Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-7513

ib_warn_row_too_big dereferences null thd

    Details

      Description

      This is http://bugs.mysql.com/75245 - which appears to be a duplicate of a (private) MySQL bug, https://bugs.mysql.com/75095. MariaDB 10.0.16 seems to have inherited this from InnoDB in 5.6.22.

      Steps to reproduce are fairly simple (taken from bug 75245):

      { echo -n "CREATE TABLE test.foo ( "; for i in {1..197}; do echo -n "text${i} TEXT"; [[ ${i} -ne 197 ]] && echo -n ","; echo; done; echo ") ENGINE = InnoDB"; } | mysql
      { echo -n "INSERT INTO test.foo VALUES ("; for i in {1..197}; do echo -n "'abcdef'"; [[ ${i} -ne 197 ]] && echo -n ", "; done; echo ")"; } | mysql
      mysql -Bse "DELETE FROM test.foo WHERE text1 = 'abcdef'"
      service mysqld restart

      Reviewing the MySQL error log shows:

      150127 20:21:47 [Note] InnoDB: Waiting for purge to start
      150127 20:21:47 [ERROR] mysqld got signal 11 ;
      This could be because you hit a bug. It is also possible that this binary
      or one of the libraries it was linked against is corrupt, improperly built,
      or misconfigured. This error can also be caused by malfunctioning hardware.
       
      To report this bug, see http://kb.askmonty.org/en/reporting-bugs
       
      We will try our best to scrape up some info that will hopefully help
      diagnose the problem, but since we have already crashed,
      something is definitely wrong and this may fail.
       
      Server version: 10.0.16-MariaDB-log
      key_buffer_size=8388608
      read_buffer_size=131072
      max_used_connections=0
      max_threads=66
      thread_count=0
      It is possible that mysqld could use up to
      key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 153153 K  bytes of memory
      Hope that's ok; if not, decrease some variables in the equation.
       
      Thread pointer: 0x0x0
      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong...
      stack_bottom = 0x0 thread_stack 0x48000
      150127 20:21:47 [Note] InnoDB:  Percona XtraDB (http://www.percona.com) 5.6.22-71.0 started; log sequence number 1640775
      2015-01-27 20:21:47 7fb7667fe700 InnoDB: Loading buffer pool(s) from .//ib_buffer_pool
      2015-01-27 20:21:47 7fb7667fe700 InnoDB: Buffer pool(s) load completed at 150127 20:21:47
      150127 20:21:47 [Note] Plugin 'FEEDBACK' is disabled.
      150127 20:21:47 [Warning] 'proxies_priv' entry '@% root@pachyderm' ignored in --skip-name-resolve mode.
      150127 20:21:47 [Note] Event Scheduler: Loaded 0 events
      mysys/stacktrace.c:247(my_print_stacktrace)[0xbb258b]
      sql/signal_handler.cc:153(handle_fatal_signal)[0x71bf28]
      /lib64/libpthread.so.0(+0xf6d0)[0x7fb77837f6d0]
      sql/sql_class.cc:1204(THD::raise_condition(unsigned int, char const*, Sql_condition::enum_warning_level, char const*))[0x59a942]
      sql/sql_class.h:3150(THD::get_stmt_da())[0x5aa804]
      handler/ha_innodb.cc:18944(ib_warn_row_too_big(dict_table_t const*))[0x877214]
      dict/dict0dict.cc:2432(dict_index_add_to_cache(dict_table_t*, dict_index_t*, unsigned long, unsigned long))[0x9b93e0]
      dict/dict0load.cc:2018(dict_load_indexes)[0x9cb9cb]
      dict/dict0load.cc:2447(dict_load_table(char const*, unsigned long, dict_err_ignore_t))[0x9c89b7]
      dict/dict0load.cc:2633(dict_load_table_on_id(unsigned long, dict_err_ignore_t))[0x9c9910]
      dict/dict0dict.cc:900(dict_table_open_on_id(unsigned long, unsigned long, dict_table_op_t))[0x9b8218]
      row/row0purge.cc:759(row_purge_parse_undo_rec)[0x918eef]
      que/que0que.cc:1115(que_thr_step)[0x8e471b]
      trx/trx0purge.cc:1254(trx_purge(unsigned long, unsigned long, bool))[0x940a57]
      srv/srv0srv.cc:3278(srv_do_purge)[0x931ca8]
      /lib64/libpthread.so.0(+0x7ee5)[0x7fb778377ee5]
      /lib64/libc.so.6(clone+0x6d)[0x7fb777a94b8d]
      The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
      information that should help you find out what is causing the crash.

      As a naive fix, adding a check along the lines of

       if(thd == null) return; 

      in ib_warn_row_too_big() seems to resolve the immediate cause of the crash.

        Attachments

          Activity

            People

            • Assignee:
              jplindst Jan Lindström
              Reporter:
              andrew.garner Andrew Garner
            • Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: