[MDEV-13024] Server crashes in my_store_ptr upon DELETE from sequence in multi-table format Created: 2017-06-07  Updated: 2018-05-06  Resolved: 2018-05-06

Status: Closed
Project: MariaDB Server
Component/s: Sequences
Affects Version/s: 10.3
Fix Version/s: 10.3.7

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-13016 Testing SEQUENCE object phase 2 Closed

 Description   

CREATE SEQUENCE s;
DELETE s FROM s;

10.3 86b941703529

#3  <signal handler called>
#4  0x000055f90fc9c05c in my_store_ptr (buff=0x0, pack_length=7, pos=0) at /data/src/10.3/mysys/ptr_cmp.c:199
#5  0x000055f90fbe7bea in ha_myisam::position (this=0x7f237c00d818, record=0x7f237c0065f8 "\377\001") at /data/src/10.3/storage/myisam/ha_myisam.cc:1936
#6  0x000055f90fc6d942 in ha_sequence::position (this=0x7f237c071428, record=0x7f237c0065f8 "\377\001") at /data/src/10.3/sql/ha_sequence.h:126
#7  0x000055f90f6d3ead in multi_delete::send_data (this=0x7f237c0156e8, values=...) at /data/src/10.3/sql/sql_delete.cc:1055
#8  0x000055f90f2f8584 in end_send (join=0x7f237c015748, join_tab=0x0, end_of_records=false) at /data/src/10.3/sql/sql_select.cc:19622
#9  0x000055f90f2f4d04 in do_select (join=0x7f237c015748, procedure=0x0) at /data/src/10.3/sql/sql_select.cc:17956
#10 0x000055f90f2cf8fb in JOIN::exec_inner (this=0x7f237c015748) at /data/src/10.3/sql/sql_select.cc:3478
#11 0x000055f90f2cedd8 in JOIN::exec (this=0x7f237c015748) at /data/src/10.3/sql/sql_select.cc:3280
#12 0x000055f90f2cff73 in mysql_select (thd=0x7f237c000b00, tables=0x7f237c014fe0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=3489926016, result=0x7f237c0156e8, unit=0x7f237c004698, select_lex=0x7f237c004dd8) at /data/src/10.3/sql/sql_select.cc:3673
#13 0x000055f90f28aa19 in mysql_execute_command (thd=0x7f237c000b00) at /data/src/10.3/sql/sql_parse.cc:4799
#14 0x000055f90f294860 in mysql_parse (thd=0x7f237c000b00, rawbuf=0x7f237c0148c8 "DELETE s FROM s", length=15, parser_state=0x7f238c8e9200, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7927
#15 0x000055f90f282518 in dispatch_command (command=COM_QUERY, thd=0x7f237c000b00, packet=0x7f237c088501 "DELETE s FROM s", packet_length=15, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1817
#16 0x000055f90f280ec1 in do_command (thd=0x7f237c000b00) at /data/src/10.3/sql/sql_parse.cc:1380
#17 0x000055f90f3ce3f4 in do_handle_one_connection (connect=0x55f912e71e50) at /data/src/10.3/sql/sql_connect.cc:1354
#18 0x000055f90f3ce181 in handle_one_connection (arg=0x55f912e71e50) at /data/src/10.3/sql/sql_connect.cc:1260
#19 0x000055f90f82aa8d in pfs_spawn_thread (arg=0x55f912dd1660) at /data/src/10.3/storage/perfschema/pfs.cc:1862
#20 0x00007f2394374494 in start_thread (arg=0x7f238c8ea700) at pthread_create.c:333
#21 0x00007f23926f793f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Also reproducible on bb-10.2-ext 3d428e017d

Stack trace with InnoDB (to make it searchable):

10.3 a1e0e64a4

#3  <signal handler called>
#4  __memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:167
#5  0x00007f9070cc3f93 in ha_innobase::position (this=0x7f901409f508, record=0x7f901400ce98 "\377\001") at /data/src/10.3/storage/innobase/handler/ha_innodb.cc:10963
#6  0x00007f90711f5a7e in ha_sequence::position (this=0x7f9014035688, record=0x7f901400ce98 "\377\001") at /data/src/10.3/sql/ha_sequence.h:126
#7  0x00007f9070c02766 in multi_delete::send_data (this=0x7f9014015ae0, values=...) at /data/src/10.3/sql/sql_delete.cc:1245
#8  0x00007f90707dbaa8 in end_send (join=0x7f9014015b40, join_tab=0x0, end_of_records=false) at /data/src/10.3/sql/sql_select.cc:20468
#9  0x00007f90707d7fca in do_select (join=0x7f9014015b40, procedure=0x0) at /data/src/10.3/sql/sql_select.cc:18796
#10 0x00007f90707b1442 in JOIN::exec_inner (this=0x7f9014015b40) at /data/src/10.3/sql/sql_select.cc:4061
#11 0x00007f90707b06ae in JOIN::exec (this=0x7f9014015b40) at /data/src/10.3/sql/sql_select.cc:3844
#12 0x00007f90707b1b27 in mysql_select (thd=0x7f9014000b00, tables=0x7f90140153a0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=3489926016, result=0x7f9014015ae0, unit=0x7f9014004890, select_lex=0x7f9014004ff8) at /data/src/10.3/sql/sql_select.cc:4260
#13 0x00007f9070768bac in mysql_execute_command (thd=0x7f9014000b00) at /data/src/10.3/sql/sql_parse.cc:4965
#14 0x00007f9070772178 in mysql_parse (thd=0x7f9014000b00, rawbuf=0x7f9014014c58 "DELETE s FROM s", length=15, parser_state=0x7f90687d35e0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7977
#15 0x00007f907075f9bf in dispatch_command (command=COM_QUERY, thd=0x7f9014000b00, packet=0x7f90141200f1 "DELETE s FROM s", packet_length=15, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1825
#16 0x00007f907075e3ff in do_command (thd=0x7f9014000b00) at /data/src/10.3/sql/sql_parse.cc:1370
#17 0x00007f90708c5cf4 in do_handle_one_connection (connect=0x7f9072ed4fa0) at /data/src/10.3/sql/sql_connect.cc:1402
#18 0x00007f90708c5a81 in handle_one_connection (arg=0x7f9072ed4fa0) at /data/src/10.3/sql/sql_connect.cc:1308
#19 0x00007f9070c8c020 in pfs_spawn_thread (arg=0x7f9072ef1f40) at /data/src/10.3/storage/perfschema/pfs.cc:1862
#20 0x00007f906fcb9064 in start_thread (arg=0x7f90687d4700) at pthread_create.c:309
#21 0x00007f906e10c62d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111



 Comments   
Comment by Oleksandr Byelkin [ 2018-04-26 ]

why ha_sequence::open copy ref if it always NULL is?

Comment by Oleksandr Byelkin [ 2018-04-26 ]

revision-id: 35e9c9319b8cbb9aec1d452caa46a17c887312c8 (mariadb-10.3.6-53-g35e9c9319b8)
parent(s): 0bdc15d86ea94df6ed7ac07e69309d7b9b7281b2
author: Oleksandr Byelkin
committer: Oleksandr Byelkin
timestamp: 2018-04-26 19:58:43 +0200
message:

MDEV-13024: Server crashes in my_store_ptr upon DELETE from sequence in multi-table format

Make operation possition() dummy for sequences (should not be used really)

Comment by Michael Widenius [ 2018-05-03 ]

Following fixes needs to done:

  • Allocate ref in ha_sequence_open (have given a tested patch to Sanja)
  • Add test of multi_table_deletes with several tables and sequences
Generated at Thu Feb 08 08:02:19 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.