Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-7003

test-alter-table crashes debug build due to double free of plugin

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 10.0.14
    • Fix Version/s: 10.0.15
    • Labels:
      None
    • Environment:
      linux ubuntu 14 or centos 5

      Description

      running mariadb 10.0.14 debug build with tokudb plugin loaded.

      when running sql-bench 'test-alter-table --create-options=engine=tokudb', mysqld hits buffer overrun assert. it appears that that a plugin is unlocked twice which causes a debug memory to be freed twice.

      here is some gdb info:

      (gdb) bt
      #0  my_free (ptr=0x7ffda4020c70) at /home/rfp/maria/mysys/my_malloc.c:208
      #1  0x000000000065c945 in intern_plugin_unlock (lex=0x0, plugin=0x7ffda4020c70) at /home/rfp/maria/sql/sql_plugin.cc:1275
      #2  0x000000000065cb0c in plugin_unlock (thd=0x0, plugin=0x7ffda4020c70) at /home/rfp/maria/sql/sql_plugin.cc:1319
      #3  0x0000000000725e57 in TABLE_SHARE::destroy (this=0x7ffda427ca00) at /home/rfp/maria/sql/table.cc:429
      #4  0x0000000000725fe4 in free_table_share (share=0x7ffda427ca00) at /home/rfp/maria/sql/table.cc:470
      #5  0x00000000005ec898 in open_table_uncached (thd=0x7ffd9b614070, hton=0x7ffdb5fc2670, path=0x7ffff7f63ffc "./test/#sql-3194_2", db=0x7ffda4022758 "test", table_name=0x7ffff7f63790 "#sql-3194_2", add_to\
      _temporary_tables_list=true, open_in_engine=false) at /home/rfp/maria/sql/sql_base.cc:5606
      #6  0x0000000000705679 in mysql_alter_table (thd=0x7ffd9b614070, new_db=0x7ffda4022758 "test", new_name=0x0, create_info=0x7ffff7f64350, table_list=0x7ffda4022180, alter_info=0x7ffff7f642c0, order_num=0,\
       order=0x0, ignore=false) at /home/rfp/maria/sql/sql_table.cc:8713
      #7  0x000000000077195e in Sql_cmd_alter_table::execute (this=0x7ffda4022840, thd=0x7ffd9b614070) at /home/rfp/maria/sql/sql_alter.cc:312
      #8  0x0000000000650440 in mysql_execute_command (thd=0x7ffd9b614070) at /home/rfp/maria/sql/sql_parse.cc:5077
      #9  0x00000000006534fe in mysql_parse (thd=0x7ffd9b614070, rawbuf=0x7ffda4022088 "ALTER TABLE bench ADD  i230 integer", length=35, parser_state=0x7ffff7f65640) at /home/rfp/maria/sql/sql_parse.cc:6406
      #10 0x000000000064602e in dispatch_command (command=COM_QUERY, thd=0x7ffd9b614070, packet=0x7ffd9b743071 "ALTER TABLE bench ADD  i230 integer", packet_length=35) at /home/rfp/maria/sql/sql_parse.cc:1299
      #11 0x000000000064538c in do_command (thd=0x7ffd9b614070) at /home/rfp/maria/sql/sql_parse.cc:996
      #12 0x000000000076ce84 in do_handle_one_connection (thd_arg=0x7ffd9b614070) at /home/rfp/maria/sql/sql_connect.cc:1379
      #13 0x000000000076cbea in handle_one_connection (arg=0x7ffd9b614070) at /home/rfp/maria/sql/sql_connect.cc:1293
      #14 0x00007ffff733c182 in start_thread (arg=0x7ffff7f66700) at pthread_create.c:312
      #15 0x00007ffff6222fbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
      (gdb) up
      #1  0x000000000065c945 in intern_plugin_unlock (lex=0x0, plugin=0x7ffda4020c70) at /home/rfp/maria/sql/sql_plugin.cc:1275
      (gdb) c
      Continuing.

      Breakpoint 13, my_free (ptr=0x7ffda4020c70) at /home/rfp/maria/mysys/my_malloc.c:208
      (gdb) bt
      #0  my_free (ptr=0x7ffda4020c70) at /home/rfp/maria/mysys/my_malloc.c:208
      #1  0x000000000065c945 in intern_plugin_unlock (lex=0x0, plugin=0x7ffda4020c70) at /home/rfp/maria/sql/sql_plugin.cc:1275
      #2  0x000000000065cc09 in plugin_unlock_list (thd=0x0, list=0x7ffd9b6188e8, count=0) at /home/rfp/maria/sql/sql_plugin.cc:1336
      #3  0x000000000063831b in lex_end (lex=0x7ffd9b617cb8) at /home/rfp/maria/sql/sql_lex.cc:559
      #4  0x0000000000611a9b in THD::end_statement (this=0x7ffd9b614070) at /home/rfp/maria/sql/sql_class.cc:3394
      #5  0x0000000000653628 in mysql_parse (thd=0x7ffd9b614070, rawbuf=0x7ffda4022088 "ALTER TABLE bench ADD  i230 integer", length=35, parser_state=0x7ffff7f65640) at /home/rfp/maria/sql/sql_parse.cc:6426
      #6  0x000000000064602e in dispatch_command (command=COM_QUERY, thd=0x7ffd9b614070, packet=0x7ffd9b743071 "ALTER TABLE bench ADD  i230 integer", packet_length=35) at /home/rfp/maria/sql/sql_parse.cc:1299
      #7  0x000000000064538c in do_command (thd=0x7ffd9b614070) at /home/rfp/maria/sql/sql_parse.cc:996
      #8  0x000000000076ce84 in do_handle_one_connection (thd_arg=0x7ffd9b614070) at /home/rfp/maria/sql/sql_connect.cc:1379
      #9  0x000000000076cbea in handle_one_connection (arg=0x7ffd9b614070) at /home/rfp/maria/sql/sql_connect.cc:1293
      #10 0x00007ffff733c182 in start_thread (arg=0x7ffff7f66700) at pthread_create.c:312
      #11 0x00007ffff6222fbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

        Attachments

          Activity

            People

            Assignee:
            serg Sergei Golubchik
            Reporter:
            prohaska7 Rich Prohaska
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: