MDEV-39883 — symbolised crash stack
=====================================
Host:        BS-MARIADB-EUSE
Crash:       2026-06-27 16:10:43 UTC  (kernel: ib_tpool_worker[3261383]: segfault at 10)
Core:        systemd-coredump PID 3235777 (libaio backend, @@global.innodb_linux_aio = aio)
Build:       12.3.2-MariaDB-ubu2404-log
Build-ID:    7af232ca90a8d0721d079f90de9f9fc8e564782e
Symbols:     mariadb-server-core-dbgsym 1:12.3.2+maria~ubu2404
             (deb.mariadb.org/12.3/ubuntu noble main/debug)

Signal:      SIGSEGV, read of address 0x10 (NULL pointer + struct offset)

Faulting thread (Thread 85, LWP 3261383 — the ib_tpool_worker named in the kernel log):

#0  btr_sea::hash_chain::search<btr_sea::partition::erase<true>(btr_sea::hash_chain&, unsigned char const*)::{lambda(ahi_node const*)#1}>(...)
                                                            storage/innobase/btr/btr0sea.cc:931      <-- fault
#1  btr_sea::partition::erase<true> (rec, cell, this)       storage/innobase/btr/btr0sea.cc:931
#2  btr_search_update_hash_on_delete (cursor)               storage/innobase/btr/btr0sea.cc:1822
#3  btr_search_update_hash_on_delete (cursor)               storage/innobase/btr/btr0cur.cc:4464
#4  btr_cur_optimistic_delete (cursor, flags, mtr)          storage/innobase/btr/btr0cur.cc:4451
#5  row_purge_remove_sec_if_poss_leaf (node, index, entry)  storage/innobase/row/row0purge.cc:954
#6  row_purge_remove_sec_if_poss (entry, index, node)       storage/innobase/row/row0purge.cc:985
#7  row_purge_del_mark (node)                               storage/innobase/row/row0purge.cc:1018
#8  row_purge_record (updated_extern, thr, undo_rec, node)  storage/innobase/row/row0purge.cc:1434
#9  row_purge (thd, thr, undo_rec, node)                    storage/innobase/row/row0purge.cc:1486
#10 row_purge_step (thr)                                    storage/innobase/row/row0purge.cc:1565
#11 que_thr_step (thr)                                      storage/innobase/que/que0que.cc:553
#12 que_run_threads_low (thr)                               storage/innobase/que/que0que.cc:609
#13 que_run_threads (thr)                                   storage/innobase/que/que0que.cc:629
#14 srv_task_execute (thd)                                  storage/innobase/srv/srv0srv.cc:1356
#15 srv_purge_worker_task_low ()                            storage/innobase/srv/srv0srv.cc:1488
#16 trx_purge (history_size, n_tasks, trx)                  storage/innobase/trx/trx0purge.cc:1518
#17 purge_coordinator_state::do_purge (this, trx)           storage/innobase/srv/srv0srv.cc:1420
#18 purge_coordinator_callback ()                           storage/innobase/srv/srv0srv.cc:1513
#19 tpool::task_group::execute (this, t)                    tpool/task_group.cc:73
#20 tpool::task::execute (this)                             tpool/task.cc:32
#21 tpool::thread_pool_generic::worker_main (this, thread_var) tpool/tpool_generic.cc:531
#22 (libstdc++ std::thread shim) -> start_thread -> clone3

Concurrent state at crash time: 6+ pool-of-threads workers simultaneously in
Sql_cmd_delete::delete_from_single_table -> handler::ha_delete_row (the daily bulk-DELETE
"delete old ProductPages" job).

Interpretation: NULL dereference in the InnoDB Adaptive Hash Index (btr_sea::partition::erase,
btr0sea.cc:931) while the purge coordinator removes a delete-marked secondary-index record
(row_purge_remove_sec_if_poss_leaf -> btr_cur_optimistic_delete -> btr_search_update_hash_on_delete)
under heavy concurrent DELETE load. Independent of the AIO backend (reproduces on both io_uring
and libaio). innodb_adaptive_hash_index was ON.

Workaround applied 2026-06-27 on all 7 locale shards: innodb_adaptive_hash_index = OFF
(dynamic SET GLOBAL + persisted in /etc/mysql/mariadb.conf.d/zz-ahi-mitigation.cnf), which
makes btr_search_update_hash_on_delete a no-op and bypasses the faulting path.

Full `thread apply all bt` (all 86 threads) retained at BS-MARIADB-EUSE:~provision and
hub DOVPS4:~/bt_sym_EUSE_20260627.txt.