[MDEV-18291] ASAN heap-use-after-free or SIGABRT in dict_mem_table_free after concurrent ALTER and BACKUP STAGE BLOCK_COMMIT Created: 2019-01-17  Updated: 2021-05-04

Status: Open
Project: MariaDB Server
Component/s: Locking, Storage Engine - InnoDB
Affects Version/s: 10.4
Fix Version/s: 10.4

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Michael Widenius
Resolution: Unresolved Votes: 0
Labels: None


 Description   

_The test case uses concurrency, so it might be non-deterministic; run with --repeat=N if it doesn't fail right away. It fails for me every time with ASAN and within a few attempts without ASAN.

--source include/have_innodb.inc
 
 
 
SET @stats= @@innodb_stats_persistent;
 
SET GLOBAL innodb_stats_persistent= ON;
 
 
 
CREATE TABLE t1 (a INT, b INT AS (a)) ENGINE=InnoDB;
 
 
 
--connect (con1,localhost,root,,test)
 
BACKUP STAGE START;
 
BACKUP STAGE BLOCK_COMMIT;
 
BACKUP STAGE END;
 
DROP USER IF EXISTS u;
 
BACKUP STAGE START;
 
--send
 
  BACKUP STAGE BLOCK_COMMIT;
 
 
 
--connection default
 
--error 0,ER_LOCK_WAIT_TIMEOUT
 
ALTER TABLE t1 NOWAIT ADD COLUMN c CHAR(8);
 
 
 
--connection con1
 
--reap
 
BACKUP STAGE END;
 
DROP TABLE t1;
 
 
 
--connection default
 
SET GLOBAL innodb_stats_persistent= @stats;

10.4 ASAN b13d356af8

 
==9621==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000005f10 at pc 0x5624852f94e9 bp 0x7f76d7886690 sp 0x7f76d7886688
 
READ of size 8 at 0x602000005f10 thread T28
 
    #0 0x5624852f94e8 in std::_List_base<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::_M_clear() /usr/include/c++/4.9/bits/list.tcc:69
 
    #1 0x5624852f85f3 in std::_List_base<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::~_List_base() /usr/include/c++/4.9/bits/stl_list.h:387
 
    #2 0x5624852e8b6b in std::list<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::~list() /usr/include/c++/4.9/bits/stl_list.h:447
 
    #3 0x5624857ca940 in dict_mem_table_free(dict_table_t*) /data/src/10.4/storage/innobase/dict/dict0mem.cc:233
 
    #4 0x562485790623 in dict_table_remove_from_cache(dict_table_t*, bool, bool) /data/src/10.4/storage/innobase/dict/dict0dict.cc:2057
 
    #5 0x5624854f2165 in row_drop_table_from_cache /data/src/10.4/storage/innobase/row/row0mysql.cc:3278
 
    #6 0x5624854f40ed in row_drop_table_for_mysql(char const*, trx_t*, enum_sql_command, bool, bool) /data/src/10.4/storage/innobase/row/row0mysql.cc:3751
 
    #7 0x56248527f56b in ha_innobase::delete_table(char const*, enum_sql_command) (/data/bld/10.4-asan/bin/mysqld+0x1eac56b)
 
    #8 0x562485253c0f in ha_innobase::delete_table(char const*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:12962
 
    #9 0x562484a793f4 in handler::ha_delete_table(char const*) /data/src/10.4/sql/handler.cc:4596
 
    #10 0x562484a691c8 in ha_delete_table(THD*, handlerton*, char const*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, bool) /data/src/10.4/sql/handler.cc:2564
 
    #11 0x562484520f15 in mysql_rm_table_no_locks(THD*, TABLE_LIST*, bool, bool, bool, bool, bool, bool) /data/src/10.4/sql/sql_table.cc:2508
 
    #12 0x56248451f253 in mysql_rm_table(THD*, TABLE_LIST*, bool, bool, bool) /data/src/10.4/sql/sql_table.cc:2123
 
    #13 0x56248432a591 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:5057
 
    #14 0x56248433d4de in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8116
 
    #15 0x5624843179ab in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1852
 
    #16 0x562484314a33 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1397
 
    #17 0x56248468af32 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1402
 
    #18 0x56248468a93e in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1308
 
    #19 0x5624851f15af in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
 
    #20 0x7f76f3d76493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #21 0x7f76f215c93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x602000005f10 is located 0 bytes inside of 16-byte region [0x602000005f10,0x602000005f20)
 
freed by thread T27 here:
 
    #0 0x7f76f3fe1477 in operator delete(void*) (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x55477)
 
    #1 0x5624852ebf65 in ha_innobase_inplace_ctx::~ha_innobase_inplace_ctx() (/data/bld/10.4-asan/bin/mysqld+0x1f18f65)
 
    #2 0x5624852ec02f in ha_innobase_inplace_ctx::~ha_innobase_inplace_ctx() (/data/bld/10.4-asan/bin/mysqld+0x1f1902f)
 
    #3 0x562484557352 in Alter_inplace_info::~Alter_inplace_info() (/data/bld/10.4-asan/bin/mysqld+0x1184352)
 
    #4 0x56248454db8b in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.4/sql/sql_table.cc:9701
 
    #5 0x56248469a543 in Sql_cmd_alter_table::execute(THD*) /data/src/10.4/sql/sql_alter.cc:497
 
    #6 0x562484332acb in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:6314
 
    #7 0x56248433d4de in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8116
 
    #8 0x5624843179ab in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1852
 
    #9 0x562484314a33 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1397
 
    #10 0x56248468af32 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1402
 
    #11 0x56248468a93e in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1308
 
    #12 0x5624851f15af in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
 
    #13 0x7f76f3d76493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7f76f3fe123f in operator new(unsigned long, std::nothrow_t const&) (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5523f)
 
    #1 0x5624857cb90f in dict_mem_table_add_v_col(dict_table_t*, mem_block_info_t*, char const*, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long) /data/src/10.4/storage/innobase/dict/dict0mem.cc:418
 
    #2 0x56248527c62a in create_table_info_t::create_table_def() (/data/bld/10.4-asan/bin/mysqld+0x1ea962a)
 
    #3 0x562485251013 in create_table_info_t::create_table(bool) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:12266
 
    #4 0x56248527eccb in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*, bool, trx_t*) (/data/bld/10.4-asan/bin/mysqld+0x1eabccb)
 
    #5 0x562485252c67 in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:12637
 
    #6 0x562484a7967f in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /data/src/10.4/sql/handler.cc:4630
 
    #7 0x562484a7c76b in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /data/src/10.4/sql/handler.cc:5004
 
    #8 0x562484619473 in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /data/src/10.4/sql/unireg.cc:514
 
    #9 0x562484530cd6 in create_table_impl /data/src/10.4/sql/sql_table.cc:4953
 
    #10 0x5624845317b7 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/src/10.4/sql/sql_table.cc:5074
 
    #11 0x562484532217 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /data/src/10.4/sql/sql_table.cc:5167
 
    #12 0x56248432513a in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4284
 
    #13 0x56248433d4de in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8116
 
    #14 0x5624843179ab in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1852
 
    #15 0x562484314a33 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1397
 
    #16 0x56248468af32 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1402
 
    #17 0x56248468a93e in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1308
 
    #18 0x5624851f15af in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
 
    #19 0x7f76f3d76493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
Thread T28 created by T0 here:
 
    #0 0x7f76f3fafbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x5624851f1b77 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
 
    #2 0x56248406ed56 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x562484084f74 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6438
 
    #4 0x562484085679 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6508
 
    #5 0x562484085a09 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6625
 
    #6 0x562484086655 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6790
 
    #7 0x562484084431 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:6060
 
    #8 0x56248406cbdf in main /data/src/10.4/sql/main.cc:25
 
    #9 0x7f76f20942b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f76f3fafbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x5624851f1b77 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
 
    #2 0x56248406ed56 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x562484084f74 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6438
 
    #4 0x562484085679 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6508
 
    #5 0x562484085a09 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6625
 
    #6 0x562484086655 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6790
 
    #7 0x562484084431 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:6060
 
    #8 0x56248406cbdf in main /data/src/10.4/sql/main.cc:25
 
    #9 0x7f76f20942b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/c++/4.9/bits/list.tcc:69 std::_List_base<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::_M_clear()
 
Shadow bytes around the buggy address:
 
  0x0c047fff8b90: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
 
  0x0c047fff8ba0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
 
  0x0c047fff8bb0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
 
  0x0c047fff8bc0: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa
 
  0x0c047fff8bd0: fa fa 00 06 fa fa 00 fa fa fa fd fa fa fa fd fd
 
=>0x0c047fff8be0: fa fa[fd]fd fa fa fd fa fa fa 00 00 fa fa 00 00
 
  0x0c047fff8bf0: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa fd fd
 
  0x0c047fff8c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c047fff8c10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c047fff8c20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c047fff8c30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==9621==ABORTING

10.4 debug b13d356af

 
190118  1:13:02 [ERROR] mysqld got signal 6 ;
 
 
 
#5  0x00007f294a4143fa in abort () from /lib/x86_64-linux-gnu/libc.so.6
 
#6  0x00007f294a450bd0 in __libc_message () from /lib/x86_64-linux-gnu/libc.so.6
 
#7  0x00007f294a456f96 in malloc_printerr () from /lib/x86_64-linux-gnu/libc.so.6
 
#8  0x00007f294a45778e in _int_free () from /lib/x86_64-linux-gnu/libc.so.6
 
#9  0x0000564e85f94cd4 in ut_allocator<std::_List_node<dict_v_idx_t>, true>::deallocate (this=0x7f28f00a6ce0, ptr=0x7f28f008c560) at /data/src/10.4/storage/innobase/include/ut0new.h:442
 
#10 0x0000564e85f93dda in std::_List_base<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::_M_put_node (this=0x7f28f00a6ce0, __p=0x7f28f008c560) at /usr/include/c++/4.9/bits/stl_list.h:347
 
#11 0x0000564e85f935d1 in std::_List_base<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::_M_clear (this=0x7f28f00a6ce0) at /usr/include/c++/4.9/bits/list.tcc:79
 
#12 0x0000564e85f92be4 in std::_List_base<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::~_List_base (this=0x7f28f00a6ce0, __in_chrg=<optimized out>) at /usr/include/c++/4.9/bits/stl_list.h:387
 
#13 0x0000564e85f8c1ae in std::list<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::~list (this=0x7f28f00a6ce0, __in_chrg=<optimized out>) at /usr/include/c++/4.9/bits/stl_list.h:447
 
#14 0x0000564e8623bc81 in dict_mem_table_free (table=0x7f28f0155a78) at /data/src/10.4/storage/innobase/dict/dict0mem.cc:233
 
#15 0x0000564e8621b6a7 in dict_table_remove_from_cache (table=0x7f28f0155a78, lru=false, keep=false) at /data/src/10.4/storage/innobase/dict/dict0dict.cc:2057
 
#16 0x0000564e860a5a04 in row_drop_table_from_cache (tablename=0x7f28f40b4f28 "test/t1", table=0x7f28f0155a78, trx=0x7f294421d378) at /data/src/10.4/storage/innobase/row/row0mysql.cc:3278
 
#17 0x0000564e860a6d86 in row_drop_table_for_mysql (name=0x7f293f6cddf0 "test/t1", trx=0x7f294421d378, sqlcom=SQLCOM_DROP_TABLE, create_failed=false, nonatomic=true) at /data/src/10.4/storage/innobase/row/row0mysql.cc:3751
 
#18 0x0000564e85f5ac72 in ha_innobase::delete_table (this=0x7f28f4014520, name=0x7f293f6cf9f0 "./test/t1", sqlcom=SQLCOM_DROP_TABLE) at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:12833
 
#19 0x0000564e85f470bd in ha_innobase::delete_table (this=0x7f28f4014520, name=0x7f293f6cf9f0 "./test/t1") at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:12962
 
#20 0x0000564e85c13412 in handler::ha_delete_table (this=0x7f28f4014520, name=0x7f293f6cf9f0 "./test/t1") at /data/src/10.4/sql/handler.cc:4596
 
#21 0x0000564e85c0d3f5 in ha_delete_table (thd=0x7f28f4000b00, table_type=0x564e89273240, path=0x7f293f6cf9f0 "./test/t1", db=0x7f293f6cf680, alias=0x7f28f4013cd8, generate_warning=true) at /data/src/10.4/sql/handler.cc:2564
 
#22 0x0000564e859c45e6 in mysql_rm_table_no_locks (thd=0x7f28f4000b00, tables=0x7f28f4013cb0, if_exists=false, drop_temporary=false, drop_view=false, drop_sequence=false, dont_log_query=false, dont_free_locks=false) at /data/src/10.4/sql/sql_table.cc:2508
 
#23 0x0000564e859c35da in mysql_rm_table (thd=0x7f28f4000b00, tables=0x7f28f4013cb0, if_exists=false, drop_temporary=false, drop_sequence=false) at /data/src/10.4/sql/sql_table.cc:2123
 
#24 0x0000564e858fb5b5 in mysql_execute_command (thd=0x7f28f4000b00) at /data/src/10.4/sql/sql_parse.cc:5057
 
#25 0x0000564e85904dde in mysql_parse (thd=0x7f28f4000b00, rawbuf=0x7f28f4013bf8 "DROP TABLE t1", length=13, parser_state=0x7f293f6d0600, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8116
 
#26 0x0000564e858f1f7b in dispatch_command (command=COM_QUERY, thd=0x7f28f4000b00, packet=0x7f28f400b441 "DROP TABLE t1", packet_length=13, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1852
 
#27 0x0000564e858f099f in do_command (thd=0x7f28f4000b00) at /data/src/10.4/sql/sql_parse.cc:1397
 
#28 0x0000564e85a5cc5a in do_handle_one_connection (connect=0x564e8954cf30) at /data/src/10.4/sql/sql_connect.cc:1402
 
#29 0x0000564e85a5c9de in handle_one_connection (arg=0x564e8954cf30) at /data/src/10.4/sql/sql_connect.cc:1308
 
#30 0x0000564e85f1bfb4 in pfs_spawn_thread (arg=0x564e89548260) at /data/src/10.4/storage/perfschema/pfs.cc:1862
 
#31 0x00007f294c0e2494 in start_thread (arg=0x7f293f6d1700) at pthread_create.c:333
 
#32 0x00007f294a4c893f in clone () from /lib/x86_64-linux-gnu/libc.so.6


*** Error in `/data/bld/10.4/bin/mysqld': double free or corruption (out): 0x00007f28f008c560 ***
 
======= Backtrace: =========
 
/lib/x86_64-linux-gnu/libc.so.6(+0x70bcb)[0x7f294a450bcb]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x76f96)[0x7f294a456f96]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x7778e)[0x7f294a45778e]
 
/data/bld/10.4/bin/mysqld(+0xdc3cd4)[0x564e85f94cd4]
 
/data/bld/10.4/bin/mysqld(+0xdc2dda)[0x564e85f93dda]
 
/data/bld/10.4/bin/mysqld(+0xdc25d1)[0x564e85f935d1]
 
/data/bld/10.4/bin/mysqld(+0xdc1be4)[0x564e85f92be4]
 
/data/bld/10.4/bin/mysqld(+0xdbb1ae)[0x564e85f8c1ae]
 
/data/bld/10.4/bin/mysqld(+0x106ac81)[0x564e8623bc81]
 
/data/bld/10.4/bin/mysqld(+0x104a6a7)[0x564e8621b6a7]
 
/data/bld/10.4/bin/mysqld(+0xed4a04)[0x564e860a5a04]
 
/data/bld/10.4/bin/mysqld(+0xed5d86)[0x564e860a6d86]
 
/data/bld/10.4/bin/mysqld(+0xd89c72)[0x564e85f5ac72]
 
/data/bld/10.4/bin/mysqld(+0xd760bd)[0x564e85f470bd]
 
/data/bld/10.4/bin/mysqld(_ZN7handler15ha_delete_tableEPKc+0x3c)[0x564e85c13412]
 
/data/bld/10.4/bin/mysqld(_Z15ha_delete_tableP3THDP10handlertonPKcPK25st_mysql_const_lex_stringS7_b+0x16f)[0x564e85c0d3f5]
 
/data/bld/10.4/bin/mysqld(_Z23mysql_rm_table_no_locksP3THDP10TABLE_LISTbbbbbb+0xe46)[0x564e859c45e6]
 
/data/bld/10.4/bin/mysqld(_Z14mysql_rm_tableP3THDP10TABLE_LISTbbb+0x38d)[0x564e859c35da]
 
/data/bld/10.4/bin/mysqld(_Z21mysql_execute_commandP3THD+0x5a74)[0x564e858fb5b5]
 
/data/bld/10.4/bin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_statebb+0x2af)[0x564e85904dde]
 
/data/bld/10.4/bin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcjbb+0xfda)[0x564e858f1f7b]
 
/data/bld/10.4/bin/mysqld(_Z10do_commandP3THD+0x69b)[0x564e858f099f]
 
/data/bld/10.4/bin/mysqld(_Z24do_handle_one_connectionP7CONNECT+0x1bd)[0x564e85a5cc5a]
 
/data/bld/10.4/bin/mysqld(handle_one_connection+0x30)[0x564e85a5c9de]
 
/data/bld/10.4/bin/mysqld(+0xd4afb4)[0x564e85f1bfb4]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x7494)[0x7f294c0e2494]
 
/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7f294a4c893f]
 
======= Memory map: ========
 
564e851d1000-564e86bab000 r-xp 00000000 08:11 37524375                   /data/bld/10.4/bin/mysqld
 
564e86dab000-564e86ed2000 r--p 019da000 08:11 37524375                   /data/bld/10.4/bin/mysqld
 
564e86ed2000-564e870d5000 rw-p 01b01000 08:11 37524375                   /data/bld/10.4/bin/mysqld
 
564e870d5000-564e8797a000 rw-p 00000000 00:00 0 
564e89042000-564e89644000 rw-p 00000000 00:00 0                          [heap]
 
7f28f0000000-7f28f01c3000 rw-p 00000000 00:00 0 
7f28f01c3000-7f28f4000000 ---p 00000000 00:00 0 
7f28f4000000-7f28f40dc000 rw-p 00000000 00:00 0 
7f28f40dc000-7f28f8000000 ---p 00000000 00:00 0 
7f28f8000000-7f28f8021000 rw-p 00000000 00:00 0 
7f28f8021000-7f28fc000000 ---p 00000000 00:00 0 
7f28fc000000-7f28fc027000 rw-p 00000000 00:00 0 
7f28fc027000-7f2900000000 ---p 00000000 00:00 0 
7f2900000000-7f2900021000 rw-p 00000000 00:00 0 
7f2900021000-7f2904000000 ---p 00000000 00:00 0 
7f2904000000-7f2904021000 rw-p 00000000 00:00 0 
7f2904021000-7f2908000000 ---p 00000000 00:00 0 
7f2908000000-7f2908021000 rw-p 00000000 00:00 0 
7f2908021000-7f290c000000 ---p 00000000 00:00 0 
7f290f7ff000-7f290f800000 ---p 00000000 00:00 0 
7f290f800000-7f2910000000 rw-p 00000000 00:00 0                          [stack:9540]
 
7f2910000000-7f2910021000 rw-p 00000000 00:00 0 
7f2910021000-7f2914000000 ---p 00000000 00:00 0 
7f2914000000-7f2914021000 rw-p 00000000 00:00 0 
7f2914021000-7f2918000000 ---p 00000000 00:00 0 
7f2918000000-7f2918021000 rw-p 00000000 00:00 0 
7f2918021000-7f291c000000 ---p 00000000 00:00 0 
7f291c000000-7f291c029000 rw-p 00000000 00:00 0 
7f291c029000-7f2920000000 ---p 00000000 00:00 0 
7f2920000000-7f2920021000 rw-p 00000000 00:00 0 
7f2920021000-7f2924000000 ---p 00000000 00:00 0 
7f29247f9000-7f29247fa000 ---p 00000000 00:00 0 
7f29247fa000-7f2924ffa000 rw-p 00000000 00:00 0                          [stack:9539]
 
7f2924ffa000-7f2924ffb000 ---p 00000000 00:00 0 
7f2924ffb000-7f29257fb000 rw-p 00000000 00:00 0                          [stack:9538]
 
7f29257fb000-7f29257fc000 ---p 00000000 00:00 0 
7f29257fc000-7f2925ffc000 rw-p 00000000 00:00 0                          [stack:9537]
 
7f2925ffc000-7f2925ffd000 ---p 00000000 00:00 0 
7f2925ffd000-7f29267fd000 rw-p 00000000 00:00 0                          [stack:9536]
 
7f29267fd000-7f29267fe000 ---p 00000000 00:00 0 
7f29267fe000-7f2926ffe000 rw-p 00000000 00:00 0                          [stack:9535]
 
7f2926ffe000-7f2926fff000 ---p 00000000 00:00 0 
7f2926fff000-7f29277ff000 rw-p 00000000 00:00 0                          [stack:9534]
 
7f29277ff000-7f2927800000 ---p 00000000 00:00 0 
7f2927800000-7f2928000000 rw-p 00000000 00:00 0                          [stack:9533]
 
7f2928000000-7f2928021000 rw-p 00000000 00:00 0 
7f2928021000-7f292c000000 ---p 00000000 00:00 0 
7f292c000000-7f292c021000 rw-p 00000000 00:00 0 
7f292c021000-7f2930000000 ---p 00000000 00:00 0 
7f2930000000-7f2930021000 rw-p 00000000 00:00 0 
7f2930021000-7f2934000000 ---p 00000000 00:00 0 
7f29347f9000-7f29347fa000 ---p 00000000 00:00 0 
7f29347fa000-7f2934ffa000 rw-p 00000000 00:00 0                          [stack:9531]
 
7f2934ffa000-7f2934ffb000 ---p 00000000 00:00 0 
7f2934ffb000-7f29357fb000 rw-p 00000000 00:00 0                          [stack:9530]
 
7f29357fb000-7f29357fc000 ---p 00000000 00:00 0 
7f29357fc000-7f2935ffc000 rw-p 00000000 00:00 0                          [stack:9529]
 
7f2935ffc000-7f2935ffd000 ---p 00000000 00:00 0 
7f2935ffd000-7f29367fd000 rw-p 00000000 00:00 0                          [stack:9528]
 
7f29367fd000-7f29367fe000 ---p 00000000 00:00 0 
7f29367fe000-7f2936ffe000 rw-p 00000000 00:00 0                          [stack:9527]
 
7f2936ffe000-7f2936fff000 ---p 00000000 00:00 0 
7f2936fff000-7f29377ff000 rw-p 00000000 00:00 0                          [stack:9532]
 
7f29377ff000-7f2937800000 ---p 00000000 00:00 0 
7f2937800000-7f2938000000 rw-p 00000000 00:00 0                          [stack:9525]
 
7f2938000000-7f2938021000 rw-p 00000000 00:00 0 
7f2938021000-7f293c000000 ---p 00000000 00:00 0 
7f293c3a5000-7f293c5aa000 rw-p 00000000 00:00 0 
7f293c5aa000-7f293c5ab000 ---p 00000000 00:00 0 
7f293c5ab000-7f293cdab000 rw-p 00000000 00:00 0                          [stack:9524]
 
7f293cdab000-7f293cdac000 ---p 00000000 00:00 0 
7f293cdac000-7f293d5ac000 rw-p 00000000 00:00 0                          [stack:9523]
 
7f293d5ac000-7f293d5ad000 ---p 00000000 00:00 0 
7f293d5ad000-7f293ddad000 rw-p 00000000 00:00 0                          [stack:9522]
 
7f293ddad000-7f293ddae000 ---p 00000000 00:00 0 
7f293ddae000-7f293e5ae000 rw-p 00000000 00:00 0                          [stack:9521]
 
7f293e5ae000-7f293e5af000 ---p 00000000 00:00 0 
7f293e5af000-7f293edaf000 rw-p 00000000 00:00 0                          [stack:9520]
 
7f293edaf000-7f293edb0000 ---p 00000000 00:00 0 
7f293edb0000-7f293f5b0000 rw-p 00000000 00:00 0                          [stack:9519]
 
7f293f688000-7f293f689000 ---p 00000000 00:00 0 
7f293f689000-7f293f6d2000 rw-p 00000000 00:00 0                          [stack:9548]
 
7f293f6d2000-7f293f6d3000 ---p 00000000 00:00 0 
7f293f6d3000-7f293f71c000 rw-p 00000000 00:00 0                          [stack:9545]
 
7f293f71c000-7f293f71d000 ---p 00000000 00:00 0 
7f293f71d000-7f293f766000 rw-p 00000000 00:00 0                          [stack:9542]
 
7f293f766000-7f293f767000 ---p 00000000 00:00 0 
7f293f767000-7f2940000000 rw-p 00000000 00:00 0                          [stack:9541]
 
7f2940000000-7f2940021000 rw-p 00000000 00:00 0 
7f2940021000-7f2944000000 ---p 00000000 00:00 0 
7f294401a000-7f294461b000 rw-p 00000000 00:00 0 
7f294461b000-7f294461c000 ---p 00000000 00:00 0 
7f294461c000-7f2945985000 rw-p 00000000 00:00 0                          [stack:9518]
 
7f2945985000-7f2945986000 ---p 00000000 00:00 0 
7f2945986000-7f294a3e0000 rw-p 00000000 00:00 0                          [stack:9517]
 
7f294a3e0000-7f294a575000 r-xp 00000000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
 
7f294a575000-7f294a774000 ---p 00195000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
 
7f294a774000-7f294a778000 r--p 00194000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
 
7f294a778000-7f294a77a000 rw-p 00198000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
 
7f294a77a000-7f294a77e000 rw-p 00000000 00:00 0 
7f294a77e000-7f294a794000 r-xp 00000000 08:05 3145732                    /lib/x86_64-linux-gnu/libgcc_s.so.1
 
7f294a794000-7f294a993000 ---p 00016000 08:05 3145732                    /lib/x86_64-linux-gnu/libgcc_s.so.1
 
7f294a993000-7f294a994000 rw-p 00015000 08:05 3145732                    /lib/x86_64-linux-gnu/libgcc_s.so.1
 
7f294a994000-7f294aa97000 r-xp 00000000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
 
7f294aa97000-7f294ac96000 ---p 00103000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
 
7f294ac96000-7f294ac97000 r--p 00102000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
 
7f294ac97000-7f294ac98000 rw-p 00103000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
 
7f294ac98000-7f294ae0a000 r-xp 00000000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
 
7f294ae0a000-7f294b00a000 ---p 00172000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
 
7f294b00a000-7f294b014000 r--p 00172000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
 
7f294b014000-7f294b016000 rw-p 0017c000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
 
7f294b016000-7f294b01a000 rw-p 00000000 00:00 0 
7f294b01a000-7f294b01d000 r-xp 00000000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
 
7f294b01d000-7f294b21c000 ---p 00003000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
 
7f294b21c000-7f294b21d000 r--p 00002000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
 
7f294b21d000-7f294b21e000 rw-p 00003000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
 
7f294b21e000-7f294b3eb000 r-xp 00000000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
 
7f294b3eb000-7f294b5ea000 ---p 001cd000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
 
7f294b5ea000-7f294b607000 r--p 001cc000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
 
7f294b607000-7f294b617000 rw-p 001e9000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
 
7f294b617000-7f294b61a000 rw-p 00000000 00:00 0 
7f294b61a000-7f294b671000 r-xp 00000000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
 
7f294b671000-7f294b871000 ---p 00057000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
 
7f294b871000-7f294b874000 r--p 00057000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
 
7f294b874000-7f294b87a000 rw-p 0005a000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
 
7f294b87a000-7f294b87b000 rw-p 00000000 00:00 0 
7f294b87b000-7f294b883000 r-xp 00000000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
 
7f294b883000-7f294ba83000 ---p 00008000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
 
7f294ba83000-7f294ba84000 r--p 00008000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
 
7f294ba84000-7f294ba85000 rw-p 00009000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
 
7f294ba85000-7f294bab3000 rw-p 00000000 00:00 0 
7f294bab3000-7f294bacd000 r-xp 00000000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
 
7f294bacd000-7f294bccc000 ---p 0001a000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
 
7f294bccc000-7f294bccd000 r--p 00019000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
 
7f294bccd000-7f294bcce000 rw-p 0001a000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
 
7f294bcce000-7f294bcd8000 r-xp 00000000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
 
7f294bcd8000-7f294bed7000 ---p 0000a000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
 
7f294bed7000-7f294bed8000 r--p 00009000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
 
7f294bed8000-7f294bed9000 rw-p 0000a000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
 
7f294bed9000-7f294beda000 r-xp 00000000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
 
7f294beda000-7f294c0d9000 ---p 00001000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
 
7f294c0d9000-7f294c0da000 r--p 00000000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
 
7f294c0da000-7f294c0db000 rw-p 00001000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
 
7f294c0db000-7f294c0f3000 r-xp 00000000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
 
7f294c0f3000-7f294c2f2000 ---p 00018000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
 
7f294c2f2000-7f294c2f3000 r--p 00017000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
 
7f294c2f3000-7f294c2f4000 rw-p 00018000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
 
7f294c2f4000-7f294c2f8000 rw-p 00000000 00:00 0 
7f294c2f8000-7f294c31b000 r-xp 00000000 08:05 3145795                    /lib/x86_64-linux-gnu/ld-2.24.so
 
7f294c31f000-7f294c325000 rw-s 00000000 00:11 78202295                   /dev/shm/var_auto_3qjO/mysqld.1/data/tc.log
 
7f294c325000-7f294c32a000 rw-s 00000000 00:0a 78202288                   /[aio] (deleted)
 
7f294c32a000-7f294c32f000 rw-s 00000000 00:0a 78202287                   /[aio] (deleted)
 
7f294c32f000-7f294c501000 rw-p 00000000 00:00 0 
7f294c501000-7f294c503000 rw-s 00000000 00:0a 78202289                   /[aio] (deleted)
 
7f294c503000-7f294c508000 rw-s 00000000 00:0a 78202286                   /[aio] (deleted)
 
7f294c508000-7f294c50d000 rw-s 00000000 00:0a 78202285                   /[aio] (deleted)
 
7f294c50d000-7f294c512000 rw-s 00000000 00:0a 78202284                   /[aio] (deleted)
 
7f294c512000-7f294c517000 rw-s 00000000 00:0a 78202283                   /[aio] (deleted)
 
7f294c517000-7f294c518000 rw-s 00000000 00:0a 78202281                   /[aio] (deleted)
 
7f294c518000-7f294c51b000 rw-p 00000000 00:00 0 
7f294c51b000-7f294c51c000 r--p 00023000 08:05 3145795                    /lib/x86_64-linux-gnu/ld-2.24.so
 
7f294c51c000-7f294c51d000 rw-p 00024000 08:05 3145795                    /lib/x86_64-linux-gnu/ld-2.24.so
 
7f294c51d000-7f294c51e000 rw-p 00000000 00:00 0 
7fff38e1a000-7fff38e3d000 rw-p 00000000 00:00 0                          [stack]
 
7fff38f0f000-7fff38f11000 r-xp 00000000 00:00 0                          [vdso]
 
7fff38f11000-7fff38f13000 r--p 00000000 00:00 0                          [vvar]
 
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

A variation of stack trace from a variation of the test case:

#8  0x00007f3ab488953c in free () from /lib/x86_64-linux-gnu/libc.so.6
 
#9  0x00005629e634d6de in ut_allocator<std::_List_node<dict_v_idx_t>, true>::deallocate (this=0x7f3a5c0714e0, ptr=0x7f3a5c052200) at /home/travis/src/storage/innobase/include/ut0new.h:442
 
#10 0x00005629e634c74c in std::__cxx11::_List_base<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::_M_put_node (this=0x7f3a5c0714e0, __p=0x7f3a5c052200) at /usr/include/c++/5/bits/stl_list.h:396
 
#11 0x00005629e634bed1 in std::__cxx11::_List_base<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::_M_clear (this=0x7f3a5c0714e0) at /usr/include/c++/5/bits/list.tcc:79
 
#12 0x00005629e634b446 in std::__cxx11::_List_base<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::~_List_base (this=0x7f3a5c0714e0, __in_chrg=<optimized out>) at /usr/include/c++/5/bits/stl_list.h:446
 
#13 0x00005629e6344a08 in std::__cxx11::list<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::~list (this=0x7f3a5c0714e0, __in_chrg=<optimized out>) at /usr/include/c++/5/bits/stl_list.h:507
 
#14 0x00005629e6345efc in ha_innobase_inplace_ctx::~ha_innobase_inplace_ctx (this=0x7f3a58022b50, __in_chrg=<optimized out>) at /home/travis/src/storage/innobase/handler/handler0alter.cc:1037
 
#15 0x00005629e6345f6e in ha_innobase_inplace_ctx::~ha_innobase_inplace_ctx (this=0x7f3a58022b50, __in_chrg=<optimized out>) at /home/travis/src/storage/innobase/handler/handler0alter.cc:1042
 
#16 0x00005629e5ea3c90 in Alter_inplace_info::~Alter_inplace_info (this=0x7f3a9ce4e8e0, __in_chrg=<optimized out>) at /home/travis/src/sql/handler.h:2398
 
#17 0x00005629e5e9f4a2 in mysql_alter_table (thd=0x7f3a5800c700, new_db=0x7f3a580e80d8, new_name=0x7f3a580e84a8, create_info=0x7f3a9ce501f0, table_list=0x7f3a580e93d8, alter_info=0x7f3a9ce50130, order_num=0, order=0x0, ignore=false) at /home/travis/src/sql/sql_table.cc:9701
 
#18 0x00005629e5f29a96 in Sql_cmd_alter_table::execute (this=0x7f3a580ea318, thd=0x7f3a5800c700) at /home/travis/src/sql/sql_alter.cc:497
 
#19 0x00005629e5dc705c in mysql_execute_command (thd=0x7f3a5800c700) at /home/travis/src/sql/sql_parse.cc:6314
 
#20 0x00005629e5dea2fd in Prepared_statement::execute (this=0x7f3a590b0b20, expanded_query=0x7f3a9ce513d0, open_cursor=false) at /home/travis/src/sql/sql_prepare.cc:4790
 
#21 0x00005629e5de86ca in Prepared_statement::execute_loop (this=0x7f3a590b0b20, expanded_query=0x7f3a9ce513d0, open_cursor=false, packet=0x7f3a5802da2a "", packet_end=0x7f3a5802da2a "") at /home/travis/src/sql/sql_prepare.cc:4218
 
#22 0x00005629e5de5f57 in mysql_stmt_execute_common (thd=0x7f3a5800c700, stmt_id=1508, packet=0x7f3a5802da2a "", packet_end=0x7f3a5802da2a "", cursor_flags=0, bulk_op=false, read_types=false) at /home/travis/src/sql/sql_prepare.cc:3218
 
#23 0x00005629e5de5af0 in mysqld_stmt_execute (thd=0x7f3a5800c700, packet_arg=0x7f3a5802da21 "\344\005", packet_length=9) at /home/travis/src/sql/sql_prepare.cc:3116
 
#24 0x00005629e5db8d0b in dispatch_command (command=COM_STMT_EXECUTE, thd=0x7f3a5800c700, packet=0x7f3a5802da21 "\344\005", packet_length=9, is_com_multi=false, is_next_command=false) at /home/travis/src/sql/sql_parse.cc:1794
 
#25 0x00005629e5db7ad6 in do_command (thd=0x7f3a5800c700) at /home/travis/src/sql/sql_parse.cc:1397
 
#26 0x00005629e5f23ad6 in do_handle_one_connection (connect=0x5629e957ddd0) at /home/travis/src/sql/sql_connect.cc:1402
 
#27 0x00005629e5f23827 in handle_one_connection (arg=0x5629e957ddd0) at /home/travis/src/sql/sql_connect.cc:1308
 
#28 0x00007f3ab54776ba in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
 
#29 0x00007f3ab490c41d in clone () from /lib/x86_64-linux-gnu/libc.so.6



 Comments   
Comment by Marko Mäkelä [ 2020-12-17 ]

Could the bug be that the NOWAIT clause causes InnoDB native ALTER TABLE to execute without proper MDL_EXCLUSIVE protection? For the entire duration of instant ALTER TABLE, InnoDB assumes that MDL_EXCLUSIVE is being held.

We do not have any "is holding MDL" assertions in InnoDB code; in fact, I do not even know how to write such an assertion.

Comment by Vladislav Vaintroub [ 2021-05-04 ]

Backup locks go to Monty.

Generated at Thu Feb 08 08:42:58 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.