[MDEV-28941] SIGABRT in __libc_message + malloc_printerr + double free or corruption (!prev) Created: 2022-06-24  Updated: 2023-12-07

Status: Stalled
Project: MariaDB Server
Component/s: Virtual Columns
Affects Version/s: 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Ramesh Sivaraman Assignee: Aleksey Midenkov
Resolution: Unresolved Votes: 0
Labels: ASAN, duplicate, memory_corruption, not-10.2

Issue Links:
Duplicate
duplicates MDEV-29932 Invalid expr in cleanup_session_expr(... Closed

 Description   

10.[89] optimized build goes to hung mode when executing the given test case.

SET @@enforce_storage_engine=MEMORY;
SET sql_mode='';
CREATE TABLE t1 (c1 INT) ENGINE=InnoDB;
CREATE TEMPORARY TABLE t4 (c1 INT) ENGINE=InnoDB;
ALTER TABLE t1 ADD COLUMN c2 VARCHAR(20) NULL DEFAULT USER();
INSERT DELAYED INTO t1 VALUES (1,"b");
CREATE TRIGGER i5_t1 BEFORE INSERT ON t1 FOR EACH ROW CALL p4;

Leads to:

10.7.4 0a1d9d0681fda7595c0d08038357b56cf3bea9eb (Optimized)

Core was generated by `/test/MD160522-mariadb-10.7.4-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x1477fcfa2700 (LWP 3318000))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x0000147815708859 in __GI_abort () at abort.c:79
#2  0x00001478157733ee in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x14781589d285 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3  0x000014781577b47c in malloc_printerr (str=str@entry=0x14781589f690 "double free or corruption (!prev)") at malloc.c:5347
#4  0x000014781577d12c in _int_free (av=0x1478158ceb80 <main_arena>, p=0x1477c8002fc0, have_lock=<optimized out>) at malloc.c:4317
#5  0x000055ab50a99d75 in root_free (root=0x1477c8002550, size=<optimized out>, ptr=<optimized out>) at /test/10.7_opt/mysys/my_alloc.c:78
#6  free_root (root=root@entry=0x1477c8002550, MyFlags=MyFlags@entry=0) at /test/10.7_opt/mysys/my_alloc.c:501
#7  0x000055ab504997ee in closefrm (table=table@entry=0x1477c8002298) at /test/10.7_opt/sql/table.cc:4538
#8  0x000055ab505717c2 in intern_close_table (table=0x1477c8002298) at /test/10.7_opt/sql/table_cache.cc:220
#9  tc_remove_table (table=0x1477c8002298) at /test/10.7_opt/sql/table_cache.cc:258
#10 tc_release_table (table=0x1477c8002298) at /test/10.7_opt/sql/table_cache.cc:449
#11 0x000055ab5034b643 in close_thread_table (thd=thd@entry=0x1477c4000c58, table_ptr=table_ptr@entry=0x1477c4000d48) at /test/10.7_opt/sql/sql_base.cc:991
#12 0x000055ab5034c87b in close_all_tables_for_name (thd=thd@entry=0x1477c4000c58, share=<optimized out>, extra=extra@entry=HA_EXTRA_NOT_USED, skip_table=skip_table@entry=0x0) at /test/10.7_opt/sql/sql_base.cc:751
#13 0x000055ab50479e49 in mysql_create_or_drop_trigger (thd=thd@entry=0x1477c4000c58, tables=<optimized out>, create=create@entry=true) at /test/10.7_opt/sql/sql_trigger.cc:714
#14 0x000055ab503c1a9f in mysql_execute_command (thd=0x1477c4000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.7_opt/sql/sql_parse.cc:5832
#15 0x000055ab503b0015 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x1477c4000c58) at /test/10.7_opt/sql/sql_parse.cc:8043
#16 mysql_parse (thd=0x1477c4000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.7_opt/sql/sql_parse.cc:7965
#17 0x000055ab503bbe82 in dispatch_command (command=COM_QUERY, thd=0x1477c4000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.7_opt/sql/sql_class.h:1360
#18 0x000055ab503bddd8 in do_command (thd=0x1477c4000c58, blocking=blocking@entry=true) at /test/10.7_opt/sql/sql_parse.cc:1407
#19 0x000055ab504d226f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55ab531ad2f8, put_in_cache=put_in_cache@entry=true) at /test/10.7_opt/sql/sql_connect.cc:1418
#20 0x000055ab504d255d in handle_one_connection (arg=0x55ab531ad2f8) at /test/10.7_opt/sql/sql_connect.cc:1312
#21 0x0000147815c17609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#22 0x0000147815805293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.9.2 6ec17142dcfb1e9d9f41211ed1b6d82e062d1541 (Debug)

Core was generated by `/test/MD280522-mariadb-10.9.2-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055ec43f79dfc in Virtual_column_info::cleanup_session_expr (
    this=0x14945c0161d0) at /test/10.9_dbg/sql/table.cc:3658
[Current thread is 1 (Thread 0x14949c8c5700 (LWP 3275708))]
(gdb) bt
#0  0x000055ec43f79dfc in Virtual_column_info::cleanup_session_expr (this=0x14945c0161d0) at /test/10.9_dbg/sql/table.cc:3658
#1  0x000055ec43f7a199 in TABLE::vcol_cleanup_expr (this=this@entry=0x149460003f48, thd=thd@entry=0x14945c0332e8) at /test/10.9_dbg/sql/table.cc:3752
#2  0x000055ec43dd9772 in close_thread_table (thd=thd@entry=0x14945c0332e8, table_ptr=table_ptr@entry=0x14945c0333d8) at /test/10.9_dbg/sql/sql_base.cc:968
#3  0x000055ec43dd9c9e in close_thread_tables (thd=0x14945c0332e8) at /test/10.9_dbg/sql/sql_base.cc:942
#4  0x000055ec43e22f16 in handle_delayed_insert (arg=0x14945c0332c8) at /test/10.9_dbg/sql/sql_insert.cc:3413
#5  0x00001494b59d2609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#6  0x00001494b55c0293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.2.44 (dbg), 10.3.36 (dbg), 10.4.26 (dbg), 10.5.17 (dbg), 10.6.9 (dbg), 10.7.4 (opt), 10.7.5 (dbg), 10.8.3 (opt), 10.8.4 (dbg), 10.9.2 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.44 (opt), 10.3.35 (opt), 10.4.25 (opt), 10.5.16 (opt), 10.6.8 (opt)



 Comments   
Comment by Roel Van de Paar [ 2022-12-03 ]

The original testcase produces the same ASAN error as MDEV-29932; it is likely the same bug.

Generated at Thu Feb 08 10:04:38 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.