[MDEV-16682] Assertion `(buff[7] & 7) == HEAD_PAGE' failed. Created: 2018-07-04  Updated: 2018-09-03  Resolved: 2018-08-30

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - Aria
Affects Version/s: 5.5, 10.0, 10.1, 10.2, 10.3
Fix Version/s: 5.5.62, 10.0.37, 10.1.36, 10.2.18, 10.3.10, 10.4.0

Type: Bug Priority: Major
Reporter: Alice Sherepa Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-14847 Assertion `(buff[7] & 7) == HEAD_PAGE... Closed

 Description    

CREATE TABLE C (pk int, i2 int) ENGINE=Aria;
 
INSERT INTO C VALUES (1,2), (2,3),(3,4);
 
 
 
DELETE FROM tt.*, C.* USING C AS tt
 
	LEFT JOIN C  ON (tt.i2 = C.pk);

5.5

mysqld: /home/alice/git/5.5/storage/maria/ma_blockrec.c:5125: _ma_read_block_record: Assertion `(buff[7] & 7) == HEAD_PAGE' failed.
 
180704 11:36:04 [ERROR] mysqld got signal 6 ;
 
 
 
Server version: 5.5.61-MariaDB-debug
 
stack_bottom = 0x7f0552c30e20 thread_stack 0x48000
 
/usr/lib/x86_64-linux-gnu/libasan.so.2(+0x4a077)[0x7f0561a64077]
 
include/rem0rec.ic:448(rec_get_n_fields_old)[0x157aa2b]
 
sql/sql_list.h:695(base_ilist::push_back(ilink*))[0xa580c6]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7f0560fb6390]
 
linux/raise.c:54(__GI_raise)[0x7f0560585428]
 
stdlib/abort.c:91(__GI_abort)[0x7f056058702a]
 
assert/assert.c:92(__assert_fail_base)[0x7f056057dbd7]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x2dc82)[0x7f056057dc82]
 
sql/item_func.h:96(Item_func::Item_func(Item*, Item*))[0xf5bb7f]
 
sql/item_func.h:96(Item_func::Item_func(Item*, Item*))[0xf41ecd]
 
sql/sql_string.h:369(String::append(char))[0xe9258a]
 
sql/item_func.h:95(Item_func::Item_func(Item*, Item*))[0xd6860c]
 
sql/mysqld.h:534(_current_thd())[0xdcbb1a]
 
sql/sql_yacc.cc:37761(MYSQLparse(THD*))[0xdcc24f]
 
sql/sql_list.h:266(base_list::pop())[0xdcc491]
 
/home/alice/git/5.5/sql/mysqld[0x74b2cc]
 
/home/alice/git/5.5/sql/mysqld(_ZN4JOIN4execEv+0x79f1)[0x78b025]
 
/home/alice/git/5.5/sql/mysqld(_Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x209a)[0x778865]
 
/home/alice/git/5.5/sql/mysqld(_Z21mysql_execute_commandP3THD+0x932a)[0x694eac]
 
/home/alice/git/5.5/sql/mysqld(_Z11mysql_parseP3THDPcjP12Parser_state+0x3e9)[0x69eff7]
 
/home/alice/git/5.5/sql/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x19d7)[0x6a23e9]
 
/home/alice/git/5.5/sql/mysqld(_Z10do_commandP3THD+0x695)[0x6a64dd]
 
/home/alice/git/5.5/sql/mysqld(_Z24do_handle_one_connectionP3THD+0x34d)[0x8e6694]
 
/home/alice/git/5.5/sql/mysqld(handle_one_connection+0xdc)[0x8e690d]
 
handler/ha_innodb.cc:7131(ha_innobase::index_read(unsigned char*, unsigned char const*, unsigned int, ha_rkey_function))[0x14d2ca6]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7f0560fac6ba]
 
x86_64/clone.S:111(clone)[0x7f056065741d]
 
 
 
Trying to get some variables.
 
Some pointers may be invalid and cause the dump to abort.
 
Query (0x610000012558): DELETE FROM tt.*, C.* USING C AS tt LEFT JOIN C  ON (tt.i2 = C.pk)
 
Connection ID (thread ID): 2
 
Status: NOT_KILLED

10.0

Server version: 10.0.36-MariaDB-debug
 
 
 
/usr/lib/x86_64-linux-gnu/libasan.so.2(+0x4a077)[0x7fe9aaaeb077]
 
include/mach0data.ic:186(mach_read_from_4)[0x18004a3]
 
sql/debug_sync.cc:688(debug_sync_get_action)[0xb0039f]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7fe9aa03d390]
 
linux/raise.c:54(__GI_raise)[0x7fe9a960c428]
 
stdlib/abort.c:91(__GI_abort)[0x7fe9a960e02a]
 
assert/assert.c:92(__assert_fail_base)[0x7fe9a9604bd7]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x2dc82)[0x7fe9a9604c82]
 
sql/item_create.cc:5302(__static_initialization_and_destruction_0)[0x1016797]
 
sql/sql_string.h:69(String::String())[0xffe582]
 
sql/my_decimal.h:116(my_decimal::init())[0xf584e6]
 
psi/mysql_file.h:1276(inline_mysql_file_delete)[0xb10acc]
 
psi/mysql_thread.h:1068(inline_mysql_rwlock_unlock)[0xe2974c]
 
sql-common/client.c:744(free_old_query)[0xe89d78]
 
sql-common/client.c:894(cli_report_progress)[0xe8a4b0]
 
sql-common/client.c:618(cli_safe_read)[0xe8a702]
 
/home/alice/git/10.0/sql/mysqld[0x77e06c]
 
/home/alice/git/10.0/sql/mysqld(_ZN4JOIN10exec_innerEv+0x7ecd)[0x7bcf59]
 
/home/alice/git/10.0/sql/mysqld(_ZN4JOIN4execEv+0xe2)[0x7be104]
 
/home/alice/git/10.0/sql/mysqld(_Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x20dc)[0x7b39ba]
 
/home/alice/git/10.0/sql/mysqld(_Z21mysql_execute_commandP3THD+0xb7e0)[0x6bf4cc]
 
/home/alice/git/10.0/sql/mysqld(_Z11mysql_parseP3THDPcjP12Parser_state+0x4d6)[0x6cb5f3]
 
/home/alice/git/10.0/sql/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x1fe9)[0x6cec7f]
 
/home/alice/git/10.0/sql/mysqld(_Z10do_commandP3THD+0x919)[0x6d34af]
 
sql/item.h:1126(Item::print(String*, enum_query_type))[0x948cfa]
 
sql/item.h:1703(Item_basic_value::str_eq(String const*, String const*, charset_info_st const*, bool) const)[0x948f69]
 
include/sync0sync.ic:146(mutex_get_waiters)[0x173ca8a]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7fe9aa0336ba]
 
x86_64/clone.S:111(clone)[0x7fe9a96de41d]
 
 
 
Trying to get some variables.
 
Some pointers may be invalid and cause the dump to abort.
 
Query (0x611000102620): DELETE FROM tt.*, C.* USING C AS tt LEFT JOIN C  ON (tt.i2 = C.pk)
 
Connection ID (thread ID): 3
 
Status: NOT_KILLED

10.1

Server version: 10.1.35-MariaDB-debug
 
 
 
stack_bottom = 0x7f408215f1c0 thread_stack 0x48400
 
/usr/lib/x86_64-linux-gnu/libasan.so.2(+0x4a077)[0x7f4096fe3077]
 
/home/alice/git/10.1/sql/mysqld(my_print_stacktrace+0xc8)[0x55cf71b000d5]
 
mysys/stacktrace.c:267(my_print_stacktrace)[0x55cf70d884f9]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7f4096535390]
 
linux/raise.c:54(__GI_raise)[0x7f4095b04428]
 
stdlib/abort.c:91(__GI_abort)[0x7f4095b0602a]
 
assert/assert.c:92(__assert_fail_base)[0x7f4095afcbd7]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x2dc82)[0x7f4095afcc82]
 
maria/ma_blockrec.c:5165(_ma_read_block_record)[0x55cf712acbfa]
 
maria/ma_rrnd.c:45(maria_rrnd)[0x55cf71294f3d]
 
maria/ha_maria.cc:2479(ha_maria::rnd_pos(unsigned char*, unsigned char*))[0x55cf711ee0d6]
 
sql/handler.cc:2635(handler::ha_rnd_pos(unsigned char*, unsigned char*))[0x55cf70d9912b]
 
sql/records.cc:548(rr_from_pointers(READ_RECORD*))[0x55cf710c108f]
 
sql/sql_delete.cc:1232(multi_delete::do_table_deletes(TABLE*, bool))[0x55cf71123efb]
 
sql/sql_delete.cc:1188(multi_delete::do_deletes())[0x55cf711245fe]
 
sql/sql_delete.cc:1299(multi_delete::send_eof())[0x55cf7112499f]
 
sql/sql_select.cc:18152(do_select(JOIN*, List<Item>*, TABLE*, Procedure*))[0x55cf709a51df]
 
sql/sql_select.cc:3260(JOIN::exec_inner())[0x55cf709e8fe1]
 
sql/sql_select.cc:2548(JOIN::exec())[0x55cf709ea10c]
 
sql/sql_select.cc:3486(mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55cf709df3c8]
 
sql/sql_parse.cc:4181(mysql_execute_command(THD*))[0x55cf708e0fa7]
 
sql/sql_parse.cc:7449(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55cf708ed66f]
 
sql/sql_parse.cc:1515(dispatch_command(enum_server_command, THD*, char*, unsigned int))[0x55cf708f3770]
 
sql/sql_parse.cc:1121(do_command(THD*))[0x55cf708f9cd8]
 
sql/sql_connect.cc:1330(do_handle_one_connection(THD*))[0x55cf70b7d34c]
 
sql/sql_connect.cc:1244(handle_one_connection)[0x55cf70b7d838]
 
perfschema/pfs.cc:1864(pfs_spawn_thread)[0x55cf71a37576]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7f409652b6ba]
 
x86_64/clone.S:111(clone)[0x7f4095bd641d]
 
 
 
Trying to get some variables.
 
Some pointers may be invalid and cause the dump to abort.
 
Query (0x611000093fe0): DELETE FROM tt.*, C.* USING C AS tt LEFT JOIN C  ON (tt.i2 = C.pk)
 
Connection ID (thread ID): 3
 
Status: NOT_KILLED



 Comments   
Comment by Elena Stepanova [ 2018-08-24 ]

Still reproducible:

10.3 c43d11b96e

 
mysqld: /data/src/10.3/storage/maria/ma_blockrec.c:5164: _ma_read_block_record: Assertion `(buff[7] & 7) == HEAD_PAGE' failed.
 
180824 19:38:40 [ERROR] mysqld got signal 6 ;
 
 
 
#7  0x00007fad84bc0ee2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
 
#8  0x000056107c652884 in _ma_read_block_record (info=0x7fad640447d0, record=0x7fad64044388 "\377", record_pos=257) at /data/src/10.3/storage/maria/ma_blockrec.c:5164
 
#9  0x000056107c63ff0f in maria_rrnd (info=0x7fad640447d0, buf=0x7fad64044388 "\377", filepos=257) at /data/src/10.3/storage/maria/ma_rrnd.c:44
 
#10 0x000056107c5e84e4 in ha_maria::rnd_pos (this=0x7fad64043be8, buf=0x7fad64044388 "\377", pos=0x7fad6413b510 "") at /data/src/10.3/storage/maria/ha_maria.cc:2501
 
#11 0x000056107c3db998 in handler::ha_rnd_pos (this=0x7fad64043be8, buf=0x7fad64044388 "\377", pos=0x7fad6413b510 "") at /data/src/10.3/sql/handler.cc:2797
 
#12 0x000056107c55c9b6 in rr_from_pointers (info=0x7fad7ad5b0f0) at /data/src/10.3/sql/records.cc:547
 
#13 0x000056107c04edfb in READ_RECORD::read_record (this=0x7fad7ad5b0f0) at /data/src/10.3/sql/records.h:73
 
#14 0x000056107c57c5c4 in multi_delete::do_table_deletes (this=0x7fad64017458, table=0x7fad64042fa0, sort_info=0x7fad6405a6f0, ignore=false) at /data/src/10.3/sql/sql_delete.cc:1424
 
#15 0x000056107c57c24c in multi_delete::do_deletes (this=0x7fad64017458) at /data/src/10.3/sql/sql_delete.cc:1381
 
#16 0x000056107c57c7c5 in multi_delete::send_eof (this=0x7fad64017458) at /data/src/10.3/sql/sql_delete.cc:1488
 
#17 0x000056107c15b4ad in do_select (join=0x7fad640174c0, procedure=0x0) at /data/src/10.3/sql/sql_select.cc:18878
 
#18 0x000056107c1340ab in JOIN::exec_inner (this=0x7fad640174c0) at /data/src/10.3/sql/sql_select.cc:4028
 
#19 0x000056107c13351c in JOIN::exec (this=0x7fad640174c0) at /data/src/10.3/sql/sql_select.cc:3822
 
#20 0x000056107c13478c in mysql_select (thd=0x7fad64000b00, tables=0x7fad64015b60, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=3489926016, result=0x7fad64017458, unit=0x7fad640049a8, select_lex=0x7fad64005118) at /data/src/10.3/sql/sql_select.cc:4227
 
#21 0x000056107c0eb404 in mysql_execute_command (thd=0x7fad64000b00) at /data/src/10.3/sql/sql_parse.cc:4988
 
#22 0x000056107c0f4f9c in mysql_parse (thd=0x7fad64000b00, rawbuf=0x7fad64014d08 "DELETE FROM tt.*, C.* USING C AS tt\nLEFT JOIN C  ON (tt.i2 = C.pk)", length=66, parser_state=0x7fad7ad5c5f0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:8088
 
#23 0x000056107c0e2256 in dispatch_command (command=COM_QUERY, thd=0x7fad64000b00, packet=0x7fad64125291 "DELETE FROM tt.*, C.* USING C AS tt\nLEFT JOIN C  ON (tt.i2 = C.pk)", packet_length=66, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1850
 
#24 0x000056107c0e0c7a in do_command (thd=0x7fad64000b00) at /data/src/10.3/sql/sql_parse.cc:1395
 
#25 0x000056107c2475cb in do_handle_one_connection (connect=0x561080251d20) at /data/src/10.3/sql/sql_connect.cc:1402
 
#26 0x000056107c24734f in handle_one_connection (arg=0x561080251d20) at /data/src/10.3/sql/sql_connect.cc:1308
 
#27 0x000056107c6d914d in pfs_spawn_thread (arg=0x56108026e630) at /data/src/10.3/storage/perfschema/pfs.cc:1862
 
#28 0x00007fad86897494 in start_thread (arg=0x7fad7ad5d700) at pthread_create.c:333
 
#29 0x00007fad84c7d93f in clone () from /lib/x86_64-linux-gnu/libc.so.6

10.4 is also affected.

Comment by Michael Widenius [ 2018-08-30 ]

Problem was that SQL level tried to read a record with rnd_pos() that was already deleted by the same statement.
In the case where the page for the record had been deleted, this caused an assert.

Fixed by extending the assert to also handle empty pages and return HA_ERR_RECORD_DELETED for reads to deleted pages.

Comment by Michael Widenius [ 2018-08-30 ]

Pushed into 5.5

Generated at Thu Feb 08 08:30:46 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.