[MDEV-20203] InnoDB: Failing assertion: (block)->index || (block)->n_pointers == 0 Created: 2019-07-29  Updated: 2023-12-05

Status: Confirmed
Project: MariaDB Server
Component/s: Storage Engine - InnoDB
Affects Version/s: 10.4.7, 10.6.5, 10.10
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Matthias Leich Assignee: Thirunarayanan Balathandayuthapani
Resolution: Unresolved Votes: 1
Labels: rr-profile-analyzed

Attachments: File 000000.log     File Seven.yy     File simp_MDEV-20203.cfg    
Issue Links:
Duplicate
is duplicated by MDEV-23995 InnoDB: Failing assertion: (block)->i... Closed
Relates
relates to MDEV-20487 Set innodb_adaptive_hash_index=OFF by... Closed
relates to MDEV-23885 Crash in ha_delete_hash_node() in btr... Closed
relates to MDEV-24832 Root page AHI Removal fails fails dur... Closed
relates to MDEV-26450 Corruption due to innodb_undo_log_tru... Closed
relates to MDEV-27700 SUMMARY: AddressSanitizer: heap-use-a... Closed

 Description   

Problem found during RQG testing.
 Version: '10.4.7-MariaDB-debug-log'  socket: '/dev/shm/vardir/1564417709/8/1/mysql.sock'  port: 19440  Source distribution
 2019-07-29 18:29:01 0x7f55a004c700  InnoDB: Assertion failure in file /work/10.4/storage/innobase/btr/btr0sea.cc line 1824
 InnoDB: Failing assertion: (block)->index || (block)->n_pointers == 0
...
Query (0x7fc228011190): INSERT INTO t3 (col1,col2) VALUES ( 2241, 2241 ) /* E_R Thread3 QNO 7611 CON_ID 18 */
Connection ID (thread ID): 18
Status: NOT_KILLED
 
In case I start the server with
     innodb_adaptive_hash_index=off
than the test passes.



 Comments   
Comment by Matthias Leich [ 2019-07-29 ]

000000.log - Protocol of my RQG run
Seven.yy - Simplified RQG grammar
simp_MDEV-20203.cfg - Config file for rqg_batch.pl

Please show up in case you want work on this bug because the environments where
I was able to replay it are ugly (exceptional CPU load on testing box required).

Comment by Marko Mäkelä [ 2020-04-29 ]

mleich, could you try to produce an rr record trace for this? With rr replay it should be almost trivial to determine the sequence of events that lead to the failure.

Comment by Matthias Leich [ 2020-07-30 ]

The bug showed up again in some run of the RQG simplifier 
on 10.4.14 fc48c8ff4c6cb9aa7a0fd27e724e6e3acd555b0e 2020-07-21T12:42:42+03:00
but in such specialized runs rr tracing is usually not enabled.
Attempts with rr tracing enabled and
- the simplified RQG grammar Seven.yy
- the RQG grammar which replayed in the Simplifier run
- variation of some InnoDB related parameters
had no success.

Comment by Matthias Leich [ 2021-01-27 ]

(rr) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007fd9f7719859 in __GI_abort () at abort.c:79
#2  0x00005634346aae5d in ut_dbg_assertion_failed (expr=0x563435d91c40 "(block)->index || (block)->n_pointers == 0", file=0x563435d90f60 "/Server/bb-10.6-MDEV-24671/storage/innobase/btr/btr0sea.cc", line=1379)
    at /Server/bb-10.6-MDEV-24671/storage/innobase/ut/ut0dbg.cc:60
#3  0x00005634347519fe in btr_search_drop_page_hash_index (block=0x4b1c4d222760) at /Server/bb-10.6-MDEV-24671/storage/innobase/btr/btr0sea.cc:1379
#4  0x00005634347c7418 in buf_LRU_free_page (bpage=0x4b1c4d222760, zip=true) at /Server/bb-10.6-MDEV-24671/storage/innobase/buf/buf0lru.cc:946
#5  0x00005634347c17b8 in buf_LRU_free_from_common_LRU_list (limit=100) at /Server/bb-10.6-MDEV-24671/storage/innobase/buf/buf0lru.cc:246
#6  0x00005634347c1be0 in buf_LRU_scan_and_free_block (limit=100) at /Server/bb-10.6-MDEV-24671/storage/innobase/buf/buf0lru.cc:278
#7  0x00005634347c32b6 in buf_LRU_get_free_block (have_mutex=false) at /Server/bb-10.6-MDEV-24671/storage/innobase/buf/buf0lru.cc:439
#8  0x00005634347ce28c in buf_page_init_for_read (mode=132, page_id=..., zip_size=0, unzip=false) at /Server/bb-10.6-MDEV-24671/storage/innobase/buf/buf0rea.cc:109
#9  0x00005634347cf3f4 in buf_read_page_low (err=0x415f1f788020, space=0x61300015e598, sync=true, mode=132, page_id=..., zip_size=0, unzip=false) at /Server/bb-10.6-MDEV-24671/storage/innobase/buf/buf0rea.cc:307
#10 0x00005634347d0743 in buf_read_page (page_id=..., zip_size=0) at /Server/bb-10.6-MDEV-24671/storage/innobase/buf/buf0rea.cc:483
#11 0x000056343477565c in buf_page_get_low (page_id=..., zip_size=0, rw_latch=4, guess=0x0, mode=10, mtr=0x415f1f788b40, err=0x0, allow_ibuf_merge=false) at /Server/bb-10.6-MDEV-24671/storage/innobase/buf/buf0buf.cc:2910
#12 0x0000563434777173 in buf_page_get_gen (page_id=..., zip_size=0, rw_latch=4, guess=0x0, mode=10, mtr=0x415f1f788b40, err=0x0, allow_ibuf_merge=false) at /Server/bb-10.6-MDEV-24671/storage/innobase/buf/buf0buf.cc:3342
#13 0x00005634348c1573 in fut_get_ptr (space=39, zip_size=0, addr=..., rw_latch=RW_SX_LATCH, mtr=0x415f1f788b40, ptr_block=0x0) at /Server/bb-10.6-MDEV-24671/storage/innobase/include/fut0fut.h:60
#14 0x00005634348ca253 in fseg_inode_try_get (header=0x4b1c4d910054 "", space=39, zip_size=0, mtr=0x415f1f788b40, block=0x0) at /Server/bb-10.6-MDEV-24671/storage/innobase/fsp/fsp0fsp.cc:1484
#15 0x00005634348ca3c2 in fseg_inode_get (header=0x4b1c4d910054 "", space=39, zip_size=0, mtr=0x415f1f788b40, block=0x0) at /Server/bb-10.6-MDEV-24671/storage/innobase/fsp/fsp0fsp.cc:1515
#16 0x00005634348cbbb5 in fseg_n_reserved_pages (block=..., header=0x4b1c4d910054 "", used=0x415f1f788940, mtr=0x415f1f788b40) at /Server/bb-10.6-MDEV-24671/storage/innobase/fsp/fsp0fsp.cc:1767
#17 0x00005634346c04ae in btr_get_size (index=0x6160033b8f20, flag=2, mtr=0x415f1f788b40) at /Server/bb-10.6-MDEV-24671/storage/innobase/btr/btr0btr.cc:598
#18 0x000056343485fa60 in dict_stats_analyze_index (index=0x6160033b8f20) at /Server/bb-10.6-MDEV-24671/storage/innobase/dict/dict0stats.cc:1945
#19 0x000056343486186d in dict_stats_update_persistent (table=0x6180000e0920) at /Server/bb-10.6-MDEV-24671/storage/innobase/dict/dict0stats.cc:2250
#20 0x00005634348672ec in dict_stats_update (table=0x6180000e0920, stats_upd_option=DICT_STATS_RECALC_PERSISTENT) at /Server/bb-10.6-MDEV-24671/storage/innobase/dict/dict0stats.cc:3223
#21 0x0000563434873b6a in dict_stats_process_entry_from_recalc_pool () at /Server/bb-10.6-MDEV-24671/storage/innobase/dict/dict0stats_bg.cc:374
#22 0x0000563434873ce7 in dict_stats_func () at /Server/bb-10.6-MDEV-24671/storage/innobase/dict/dict0stats_bg.cc:408
#23 0x00005634349db89a in tpool::thread_pool_generic::timer_generic::run (this=0x6120000037c0) at /Server/bb-10.6-MDEV-24671/tpool/tpool_generic.cc:309
#24 0x00005634349dbb81 in tpool::thread_pool_generic::timer_generic::execute (arg=0x6120000037c0) at /Server/bb-10.6-MDEV-24671/tpool/tpool_generic.cc:329
#25 0x00005634349ebbf1 in tpool::task::execute (this=0x612000003800) at /Server/bb-10.6-MDEV-24671/tpool/task.cc:52
#26 0x00005634349d7b4b in tpool::thread_pool_generic::worker_main (this=0x618000000480, thread_var=0x63000001f300) at /Server/bb-10.6-MDEV-24671/tpool/tpool_generic.cc:546
#27 0x00005634349eace7 in std::__invoke_impl<void, void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> (__f=
    @0x6040000321a8: (void (tpool::thread_pool_generic::*)(class tpool::thread_pool_generic * const, struct tpool::worker_data *)) 0x5634349d7968 <tpool::thread_pool_generic::worker_main(tpool::worker_data*)>, __t=@0x6040000321a0: 0x618000000480)
    at /usr/include/c++/9/bits/invoke.h:73
#28 0x00005634349eaa92 in std::__invoke<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> (__fn=
    @0x6040000321a8: (void (tpool::thread_pool_generic::*)(class tpool::thread_pool_generic * const, struct tpool::worker_data *)) 0x5634349d7968 <tpool::thread_pool_generic::worker_main(tpool::worker_data*)>)
    at /usr/include/c++/9/bits/invoke.h:95
#29 0x00005634349ea923 in std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> >::_M_invoke<0ul, 1ul, 2ul> (this=0x604000032198)
    at /usr/include/c++/9/thread:244
#30 0x00005634349ea86d in std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> >::operator() (this=0x604000032198) at /usr/include/c++/9/thread:251
#31 0x00005634349ea7d2 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> > >::_M_run (this=0x604000032190)
    at /usr/include/c++/9/thread:195
#32 0x0000733c48c30d84 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#33 0x00005eb60ba6c609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#34 0x00007fd9f7816293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
(rr)
sdp:/home/mleich/RQG_O/storage/1611680594/MDEV-20203/dev/shm/vardir/1611680594/42/1/rr
_RR_TRACE_DIR="." rr replay --mark-stdio
 
origin/bb-10.6-MDEV-24671 78c174785a7f05b4e97470be4f68d6326e6ef51f 2021-01-26T17:48:14+02:00
 
perl rqg.pl \
--views \
--grammar=conf/mariadb/partitions_innodb.yy \
--redefine=conf/mariadb/alter_table.yy \
--redefine=conf/mariadb/instant_add.yy \
--redefine=conf/mariadb/modules/alter_table_columns.yy \
--redefine=conf/mariadb/sp.yy \
--redefine=conf/mariadb/bulk_insert.yy \
--redefine=conf/mariadb/modules/userstat.yy \
--redefine=conf/mariadb/modules/foreign_keys.yy \
--redefine=conf/mariadb/modules/locks.yy \
--redefine=conf/mariadb/modules/sql_mode.yy \
--redefine=conf/mariadb/versioning.yy \
--redefine=conf/mariadb/sequences.yy \
--redefine=conf/mariadb/modules/locks-10.4-extra.yy \
--mysqld=--innodb_use_native_aio=1 \
--mysqld=--innodb_lock_schedule_algorithm=fcfs \
--mysqld=--loose-idle_write_transaction_timeout=0 \
--mysqld=--loose-idle_transaction_timeout=0 \
--mysqld=--loose-idle_readonly_transaction_timeout=0 \
--mysqld=--connect_timeout=60 \
--mysqld=--interactive_timeout=28800 \
--mysqld=--slave_net_timeout=60 \
--mysqld=--net_read_timeout=30 \
--mysqld=--net_write_timeout=60 \
--mysqld=--loose-table_lock_wait_timeout=50 \
--mysqld=--wait_timeout=28800 \
--mysqld=--lock-wait-timeout=86400 \
--mysqld=--innodb-lock-wait-timeout=50 \
--no-mask \
--queries=10000000 \
--seed=random \
--reporters=Backtrace \
--reporters=ErrorLog \
--reporters=Deadlock1 \
--validators=None \
--mysqld=--log_output=none \
--mysqld=--log-bin \
--mysqld=--log_bin_trust_function_creators=1 \
--mysqld=--loose-debug_assert_on_not_freed_memory=0 \
--engine=InnoDB \
--restart_timeout=240 \
--mysqld=--plugin-load-add=file_key_management.so \
--mysqld=--loose-file-key-management-filename=$RQG_HOME/conf/mariadb/encryption_keys.txt \
--duration=300 \
--mysqld=--loose-innodb_fatal_semaphore_wait_threshold=300 \
--mysqld=--loose-innodb-sync-debug \
--mysqld=--innodb_stats_persistent=on \
--mysqld=--innodb_adaptive_hash_index=on \
--mysqld=--loose-max-statement-time=30 \
--threads=33 \
--mysqld=--innodb_page_size=32K \
--mysqld=--innodb-buffer-pool-size=24M \
--duration=300 \
--no_mask \
--workdir=/home/mleich/RQG_O/storage/1611680594/42 \
--vardir=/dev/shm/vardir/1611680594/42 \
--mtr-build-thread=771 \
--basedir1=/Server_bin/bb-10.6-MDEV-24671_asan \
--basedir2=/Server_bin/bb-10.6-MDEV-24671_asan \
--script_debug=_nix_ \
--rr=Extended \
--rr_options=--chaos

Comment by Roel Van de Paar [ 2021-01-28 ]

Seen with two different stacks during a testrun of MDEV-24671, as follows:

10.6.0 78c174785a7f05b4e97470be4f68d6326e6ef51f

InnoDB: Failing assertion: (block)->index || (block)->n_pointers == 0

10.6.0 78c174785a7f05b4e97470be4f68d6326e6ef51f

Core was generated by `/test/MDEV-24671_MD270121-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defau'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
[Current thread is 1 (Thread 0x1541b4064700 (LWP 4001105))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
#1  0x000055a708c529fc in my_write_core (sig=sig@entry=6) at /test/bb-10.6-MDEV-24671_dbg/mysys/stacktrace.c:424
#2  0x000055a7083e82d0 in handle_fatal_signal (sig=6) at /test/bb-10.6-MDEV-24671_dbg/sql/signal_handler.cc:330
#3  <signal handler called>
#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#5  0x00001541b5e6f859 in __GI_abort () at abort.c:79
#6  0x000055a708a31e48 in ut_dbg_assertion_failed (expr=expr@entry=0x55a709023308 "(block)->index || (block)->n_pointers == 0", file=file@entry=0x55a7090752c8 "/test/bb-10.6-MDEV-24671_dbg/storage/innobase/btr/btr0sea.cc", line=line@entry=1379) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/ut/ut0dbg.cc:60
#7  0x000055a708a98732 in btr_search_drop_page_hash_index (block=block@entry=0x154194017e60) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/btr/btr0sea.cc:1379
#8  0x000055a708a356ae in btr_free_root (block=block@entry=0x154194017e60, mtr=mtr@entry=0x1541b4061dc0) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/btr/btr0btr.cc:933
#9  0x000055a708a3a1d5 in btr_free (page_id=<optimized out>) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/btr/btr0btr.cc:1241
#10 0x000055a70896dfd9 in row_drop_table_for_mysql (name=name@entry=0x1541b4062bf0 "tmp/#sql-temptable-3d0bd7-8-23", trx=trx@entry=0x1541a1159170, sqlcom=sqlcom@entry=SQLCOM_SELECT, create_failed=create_failed@entry=false, nonatomic=nonatomic@entry=true) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/include/buf0types.h:125
#11 0x000055a708804d4d in ha_innobase::delete_table (this=this@entry=0x154159243558, name=<optimized out>, name@entry=0x1541583a9e10 "/dev/shm/242960/15/tmp/#sql-temptable-3d0bd7-8-23", sqlcom=sqlcom@entry=SQLCOM_SELECT) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/handler/ha_innodb.cc:12992
#12 0x000055a7087ee258 in ha_innobase::delete_table (this=0x154159243558, name=0x1541583a9e10 "/dev/shm/242960/15/tmp/#sql-temptable-3d0bd7-8-23") at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/handler/ha_innodb.cc:13119
#13 0x000055a7083ef1d2 in hton_drop_table (hton=<optimized out>, path=<optimized out>) at /test/bb-10.6-MDEV-24671_dbg/sql/handler.cc:564
#14 0x000055a708349664 in THD::rm_temporary_table (this=this@entry=0x154158000db8, base=0x55a70ba35678, path=0x1541583a9e10 "/dev/shm/242960/15/tmp/#sql-temptable-3d0bd7-8-23") at /test/bb-10.6-MDEV-24671_dbg/sql/temporary_tables.cc:703
#15 0x000055a70834a720 in THD::log_events_and_free_tmp_shares (this=this@entry=0x154158000db8) at /test/bb-10.6-MDEV-24671_dbg/sql/handler.h:1720
#16 0x000055a70834ac27 in THD::close_temporary_tables (this=this@entry=0x154158000db8) at /test/bb-10.6-MDEV-24671_dbg/sql/temporary_tables.cc:538
#17 0x000055a7080aec58 in THD::cleanup (this=this@entry=0x154158000db8, have_mutex=have_mutex@entry=false) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_class.cc:1565
#18 0x000055a7080059a2 in unlink_thd (thd=0x154158000db8) at /test/bb-10.6-MDEV-24671_dbg/sql/mysqld.cc:2601
#19 0x000055a70827d5a5 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55a70c2afe78, put_in_cache=put_in_cache@entry=true) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_connect.cc:1421
#20 0x000055a70827d77d in handle_one_connection (arg=arg@entry=0x55a70c2afe78) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_connect.cc:1312
#21 0x000055a70873043f in pfs_spawn_thread (arg=0x55a70c2210f8) at /test/bb-10.6-MDEV-24671_dbg/storage/perfschema/pfs.cc:2201
#22 0x00001541b637d609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#23 0x00001541b5f6c293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

And:

10.6.0 78c174785a7f05b4e97470be4f68d6326e6ef51f

InnoDB: Failing assertion: (block)->index || (block)->n_pointers == 0

10.6.0 78c174785a7f05b4e97470be4f68d6326e6ef51f

Core was generated by `/test/MDEV-24671_MD270121-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defau'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
[Current thread is 1 (Thread 0x145c5006f700 (LWP 1597435))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
#1  0x00005577831a99fc in my_write_core (sig=sig@entry=6) at /test/bb-10.6-MDEV-24671_dbg/mysys/stacktrace.c:424
#2  0x000055778293f2d0 in handle_fatal_signal (sig=6) at /test/bb-10.6-MDEV-24671_dbg/sql/signal_handler.cc:330
#3  <signal handler called> 
#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#5  0x0000145c5b51f859 in __GI_abort () at abort.c:79
#6  0x0000557782f88e48 in ut_dbg_assertion_failed (expr=expr@entry=0x55778357a308 "(block)->index || (block)->n_pointers == 0", file=file@entry=0x5577835cc2c8 "/test/bb-10.6-MDEV-24671_dbg/storage/innobase/btr/btr0sea.cc", line=line@entry=1379) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/ut/ut0dbg.cc:60
#7  0x0000557782fef732 in btr_search_drop_page_hash_index (block=block@entry=0x145c3805b460) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/btr/btr0sea.cc:1379
#8  0x0000557782ff030d in btr_search_build_page_hash_index (index=0x145bf56a1238, block=block@entry=0x145c3805b460, ahi_latch=ahi_latch@entry=0x5577861d97d8, n_fields=0, n_bytes=1, left_side=false) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/btr/btr0sea.cc:1488
#9  0x0000557782ff1676 in btr_search_info_update_slow (info=info@entry=0x145bf4595788, cursor=cursor@entry=0x145c5006c5c0) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/btr/btr0sea.cc:1673
#10 0x0000557782fd0e5a in btr_search_info_update (cursor=0x145c5006c5c0, index=0x145bf56a1238) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/include/btr0sea.ic:81
#11 btr_cur_search_to_nth_level_func (index=index@entry=0x145bf56a1238, level=<optimized out>, tuple=tuple@entry=0x145bf4196b58, mode=mode@entry=PAGE_CUR_LE, latch_mode=<optimized out>, latch_mode@entry=2, cursor=cursor@entry=0x145c5006c5c0, ahi_latch=<optimized out>, mtr=<optimized out>, autoinc=<optimized out>) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/btr/btr0cur.cc:2452
#12 0x0000557782e8f4d0 in btr_pcur_open_low (index=index@entry=0x145bf56a1238, level=<optimized out>, level@entry=0, tuple=tuple@entry=0x145bf4196b58, mode=mode@entry=PAGE_CUR_LE, latch_mode=latch_mode@entry=2, cursor=cursor@entry=0x145c5006c5c0, autoinc=0, mtr=0x145c5006cb80) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/include/btr0pcur.ic:439
#13 0x0000557782e9518d in row_ins_clust_index_entry_low (flags=flags@entry=2, mode=mode@entry=2, index=index@entry=0x145bf56a1238, n_uniq=n_uniq@entry=0, entry=entry@entry=0x145bf4196b58, n_ext=n_ext@entry=0, thr=0x145bf539e840) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/row/row0ins.cc:2632
#14 0x0000557782e9797a in row_ins_clust_index_entry (index=index@entry=0x145bf56a1238, entry=entry@entry=0x145bf4196b58, thr=thr@entry=0x145bf539e840, n_ext=n_ext@entry=0) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/row/row0ins.cc:3255
#15 0x0000557782e9c530 in row_ins_index_entry (thr=0x145bf539e840, entry=0x145bf4196b58, index=0x145bf56a1238) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/row/row0ins.cc:3380
#16 row_ins_index_entry_step (thr=0x145bf539e840, node=0x145bf539e620) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/row/row0ins.cc:3549
#17 row_ins (thr=0x145bf539e840, node=0x145bf539e620) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/row/row0ins.cc:3695
#18 row_ins_step (thr=thr@entry=0x145bf539e840) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/row/row0ins.cc:3837
#19 0x0000557782ec0c30 in row_insert_for_mysql (mysql_rec=mysql_rec@entry=0x145bf559ec08 "\375\325\a", prebuilt=0x145bf539e128, ins_mode=ROW_INS_NORMAL) at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/row/row0mysql.cc:1384
#20 0x0000557782d4afe0 in ha_innobase::write_row (this=0x145bf539d8d0, record=0x145bf559ec08 "\375\325\a") at /test/bb-10.6-MDEV-24671_dbg/storage/innobase/handler/ha_innodb.cc:7342
#21 0x0000557782953618 in handler::ha_write_row (this=0x145bf539d8d0, buf=0x145bf559ec08 "\375\325\a") at /test/bb-10.6-MDEV-24671_dbg/sql/handler.cc:7151
#22 0x00005577826294ad in write_record (thd=thd@entry=0x145bf4000db8, table=table@entry=0x145bf559e778, info=info@entry=0x145c5006dc60, sink=sink@entry=0x0) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_insert.cc:2106
#23 0x0000557782635b4e in mysql_insert (thd=thd@entry=0x145bf4000db8, table_list=0x145bf57fc800, fields=@0x145bf4005e28: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x557783c4e2e0 <end_of_list>, last = 0x145bf4005e28, elements = 0}, <No data fields>}, values_list=@0x145bf4005e70: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x145bf4206b10, last = 0x145bf57fd508, elements = 3}, <No data fields>}, update_fields=@0x145bf4005e58: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x557783c4e2e0 <end_of_list>, last = 0x145bf4005e58, elements = 0}, <No data fields>}, update_values=@0x145bf4005e40: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x557783c4e2e0 <end_of_list>, last = 0x145bf4005e40, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_insert.cc:1099
#24 0x000055778267c6a8 in mysql_execute_command (thd=thd@entry=0x145bf4000db8) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_parse.cc:4448
#25 0x000055778266715e in mysql_parse (thd=thd@entry=0x145bf4000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x145c5006e3d0) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_parse.cc:7901
#26 0x000055778267524f in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x145bf4000db8, packet=packet@entry=0x145bf416f049 "INSERT INTO t1  VALUES ('2005-10-13'),('2005-10-20'),('2005-10-30');", packet_length=packet_length@entry=68) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_class.h:1294
#27 0x0000557782678581 in do_command (thd=0x145bf4000db8) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_parse.cc:1365
#28 0x00005577827d4079 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55778693ed68, put_in_cache=put_in_cache@entry=true) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_connect.cc:1410
#29 0x00005577827d477d in handle_one_connection (arg=arg@entry=0x55778693ed68) at /test/bb-10.6-MDEV-24671_dbg/sql/sql_connect.cc:1312
#30 0x0000557782c8743f in pfs_spawn_thread (arg=0x5577868affe8) at /test/bb-10.6-MDEV-24671_dbg/storage/perfschema/pfs.cc:2201
#31 0x0000145c5ba2d609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#32 0x0000145c5b61c293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Unique ID's here:

(block)->index || (block)->n_pointers == 0|SIGABRT|ut_dbg_assertion_failed|btr_search_drop_page_hash_index|btr_free_root|btr_free
(block)->index || (block)->n_pointers == 0|SIGABRT|ut_dbg_assertion_failed|btr_search_drop_page_hash_index|btr_search_b
uild_page_hash_index|btr_search_info_update_slow

Some hopefully helpful infos;

  • The "btr_free_root" bug is 90% of the time seen after shutdown has been issued already.
  • The "btr_free_root" bug is seen quite a lot more then the "btr_search_build_page_hash_index" one.
  • I only had a single occurrence of the "btr_search_build_page_hash_index" one, and it was not on shutdown afaict.
  • Both bugs are single-client-thread reproducible.
  • Finally, this issue has become much more prevalent in the bb-10.6-MDEV-24671 @ 78c174785a7f05b4e97470be4f68d6326e6ef51f branch. I do not think I saw it ever before this one. The fact that Matthias also ran into it again now on the same branch (ref last comment) seems to confirm this further.
Comment by Matthias Leich [ 2021-03-25 ]

pluto:/data/Results/1612812248/MDEV-20203/dev/shm/vardir/1612812248/75/1/rr

Comment by Marko Mäkelä [ 2021-03-25 ]

I just debugged a 10.6 trace that server_version_source_revision identified as 786bc312b85e58857cb26a24ab6e997ba0fdfc32, which turned out to be a duplicate of MDEV-24832.

In 10.6, MDEV-515 introduced a regression that was fixed by MDEV-24832 in a2fbbba2e3f2ee291163d74f3f4246e259a5cffe.

Roel, the commit 78c174785a7f05b4e97470be4f68d6326e6ef51f was in a development branch of MDEV-20612 that has been deleted. It was based on the 10.6 repository as of commit 3f871b339429441ad907ecf7dfabdc414797e664, which is between MDEV-515 and MDEV-24832.

This means that we will need new rr replay traces of the originally reported failure. If the trace is for 10.6, it will have to be either before MDEV-515 or with the MDEV-24832 fix.

Comment by Roel Van de Paar [ 2021-05-24 ]

I have not seen the assertion anymore since the MDEV-24832 fix was implemented.

Comment by Matthias Leich [ 2021-08-20 ]

The bug was observed again on
origin/10.6 b0d38448a176dc990554c7dd5b184c3ebe64be8b 2021-08-19T16:35:44+05:30
 
RQG
====
--------------------------------------
git clone https://github.com/mleich1/rqg --branch experimental RQG
 
perl rqg.pl \
--grammar=conf/engines/many_indexes.yy \
--gendata=conf/engines/many_indexes.zz \
--reporters=RestartConsistencyRR \                     #    Experimental derivate of RestartConsistency, but RestartConsistency replays too
--mysqld=--loose-innodb_lock_schedule_algorithm=fcfs \
--mysqld=--loose-idle_write_transaction_timeout=0 \
--mysqld=--loose-idle_transaction_timeout=0 \
--mysqld=--loose-idle_readonly_transaction_timeout=0 \
--mysqld=--connect_timeout=60 \
--mysqld=--interactive_timeout=28800 \
--mysqld=--slave_net_timeout=60 \
--mysqld=--net_read_timeout=30 \
--mysqld=--net_write_timeout=60 \
--mysqld=--loose-table_lock_wait_timeout=50 \
--mysqld=--wait_timeout=28800 \
--mysqld=--lock-wait-timeout=86400 \
--mysqld=--innodb-lock-wait-timeout=50 \
--no-mask \
--queries=10000000 \
--seed=random \
--reporters=Backtrace \
--reporters=ErrorLog \
--reporters=Deadlock1 \
--validators=None \
--mysqld=--log_output=none \
--mysqld=--log_bin_trust_function_creators=1 \
--mysqld=--loose-debug_assert_on_not_freed_memory=0 \
--engine=InnoDB \
--restart_timeout=240 \
--mysqld=--plugin-load-add=file_key_management.so \
--mysqld=--loose-file-key-management-filename=$RQG_HOME/conf/mariadb/encryption_keys.txt \
--duration=150 \
--mysqld=--loose-innodb_fatal_semaphore_wait_threshold=300 \
--mysqld=--innodb_stats_persistent=on \
--mysqld=--innodb_adaptive_hash_index=on \
--mysqld=--log-bin \
--mysqld=--sync-binlog=1 \
--mysqld=--loose-innodb_evict_tables_on_commit_debug=off \
--mysqld=--loose-max-statement-time=30 \
--threads=9 \
--mysqld=--innodb_use_native_aio=1 \
--mysqld=--innodb_undo_tablespaces=3 \
--mysqld=--innodb_undo_log_truncate=ON \
--mysqld=--innodb_page_size=16K \
--mysqld=--innodb-buffer-pool-size=8M \
--no_mask \
--workdir=<local settings>
--vardir=<local settings>
--mtr-build-thread=<local settings>
--basedir1=<local settings>
--script_debug=_nix_
 
The test above replays MDEV-26450 far way more often.

Comment by Marko Mäkelä [ 2022-08-02 ]

Sorry, I was too slow. While the trace is still there, the executable has been lost or moved:

marko@pluto:~$ rr replay /data/results/1641558610/MDEV-20203/run/user/1001/1641558610/202/1/rr/latest-trace
[FATAL /home/roc/rr/rr/src/TraceStream.cc:1146:read_mapped_region() errno: ENOENT] Failed to stat /data/Server_bin/preview-10.8-MDEV-14425-innodbC_asan/bin/mariadbd: replay is impossible

Comment by Matthias Leich [ 2022-08-15 ]

origin/bb-10.10-MDEV-11026 2acc2601910d5292f1ea46e06e5affeb56dc8010 2022-06-10T14:05:00+03:00
pluto:/data/results/1655120660/MDEV-20203$ _RR_TRACE_DIR=./1/rr/ rr replay
2022-06-13 13:53:51 0x7f440a0fb700  InnoDB: Assertion failure in file /data/Server/bb-10.10-MDEV-11026A/storage/innobase/btr/btr0sea.cc line 699
InnoDB: Failing assertion: (block)->index || (block)->n_pointers == 0
 
(rr) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007f442b7f6859 in __GI_abort () at abort.c:79
#2  0x00005654610a901d in ut_dbg_assertion_failed (expr=0x5654622d7380 "(block)->index || (block)->n_pointers == 0", file=0x5654622d6720 "/data/Server/bb-10.10-MDEV-11026A/storage/innobase/btr/btr0sea.cc", line=699)
    at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/ut/ut0dbg.cc:60
#3  0x000056546114509c in btr_search_update_hash_ref (info=0x61a00006f9a0, block=0x7f441ee97790, cursor=0x6230001a2868) at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/btr/btr0sea.cc:699
#4  0x000056546114ae08 in btr_search_info_update_slow (info=0x61a00006f9a0, cursor=0x6230001a2868) at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/btr/btr0sea.cc:1695
#5  0x00005654611012b3 in btr_search_info_update (index=0x616000a8b508, cursor=0x6230001a2868) at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/include/btr0sea.inl:83
#6  0x000056546110e6a6 in btr_cur_search_to_nth_level_func (index=0x616000a8b508, level=0, tuple=0x6230001a2e20, mode=PAGE_CUR_LE, latch_mode=1, cursor=0x6230001a2868, ahi_latch=0x0, mtr=0x7f440a0f7b10, autoinc=0)
    at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/btr/btr0cur.cc:2413
#7  0x0000565460fa1836 in btr_pcur_open_with_no_init_func (index=0x616000a8b508, tuple=0x6230001a2e20, mode=PAGE_CUR_LE, latch_mode=1, cursor=0x6230001a2868, ahi_latch=0x0, mtr=0x7f440a0f7b10)
    at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/include/btr0pcur.inl:390
#8  0x0000565460fb3aae in Row_sel_get_clust_rec_for_mysql::operator() (this=0x7f440a0f70f0, prebuilt=0x6230001a2588, sec_index=0x616000a92108, rec=0x7f441eeb8b2c "", thr=0x6230001a3028, out_rec=0x7f440a0f6ff0, 
    offsets=0x7f440a0f7050, offset_heap=0x7f440a0f7030, vrow=0x0, mtr=0x7f440a0f7b10) at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/row/row0sel.cc:3352
#9  0x0000565460fc1467 in row_search_mvcc (buf=0x6260001dd122 "", mode=PAGE_CUR_G, prebuilt=0x6230001a2588, match_mode=0, direction=1) at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/row/row0sel.cc:5466
#10 0x0000565460bafd31 in ha_innobase::general_fetch (this=0x61d0008ca0b8, buf=0x6260001dd122 "", direction=1, match_mode=0) at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/handler/ha_innodb.cc:9243
#11 0x0000565460bb0326 in ha_innobase::index_next (this=0x61d0008ca0b8, buf=0x6260001dd122 "") at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/handler/ha_innodb.cc:9298
#12 0x0000565460307239 in handler::ha_index_next (this=0x61d0008ca0b8, buf=0x6260001dd122 "") at /data/Server/bb-10.10-MDEV-11026A/sql/handler.cc:3522
#13 0x0000565460ab8d9c in ha_partition::handle_ordered_next (this=0x61d0008c96b8, buf=0x626000165138 "", is_next_same=false) at /data/Server/bb-10.10-MDEV-11026A/sql/ha_partition.cc:8302
#14 0x0000565460aa8774 in ha_partition::index_next (this=0x61d0008c96b8, buf=0x626000165138 "") at /data/Server/bb-10.10-MDEV-11026A/sql/ha_partition.cc:6135
#15 0x0000565460307239 in handler::ha_index_next (this=0x61d0008c96b8, buf=0x626000165138 "") at /data/Server/bb-10.10-MDEV-11026A/sql/handler.cc:3522
#16 0x000056545fc2a2f6 in join_read_next (info=0x629000e99f00) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_select.cc:22329
#17 0x000056545f7f4b00 in READ_RECORD::read_record (this=0x629000e99f00) at /data/Server/bb-10.10-MDEV-11026A/sql/records.h:81
#18 0x000056545fc23476 in sub_select (join=0x629000e98b38, join_tab=0x629000e99e38, end_of_records=false) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_select.cc:21297
#19 0x000056545fc21afd in do_select (join=0x629000e98b38, procedure=0x0) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_select.cc:20823
#20 0x000056545fbb2837 in JOIN::exec_inner (this=0x629000e98b38) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_select.cc:4787
#21 0x000056545fbb0080 in JOIN::exec (this=0x629000e98b38) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_select.cc:4565
#22 0x000056545fbb3c9e in mysql_select (thd=0x62b00021b218, tables=0x629000e97af8, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x629000e98b08, 
    unit=0x62b00021f438, select_lex=0x629000e97390) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_select.cc:5045
#23 0x000056545fb88b21 in handle_select (thd=0x62b00021b218, lex=0x62b00021f360, result=0x629000e98b08, setup_tables_done_option=0) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_select.cc:579
#24 0x000056545facabb8 in execute_sqlcom_select (thd=0x62b00021b218, all_tables=0x629000e97af8) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_parse.cc:6260
#25 0x000056545fab9832 in mysql_execute_command (thd=0x62b00021b218, is_called_from_prepared_stmt=false) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_parse.cc:3944
#26 0x000056545fad4c44 in mysql_parse (thd=0x62b00021b218, rawbuf=0x629000e97238 "SELECT `col_varchar_255_ucs2_key` FROM `table100_innodb_key_pk_parts_2_int_autoinc` /* E_R Thread3 QNO 13 CON_ID 21 */", length=118, 
    parser_state=0x7f440a0f9b10) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_parse.cc:8036
#27 0x000056545faace0c in dispatch_command (command=COM_QUERY, thd=0x62b00021b218, packet=0x629000e8d219 "", packet_length=119, blocking=true) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_parse.cc:1894
#28 0x000056545faaa253 in do_command (thd=0x62b00021b218, blocking=true) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_parse.cc:1407
#29 0x000056545feee367 in do_handle_one_connection (connect=0x608000003138, put_in_cache=true) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_connect.cc:1418
#30 0x000056545feedbf3 in handle_one_connection (arg=0x608000003138) at /data/Server/bb-10.10-MDEV-11026A/sql/sql_connect.cc:1312
#31 0x00007f442bd20609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#32 0x00007f442b8f3293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
(rr) quit
 
origin/bb-10.8-MDEV-27716 81ab5d74e5f2bdbb5b7f495c74113a9bbb63376f 2022-02-04T11:02:12+02:00
pluto:/data/results/1643977579/MDEV-20203/dev/shm/rqg/1643977579/256/1/rr
2022-02-04 15:29:36 0x7f178ed43700  InnoDB: Assertion failure in file /data/Server/bb-10.8-MDEV-27716A/storage/innobase/btr/btr0sea.cc line 699
InnoDB: Failing assertion: (block)->index || (block)->n_pointers == 0

Comment by Marko Mäkelä [ 2022-08-16 ]

There is a race condition around the assertion. Right after the time the crashing thread was reading block->index, another thread had created an adaptive hash index for the block.

bb-10.10-MDEV-11026 2acc2601910d5292f1ea46e06e5affeb56dc8010

#0  0x000056546114a7ad in btr_search_build_page_hash_index (
    index=0x616000a8b508, block=0x7f441ee97790, ahi_latch=0x615000003b40, 
    n_fields=1, n_bytes=0, left_side=false)
    at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/btr/btr0sea.cc:1642
#1  0x000056546114af27 in btr_search_info_update_slow (info=0x61a00006f9a0, 
    cursor=0x7f440d0e4c70)
    at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/btr/btr0sea.cc:1702
#2  0x00005654611012b3 in btr_search_info_update (index=0x616000a8b508, 
    cursor=0x7f440d0e4c70)
    at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/include/btr0sea.inl:83
#3  0x000056546110e6a6 in btr_cur_search_to_nth_level_func (
    index=0x616000a8b508, level=0, tuple=0x6130001ddcc8, mode=PAGE_CUR_LE, 
    latch_mode=1, cursor=0x7f440d0e4c70, ahi_latch=0x0, mtr=0x7f440d0e4e60, 
    autoinc=0)
    at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/btr/btr0cur.cc:2413
#4  0x0000565460bf47cd in btr_pcur_open_low (index=0x616000a8b508, level=0, 
    tuple=0x6130001ddcc8, mode=PAGE_CUR_LE, latch_mode=1, 
    cursor=0x7f440d0e4c70, autoinc=0, mtr=0x7f440d0e4e60)
    at /data/Server/bb-10.10-MDEV-11026A/storage/innobase/include/btr0pcur.inl:346

In other words, this particular failure looks like a failure of a bogus debug assertion and not a real error. There are other occurrences of assert_block_ahi_valid() that look equally racey (not protected by the AHI partition latch). One is located right at the start of btr_search_drop_page_hash_index() and even documented as being buggy:

void btr_search_drop_page_hash_index(buf_block_t* block)
{
	ulint			n_fields;
	ulint			n_bytes;
	const rec_t*		rec;
	mem_heap_t*		heap;
	rec_offs*		offsets;
 
retry:
	/* This debug check uses a dirty read that could theoretically cause
	false positives while buf_pool.clear_hash_index() is executing. */
	assert_block_ahi_valid(block);

I think that these bogus assertions would best be fixed (or removed) as part of MDEV-27700.

Generated at Thu Feb 08 08:57:37 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.