[MDEV-23794] Server crashes in bitmap_bits_set / pack_row / THD::binlog_write_row or bitmap_is_set / max_row_length / THD::binlog_write_row Created: 2020-09-22  Updated: 2023-04-27

Status: Open
Project: MariaDB Server
Component/s: Partitioning, Replication, Storage Engine - InnoDB
Affects Version/s: 10.1, 10.2, 10.3, 10.4
Fix Version/s: 10.4

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Andrei Elkin
Resolution: Unresolved Votes: 0
Labels: not-10.5


 Description   

--source include/have_innodb.inc
--source include/have_partition.inc
--source include/have_binlog_format_row.inc
 
CREATE TABLE t1 (a INT) ENGINE=InnoDB PARTITION BY RANGE (a) (PARTITION p0 VALUES LESS THAN (0), PARTITION pn VALUES LESS THAN MAXVALUE);
INSERT INTO t1 VALUES (1),(2);
ALTER TABLE t1 DROP a, ADD a INT;
ALTER TABLE t1 REPAIR PARTITION pn;
 
# Cleanup
DROP TABLE t1;

10.2 e05650e6

#3  <signal handler called>
#4  0x0000562332cafcf3 in bitmap_bits_set (map=0x0) at /data/src/10.2/mysys/my_bitmap.c:610
#5  0x000056233265c64f in pack_row (table=0x7febf80a2260, cols=0x0, row_data=0x7febf808fcf0 '\245' <repeats 14 times>, '\217' <repeats 186 times>..., record=0x7febf80a2e88 "\377") at /data/src/10.2/sql/rpl_record.cc:65
#6  0x00005623322595e5 in THD::binlog_write_row (this=0x7febf8000d90, table=0x7febf80a2260, is_trans=true, record=0x7febf80a2e88 "\377") at /data/src/10.2/sql/sql_class.cc:6413
#7  0x000056233252ba41 in Write_rows_log_event::binlog_row_logging_function (thd=0x7febf8000d90, table=0x7febf80a2260, is_transactional=true, before_record=0x0, after_record=0x7febf80a2e88 "\377") at /data/src/10.2/sql/log_event.h:4727
#8  0x0000562332528b96 in binlog_log_row_internal (table=0x7febf80a2260, before_record=0x0, after_record=0x7febf80a2e88 "\377", log_func=0x56233252ba08 <Write_rows_log_event::binlog_row_logging_function(THD*, TABLE*, bool, unsigned char const*, unsigned char const*)>) at /data/src/10.2/sql/handler.cc:5952
#9  0x0000562332528d6f in binlog_log_row (table=0x7febf80a2260, before_record=0x0, after_record=0x7febf80a2e88 "\377", log_func=0x56233252ba08 <Write_rows_log_event::binlog_row_logging_function(THD*, TABLE*, bool, unsigned char const*, unsigned char const*)>) at /data/src/10.2/sql/handler.cc:5988
#10 0x00005623325294bd in handler::ha_write_row (this=0x7febf808d158, buf=0x7febf80a2e88 "\377") at /data/src/10.2/sql/handler.cc:6115
#11 0x0000562332c3a542 in ha_partition::check_misplaced_rows (this=0x7febf8035348, read_part_id=1, do_repair=true) at /data/src/10.2/sql/ha_partition.cc:8991
#12 0x0000562332c28369 in ha_partition::handle_opt_part (this=0x7febf8035348, thd=0x7febf8000d90, check_opt=0x7febf80058a8, part_id=1, flag=4) at /data/src/10.2/sql/ha_partition.cc:1247
#13 0x0000562332c28b1c in ha_partition::handle_opt_partitions (this=0x7febf8035348, thd=0x7febf8000d90, check_opt=0x7febf80058a8, flag=4) at /data/src/10.2/sql/ha_partition.cc:1406
#14 0x0000562332c28065 in ha_partition::repair (this=0x7febf8035348, thd=0x7febf8000d90, check_opt=0x7febf80058a8) at /data/src/10.2/sql/ha_partition.cc:1159
#15 0x00005623325246c5 in handler::ha_repair (this=0x7febf8035348, thd=0x7febf8000d90, check_opt=0x7febf80058a8) at /data/src/10.2/sql/handler.cc:4157
#16 0x00005623323fe927 in mysql_admin_table (thd=0x7febf8000d90, tables=0x7febf80128f0, check_opt=0x7febf80058a8, operator_name=0x562332d87065 "repair", lock_type=TL_WRITE, org_open_for_modify=true, repair_table_use_frm=false, extra_open_options=32, prepare_func=0x5623323fc90b <prepare_for_repair(THD*, TABLE_LIST*, HA_CHECK_OPT*)>, operator_func=(int (handler::*)(handler * const, THD *, HA_CHECK_OPT *)) 0x56233252467c <handler::ha_repair(THD*, st_ha_check_opt*)>, view_operator_func=0x5623323981b9 <view_repair(THD*, TABLE_LIST*, st_ha_check_opt*)>) at /data/src/10.2/sql/sql_admin.cc:788
#17 0x000056233240109a in Sql_cmd_repair_table::execute (this=0x7febf8012f28, thd=0x7febf8000d90) at /data/src/10.2/sql/sql_admin.cc:1403
#18 0x00005623326e12db in Sql_cmd_alter_table_repair_partition::execute (this=0x7febf8012f28, thd=0x7febf8000d90) at /data/src/10.2/sql/sql_partition_admin.cc:725
#19 0x00005623322a0c21 in mysql_execute_command (thd=0x7febf8000d90) at /data/src/10.2/sql/sql_parse.cc:5964
#20 0x00005623322a5c37 in mysql_parse (thd=0x7febf8000d90, rawbuf=0x7febf80127f8 "ALTER TABLE t1 REPAIR PARTITION pn", length=34, parser_state=0x7fec49a805f0, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7733
#21 0x0000562332293f46 in dispatch_command (command=COM_QUERY, thd=0x7febf8000d90, packet=0x7febf8008c51 "", packet_length=34, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1823
#22 0x0000562332292a41 in do_command (thd=0x7febf8000d90) at /data/src/10.2/sql/sql_parse.cc:1377
#23 0x00005623323ec413 in do_handle_one_connection (connect=0x5623349716d0) at /data/src/10.2/sql/sql_connect.cc:1336
#24 0x00005623323ec178 in handle_one_connection (arg=0x5623349716d0) at /data/src/10.2/sql/sql_connect.cc:1241
#25 0x0000562332c10782 in pfs_spawn_thread (arg=0x56233497a450) at /data/src/10.2/storage/perfschema/pfs.cc:1869
#26 0x00007fec4fb6f609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#27 0x00007fec4f749103 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Reproducible on 10.1-10.4, non-debug, debug and ASAN builds alike.
Not reproducible on 10.5.

A slight change in the test case causes somewhat different stack trace (the difference is in the first ALTER):

--source include/have_innodb.inc
--source include/have_partition.inc
--source include/have_binlog_format_row.inc
 
CREATE TABLE t1 (a INT) ENGINE=InnoDB PARTITION BY RANGE (a) (PARTITION p0 VALUES LESS THAN (0), PARTITION pn VALUES LESS THAN MAXVALUE);
INSERT INTO t1 VALUES (1),(2);
ALTER TABLE t1 DROP a, ADD (x TEXT, a INT);
ALTER TABLE t1 REPAIR PARTITION pn;
 
# Cleanup
DROP TABLE t1;

10.2 e05650e6

#3  <signal handler called>
#4  0x0000558f8d3428ac in bitmap_is_set (map=0x0, bit=0) at /data/src/10.2/include/my_bitmap.h:131
#5  0x0000558f8d357ebb in max_row_length (table=0x7f34d80a2260, cols=0x0, data=0x7f34d80a2e88 "\377") at /data/src/10.2/sql/table.cc:7557
#6  0x0000558f8d20257e in THD::binlog_write_row (this=0x7f34d8000d90, table=0x7f34d80a2260, is_trans=true, record=0x7f34d80a2e88 "\377") at /data/src/10.2/sql/sql_class.cc:6407
#7  0x0000558f8d4d4a41 in Write_rows_log_event::binlog_row_logging_function (thd=0x7f34d8000d90, table=0x7f34d80a2260, is_transactional=true, before_record=0x0, after_record=0x7f34d80a2e88 "\377") at /data/src/10.2/sql/log_event.h:4727
#8  0x0000558f8d4d1b96 in binlog_log_row_internal (table=0x7f34d80a2260, before_record=0x0, after_record=0x7f34d80a2e88 "\377", log_func=0x558f8d4d4a08 <Write_rows_log_event::binlog_row_logging_function(THD*, TABLE*, bool, unsigned char const*, unsigned char const*)>) at /data/src/10.2/sql/handler.cc:5952
#9  0x0000558f8d4d1d6f in binlog_log_row (table=0x7f34d80a2260, before_record=0x0, after_record=0x7f34d80a2e88 "\377", log_func=0x558f8d4d4a08 <Write_rows_log_event::binlog_row_logging_function(THD*, TABLE*, bool, unsigned char const*, unsigned char const*)>) at /data/src/10.2/sql/handler.cc:5988
#10 0x0000558f8d4d24bd in handler::ha_write_row (this=0x7f34d808d468, buf=0x7f34d80a2e88 "\377") at /data/src/10.2/sql/handler.cc:6115
#11 0x0000558f8dbe3542 in ha_partition::check_misplaced_rows (this=0x7f34d8035348, read_part_id=1, do_repair=true) at /data/src/10.2/sql/ha_partition.cc:8991
#12 0x0000558f8dbd1369 in ha_partition::handle_opt_part (this=0x7f34d8035348, thd=0x7f34d8000d90, check_opt=0x7f34d80058a8, part_id=1, flag=4) at /data/src/10.2/sql/ha_partition.cc:1247
#13 0x0000558f8dbd1b1c in ha_partition::handle_opt_partitions (this=0x7f34d8035348, thd=0x7f34d8000d90, check_opt=0x7f34d80058a8, flag=4) at /data/src/10.2/sql/ha_partition.cc:1406
#14 0x0000558f8dbd1065 in ha_partition::repair (this=0x7f34d8035348, thd=0x7f34d8000d90, check_opt=0x7f34d80058a8) at /data/src/10.2/sql/ha_partition.cc:1159
#15 0x0000558f8d4cd6c5 in handler::ha_repair (this=0x7f34d8035348, thd=0x7f34d8000d90, check_opt=0x7f34d80058a8) at /data/src/10.2/sql/handler.cc:4157
#16 0x0000558f8d3a7927 in mysql_admin_table (thd=0x7f34d8000d90, tables=0x7f34d80128f0, check_opt=0x7f34d80058a8, operator_name=0x558f8dd30065 "repair", lock_type=TL_WRITE, org_open_for_modify=true, repair_table_use_frm=false, extra_open_options=32, prepare_func=0x558f8d3a590b <prepare_for_repair(THD*, TABLE_LIST*, HA_CHECK_OPT*)>, operator_func=(int (handler::*)(class handler * const, class THD *, HA_CHECK_OPT *)) 0x558f8d4cd67c <handler::ha_repair(THD*, st_ha_check_opt*)>, view_operator_func=0x558f8d3411b9 <view_repair(THD*, TABLE_LIST*, st_ha_check_opt*)>) at /data/src/10.2/sql/sql_admin.cc:788
#17 0x0000558f8d3aa09a in Sql_cmd_repair_table::execute (this=0x7f34d8012f28, thd=0x7f34d8000d90) at /data/src/10.2/sql/sql_admin.cc:1403
#18 0x0000558f8d68a2db in Sql_cmd_alter_table_repair_partition::execute (this=0x7f34d8012f28, thd=0x7f34d8000d90) at /data/src/10.2/sql/sql_partition_admin.cc:725
#19 0x0000558f8d249c21 in mysql_execute_command (thd=0x7f34d8000d90) at /data/src/10.2/sql/sql_parse.cc:5964
#20 0x0000558f8d24ec37 in mysql_parse (thd=0x7f34d8000d90, rawbuf=0x7f34d80127f8 "ALTER TABLE t1 REPAIR PARTITION pn", length=34, parser_state=0x7f352c0755f0, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7733
#21 0x0000558f8d23cf46 in dispatch_command (command=COM_QUERY, thd=0x7f34d8000d90, packet=0x7f34d8008c51 "", packet_length=34, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1823
#22 0x0000558f8d23ba41 in do_command (thd=0x7f34d8000d90) at /data/src/10.2/sql/sql_parse.cc:1377
#23 0x0000558f8d395413 in do_handle_one_connection (connect=0x558f90e256e0) at /data/src/10.2/sql/sql_connect.cc:1336
#24 0x0000558f8d395178 in handle_one_connection (arg=0x558f90e256e0) at /data/src/10.2/sql/sql_connect.cc:1241
#25 0x0000558f8dbb9782 in pfs_spawn_thread (arg=0x558f90e2e460) at /data/src/10.2/storage/perfschema/pfs.cc:1869
#26 0x00007f3531947609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#27 0x00007f3531521103 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95


Generated at Thu Feb 08 09:25:06 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.