[MDEV-25906] SIGSEGV in flush_tables_with_read_lock on FTWRL or FTFE | SIGSEGV in ha_maria::extra Created: 2021-06-13  Updated: 2021-08-20  Resolved: 2021-07-02

Status: Closed
Project: MariaDB Server
Component/s: Locking, Views
Affects Version/s: 10.6
Fix Version/s: 10.6.3

Type: Bug Priority: Blocker
Reporter: Roel Van de Paar Assignee: Sergei Golubchik
Resolution: Fixed Votes: 0
Labels: not-10.2, not-10.3, not-10.4, not-10.5, regression

Issue Links:
Relates
relates to MDEV-26456 SIGSEGV in flush_tables_with_read_loc... Closed
relates to MDEV-15888 Implement FLUSH TABLES tbl_name [, tb... Closed
relates to MDEV-25837 Assertion `thd->locked_tables_mode ==... Closed

 Description   

Similar to MDEV-25837 but not the same stack. This crashes optimized builds also.

CREATE VIEW v AS SELECT 1 FROM (SELECT 1) AS d;
 
FLUSH TABLE v WITH READ LOCK;

Leads to:

10.6.2 6c39eaeb126328e7813b146ecf652d51e4508981 (Debug)

 
Core was generated by `/test/MD120621-mariadb-10.6.2-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x0000555e54592a4e in flush_tables_with_read_lock (thd=thd@entry=
 
    0x152928000db8, all_tables=<optimized out>)
 
    at /test/10.6_dbg/sql/table.h:2755
 
2755	  bool is_view() const { return (derived_type & DTYPE_VIEW); }
 
[Current thread is 1 (Thread 0x152964d70700 (LWP 1650774))]
 
(gdb) bt
 
#0  0x0000555e54592a4e in flush_tables_with_read_lock (thd=thd@entry=0x152928000db8, all_tables=<optimized out>) at /test/10.6_dbg/sql/table.h:2755
 
#1  0x0000555e543fe6f3 in mysql_execute_command (thd=thd@entry=0x152928000db8) at /test/10.6_dbg/sql/sql_parse.cc:5397
 
#2  0x0000555e543e6890 in mysql_parse (thd=thd@entry=0x152928000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152964d6f400) at /test/10.6_dbg/sql/sql_parse.cc:8016
 
#3  0x0000555e543f53fa in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152928000db8, packet=packet@entry=0x15292800b769 "FLUSH TABLE v WITH READ LOCK", packet_length=packet_length@entry=28, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_class.h:1340
 
#4  0x0000555e543f87da in do_command (thd=0x152928000db8, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_parse.cc:1406
 
#5  0x0000555e5455cc8e in do_handle_one_connection (connect=<optimized out>, connect@entry=0x555e5867f418, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410
 
#6  0x0000555e5455d293 in handle_one_connection (arg=arg@entry=0x555e5867f418) at /test/10.6_dbg/sql/sql_connect.cc:1312
 
#7  0x0000555e54a0b166 in pfs_spawn_thread (arg=0x555e58567d08) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
 
#8  0x000015297a0f8609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#9  0x0000152979ce7293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.6.2 6c39eaeb126328e7813b146ecf652d51e4508981 (Optimized)

 
Core was generated by `/test/MD120621-mariadb-10.6.2-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x00005637f4fe191d in flush_tables_with_read_lock (thd=thd@entry=
 
    0x1527f0000c58, all_tables=<optimized out>)
 
    at /test/10.6_opt/sql/table.h:2755
 
2755	  bool is_view() const { return (derived_type & DTYPE_VIEW); }
 
[Current thread is 1 (Thread 0x152828c84700 (LWP 2224119))]
 
(gdb) bt
 
#0  0x00005637f4fe191d in flush_tables_with_read_lock (thd=thd@entry=0x1527f0000c58, all_tables=<optimized out>) at /test/10.6_opt/sql/table.h:2755
 
#1  0x00005637f4eba49c in mysql_execute_command (thd=0x1527f0000c58) at /test/10.6_opt/sql/sql_parse.cc:5397
 
#2  0x00005637f4ea73f4 in mysql_parse (thd=0x1527f0000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:8016
 
#3  0x00005637f4eb3295 in dispatch_command (command=COM_QUERY, thd=0x1527f0000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.6_opt/sql/sql_class.h:1340
 
#4  0x00005637f4eb51f7 in do_command (thd=0x1527f0000c58, blocking=blocking@entry=true) at /test/10.6_opt/sql/sql_parse.cc:1406
 
#5  0x00005637f4fc3057 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/10.6_opt/sql/sql_connect.cc:1410
 
#6  0x00005637f4fc33bd in handle_one_connection (arg=arg@entry=0x5637f7b26f68) at /test/10.6_opt/sql/sql_connect.cc:1312
 
#7  0x00005637f534c8f8 in pfs_spawn_thread (arg=0x5637f7ad58c8) at /test/10.6_opt/storage/perfschema/pfs.cc:2201
 
#8  0x000015283f039609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#9  0x000015283ec28293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.6.2 (dbg), 10.6.2 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.38 (dbg), 10.2.38 (opt), 10.3.29 (dbg), 10.3.29 (opt), 10.4.19 (dbg), 10.4.19 (opt), 10.5.10 (dbg), 10.5.10 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.34 (dbg), 5.7.34 (opt), 8.0.24 (dbg), 8.0.24 (opt)

 Comments   
Comment by Roel Van de Paar [ 2021-06-13 ]

Secondary testcase with FOR EXPORT:

CREATE VIEW v1 AS SELECT 1 FROM (SELECT 1) as d;
 
FLUSH TABLES v1 FOR EXPORT;

Leads to:

10.6.2 6c39eaeb126328e7813b146ecf652d51e4508981 (Debug)

 
Core was generated by `/test/MD120621-mariadb-10.6.2-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x0000561d849669d4 in flush_tables_with_read_lock (thd=thd@entry=
 
    0x153d50000db8, all_tables=0x153d50014080)
 
    at /test/10.6_dbg/sql/table.h:2755
 
2755	  bool is_view() const { return (derived_type & DTYPE_VIEW); }
 
[Current thread is 1 (Thread 0x153d984ad700 (LWP 2820678))]
 
(gdb) bt
 
#0  0x0000561d849669d4 in flush_tables_with_read_lock (thd=thd@entry=0x153d50000db8, all_tables=0x153d50014080) at /test/10.6_dbg/sql/table.h:2755
 
#1  0x0000561d847d26f3 in mysql_execute_command (thd=thd@entry=0x153d50000db8) at /test/10.6_dbg/sql/sql_parse.cc:5397
 
#2  0x0000561d847ba890 in mysql_parse (thd=thd@entry=0x153d50000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x153d984ac400) at /test/10.6_dbg/sql/sql_parse.cc:8016
 
#3  0x0000561d847c93fa in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x153d50000db8, packet=packet@entry=0x153d5000b769 "FLUSH TABLES v1 FOR EXPORT", packet_length=packet_length@entry=26, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_class.h:1340
 
#4  0x0000561d847cc7da in do_command (thd=0x153d50000db8, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_parse.cc:1406
 
#5  0x0000561d84930c8e in do_handle_one_connection (connect=<optimized out>, connect@entry=0x561d88092338, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410
 
#6  0x0000561d84931293 in handle_one_connection (arg=arg@entry=0x561d88092338) at /test/10.6_dbg/sql/sql_connect.cc:1312
 
#7  0x0000561d84ddf166 in pfs_spawn_thread (arg=0x561d87f7acf8) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
 
#8  0x0000153d9c579609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#9  0x0000153d9c168293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.6.2 (dbg), 10.6.2 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.38 (dbg), 10.2.38 (opt), 10.3.29 (dbg), 10.3.29 (opt), 10.4.19 (dbg), 10.4.19 (opt), 10.5.10 (dbg), 10.5.10 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.34 (dbg), 5.7.34 (opt), 8.0.24 (dbg), 8.0.24 (opt)

Comment by Roel Van de Paar [ 2021-06-13 ]

It looks like a check is missing; 10.5 Output to compare:

10.5.10 dd07cfcecd4aabb0aeae9c4f5087f82b4080c1bd (Debug)

 
10.5.10-dbg>CREATE VIEW v1 AS SELECT 1 FROM (SELECT 1) as d;
 
Query OK, 0 rows affected (0.007 sec)
 
 
 
10.5.10-dbg>FLUSH TABLES v1 FOR EXPORT;
 
ERROR 1347 (HY000): 'test.v1' is not of type 'BASE TABLE'
 
 
 
10.5.10-dbg>CREATE VIEW v AS SELECT 1 FROM (SELECT 1) AS d;
 
Query OK, 0 rows affected (0.003 sec)
 
 
 
10.5.10-dbg>FLUSH TABLE v WITH READ LOCK;
 
ERROR 1347 (HY000): 'test.v' is not of type 'BASE TABLE'

Comment by Roel Van de Paar [ 2021-06-13 ]

Different stack with this similar testcase:

CREATE VIEW v(c) AS SELECT column_name FROM information_schema.columns;
 
FLUSH TABLE v WITH READ LOCK;

Leads to:

10.6.2 6c39eaeb126328e7813b146ecf652d51e4508981 (Debug)

 
Core was generated by `/test/MD120621-mariadb-10.6.2-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x0000556f5d2d5c78 in ha_maria::extra (this=0x1484b0021790, 
    operation=HA_EXTRA_FLUSH) at /test/10.6_dbg/storage/maria/ha_maria.cc:2671
 
2671	  if (operation == HA_EXTRA_WRITE_CACHE && has_long_unique())
 
[Current thread is 1 (Thread 0x1484e0f56700 (LWP 1825731))]
 
(gdb) bt
 
#0  0x0000556f5d2d5c78 in ha_maria::extra (this=0x1484b0021790, operation=HA_EXTRA_FLUSH) at /test/10.6_dbg/storage/maria/ha_maria.cc:2671
 
#1  0x0000556f5cf1ba60 in flush_tables_with_read_lock (thd=thd@entry=0x1484b0000db8, all_tables=<optimized out>) at /test/10.6_dbg/sql/table.h:2755
 
#2  0x0000556f5cd876f3 in mysql_execute_command (thd=thd@entry=0x1484b0000db8) at /test/10.6_dbg/sql/sql_parse.cc:5397
 
#3  0x0000556f5cd6f890 in mysql_parse (thd=thd@entry=0x1484b0000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1484e0f55400) at /test/10.6_dbg/sql/sql_parse.cc:8016
 
#4  0x0000556f5cd7e3fa in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1484b0000db8, packet=packet@entry=0x1484b000b769 "FLUSH TABLE v WITH READ LOCK", packet_length=packet_length@entry=28, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_class.h:1340
 
#5  0x0000556f5cd817da in do_command (thd=0x1484b0000db8, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_parse.cc:1406
 
#6  0x0000556f5cee5c8e in do_handle_one_connection (connect=<optimized out>, connect@entry=0x556f600da408, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410
 
#7  0x0000556f5cee6293 in handle_one_connection (arg=arg@entry=0x556f600da408) at /test/10.6_dbg/sql/sql_connect.cc:1312
 
#8  0x0000556f5d394166 in pfs_spawn_thread (arg=0x556f5ffc2aa8) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
 
#9  0x00001484f62ec609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#10 0x00001484f5edb293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.6.2 (dbg), 10.6.2 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.38 (dbg), 10.2.38 (opt), 10.3.29 (dbg), 10.3.29 (opt), 10.4.19 (dbg), 10.4.19 (opt), 10.5.10 (dbg), 10.5.10 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.34 (dbg), 5.7.34 (opt), 8.0.24 (dbg), 8.0.24 (opt)

Comment by Jan Lindström (Inactive) [ 2021-06-29 ]

https://github.com/MariaDB/server/commit/3573429c87956f1f51162ba08280ab009d204412

Comment by Oleksandr Byelkin [ 2021-07-01 ]

https://github.com/MariaDB/server/commit/b29ec61724dcac751592b7c83d33d2d600b6bc2e

Generated at Thu Feb 08 09:41:18 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.