alter_table or any other test with a -DWITH_ASAN executable. Only memory leaks were reported for InnoDB/XtraDB tests in 10.0 in the server error logs (which are ignored by mtr): innodb.innodb_file_format innodb.innodb_prefix_index_restart_server
I was unable to build 8777e801517d503aa5cf7a038610fe27f91ba730~ (the 10.0 version immediately before this change), so I cannot confirm if a double free was present before the change.
I really do not know what is wrong with this, I can't repeat this on my machine and reading the code it looks correct.