[MDEV-17551] Assertion `(&(&share->intern_lock)->m_mutex)->count > 0 && pthread_equal(pthread_self(), (&(&share->intern_lock)->m_mutex)->thread)' failed in _ma_state_info_write or ER_CRASHED_ON_USAGE upon SELECT with UNION Created: 2018-10-26  Updated: 2021-02-12  Resolved: 2019-06-27

Status: Closed
Project: MariaDB Server
Component/s: Data Definition - Temporary, Storage Engine - Aria
Affects Version/s: 10.3, 10.4
Fix Version/s: 10.3.17, 10.4.7

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Duplicate
is duplicated by MDEV-19075 ERROR 1194 or server crashes after a ... Closed
Relates
relates to MDEV-18171 Server crashes in _ma_rec_pack / _ma_... Closed

 Description    

CREATE TABLE t1 (b BLOB, vb BLOB AS (b) VIRTUAL);
 
INSERT INTO t1 (b) VALUES ('foobar');
 
 
 
SELECT 'foo' AS f1, CONVERT( 'bar' USING latin1 ) AS f2 FROM t1
 
  UNION
 
SELECT b AS f1, CONVERT( vb USING latin1 ) AS f2 FROM t1
 
;
 
 
 
# Cleanup
 
DROP TABLE t1;

10.3 f454189c606b9ce7c401a3493c9b85c72651e220 debug

 
2018-10-18  6:32:17 16 [ERROR] mysqld: Table '/home/travis/logs/vardir/tmp/#sql_5632_4' is marked as crashed and should be repaired
 
mysqld: /home/travis/src/storage/maria/ma_open.c:1379: _ma_state_info_write: Assertion `(&(&share->intern_lock)->m_mutex)->count > 0 && pthread_equal(pthread_self(), (&(&share->intern_lock)->m_mutex)->thread)' failed.
 
181018  6:32:17 [ERROR] mysqld got signal 6 ;
 
 
 
#7  0x00007fe48d64cca2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
 
#8  0x000055a86e71f95e in _ma_state_info_write (share=0x55a872307c80, pWrite=1) at /home/travis/src/storage/maria/ma_open.c:1379
 
#9  0x000055a86e7643ee in maria_close (info=0x55a872308e80) at /home/travis/src/storage/maria/ma_close.c:148
 
#10 0x000055a86e6dac6e in ha_maria::close (this=0x55a8722b9428) at /home/travis/src/storage/maria/ha_maria.cc:1275
 
#11 0x000055a86e102eae in handler::ha_close (this=0x55a8722b9428) at /home/travis/src/sql/handler.cc:2751
 
#12 0x000055a86e6df288 in ha_maria::drop_table (this=0x55a8722b9428, name=0x55a872307380 "/home/travis/logs/vardir/tmp/#sql_5632_4") at /home/travis/src/storage/maria/ha_maria.cc:2697
 
#13 0x000055a86e108194 in handler::ha_drop_table (this=0x55a8722b9428, name=0x55a872307380 "/home/travis/logs/vardir/tmp/#sql_5632_4") at /home/travis/src/sql/handler.cc:4579
 
#14 0x000055a86de7933f in free_tmp_table (thd=0x55a871ed1ed0, entry=0x55a872305f38) at /home/travis/src/sql/sql_select.cc:18605
 
#15 0x000055a86defc3e2 in st_select_lex_unit::cleanup (this=0x55a871ed5d80) at /home/travis/src/sql/sql_union.cc:1876
 
#16 0x000055a86def5bd8 in mysql_union (thd=0x55a871ed1ed0, lex=0x55a871ed5cb8, result=0x55a8722c5ff0, unit=0x55a871ed5d80, setup_tables_done_option=0) at /home/travis/src/sql/sql_union.cc:42
 
#17 0x000055a86de452d5 in handle_select (thd=0x55a871ed1ed0, lex=0x55a871ed5cb8, result=0x55a8722c5ff0, setup_tables_done_option=0) at /home/travis/src/sql/sql_select.cc:360
 
#18 0x000055a86de0fc5d in execute_sqlcom_select (thd=0x55a871ed1ed0, all_tables=0x55a871ee5028) at /home/travis/src/sql/sql_parse.cc:6547
 
#19 0x000055a86de062cf in mysql_execute_command (thd=0x55a871ed1ed0) at /home/travis/src/sql/sql_parse.cc:3769
 
#20 0x000055a86de13bea in mysql_parse (thd=0x55a871ed1ed0, rawbuf=0x55a871ee4148 "/* GenTest::Transform::ExecuteAsIntersect */ (  SELECT DISTINCT UpdateXML( '01:10:09.003094', '/bed/dbecbcebaa/decce', NULL ) AS field1, CONVERT( ( IF( `pk`, 'g', `vcol_blob` ) ) USING latin1 ) AS fie"..., length=555, parser_state=0x7fe48c0b9600, is_com_multi=false, is_next_command=false) at /home/travis/src/sql/sql_parse.cc:8091
 
#21 0x000055a86de00dfa in dispatch_command (command=COM_QUERY, thd=0x55a871ed1ed0, packet=0x55a871edba11 "/* GenTest::Transform::ExecuteAsIntersect */ (  SELECT DISTINCT UpdateXML( '01:10:09.003094', '/bed/dbecbcebaa/decce', NULL ) AS field1, CONVERT( ( IF( `pk`, 'g', `vcol_blob` ) ) USING latin1 ) AS fie"..., packet_length=556, is_com_multi=false, is_next_command=false) at /home/travis/src/sql/sql_parse.cc:1850
 
#22 0x000055a86ddff82b in do_command (thd=0x55a871ed1ed0) at /home/travis/src/sql/sql_parse.cc:1395
 
#23 0x000055a86df6804a in do_handle_one_connection (connect=0x55a871df8df0) at /home/travis/src/sql/sql_connect.cc:1402
 
#24 0x000055a86df67dce in handle_one_connection (arg=0x55a871df8df0) at /home/travis/src/sql/sql_connect.cc:1308
 
#25 0x00007fe48e20e184 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
 
#26 0x00007fe48d71affd in clone () from /lib/x86_64-linux-gnu/libc.so.6

10.3 3e47b41a16b5e2 non-debug

 
mysqltest: At line 4: query 'SELECT 'foo' AS f1, CONVERT( 'bar' USING latin1 ) AS f2 FROM t1
 
UNION
 
SELECT b AS f1, CONVERT( vb USING latin1 ) AS f2 FROM t1
 
' failed: 1194: Table '/dev/shm/var/tmp/mysqld.1/#sql_2a71_0' is marked as crashed and should be repaired

Also reproducible on previous 10.3 releases.
Not reproducible on 10.2.

 Comments   
Comment by Alice Sherepa [ 2019-01-10 ]

similar testcase:

CREATE or replace TABLE t1 (k1 text);
 
#INSERT INTO t1 VALUES ('ÿØÿà\0JFIF\0\0H\0H\0\0ÿá\0Exif\0\0MM\0*\0\0\0\0\0\0\0\0\0ÿÛ\0C\0  \Z!\Z\"$\"$ÿÛ\0CÿÀ');
 
INSERT INTO t1 VALUES 'aaa'; #then assertion as above
 
 
 
(SELECT UpdateXML('2000-01-03', 'aaa', '2000-01-03'), BINARY k1 FROM t1) 
  EXCEPT (SELECT UpdateXML('2000-01-03', 'aaa', '2000-01-03'), BINARY k1 FROM t1);


#6  0x0000556a35428819 in write_dynamic_record (info=0x241e22242217131f, record=0x1e1e1e1e1e1e1e2c <error: Cannot access memory at address 0x1e1e1e1e1e1e1e2c>, reclength=218) at /git/10.3/storage/maria/ma_dynrec.c:339
 
 
 
#7  0x0000556a354285e0 in _ma_write_blob_record (info=0x241e22242217131f, record=0x1f1f1d1d1a182118 <error: Cannot access memory at address 0x1f1f1d1d1a182118>) at /git/10.3/storage/maria/ma_dynrec.c:264

Comment by Michael Widenius [ 2019-06-27 ]

MDEV-17551 assert or crashed table when using blobs

The bug was that when long item-strings was converted to VARCHAR,
type_handler::string_type_handler() didn't take into account max
VARCHAR length. The resulting Aria temporary table was created with
a VARCHAR field of length 1 when it should have been 65537. This caused
MariaDB to send impossible records to ma_write() and Aria reported
eventually the table as crashed.

Fixed by updating Type_handler::string_type_handler() to not create too long
VARCHAR fields. To make things extra safe, I also added checks in when
writing dynamic Aria records to ensure we find the wrong record during write
instead of during read.

Comment by Michael Widenius [ 2019-06-27 ]

Pushed to 10.3

Generated at Thu Feb 08 08:37:19 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.