[MDEV-18870] Server crashes in row_upd or in row_upd_del_mark_clust_rec upon DELETE HISTORY from table with system and application periods Created: 2019-03-09  Updated: 2019-07-23  Resolved: 2019-07-23

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - InnoDB, Versioned Tables
Affects Version/s: 10.4
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Aleksey Midenkov
Resolution: Duplicate Votes: 0
Labels: None

Issue Links:
Duplicate
duplicates MDEV-19814 Assertion `update->n_fields < ulint(t... Closed
Relates
relates to MDEV-19486 Server crashes in row_upd or row_upd_... Closed
relates to MDEV-19814 Assertion `update->n_fields < ulint(t... Closed

 Description   

Note: It's quite possible that the problem has nothing to do with versioning, but the test case demands it, I don't have a different one so far.

--source include/have_innodb.inc
 
CREATE OR REPLACE TABLE t1 (
  s DATE,
  e DATE,
  PERIOD FOR app(s,e),
  row_start BIGINT UNSIGNED AS ROW START,
  row_end BIGINT UNSIGNED AS ROW END,
  PERIOD FOR SYSTEM_TIME(row_start,row_end)
) ENGINE=InnoDB WITH SYSTEM VERSIONING;
 
INSERT INTO t1 (s,e) VALUES 
  ('2020-08-03','2025-01-05'),('2019-03-05','2019-03-13'),
  ('2020-08-03','2025-01-05'),('2019-03-05','2019-03-13'),
  ('2019-11-30','2021-10-17');
DELETE FROM t1 FOR PORTION OF app FROM '2019-02-10' TO '2021-09-29';
DELETE FROM t1;
DELETE HISTORY FROM t1;
 
# Cleanup
DROP TABLE t1;

10.4 5a796f1f debug

#3  <signal handler called>
#4  0x000056233cfeed94 in row_upd (node=0x7f14001518a8, thr=0x7f1400151c10) at /data/src/10.4/storage/innobase/row/row0upd.cc:3266
#5  0x000056233cfef442 in row_upd_step (thr=0x7f1400151c10) at /data/src/10.4/storage/innobase/row/row0upd.cc:3437
#6  0x000056233cf9d2f3 in row_update_for_mysql (prebuilt=0x7f1400150d28) at /data/src/10.4/storage/innobase/row/row0mysql.cc:1890
#7  0x000056233ce38c96 in ha_innobase::delete_row (this=0x7f140000d7e8, record=0x7f14001a2190 "\377=\313\017Q\313\017'") at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9025
#8  0x000056233cb03784 in handler::ha_delete_row (this=0x7f140000d7e8, buf=0x7f14001a2190 "\377=\313\017Q\313\017'") at /data/src/10.4/sql/handler.cc:6810
#9  0x000056233ccadf79 in TABLE::delete_row (this=0x7f140000c980) at /data/src/10.4/sql/sql_delete.cc:297
#10 0x000056233ccaaedc in mysql_delete (thd=0x7f1400000b00, table_list=0x7f14000155a0, conds=0x0, order_list=0x7f1400005498, limit=18446744073709551608, options=0, result=0x0) at /data/src/10.4/sql/sql_delete.cc:843
#11 0x000056233c7b0c11 in mysql_execute_command (thd=0x7f1400000b00) at /data/src/10.4/sql/sql_parse.cc:5032
#12 0x000056233c7bbb63 in mysql_parse (thd=0x7f1400000b00, rawbuf=0x7f14000154c8 "DELETE HISTORY FROM t1", length=22, parser_state=0x7f14500d9180, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8204
#13 0x000056233c7a71a5 in dispatch_command (command=COM_QUERY, thd=0x7f1400000b00, packet=0x7f1400139ff1 "DELETE HISTORY FROM t1", packet_length=22, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1829
#14 0x000056233c7a598b in do_command (thd=0x7f1400000b00) at /data/src/10.4/sql/sql_parse.cc:1358
#15 0x000056233c91f703 in do_handle_one_connection (connect=0x5623409ee160) at /data/src/10.4/sql/sql_connect.cc:1399
#16 0x000056233c91f474 in handle_one_connection (arg=0x5623409ee160) at /data/src/10.4/sql/sql_connect.cc:1302
#17 0x000056233ce15031 in pfs_spawn_thread (arg=0x562340a33fd0) at /data/src/10.4/storage/perfschema/pfs.cc:1862
#18 0x00007f1458a87494 in start_thread (arg=0x7f14500da700) at pthread_create.c:333
#19 0x00007f1456e6d93f in clone () from /lib/x86_64-linux-gnu/libc.so.6

ASAN

==1049==ERROR: AddressSanitizer: SEGV on unknown address 0x01013fff8aea (pc 0x5578e153e48a sp 0x7f69e3426700 bp 0x7f69e34267c0 T27)
    #0 0x5578e153e489 in row_upd /data/src/10.4/storage/innobase/row/row0upd.cc:3266
    #1 0x5578e153f622 in row_upd_step(que_thr_t*) /data/src/10.4/storage/innobase/row/row0upd.cc:3437
    #2 0x5578e14a5f15 in row_update_for_mysql(row_prebuilt_t*) /data/src/10.4/storage/innobase/row/row0mysql.cc:1890
    #3 0x5578e11f6baf in ha_innobase::delete_row(unsigned char const*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9025
    #4 0x5578e0a22839 in handler::ha_delete_row(unsigned char const*) /data/src/10.4/sql/handler.cc:6810
    #5 0x5578e0e1c601 in TABLE::delete_row() /data/src/10.4/sql/sql_delete.cc:297
    #6 0x5578e0e14e7c in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:843
    #7 0x5578e0261f3a in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:5032
    #8 0x5578e0276f8a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8204
    #9 0x5578e024ef07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
    #10 0x5578e024bd58 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
    #11 0x5578e05df921 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
    #12 0x5578e05df31a in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
    #13 0x5578e11a6888 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
    #14 0x7f69eee00493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
    #15 0x7f69ed1e693e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /data/src/10.4/storage/innobase/row/row0upd.cc:3266 row_upd
Thread T27 created by T0 here:
    #0 0x7f69ef039bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
    #1 0x5578e11a6e50 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
    #2 0x5578dff97476 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
    #3 0x5578dffac6ed in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6141
    #4 0x5578dffacdf2 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6211
    #5 0x5578dffad182 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6309
    #6 0x5578dffaddce in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6467
    #7 0x5578dffabf28 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5799
    #8 0x5578dff952ff in main /data/src/10.4/sql/main.cc:25
    #9 0x7f69ed11e2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
==1049==ABORTING

Non-debug also crashes:

10.4 5a796f1f

#2  <signal handler called>
#3  row_upd_del_mark_clust_rec (mtr=0x7f07875cab80, foreign=<optimized out>, referenced=0, thr=0x7f07340cc730, offsets=0x7f07875ca860, index=0x7f07340843b0, node=0x7f07340cc3d8) at /data/src/10.4/storage/innobase/row/row0upd.cc:2981
#4  row_upd_clust_step (node=node@entry=0x7f07340cc3d8, thr=thr@entry=0x7f07340cc730) at /data/src/10.4/storage/innobase/row/row0upd.cc:3171
#5  0x00005612ccca464f in row_upd (thr=0x7f07340cc730, node=0x7f07340cc3d8) at /data/src/10.4/storage/innobase/row/row0upd.cc:3293
#6  row_upd_step (thr=thr@entry=0x7f07340cc730) at /data/src/10.4/storage/innobase/row/row0upd.cc:3437
#7  0x00005612ccc7e09c in row_update_for_mysql (prebuilt=0x7f07340cb890) at /data/src/10.4/storage/innobase/row/row0mysql.cc:1890
#8  0x00005612ccbc8b81 in ha_innobase::delete_row (this=0x7f0734083bf0, record=0x7f0734083808 "\377=\313\017Q\313\017'") at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9025
#9  0x00005612cc9b0806 in handler::ha_delete_row (this=0x7f0734083bf0, buf=0x7f0734083808 "\377=\313\017Q\313\017'") at /data/src/10.4/sql/handler.cc:6810
#10 0x00005612ccaca857 in mysql_delete (thd=thd@entry=0x7f07340009a8, table_list=0x7f0734011f98, conds=0x0, order_list=order_list@entry=0x7f0734005180, limit=18446744073709551608, options=<optimized out>, result=0x0) at /data/src/10.4/sql/sql_delete.cc:843
#11 0x00005612cc7a5639 in mysql_execute_command (thd=thd@entry=0x7f07340009a8) at /data/src/10.4/sql/sql_parse.cc:5032
#12 0x00005612cc7a9cd1 in mysql_parse (thd=thd@entry=0x7f07340009a8, rawbuf=<optimized out>, length=22, parser_state=parser_state@entry=0x7f07875ce1d0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/src/10.4/sql/sql_parse.cc:8204
#13 0x00005612cc7ac5a2 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f07340009a8, packet=packet@entry=0x7f0734009b59 "DELETE HISTORY FROM t1", packet_length=packet_length@entry=22, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/src/10.4/sql/sql_parse.cc:1829
#14 0x00005612cc7ad9f7 in do_command (thd=0x7f07340009a8) at /data/src/10.4/sql/sql_parse.cc:1358
#15 0x00005612cc887f9c in do_handle_one_connection (connect=connect@entry=0x5612d01e9ca8) at /data/src/10.4/sql/sql_connect.cc:1399
#16 0x00005612cc888104 in handle_one_connection (arg=arg@entry=0x5612d01e9ca8) at /data/src/10.4/sql/sql_connect.cc:1302
#17 0x00005612ccba47b4 in pfs_spawn_thread (arg=0x5612d021e0a8) at /data/src/10.4/storage/perfschema/pfs.cc:1862
#18 0x00007f0793f84494 in start_thread (arg=0x7f07875cf700) at pthread_create.c:333
#19 0x00007f079236a93f in clone () from /lib/x86_64-linux-gnu/libc.so.6


Generated at Thu Feb 08 08:47:21 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.