[MDEV-19601] MDEV-13708 is still unfixed Created: 2019-05-26  Updated: 2023-04-14

Status: Stalled
Project: MariaDB Server
Component/s: Data Manipulation - Delete, Dynamic Columns
Affects Version/s: 10.3.9
Fix Version/s: 10.4

Type: Bug Priority: Major
Reporter: Piotr Nizynski Assignee: Nikita Malyavin
Resolution: Unresolved Votes: 0
Labels: None
Environment:

mysql Ver 15.1 Distrib 10.3.9-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2


Issue Links:
Relates
relates to MDEV-21153 Galera: Replica nodes crash with sign... Closed
relates to MDEV-29181 Potential corruption on Foreign key u... In Review

 Description   

It seems that MDEV-13708 is still unfixed.
I'm using 10.3.9-MariaDB from the official .deb repository and it appears that I've got exactly the same problem.
I'm using Galera cluster, if that matters.
Please let me know if the problem has been fixed after 10.3.9 release.



 Comments   
Comment by Elena Stepanova [ 2019-05-27 ]

None of two test cases from MDEV-13708 fails either on the current 10.3 tree or on 10.3.7, so what you're getting is not exactly the same.
However, there are several known open with crashes around innobase_get_computed_value, e.g. MDEV-17005,MDEV-18546, and probably some fixed ones since 10.3.9 is 6 releases behind the current one.
Please try a recent release, and if the problem is reproducible, provide the stack trace and steps to reproduce.
Thanks.

Comment by Piotr Nizynski [ 2019-05-27 ]

MDEV-18546 seems to be another case, because I've tried in two configurations (foreign key CASCADE ON UPDATE, DELETE is common in both cases, as well as the existence of a Virtual Generated Column in table B, i.e.: the one which is secondary and less significant):

a) the row which is being deleted is in table A, whereas table B references a key in table A as a foreign key and contains amongst its rows the key value from A which is being deleted

– in this case, crash happens. In my setup A contains a Virtual Generated Column.

b) the row which is being deleted is in table A, table B references a key in table A as a foreign key, but in this setup the row which referenced the key value from A has already been deleted from B manually before I tried to delete its matching row in A.

– in this case, no crash happens.
The problem occurs repeatedly on my system.
Soon I'll have a look at newer versions to bring you extended information, as well as a backtrace. At the moment I've got just a non-readable backtrace, which looks like this:

Core was generated by `/usr/sbin/mysqld --wsrep_start_position=2d193bc0-c499-11e8-a054-06ce2f46a76c:38'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000564286a9ff5e in ?? ()
[Current thread is 1 (Thread 0x7fb5a0cb4700 (LWP 5194))]
(gdb) bt
#0  0x0000564286a9ff5e in ?? ()
#1  0x00005642869c7636 in ?? ()
#2  0x0000564286ab74ec in ?? ()
#3  0x0000564286ab7fb6 in ?? ()
#4  0x0000564286ab8fbf in ?? ()
#5  0x0000564286a85a69 in ?? ()
#6  0x0000564286a6ed4e in ?? ()
#7  0x0000564286ab2243 in ?? ()
#8  0x0000564286ab8ad6 in ?? ()
#9  0x0000564286ab8fbf in ?? ()
#10 0x0000564286a85554 in ?? ()
#11 0x00005642869c2543 in ?? ()
#12 0x00005642868449af in handler::ha_delete_row(unsigned char const*) ()
#13 0x0000564286967328 in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order> * , unsigned long long, unsigned long long, select_result*) ()
#14 0x0000564286665ff3 in mysql_execute_command(THD*) ()
#15 0x00005642866664ea in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) ()
#16 0x0000564286666db9 in ?? ()
#17 0x00005642866682ec in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) ()
#18 0x0000564286669ba1 in do_command(THD*) ()
#19 0x00005642867399fa in do_handle_one_connection(CONNECT*) ()
#20 0x0000564286739b7d in handle_one_connection ()
#21 0x00007fb5b8aee4a4 in start_thread (arg=0x7fb5a0cb4700) at pthread_create.c:456
#22 0x00007fb5b7042d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97
(gdb) disass 0x0000564286a9ff5e
No function contains specified address.
(gdb) x/i 0x0000564286a9ff5e
=> 0x564286a9ff5e:	mov    %sil,-0x1(%rdx)
(gdb) 
   0x564286a9ff62:	je     0x564286a9ff7a
(gdb) 
   0x564286a9ff64:	nopl   0x0(%rax)
(gdb) 
   0x564286a9ff68:	add    $0x1,%rbx
(gdb) 
   0x564286a9ff6c:	movzbl (%rbx),%edx
(gdb) 
   0x564286a9ff6f:	sub    $0x1,%rax
(gdb) 
   0x564286a9ff73:	cmp    %rax,%r8
(gdb) 
   0x564286a9ff76:	mov    %dl,(%rax)
(gdb) 
   0x564286a9ff78:	jne    0x564286a9ff68
(gdb) 
   0x564286a9ff7a:	cmpq   $0x0,0x80(%r12)
(gdb) 
   0x564286a9ff83:	jne    0x564286a9ffab
(gdb) 
   0x564286a9ff85:	addb   $0x80,-0x1(%r8,%rcx,1)
(gdb) 
   0x564286a9ff8b:	jmp    0x564286a9ffab
(gdb) 
   0x564286a9ff8d:	nopl   (%rax)
(gdb) 
   0x564286a9ff90:	mov    %rcx,%rdx
(gdb) 
   0x564286a9ff93:	mov    %rbx,%rsi
(gdb) 
   0x564286a9ff96:	mov    %rcx,-0x28(%rbp)
(gdb) 
   0x564286a9ff9a:	callq  0x564286577608
(gdb) 
   0x564286a9ff9f:	cmpq   $0x1,0x70(%r12)
(gdb) 
   0x564286a9ffa5:	mov    -0x28(%rbp),%rcx
(gdb) 
   0x564286a9ffa9:	je     0x564286aa0010
(gdb) 
   0x564286a9ffab:	add    $0x18,%rsp
(gdb) 
   0x564286a9ffaf:	pop    %rbx
(gdb) 
   0x564286a9ffb0:	pop    %r12
(gdb) 
   0x564286a9ffb2:	pop    %r13
(gdb) 
   0x564286a9ffb4:	pop    %rbp
(gdb) 
   0x564286a9ffb5:	retq   
(gdb) frame 11
#11 0x00005642869c2543 in ?? ()
(gdb) x/i 0x00005642869c2543
=> 0x5642869c2543:	mov    0x6d0(%rbx),%r14
(gdb) 
   0x5642869c254a:	mov    %eax,%r12d
(gdb) 
   0x5642869c254d:	mov    0x18(%r14),%rax
(gdb) 
   0x5642869c2551:	mov    0x1b0(%rax),%rdi
(gdb) 
   0x5642869c2558:	callq  0x5642867a9e80 <wsrep_on>
(gdb) 
   0x5642869c255d:	test   %eax,%eax
(gdb) 
   0x5642869c255f:	jne    0x5642869c2630
(gdb) 
   0x5642869c2565:	mov    0x18(%r14),%rdi
(gdb) 
   0x5642869c2569:	cmpb   $0x0,0x184(%rdi)
(gdb) 
   0x5642869c2570:	je     0x5642869c2580
(gdb) 
   0x5642869c2572:	mov    0x188(%rdi),%eax
(gdb) 
   0x5642869c2578:	test   %eax,%eax
(gdb) 
   0x5642869c257a:	je     0x5642869c2620
(gdb) 
   0x5642869c2580:	mov    0xd5e779(%rip),%rax        # 0x564287720d00
(gdb) 
   0x5642869c2587:	add    $0x1,%rax
(gdb) 
   0x5642869c258b:	test   $0x1f,%al
(gdb) 
   0x5642869c258d:	mov    %rax,0xd5e76c(%rip)        # 0x564287720d00
(gdb) 
   0x5642869c2594:	jne    0x5642869c25a2
(gdb) 
   0x5642869c2596:	lea    0xd9d845(%rip),%rax        # 0x56428775fde2
(gdb) 
   0x5642869c259d:	cmpb   $0x0,(%rax)
(gdb) 
   0x5642869c25a0:	je     0x5642869c2610
(gdb) 
   0x5642869c25a2:	cmp    $0xa,%r12d
(gdb) 
   0x5642869c25a6:	je     0x5642869c26e0
(gdb) frame 10
#10 0x0000564286a85554 in ?? ()
(gdb) x/i 0x0000564286a85554
=> 0x564286a85554:	mov    0x1e0(%r12),%eax
(gdb) 
   0x564286a8555c:	cmp    $0xa,%eax
(gdb) 
   0x564286a8555f:	mov    %eax,-0x44(%rbp)
(gdb) 
   0x564286a85562:	jne    0x564286a854f8
(gdb) 
   0x564286a85564:	mov    %r12,%rsi
(gdb) 
   0x564286a85567:	mov    %r15,%rdi
(gdb) 
   0x564286a8556a:	callq  0x564286a52490
(gdb) 
   0x564286a8556f:	testb  $0x1,0x32(%r14)
(gdb) 
   0x564286a85574:	je     0x564286a85595
(gdb) 
   0x564286a85576:	cmpq   $0xffffffffffffffff,0x290(%r12)
(gdb) 
   0x564286a8557f:	je     0x564286a85595
(gdb) 
   0x564286a85581:	mov    %rbx,%rdi
(gdb) 
   0x564286a85584:	callq  0x564286a822c0
(gdb) 
   0x564286a85589:	cmp    $0xa,%eax
(gdb) 
   0x564286a8558c:	mov    %eax,-0x44(%rbp)
(gdb) 
   0x564286a8558f:	jne    0x564286a856ac
(gdb) 
   0x564286a85595:	cmpl   $0x1,-0x64(%rbp)
(gdb) 
   0x564286a85599:	je     0x564286a857b1
(gdb) 
   0x564286a8559f:	cmpb   $0x0,0x6b(%r14)
(gdb) 
   0x564286a855a4:	mov    0x38(%r12),%rax
(gdb) 
   0x564286a855a9:	je     0x564286a85800
(gdb) 
   0x564286a855af:	and    $0x3f,%eax
(gdb) 
   0x564286a855b2:	lea    0x8(,%rax,8),%rdx
(gdb) frame 9
#9  0x0000564286ab8fbf in ?? ()
(gdb) x/i 0x0000564286ab8fbf
=> 0x564286ab8fbf:	cmp    $0xa,%eax
(gdb) 
   0x564286ab8fc2:	je     0x564286ab8d69
(gdb) 
   0x564286ab8fc8:	mov    %eax,0x1e0(%r13)
(gdb) 
   0x564286ab8fcf:	add    $0x28,%rsp
(gdb) 
   0x564286ab8fd3:	xor    %eax,%eax
(gdb) 
   0x564286ab8fd5:	pop    %rbx
(gdb) 
   0x564286ab8fd6:	pop    %r12
(gdb) 
   0x564286ab8fd8:	pop    %r13
(gdb) 
   0x564286ab8fda:	pop    %r14
(gdb) 
   0x564286ab8fdc:	pop    %r15
(gdb) 
   0x564286ab8fde:	pop    %rbp
(gdb) 
   0x564286ab8fdf:	retq   
(gdb) frame 8
#8  0x0000564286ab8ad6 in ?? ()
(gdb) x/i 0x0000564286ab8ad6
=> 0x564286ab8ad6:	mov    %eax,%r13d
(gdb) 
   0x564286ab8ad9:	pop    %rax
(gdb) 
   0x564286ab8ada:	pop    %rdx
(gdb) 
   0x564286ab8adb:	jmpq   0x564286ab8017
(gdb) 
   0x564286ab8ae0:	lea    0xc638be(%rip),%rax        # 0x56428771c3a5 <wsrep_debug>
(gdb) 
   0x564286ab8ae7:	cmpb   $0x0,(%rax)
(gdb) 
   0x564286ab8aea:	je     0x564286ab81e7
(gdb) 
   0x564286ab8af0:	mov    0x18(%rbx),%rax
(gdb) 
   0x564286ab8af4:	lea    -0x680(%rbp),%rdi
(gdb) 
   0x564286ab8afb:	lea    -0x680(%rbp),%r12
(gdb) 
   0x564286ab8b02:	mov    $0x2f,%ecx
(gdb) 
   0x564286ab8b07:	lea    0x10(%rbx),%r14
(gdb) 
   0x564286ab8b0b:	add    $0x10,%rax
(gdb) 
   0x564286ab8b0f:	mov    %rax,-0xe70(%rbp)
(gdb) 
   0x564286ab8b16:	xor    %eax,%eax
(gdb) 
   0x564286ab8b18:	rep stos %rax,%es:  (%rdi)
(gdb) 
   0x564286ab8b1b:	mov    %r12,%rdi
(gdb) 
   0x564286ab8b1e:	callq  0x56428657f044
(gdb) 
   0x564286ab8b23:	lea    0x486866(%rip),%rsi        # 0x564286f3f390
(gdb) 
   0x564286ab8b2a:	mov    %r12,%rdi
(gdb) 
   0x564286ab8b2d:	callq  0x564286577c68
(gdb) 
   0x564286ab8b32:	lea    0x485cfd(%rip),%rsi        # 0x564286f3e836
(gdb) 
   0x564286ab8b39:	mov    %r12,%rdi
(gdb) 
   0x564286ab8b3c:	callq  0x564286577c68
(gdb) 
   0x564286ab8b41:	mov    %r14,%rsi
(gdb) frame 7
#7  0x0000564286ab2243 in ?? ()
(gdb) x/i 0x0000564286ab2243
=> 0x564286ab2243:	mov    %eax,%r14d
(gdb) 
   0x564286ab2246:	lock subq $0x1,(%r15)
(gdb) 
   0x564286ab224b:	cmp    $0xa,%r14d
(gdb) 
   0x564286ab224f:	je     0x564286ab21d8
(gdb) 
   0x564286ab2251:	cmpq   $0x0,-0x78(%rbp)
(gdb) 
   0x564286ab2256:	mov    -0x70(%rbp),%rbx
(gdb) 
   0x564286ab225a:	jne    0x564286ab22c1
(gdb) 
   0x564286ab225c:	nopl   0x0(%rax)
(gdb) 
   0x564286ab2260:	cmpq   $0x0,0x60(%rbx)
(gdb) 
   0x564286ab2265:	mov    0x18(%rbx),%rsi
(gdb) 
   0x564286ab2269:	je     0x564286ab228f
(gdb) 
   0x564286ab226b:	mov    %rbx,%rdi
(gdb) 
   0x564286ab226e:	mov    %rsi,-0x48(%rbp)
(gdb) 
   0x564286ab2272:	callq  0x564286a217d0
(gdb) 
   0x564286ab2277:	mov    -0x48(%rbp),%rsi
(gdb) 
   0x564286ab227b:	jmp    0x564286ab228f
(gdb) 
   0x564286ab227d:	nopl   (%rax)
(gdb) 
   0x564286ab2280:	mov    0x28(%rsi),%r12
(gdb) 
   0x564286ab2284:	mov    %rbx,%rdi
(gdb) 
   0x564286ab2287:	callq  0x564286a210f0
(gdb) 
   0x564286ab228c:	mov    %r12,%rsi
(gdb) 
   0x564286ab228f:	test   %rsi,%rsi
(gdb) 
   0x564286ab2292:	jne    0x564286ab2280
(gdb) 
   0x564286ab2294:	add    $0x68,%rsp
(gdb) 
   0x564286ab2298:	mov    %r14d,%eax
(gdb) 
   0x564286ab229b:	pop    %rbx
(gdb) 
   0x564286ab229c:	pop    %r12
(gdb) 
   0x564286ab229e:	pop    %r13
(gdb) 
   0x564286ab22a0:	pop    %r14
(gdb) 
   0x564286ab22a2:	pop    %r15
(gdb) 
   0x564286ab22a4:	pop    %rbp
(gdb) 
   0x564286ab22a5:	retq   
(gdb) frame 6
#6  0x0000564286a6ed4e in ?? ()
(gdb) x/i 0x0000564286a6ed4e
=> 0x564286a6ed4e:	mov    %eax,-0x10dc(%rbp)
(gdb) 
   0x564286a6ed54:	jmpq   0x564286a6ec99
(gdb) 
   0x564286a6ed59:	lea    0x4cad90(%rip),%rsi        # 0x564286f39af0
(gdb) 
   0x564286a6ed60:	lea    0x4cb0e1(%rip),%rdi        # 0x564286f39e48
(gdb) 
   0x564286a6ed67:	mov    $0x597,%edx
(gdb) 
   0x564286a6ed6c:	callq  0x564286586bb6
(gdb) 
   0x564286a6ed71:	mov    -0x10f8(%rbp),%rsi
(gdb) 
   0x564286a6ed78:	callq  0x564286b395b0
(gdb) 
   0x564286a6ed7d:	jmpq   0x564286a6ec20
(gdb) 
   0x564286a6ed82:	mov    -0x10e8(%rbp),%rax
(gdb) 
   0x564286a6ed89:	testb  $0x10,0x11(%rax)
(gdb) 
   0x564286a6ed8d:	je     0x564286a6e896
(gdb) 
   0x564286a6ed93:	mov    -0x1148(%rbp),%rax
(gdb) 
   0x564286a6ed9a:	mov    -0x10e8(%rbp),%rcx
(gdb) 
   0x564286a6eda1:	mov    0x58(%rax),%rax
(gdb) 
   0x564286a6eda5:	mov    0x28(%rcx),%rdx
(gdb) 
   0x564286a6eda9:	mov    0x58(%rcx),%rcx
(gdb) 
   0x564286a6edad:	test   %rax,%rax
(gdb) 
   0x564286a6edb0:	mov    %rdx,-0x1160(%rbp)
(gdb) 
   0x564286a6edb7:	mov    %rcx,-0x11f0(%rbp)
(gdb) 
   0x564286a6edbe:	je     0x564286a6f214
(gdb) 
   0x564286a6edc4:	cmpq   $0x0,-0x1160(%rbp)
(gdb) 
   0x564286a6edcc:	je     0x564286a6f5cb
(gdb) 
   0x564286a6edd2:	cmpq   $0x0,-0x11f0(%rbp)
(gdb) 
   0x564286a6edda:	je     0x564286a6f5b3
(gdb) 
   0x564286a6ede0:	mov    -0x1148(%rbp),%rcx
(gdb) 
   0x564286a6ede7:	mov    -0x10e8(%rbp),%rdx
(gdb) 
   0x564286a6edee:	mov    0x78(%rcx),%rcx
(gdb) 
   0x564286a6edf2:	cmp    0x48(%rdx),%rcx
(gdb) 
   0x564286a6edf6:	mov    %rcx,-0x1218(%rbp)
(gdb) frame 5
#5  0x0000564286a85a69 in ?? ()
(gdb) x/i 0x0000564286a85a69
=> 0x564286a85a69:	mov    0xb0(%rbx),%rax
(gdb) 
   0x564286a85a70:	mov    %r14,0x1b8(%rax)
(gdb) 
   0x564286a85a77:	mov    0x1e0(%r12),%eax
(gdb) 
   0x564286a85a7f:	cmp    $0xa,%eax
(gdb) 
   0x564286a85a82:	je     0x564286a85ac0
(gdb) 
   0x564286a85a84:	cmp    $0xf,%eax
(gdb) 
   0x564286a85a87:	jne    0x564286a85aa8
(gdb) 
   0x564286a85a89:	mov    %rbx,%rdi
(gdb) 
   0x564286a85a8c:	callq  0x564286a52100
(gdb) 
   0x564286a85a91:	mov    %rbx,%rdi
(gdb) 
   0x564286a85a94:	callq  0x564286a07130
(gdb) 
   0x564286a85a99:	cmpl   $0xa,0x1e0(%r12)
(gdb) 
   0x564286a85aa2:	je     0x564286a85a40
(gdb) 
   0x564286a85aa4:	nopl   0x0(%rax)
(gdb) 
   0x564286a85aa8:	movq   $0x0,0xa8(%rbx)
(gdb) 
   0x564286a85ab3:	mov    0x1e0(%r12),%eax
(gdb) 
   0x564286a85abb:	jmpq   0x564286a8598d
(gdb) 
   0x564286a85ac0:	movq   $0x0,0xa8(%rbx)
(gdb) 
   0x564286a85acb:	cmpl   $0x1,0x38(%r13)
(gdb) 
   0x564286a85ad0:	je     0x564286a85d10
(gdb) 
   0x564286a85ad6:	mov    0x38(%r12),%rdx
(gdb) 
   0x564286a85adb:	mov    0xb8(%r13),%rax
(gdb) 
   0x564286a85ae2:	and    $0x3f,%edx
(gdb) 
   0x564286a85ae5:	not    %rax
(gdb) 
   0x564286a85ae8:	lea    0x8(,%rdx,8),%rcx
(gdb) 
   0x564286a85af0:	lea    0xcbdfc9(%rip),%rdx        # 0x564287743ac0
(gdb) frame 4
#4  0x0000564286ab8fbf in ?? ()
(gdb) x/i 0x0000564286ab8fbf
=> 0x564286ab8fbf:	cmp    $0xa,%eax
(gdb) 
   0x564286ab8fc2:	je     0x564286ab8d69
(gdb) 
   0x564286ab8fc8:	mov    %eax,0x1e0(%r13)
(gdb) 
   0x564286ab8fcf:	add    $0x28,%rsp
(gdb) 
   0x564286ab8fd3:	xor    %eax,%eax
(gdb) 
   0x564286ab8fd5:	pop    %rbx
(gdb) 
   0x564286ab8fd6:	pop    %r12
(gdb) 
   0x564286ab8fd8:	pop    %r13
(gdb) 
   0x564286ab8fda:	pop    %r14
(gdb) 
   0x564286ab8fdc:	pop    %r15
(gdb) 
   0x564286ab8fde:	pop    %rbp
(gdb) 
   0x564286ab8fdf:	retq   
(gdb) frame 3
#3  0x0000564286ab7fb6 in ?? ()
(gdb) x/i 0x0000564286ab7fb6
=> 0x564286ab7fb6:	mov    0x10(%r12),%rsi
(gdb) 
   0x564286ab7fbb:	mov    0x20(%r12),%rdi
(gdb) 
   0x564286ab7fc0:	sub    $0x8,%rsp
(gdb) 
   0x564286ab7fc4:	mov    -0xe88(%rbp),%r8
(gdb) 
   0x564286ab7fcb:	pushq  -0xe68(%rbp)
(gdb) 
   0x564286ab7fd1:	mov    %rbx,%rdx
(gdb) 
   0x564286ab7fd4:	mov    0xd0(%r15),%r9
(gdb) 
   0x564286ab7fdb:	mov    -0xe98(%rbp),%rcx
(gdb) 
   0x564286ab7fe2:	callq  0x564286b2f0a0
(gdb) 
   0x564286ab7fe7:	cmp    $0xa,%eax
(gdb) 
   0x564286ab7fea:	mov    %eax,%r13d
(gdb) 
   0x564286ab7fed:	pop    %rcx
(gdb) 
   0x564286ab7fee:	pop    %rsi
(gdb) 
   0x564286ab7fef:	jne    0x564286ab8017
(gdb) 
   0x564286ab7ff1:	cmpq   $0x0,-0xe78(%rbp)
(gdb) 
   0x564286ab7ff9:	je     0x564286ab8763
(gdb) 
   0x564286ab7fff:	mov    0x18(%rbx),%rdx
(gdb) 
   0x564286ab8003:	cmpq   $0x0,0x170(%rdx)
(gdb) 
   0x564286ab800b:	jne    0x564286ab8ab0
(gdb) 
   0x564286ab8011:	mov    $0xa,%r13d
(gdb) 
   0x564286ab8017:	mov    -0xe68(%rbp),%rdi
(gdb) 
   0x564286ab801e:	callq  0x564286a27a30
(gdb) 
   0x564286ab8023:	cmp    $0xa,%r13d
(gdb) 
   0x564286ab8027:	jne    0x564286ab7d48
(gdb) 
   0x564286ab802d:	movq   $0x5,0xc0(%r15)
(gdb) frame 2
#2  0x0000564286ab74ec in ?? ()
(gdb) x/i 0x0000564286ab74ec
=> 0x564286ab74ec:	add    $0x30,%rsp
(gdb) 
   0x564286ab74f0:	mov    0x78(%rbx),%rdx
(gdb) 
   0x564286ab74f4:	mov    -0x390(%rbp),%r10
(gdb) 
   0x564286ab74fb:	jmpq   0x564286ab7206
(gdb) 
   0x564286ab7500:	movq   $0x0,0x50
(gdb) 
   0x564286ab750c:	ud2    
(gdb) 
   0x564286ab750e:	lea    (%r15,%r15,2),%rax
(gdb) 
   0x564286ab7512:	test   %r15,%r15
(gdb) 
   0x564286ab7515:	lea    (%rdx,%rax,8),%rax
(gdb) 
   0x564286ab7519:	mov    %rax,0x28(%rdi)
(gdb) 
   0x564286ab751d:	jne    0x564286ab730c
(gdb) 
   0x564286ab7523:	jmpq   0x564286ab734e
(gdb) 
   0x564286ab7528:	lea    0x40(%rdx),%rsi
(gdb) 
   0x564286ab752c:	mov    %rcx,-0x388(%rbp)
(gdb) 
   0x564286ab7533:	callq  0x564286a20e00
(gdb) 
   0x564286ab7538:	test   %rax,%rax
(gdb) 
   0x564286ab753b:	je     0x564286ab7559
(gdb) 
   0x564286ab753d:	mov    0x50(%rax),%rsi
(gdb) 
   0x564286ab7541:	mov    -0x388(%rbp),%rcx
(gdb) 
   0x564286ab7548:	lea    (%rcx,%rsi,1),%r8
(gdb) 
   0x564286ab754c:	jmpq   0x564286ab72cf
(gdb) 
   0x564286ab7551:	mov    %rsi,%r14
(gdb) 
   0x564286ab7554:	jmpq   0x564286ab6ff1
(gdb) 
   0x564286ab7559:	movq   $0x0,0x0
(gdb) frame 1
#1  0x00005642869c7636 in ?? ()
(gdb) x/i 0x00005642869c7636
=> 0x5642869c7636:	mov    0x48(%r13),%rax
(gdb) 
   0x5642869c763a:	test   %rax,%rax
(gdb) 
   0x5642869c763d:	je     0x5642869c764a
(gdb) 
   0x5642869c763f:	mov    %rbx,%rdx
(gdb) 
   0x5642869c7642:	add    0x40(%r13),%rdx
(gdb) 
   0x5642869c7646:	not    %eax
(gdb) 
   0x5642869c7648:	and    %al,(%rdx)
(gdb) 
   0x5642869c764a:	mov    -0xc90(%rbp),%rbx
(gdb) 
   0x5642869c7651:	addq   $0x1,-0xc68(%rbp)
(gdb) 
   0x5642869c7659:	mov    -0xc68(%rbp),%rax
(gdb) 
   0x5642869c7660:	cmp    %rax,0x28(%rbx)
(gdb) 
   0x5642869c7664:	ja     0x5642869c74c0
(gdb) 
   0x5642869c766a:	mov    -0xc90(%rbp),%rdi
(gdb) 
   0x5642869c7671:	mov    -0xcc0(%rbp),%rbx
(gdb) 
   0x5642869c7678:	mov    0x30(%rdi),%rax
(gdb) 
   0x5642869c767c:	add    0x8(%rbx),%rax
(gdb) 
   0x5642869c7680:	lea    (%rax,%rax,2),%rdx
(gdb) 
   0x5642869c7684:	mov    0x18(%rbx),%rax
(gdb) 
   0x5642869c7688:	lea    (%rax,%rdx,8),%rbx
(gdb) 
   0x5642869c768c:	movzwl 0x8(%rdi),%eax
(gdb) 
   0x5642869c7690:	mov    -0xce0(%rbp),%rdi
(gdb) 
   0x5642869c7697:	mov    0xb0(%rdi),%rdx
(gdb) 
   0x5642869c769e:	and    $0x3ff,%eax
(gdb) 
   0x5642869c76a3:	mov    (%rdx,%rax,8),%rsi
(gdb) 
   0x5642869c76a7:	callq  0x564286711c90 <_ZN5TABLE20update_virtual_fieldEP5Field>
(gdb) 
   0x5642869c76ac:	test   %eax,%eax
(gdb) 
   0x5642869c76ae:	jne    0x5642869c7a0c
(gdb) 
   0x5642869c76b4:	mov    -0xcd8(%rbp),%rdi
(gdb) 
   0x5642869c76bb:	mov    0x48(%rdi),%rax
(gdb) 
   0x5642869c76bf:	test   %rax,%rax
(gdb) 
   0x5642869c76c2:	je     0x5642869c76dc
(gdb) 
   0x5642869c76c4:	mov    0x40(%rdi),%rdx
(gdb) 
   0x5642869c76c8:	mov    -0xca0(%rbp),%rdi
(gdb) 
   0x5642869c76cf:	movzbl (%rdi,%rdx,1),%edx
(gdb) 
   0x5642869c76d3:	test   %rax,%rdx
(gdb) 
   0x5642869c76d6:	jne    0x5642869c7932
(gdb) 
   0x5642869c76dc:	mov    -0xc98(%rbp),%rax
(gdb) 
   0x5642869c76e3:	mov    -0xca0(%rbp),%rcx
(gdb) 
   0x5642869c76ea:	mov    $0x1,%edx
(gdb) frame 0
#0  0x0000564286a9ff5e in ?? ()
(gdb) x/i 0x0000564286a9ff5e
=> 0x564286a9ff5e:	mov    %sil,-0x1(%rdx)
(gdb) 
   0x564286a9ff62:	je     0x564286a9ff7a
(gdb) 
   0x564286a9ff64:	nopl   0x0(%rax)
(gdb) 
   0x564286a9ff68:	add    $0x1,%rbx
(gdb) 
   0x564286a9ff6c:	movzbl (%rbx),%edx
(gdb) 
   0x564286a9ff6f:	sub    $0x1,%rax
(gdb) 
   0x564286a9ff73:	cmp    %rax,%r8
(gdb) 
   0x564286a9ff76:	mov    %dl,(%rax)
(gdb) 
   0x564286a9ff78:	jne    0x564286a9ff68
(gdb) 
   0x564286a9ff7a:	cmpq   $0x0,0x80(%r12)
(gdb) 
   0x564286a9ff83:	jne    0x564286a9ffab
(gdb) 
   0x564286a9ff85:	addb   $0x80,-0x1(%r8,%rcx,1)
(gdb) 
   0x564286a9ff8b:	jmp    0x564286a9ffab
(gdb) 
   0x564286a9ff8d:	nopl   (%rax)
(gdb) 
   0x564286a9ff90:	mov    %rcx,%rdx
(gdb) 
   0x564286a9ff93:	mov    %rbx,%rsi
(gdb) 
   0x564286a9ff96:	mov    %rcx,-0x28(%rbp)
(gdb) 
   0x564286a9ff9a:	callq  0x564286577608
(gdb) 
   0x564286a9ff9f:	cmpq   $0x1,0x70(%r12)
(gdb) 
   0x564286a9ffa5:	mov    -0x28(%rbp),%rcx
(gdb) 
   0x564286a9ffa9:	je     0x564286aa0010
(gdb) 
   0x564286a9ffab:	add    $0x18,%rsp
(gdb) 
   0x564286a9ffaf:	pop    %rbx
(gdb) 
   0x564286a9ffb0:	pop    %r12
(gdb) 
   0x564286a9ffb2:	pop    %r13
(gdb) 
   0x564286a9ffb4:	pop    %rbp
(gdb) 
   0x564286a9ffb5:	retq   

Here you can find some function calls in the neighborhood of the crash place.
As wsrep_* is referenced, it seems that this bug is indeed a duplicate of MDEV-13708, but more related to Galera than that one.

Comment by Elena Stepanova [ 2019-05-27 ]

Could you please provide the actual CREATE TABLE and the sequence of DML statements which causes the failure in your case, rather than a verbal description of what is referenced by what and deleted from where?

Comment by Piotr Nizynski [ 2019-05-27 ]

Here you are:

MariaDB> CREATE TABLE testMain (primid INT UNSIGNED NOT NULL AUTO_INCREMENT, PRIMARY KEY (primid)) ENGINE = InnoDB;
Query OK, 0 rows affected (0.065 sec)B;
 
MariaDB> CREATE TABLE testRef (id INT UNSIGNED NOT NULL AUTO_INCREMENT, pid INT UNSIGNED, bitmap TINYINT UNSIGNED NOT NULL DEFAULT 0, bitmap5 TINYINT UNSIGNED GENERATED ALWAYS AS (bitmap&(1<<5)) VIRTUAL, PRIMARY KEY (id), FOREIGN KEY (pid) REFERENCES testMain (primid) ON DELETE CASCADE ON UPDATE CASCADE);
Query OK, 0 rows affected (0.076 sec)
 
MariaDB> CREATE INDEX bitmap5 ON testRef(bitmap5) USING BTREE;
Query OK, 0 rows affected (0.111 sec)
Rekordów: 0  Duplikatów: 0  Ostrzeżeń: 0
 
MariaDB> INSERT INTO testMain VALUES(0);
Query OK, 1 row affected (0.030 sec)
 
MariaDB> SELECT * FROM testMain;
+--------+
| primid |
+--------+
|      3 |
+--------+
1 row in set (0.000 sec)
 
MariaDB> INSERT INTO testRef(pid) VALUES(3);
Query OK, 1 row affected (0.030 sec)
 
MariaDB> DELETE FROM testMain WHERE primid=3;
ERROR 2013 (HY000): Lost connection to MySQL server during query

Comment by Elena Stepanova [ 2019-06-03 ]

stepan.patryshev, Could you please try to reproduce it on a Galera cluster? I'm not getting the crash on a standalone server (even on 10.3.9).
If you can't reproduce it on the current 10.3, try 10.3.9, maybe it was fixed since then.
Ask piotrniz for additional information if needed.

Comment by Stepan Patryshev (Inactive) [ 2019-11-25 ]

I have not managed to reproduce it with Galera replication. Tried the both cases from this MDEV and from MDEV-13708 (the last one by Sergei) on 10.3.9 (ca26f91bcaa21933147974c823852a2e1c2e2bd7) and 10.3.21 (a14544260c33dcdb057d2f62c4aab33cb09ebcb1).
piotrniz can you please provide exact version of Galera lib you were using during the crash? Don't have other ideas how to repeat it.

Comment by Piotr Nizynski [ 2019-11-25 ]

I have just re-verified that the problem exists:

  1. mysql
    Welcome to the MariaDB monitor. Commands end with ; or \g.
    Your MariaDB connection id is 185136
    Server version: 10.3.17-MariaDB-0+deb10u1-log Debian 10

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> use xp.pl
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [xp.pl]> CREATE TABLE testMain (primid INT UNSIGNED NOT NULL AUTO_INCREMENT, PRIMARY KEY (primid)) ENGINE = InnoDB;
Query OK, 0 rows affected (1.006 sec)

MariaDB [xp.pl]> CREATE TABLE testRef (id INT UNSIGNED NOT NULL AUTO_INCREMENT, pid INT UNSIGNED, bitmap TINYINT UNSIGNED NOT NULL DEFAULT 0, bitmap5 TINYINT UNSIGNED GENERATED ALWAYS AS (bitmap&(1<<5)) VIRTUAL, PRIMARY KEY (id), FOREIGN KEY (pid) REFERENCES testMain (primid) ON DELETE CASCADE ON UPDATE CASCADE);
Query OK, 0 rows affected (1.131 sec)

MariaDB [xp.pl]> CREATE INDEX bitmap5 ON testRef(bitmap5) USING BTREE;
Query OK, 0 rows affected (2.045 sec)
Rekordów: 0 Duplikatów: 0 Ostrzeżeń: 0

MariaDB [xp.pl]> INSERT INTO testMain VALUES(0);
Query OK, 1 row affected (0.048 sec)

MariaDB [xp.pl]> SELECT * FROM testMain;
--------

primid

--------

2

--------
1 row in set (0.000 sec)

MariaDB [xp.pl]> INSERT INTO testRef(pid) VALUES(3);
ERROR 1452 (23000): Cannot add or update a child row: a foreign key constraint fails (`xp.pl`.`testRef`, CONSTRAINT `testRef_ibfk_1` FOREIGN KEY (`pid`) REFERENCES `testMain` (`primid`) ON DELETE CASCADE ON UPDATE CASCADE)
MariaDB [xp.pl]> INSERT INTO testRef(pid) VALUES(2);
Query OK, 1 row affected (0.047 sec)

MariaDB [xp.pl]> DELETE FROM testMain WHERE primid=2;
ERROR 2013 (HY000): Lost connection to MySQL server during query
MariaDB [xp.pl]> quit

^C^C^C^C^CBye

Packages in use:
ii mariadb-server-10.3 1:10.3.17-0+deb10u1 amd64 MariaDB database server binaries
ii mariadb-server-core-10.3 1:10.3.17-0+deb10u1 amd64 MariaDB database core server files
ii galera-3 25.3.25-2 amd64 Replication framework for transactional applications

wsrep_cluster_size 3
wsrep_cluster_status Primary
wsrep_thread_count 2
wsrep_local_state_comment Synced
Comment by Stepan Patryshev (Inactive) [ 2019-11-26 ]

I have not reproduced it even on MariaDB 10.3.9 and 10.3.17 with galera-3 25.3.25.
But I observered the crash not just after the deletion, but after any other next command. See linked MDEV-21153 Galera: Replica nodes crash with signal 6 after indexed virtual columns and FK cascading deletes: WSREP has not yet prepared node for application use.
And I presume that root cause for these two similar bugs is the same.

Comment by Jan Lindström (Inactive) [ 2019-11-28 ]
  • branch 10.3
  • commit bf58ec77a1adaa653a0b044b950cf420f8c19de9

    CREATE TABLE testMain (primid INT UNSIGNED NOT NULL AUTO_INCREMENT, PRIMARY KEY (primid)) ENGINE = InnoDB;
    CREATE TABLE testRef (id INT UNSIGNED NOT NULL AUTO_INCREMENT, pid INT UNSIGNED, bitmap TINYINT UNSIGNED NOT NULL DEFAULT 0, bitmap5 TINYINT UNSIGNED GENERATED ALWAYS AS (bitmap&(1<<5)) VIRTUAL, PRIMARY KEY (id), FOREIGN KEY (pid) REFERENCES testMain (primid) ON DELETE CASCADE ON UPDATE CASCADE);
    CREATE INDEX bitmap5 ON testRef(bitmap5) USING BTREE;
    INSERT INTO testMain VALUES(0);
    INSERT INTO testRef(pid) VALUES(3);
    SELECT * FROM testMain;
    primid
    1
    SELECT * FROM testRef;
    id	pid	bitmap	bitmap5
    1	3	0	0
    

Insert should fail as there is no parent for pid = 3. This is repeatable with no Galera enabled.

Comment by Marko Mäkelä [ 2019-11-29 ]

nikitamalyavin, you agreed to work on virtual column bugs. I would expect this to be repeatable on 10.2 as well.

Generated at Thu Feb 08 08:52:56 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.