[MDEV-32487] SIGSEGV in ha_resolve_storage_engine_name Created: 2023-10-17  Updated: 2024-01-17

Status: Confirmed
Project: MariaDB Server
Component/s: Storage Engine - Spider
Affects Version/s: 10.4, 10.5, 10.11, 11.2, 11.3, 11.4
Fix Version/s: 10.4, 10.5, 10.11, 11.2, 11.3

Type: Bug Priority: Critical
Reporter: Roel Van de Paar Assignee: Yuchen Pei
Resolution: Unresolved Votes: 0
Labels: affects-tests, sporadic

Attachments: File MDEV-32487_1.sql    
Issue Links:
Blocks
Relates

 Description   

The bug is seen very often in both optimized and debug builds, and yet any direct attempts at reproducing it always fail. Also, the SQL traces are at times empty, indicating that the issue can happen very close to startup. The issue stops many test runs short.

preview-11.3-preview 76e20f00772148fa928c6c6e42401f38ca89abf0 (Debug)

Core was generated by `/test/HEAD_preview_11.3_preview_MD171023-mariadb-11.3.0-linux-x86_64-dbg/bin/ma'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055e400f34711 in ha_resolve_storage_engine_name (
    db_type=<optimized out>)
    at /test/preview-11.3-preview_dbg/sql/handler.h:5546
5546	          db_type == view_pseudo_hton ? "VIEW" : hton_name(db_type)->str);
[Current thread is 1 (Thread 0x14b940073640 (LWP 45814))]
(gdb) bt
#0  0x000055e400f34711 in ha_resolve_storage_engine_name (db_type=<optimized out>) at /test/preview-11.3-preview_dbg/sql/handler.h:5546
#1  check_engine (thd=thd@entry=0x14b8a4000d58, db_name=<optimized out>, table_name=0x14b8a4013590 "t1", create_info=create_info@entry=0x14b940070200) at /test/preview-11.3-preview_dbg/sql/sql_table.cc:12498
#2  0x000055e400f3dc30 in create_table_impl (thd=thd@entry=0x14b8a4000d58, ddl_log_state_create=ddl_log_state_create@entry=0x14b94006ff80, ddl_log_state_rm=<optimized out>, ddl_log_state_rm@entry=0x14b940070110, orig_db=@0x14b8a40135e0: {str = 0x14b8a4013cd8 "test", length = 4}, orig_table_name=@0x14b8a40135f0: {str = 0x14b8a4013590 "t1", length = 2}, db=@0x14b8a40135e0: {str = 0x14b8a4013cd8 "test", length = 4}, table_name=@0x14b8a40135f0: {str = 0x14b8a4013590 "t1", length = 2}, path=@0x14b94006fc40: {str = 0x14b94006fc60 "./test/t1", length = 9}, options=<optimized out>, create_info=0x14b940070200, alter_info=0x14b940070020, create_table_mode=0, is_trans=0x14b94006ff60, key_info=0x14b94006fc38, key_count=0x14b94006fc34, frm=0x14b94006fc50) at /test/preview-11.3-preview_dbg/sql/sql_table.cc:4576
#3  0x000055e400f3eae2 in mysql_create_table_no_lock (thd=thd@entry=0x14b8a4000d58, ddl_log_state_create=ddl_log_state_create@entry=0x14b94006ff80, ddl_log_state_rm=ddl_log_state_rm@entry=0x14b940070110, db=db@entry=0x14b8a40135e0, table_name=table_name@entry=0x14b8a40135f0, create_info=create_info@entry=0x14b940070200, alter_info=0x14b940070020, is_trans=0x14b94006ff60, create_table_mode=0, table_list=0x14b8a40135c8) at /test/preview-11.3-preview_dbg/sql/sql_table.cc:4766
#4  0x000055e400f409f2 in mysql_create_table (alter_info=0x14b940070020, create_info=0x14b940070200, create_table=0x14b8a40135c8, thd=0x14b8a4000d58) at /test/preview-11.3-preview_dbg/sql/sql_table.cc:4882
#5  Sql_cmd_create_table_like::execute (this=<optimized out>, thd=0x14b8a4000d58) at /test/preview-11.3-preview_dbg/sql/sql_table.cc:12819
#6  0x000055e400e5f0d2 in mysql_execute_command (thd=thd@entry=0x14b8a4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/preview-11.3-preview_dbg/sql/sql_parse.cc:5723
#7  0x000055e400e60433 in mysql_parse (thd=thd@entry=0x14b8a4000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14b9400721e0) at /test/preview-11.3-preview_dbg/sql/sql_parse.cc:7734
#8  0x000055e400e627a9 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14b8a4000d58, packet=packet@entry=0x14b8a400b119 "CREATE TABLE t1 (a INT) ENGINE=Spider AUTO_INCREMENT_MODE=4;", packet_length=packet_length@entry=60, blocking=blocking@entry=true) at /test/preview-11.3-preview_dbg/sql/sql_class.h:251
#9  0x000055e400e648d6 in do_command (thd=0x14b8a4000d58, blocking=blocking@entry=true) at /test/preview-11.3-preview_dbg/sql/sql_parse.cc:1406
#10 0x000055e400fc46a3 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55e403b2ecf8, put_in_cache=put_in_cache@entry=true) at /test/preview-11.3-preview_dbg/sql/sql_connect.cc:1445
#11 0x000055e400fc4998 in handle_one_connection (arg=arg@entry=0x55e403b2ecf8) at /test/preview-11.3-preview_dbg/sql/sql_connect.cc:1347
#12 0x000055e4014073ba in pfs_spawn_thread (arg=0x55e403aaa618) at /test/preview-11.3-preview_dbg/storage/perfschema/pfs.cc:2201
#13 0x000014b958694ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#14 0x000014b958726a40 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

The crash always seems to happen on line 5546 in sql/handler.h:

db_type == view_pseudo_hton ? "VIEW" : hton_name(db_type)->str);



 Comments   
Comment by Roel Van de Paar [ 2023-10-17 ]

The code itself has not changed recently
https://github.com/MariaDB/server/blame/preview-11.3-preview/sql/handler.h#L5546

Comment by Sergei Golubchik [ 2023-10-17 ]

and how can I repeat this?

CREATE TABLE t1 (a INT) ENGINE=Spider AUTO_INCREMENT_MODE=4;

doesn't look like close to startup, it's something that a test does after the startup.

Comment by Roel Van de Paar [ 2024-01-03 ]

Seen very frequently during MDEV-28861 testing again. It seems the issue can be triggered by a simple query like:

create table t1 (c int) ENGINE=Spider COMMENT='WRAPPER "mysql", SRV "s",TABLE "t2"';

11.4.0 f93c20081a8a505ac502850ec02630f95673dfba (Optimized)

Core was generated by `/test/MDEV-28861_MD301223-mariadb-11.4.0-linux-x86_64-opt/bin/mariadbd --no-def'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055964cd1871f in ha_resolve_storage_engine_name (
    db_type=<optimized out>) at /test/bb-11.4-mdev-28861_opt/sql/handler.h:5546
5546	          db_type == view_pseudo_hton ? "VIEW" : hton_name(db_type)->str);
[Current thread is 1 (Thread 0x15213c0f3640 (LWP 2773284))]
(gdb) bt
#0  0x000055964cd1871f in ha_resolve_storage_engine_name (db_type=<optimized out>) at /test/bb-11.4-mdev-28861_opt/sql/handler.h:5546
#1  check_engine (thd=thd@entry=0x1520f0000c68, db_name=<optimized out>, table_name=0x1520f0010cf0 "tbl_a", create_info=create_info@entry=0x15213c0efb40) at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:12582
#2  0x000055964cd18a30 in create_table_impl (thd=thd@entry=0x1520f0000c68, ddl_log_state_create=ddl_log_state_create@entry=0x15213c0ef7a0, ddl_log_state_rm=<optimized out>, ddl_log_state_rm@entry=0x15213c0ef7c0, orig_db=@0x1520f0010d48: {str = 0x1520f0011440 "test", length = 4}, orig_table_name=@0x1520f0010d58: {str = 0x1520f0010cf0 "tbl_a", length = 5}, db=@0x1520f0010d48: {str = 0x1520f0011440 "test", length = 4}, table_name=@0x1520f0010d58: {str = 0x1520f0010cf0 "tbl_a", length = 5}, path=@0x15213c0ef3f0: {str = 0x15213c0ef410 "./test/tbl_a", length = 12}, options=<optimized out>, create_info=0x15213c0efb40, alter_info=0x15213c0ef860, create_table_mode=0, is_trans=0x15213c0ef780, key_info=0x15213c0ef3e8, key_count=0x15213c0ef3e4, frm=0x15213c0ef400) at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:4522
#3  0x000055964cd19602 in mysql_create_table_no_lock (thd=thd@entry=0x1520f0000c68, ddl_log_state_create=ddl_log_state_create@entry=0x15213c0ef7a0, ddl_log_state_rm=ddl_log_state_rm@entry=0x15213c0ef7c0, create_info=create_info@entry=0x15213c0efb40, alter_info=alter_info@entry=0x15213c0ef860, is_trans=is_trans@entry=0x15213c0ef780, create_table_mode=0, table_list=0x1520f0010d30) at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:4713
#4  0x000055964cd1e977 in mysql_create_table (alter_info=0x15213c0ef860, create_info=0x15213c0efb40, create_table=0x1520f0010d30, thd=0x1520f0000c68) at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:4883
#5  Sql_cmd_create_table_like::execute (this=<optimized out>, thd=0x1520f0000c68) at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:12903
#6  0x000055964cc603b9 in mysql_execute_command (thd=0x1520f0000c68, is_called_from_prepared_stmt=<optimized out>) at /test/bb-11.4-mdev-28861_opt/sql/sql_parse.cc:5738
#7  0x000055964cc612e6 in mysql_parse (thd=0x1520f0000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/bb-11.4-mdev-28861_opt/sql/sql_parse.cc:7748
#8  0x000055964cc63a8d in dispatch_command (command=COM_QUERY, thd=0x1520f0000c68, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/bb-11.4-mdev-28861_opt/sql/sql_parse.cc:1992
#9  0x000055964cc65840 in do_command (thd=0x1520f0000c68, blocking=blocking@entry=true) at /test/bb-11.4-mdev-28861_opt/sql/sql_parse.cc:1406
#10 0x000055964cd8f98f in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/bb-11.4-mdev-28861_opt/sql/sql_connect.cc:1418
#11 0x000055964cd8fcdd in handle_one_connection (arg=arg@entry=0x55964f4461c8) at /test/bb-11.4-mdev-28861_opt/sql/sql_connect.cc:1320
#12 0x000055964d139471 in pfs_spawn_thread (arg=0x55964f446238) at /test/bb-11.4-mdev-28861_opt/storage/perfschema/pfs.cc:2201
#13 0x000015213da94ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#14 0x000015213db26660 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

But this query needs to somehow be executed early during/just after [Spider] startup.

Comment by Roel Van de Paar [ 2024-01-03 ]

I found a way to reproduce the same, but it is a bit complex. Checking to see if I can record an rr trace. rr traces available in usual location (ref next comment)

Comment by Roel Van de Paar [ 2024-01-03 ]

FYI, the issue seems to require at least two threads interacting to trigger.

Comment by Yuchen Pei [ 2024-01-09 ]

Is there a testcase that I can try on to reproduce the issue? Roel

Simply the following does not result in the SIGSEGV.

11.4 f93c20081a8a505ac502850ec02630f95673dfba

create table t1 (c int) ENGINE=Spider COMMENT='WRAPPER "mysql", SRV "s",TABLE "t2"';

Comment by Roel Van de Paar [ 2024-01-15 ]

I have also seen these stacks, but testcase production for these has failed many times:

SIGSEGV|ha_resolve_storage_engine_name|add_server_part_options|generate_partition_syntax|generate_partition_syntax_for_frm
SIGSEGV|ha_resolve_storage_engine_name|check_engine|mysql_alter_table|Sql_cmd_alter_table::execute

They do occur frequently.

Comment by Roel Van de Paar [ 2024-01-15 ]

Another stack that is often seen in the same runs is this one:

SIGSEGV|check_engine|create_table_impl|mysql_create_table_no_lock|mysql_create_table

And it similarly defies all testcase production attempts. It is unclear if it is related to this ticket.

Comment by Roel Van de Paar [ 2024-01-15 ]

This ticket is currently the #1 Spider test-affecting bug.

Comment by Roel Van de Paar [ 2024-01-17 ]

The attached testcase, MDEV-32487_1.sql which basically is a combination of the following two main statements (as well as some SELECT SLEEP etc.):

CREATE TEMPORARY TABLE t1 ( a INT ) ENGINE=Spider;
INSTALL PLUGIN spider SONAME 'ha_spider.so';

When used in combination with pquery & the pquery framework as follows:

anc --max_connections=1000  
rm -Rf log2
for ((i=0;i<990;i++)){
  mkdir -p log2/${i}
  if [ "${i}" -eq 0 -o "$(echo $[ ${RANDOM} % 2 ])" -eq 0 ]; then
    ${HOME}/mariadb-qa/pquery/pquery2-md --infile=${HOME}/mariadb-qa/spiderpreload.sql --database=test --threads=1 --queries-per-thread=99999999 --logdir=${PWD}/log2/${i} --log-all-queries --log-failed-queries --no-shuffle --user=root --socket=./socket.sock >> log2/pquery_preload_sql.log &
  else
    ${HOME}/mariadb-qa/pquery/pquery2-md --infile=${HOME}/MDEV-32487_1.sql --database=test --threads=1 --queries-per-thread=99999999 --logdir=${PWD}/log2/${i} --log-all-queries --log-failed-queries --user=root --socket=./socket.sock >> log2/pquery_preload_sql.log &
  fi
}

i.e. ~1000 threads of the same SQL, randomly, at high frequency, will readily but sporadically result in the

SIGSEGV|check_engine|create_table_impl|mysql_create_table_no_lock|mysql_create_table

Stack mentioned above. Here is the full stack on 11.4 trunk optimized:

11.4.0 f93c20081a8a505ac502850ec02630f95673dfba (Optimized)

Core was generated by `/test/MDEV-28861_MD301223-mariadb-11.4.0-linux-x86_64-opt/bin/mariadbd --no-def'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055b959e6d7c2 in check_engine (thd=thd@entry=0x14c71c000c68, 
    db_name=<optimized out>, table_name=0x14c71c010d98 "t1", 
    create_info=create_info@entry=0x14c77c3deb40)
    at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:12577
[Current thread is 1 (Thread 0x14c77c3e2640 (LWP 3763618))]
(gdb) bt
#0  0x000055b959e6d7c2 in check_engine (thd=thd@entry=0x14c71c000c68, db_name=<optimized out>, table_name=0x14c71c010d98 "t1", create_info=create_info@entry=0x14c77c3deb40) at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:12577
#1  0x000055b959e6da30 in create_table_impl (thd=thd@entry=0x14c71c000c68, ddl_log_state_create=0x0, ddl_log_state_create@entry=0x14c77c3de7a0, ddl_log_state_rm=<optimized out>, ddl_log_state_rm@entry=0x14c77c3de7c0, orig_db=@0x14c71c010de8: {str = 0x14c71c0114e0 "test", length = 4}, orig_table_name=@0x14c71c010df8: {str = 0x14c71c010d98 "t1", length = 2}, db=@0x14c71c010de8: {str = 0x14c71c0114e0 "test", length = 4}, table_name=@0x14c71c010df8: {str = 0x14c71c010d98 "t1", length = 2}, path=@0x14c77c3de3f0: {str = 0x14c77c3de410 "/test/MDEV-28861_MD301223-mariadb-11.4.0-linux-x86_64-opt/data/#sql-temptable-396d35-21-0", length = 89}, options=<optimized out>, create_info=0x14c77c3deb40, alter_info=0x14c77c3de860, create_table_mode=0, is_trans=0x14c77c3de780, key_info=0x14c77c3de3e8, key_count=0x14c77c3de3e4, frm=0x14c77c3de400) at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:4522
#2  0x000055b959e6e602 in mysql_create_table_no_lock (thd=thd@entry=0x14c71c000c68, ddl_log_state_create=ddl_log_state_create@entry=0x14c77c3de7a0, ddl_log_state_rm=ddl_log_state_rm@entry=0x14c77c3de7c0, create_info=create_info@entry=0x14c77c3deb40, alter_info=alter_info@entry=0x14c77c3de860, is_trans=is_trans@entry=0x14c77c3de780, create_table_mode=0, table_list=0x14c71c010dd0) at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:4713
#3  0x000055b959e73977 in mysql_create_table (alter_info=0x14c77c3de860, create_info=0x14c77c3deb40, create_table=0x14c71c010dd0, thd=0x14c71c000c68) at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:4883
#4  Sql_cmd_create_table_like::execute (this=<optimized out>, thd=0x14c71c000c68) at /test/bb-11.4-mdev-28861_opt/sql/sql_table.cc:12903
#5  0x000055b959db53b9 in mysql_execute_command (thd=0x14c71c000c68, is_called_from_prepared_stmt=<optimized out>) at /test/bb-11.4-mdev-28861_opt/sql/sql_parse.cc:5738
#6  0x000055b959db62e6 in mysql_parse (thd=0x14c71c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/bb-11.4-mdev-28861_opt/sql/sql_parse.cc:7748
#7  0x000055b959db8a8d in dispatch_command (command=COM_QUERY, thd=0x14c71c000c68, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/bb-11.4-mdev-28861_opt/sql/sql_parse.cc:1992
#8  0x000055b959dba840 in do_command (thd=0x14c71c000c68, blocking=blocking@entry=true) at /test/bb-11.4-mdev-28861_opt/sql/sql_parse.cc:1406
#9  0x000055b959ee498f in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/bb-11.4-mdev-28861_opt/sql/sql_connect.cc:1418
#10 0x000055b959ee4cdd in handle_one_connection (arg=arg@entry=0x55b95bb0ce48) at /test/bb-11.4-mdev-28861_opt/sql/sql_connect.cc:1320
#11 0x000055b95a28e471 in pfs_spawn_thread (arg=0x55b95bb0ceb8) at /test/bb-11.4-mdev-28861_opt/storage/perfschema/pfs.cc:2201
#12 0x000014c7a0e94ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#13 0x000014c7a0f26850 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

An rr trace can likely be produced too if desired.

Comment by Roel Van de Paar [ 2024-01-17 ]

The last stack also reproduced on 10.5, 10.11, 11.2 and 11.3 optimized builds. 10.4 Consistently failed to reproduce the issue.

Comment by Roel Van de Paar [ 2024-01-17 ]

CREATE TABLE t (c INT) PARTITION BY LIST COLUMNS (c) (PARTITION p DEFAULT ENGINE=SPIDER); ;
INSTALL PLUGIN spider SONAME 'ha_spider.so'; ;

Saved as MDEV-32487_2.sql and replayed as:

anc --max_connections=1000  
rm -Rf log2
INFILE=${HOME}/MDEV-32487_2.sql
for ((i=0;i<990;i++)){
  mkdir -p log2/${i}
  if [ "${i}" -eq 0 -o "$(echo $[ ${RANDOM} % 2 ])" -eq 0 ]; then
    ${HOME}/mariadb-qa/pquery/pquery2-md --infile=${HOME}/mariadb-qa/spiderpreload.sql --database=test --threads=1 --queries-per-thread=99999999 --logdir=${PWD}/log2/${i} --log-all-queries --log-failed-queries --no-shuffle --user=root --socket=./socket.sock >> log2/pquery_preload_sql.log &
  else
    ${HOME}/mariadb-qa/pquery/pquery2-md --infile=${INFILE} --database=test --threads=1 --queries-per-thread=99999999 --logdir=${PWD}/log2/${i} --log-all-queries --log-failed-queries --user=root --socket=./socket.sock >> log2/pquery_preload_sql.log &
  fi
}

Will yield the

SIGSEGV|ha_resolve_storage_engine_name|add_server_part_options|generate_partition_syntax|generate_partition_syntax_for_frm

Bug. Full stack:

11.4.0 9bd95e914f3f12d0d9d93e7a1f2c49e6e8841f17 (Debug)

Core was generated by `/test/MD271223-mariadb-11.4.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055a7c7ededb5 in ha_resolve_storage_engine_name (
    db_type=0x15203c03d2c8) at /test/11.4_dbg/sql/handler.h:5546
[Current thread is 1 (Thread 0x152064072640 (LWP 3452355))]
(gdb) bt
#0  0x000055a7c7ededb5 in ha_resolve_storage_engine_name (db_type=0x15203c03d2c8) at /test/11.4_dbg/sql/handler.h:5546
#1  add_server_part_options (str=str@entry=0x15206406daa0, p_elem=p_elem@entry=0x152028014708) at /test/11.4_dbg/sql/sql_partition.cc:2231
#2  0x000055a7c7ee077a in generate_partition_syntax (thd=thd@entry=0x152028000d58, part_info=part_info@entry=0x1520280144e0, buf_length=buf_length@entry=0x15206406e1dc, show_partition_options=show_partition_options@entry=true, create_info=create_info@entry=0x15206406f180, alter_info=alter_info@entry=0x15206406eea0) at /test/11.4_dbg/sql/sql_partition.cc:2728
#3  0x000055a7c7ee0b08 in generate_partition_syntax_for_frm (thd=thd@entry=0x152028000d58, part_info=part_info@entry=0x1520280144e0, buf_length=buf_length@entry=0x15206406e1dc, create_info=create_info@entry=0x15206406f180, alter_info=alter_info@entry=0x15206406eea0) at /test/11.4_dbg/sql/sql_partition.cc:2493
#4  0x000055a7c7fb3cea in mysql_create_frm_image (thd=thd@entry=0x152028000d58, create_info=create_info@entry=0x15206406f180, alter_info=alter_info@entry=0x15206406eea0, create_table_mode=create_table_mode@entry=0, key_info=key_info@entry=0x15206406ead8, key_count=key_count@entry=0x15206406ead4, frm=0x15206406eaf0) at /test/11.4_dbg/sql/sql_table.cc:4185
#5  0x000055a7c7fb42ed in create_table_impl (thd=thd@entry=0x152028000d58, ddl_log_state_create=ddl_log_state_create@entry=0x15206406ee00, ddl_log_state_rm=<optimized out>, ddl_log_state_rm@entry=0x15206406f010, orig_db=@0x152028013848: {str = 0x152028013f40 "test", length = 4}, orig_table_name=@0x152028013858: {str = 0x1520280137f8 "t", length = 1}, db=@0x152028013848: {str = 0x152028013f40 "test", length = 4}, table_name=@0x152028013858: {str = 0x1520280137f8 "t", length = 1}, path=@0x15206406eae0: {str = 0x15206406eb00 "./test/t", length = 8}, options=<optimized out>, create_info=0x15206406f180, alter_info=0x15206406eea0, create_table_mode=0, is_trans=0x15206406ede0, key_info=0x15206406ead8, key_count=0x15206406ead4, frm=0x15206406eaf0) at /test/11.4_dbg/sql/sql_table.cc:4589
#6  0x000055a7c7fb511c in mysql_create_table_no_lock (thd=thd@entry=0x152028000d58, ddl_log_state_create=ddl_log_state_create@entry=0x15206406ee00, ddl_log_state_rm=ddl_log_state_rm@entry=0x15206406f010, create_info=create_info@entry=0x15206406f180, alter_info=alter_info@entry=0x15206406eea0, is_trans=is_trans@entry=0x15206406ede0, create_table_mode=0, table_list=0x152028013830) at /test/11.4_dbg/sql/sql_table.cc:4713
#7  0x000055a7c7fb70fb in mysql_create_table (alter_info=0x15206406eea0, create_info=0x15206406f180, create_table=0x152028013830, thd=0x152028000d58) at /test/11.4_dbg/sql/sql_table.cc:4883
#8  Sql_cmd_create_table_like::execute (this=<optimized out>, thd=0x152028000d58) at /test/11.4_dbg/sql/sql_table.cc:12903
#9  0x000055a7c7ed1130 in mysql_execute_command (thd=thd@entry=0x152028000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.4_dbg/sql/sql_parse.cc:5738
#10 0x000055a7c7ed24bb in mysql_parse (thd=thd@entry=0x152028000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1520640711e0) at /test/11.4_dbg/sql/sql_parse.cc:7748
#11 0x000055a7c7ed4831 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152028000d58, packet=packet@entry=0x15202800b1c9 "CREATE TABLE t (c INT) PARTITION BY LIST COLUMNS (c) (PARTITION p DEFAULT ENGINE=SPIDER); ;", packet_length=packet_length@entry=91, blocking=blocking@entry=true) at /test/11.4_dbg/sql/sql_class.h:253
#12 0x000055a7c7ed6956 in do_command (thd=0x152028000d58, blocking=blocking@entry=true) at /test/11.4_dbg/sql/sql_parse.cc:1406
#13 0x000055a7c803b8b7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55a7cc296b38, put_in_cache=put_in_cache@entry=true) at /test/11.4_dbg/sql/sql_connect.cc:1418
#14 0x000055a7c803bbac in handle_one_connection (arg=arg@entry=0x55a7cc296b38) at /test/11.4_dbg/sql/sql_connect.cc:1320
#15 0x000055a7c848073a in pfs_spawn_thread (arg=0x55a7cc296ba8) at /test/11.4_dbg/storage/perfschema/pfs.cc:2201
#16 0x0000152086694ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#17 0x0000152086726850 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment by Roel Van de Paar [ 2024-01-17 ]

And the final stack:

SIGSEGV|ha_resolve_storage_engine_name|check_engine|mysql_alter_table|Sql_cmd_alter_table::execute

Can be produced with these two lines of SQL:

ALTER TABLE mysql.help_topic ENGINE=Spider; ;
INSTALL PLUGIN spider SONAME 'ha_spider.so'; ;

Replayed in the same way. Full stack:

11.4.0 9bd95e914f3f12d0d9d93e7a1f2c49e6e8841f17 (Debug)

Core was generated by `/test/MD271223-mariadb-11.4.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000555f6f22a785 in ha_resolve_storage_engine_name (
    db_type=<optimized out>) at /test/11.4_dbg/sql/handler.h:5546
[Current thread is 1 (Thread 0x151db80c2640 (LWP 1007876))]
(gdb) bt
#0  0x0000555f6f22a785 in ha_resolve_storage_engine_name (db_type=<optimized out>) at /test/11.4_dbg/sql/handler.h:5546
#1  check_engine (thd=thd@entry=0x151d80000d58, db_name=<optimized out>, table_name=0x151d80013788 "help_topic", create_info=create_info@entry=0x151db80c0130) at /test/11.4_dbg/sql/sql_table.cc:12582
#2  0x0000555f6f23a624 in mysql_alter_table (thd=thd@entry=0x151d80000d58, new_db=0x151d80005aa8, new_name=new_name@entry=0x151d80005ef8, create_info=create_info@entry=0x151db80c0130, table_list=<optimized out>, table_list@entry=0x151d800137e0, recreate_info=recreate_info@entry=0x151db80bffa0, alter_info=0x151db80bffc0, order_num=0, order=0x0, ignore=false, if_exists=false) at /test/11.4_dbg/sql/sql_table.cc:10438
#3  0x0000555f6f2c2d05 in Sql_cmd_alter_table::execute (this=<optimized out>, thd=0x151d80000d58) at /test/11.4_dbg/sql/sql_alter.cc:698
#4  0x0000555f6f151130 in mysql_execute_command (thd=thd@entry=0x151d80000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.4_dbg/sql/sql_parse.cc:5738
#5  0x0000555f6f1524bb in mysql_parse (thd=thd@entry=0x151d80000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x151db80c11e0) at /test/11.4_dbg/sql/sql_parse.cc:7748
#6  0x0000555f6f154831 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x151d80000d58, packet=packet@entry=0x151d8000b1c9 "ALTER TABLE mysql.help_topic ENGINE=Spider; ;", packet_length=packet_length@entry=45, blocking=blocking@entry=true) at /test/11.4_dbg/sql/sql_class.h:253
#7  0x0000555f6f156956 in do_command (thd=0x151d80000d58, blocking=blocking@entry=true) at /test/11.4_dbg/sql/sql_parse.cc:1406
#8  0x0000555f6f2bb8b7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x555f7288b058, put_in_cache=put_in_cache@entry=true) at /test/11.4_dbg/sql/sql_connect.cc:1418
#9  0x0000555f6f2bbbac in handle_one_connection (arg=arg@entry=0x555f7288b058) at /test/11.4_dbg/sql/sql_connect.cc:1320
#10 0x0000555f6f70073a in pfs_spawn_thread (arg=0x555f7288b0c8) at /test/11.4_dbg/storage/perfschema/pfs.cc:2201
#11 0x0000151ddac94ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#12 0x0000151ddad26850 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment by Roel Van de Paar [ 2024-01-17 ]

The test setup from the last comment yields an additional stack in 10.4

SIGSEGV|build_frm_image|mysql_create_frm_image|create_table_impl|mysql_alter_table

10.4.33 1b747ffd05dd524f8d43b35a2b583dc4c00d767b (Optimized)

Core was generated by `/test/MD271223-mariadb-10.4.33-linux-x86_64-opt/bin/mariadbd --no-defaults --ma'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00005615fc87c58e in build_frm_image (thd=thd@entry=0x14b35c000c58, 
    table=..., create_info=create_info@entry=0x14b3a41e8bb0, 
    create_fields=..., keys=2, key_info=0x14b35c011fd0, db_file=0x14b35c011418)
    at /test/10.4_opt/sql/unireg.cc:220
[Current thread is 1 (Thread 0x14b3a41ec640 (LWP 1075846))]
(gdb) bt
#0  0x00005615fc87c58e in build_frm_image (thd=thd@entry=0x14b35c000c58, table=@0x14b3a41e7fc0: {str = 0x14b35c0102b0 "help_topic", length = 10}, create_info=create_info@entry=0x14b3a41e8bb0, create_fields=@0x14b3a41e8b38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14b35c010d10, last = 0x14b35c011288, elements = 6}, <No data fields>}, keys=2, key_info=0x14b35c011fd0, db_file=0x14b35c011418) at /test/10.4_opt/sql/unireg.cc:220
#1  0x00005615fc8354d2 in mysql_create_frm_image (thd=<optimized out>, db=@0x14b3a41e7fb0: {str = 0x14b35c0102a0 "mysql", length = 5}, table_name=@0x14b3a41e7fc0: {str = 0x14b35c0102b0 "help_topic", length = 10}, create_info=0x14b3a41e8bb0, alter_info=0x14b3a41e8af0, create_table_mode=-2, key_info=0x14b3a41e6668, key_count=0x14b3a41e664c, frm=0x14b3a41e6670) at /test/10.4_opt/sql/sql_table.cc:4950
#2  0x00005615fc83db9e in create_table_impl (thd=thd@entry=0x14b35c000c58, orig_db=@0x14b3a41e7fb0: {str = 0x14b35c0102a0 "mysql", length = 5}, orig_table_name=@0x14b3a41e7fc0: {str = 0x14b35c0102b0 "help_topic", length = 10}, db=@0x14b3a41e7fe0: {str = 0x14b35c0102a0 "mysql", length = 5}, table_name=@0x14b3a41e8010: {str = 0x14b3a41e834b "#sql-106a46_e", length = 13}, path=path@entry=0x14b3a41e880e "./mysql/#sql-106a46_e", options={m_options = DDL_options_st::OPT_NONE}, create_info=0x14b3a41e8bb0, alter_info=0x14b3a41e8af0, create_table_mode=-2, is_trans=0x0, key_info=0x14b3a41e6668, key_count=0x14b3a41e664c, frm=0x14b3a41e6670) at /test/10.4_opt/sql/sql_table.cc:5195
#3  0x00005615fc842427 in mysql_alter_table (thd=thd@entry=0x14b35c000c58, new_db=new_db@entry=0x14b35c005290, new_name=new_name@entry=0x14b35c005700, create_info=create_info@entry=0x14b3a41e8bb0, table_list=<optimized out>, table_list@entry=0x14b35c0102f8, recreate_info=recreate_info@entry=0x14b3a41e8ad0, alter_info=0x14b3a41e8af0, order_num=0, order=0x0, ignore=false) at /test/10.4_opt/sql/sql_table.cc:10412
#4  0x00005615fc89f90a in Sql_cmd_alter_table::execute (this=<optimized out>, thd=0x14b35c000c58) at /test/10.4_opt/sql/sql_alter.cc:535
#5  0x00005615fc796685 in mysql_execute_command (thd=0x14b35c000c58) at /test/10.4_opt/sql/sql_parse.cc:6266
#6  0x00005615fc798687 in mysql_parse (thd=0x14b35c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_parse.cc:8062
#7  0x00005615fc79b0cd in dispatch_command (command=COM_QUERY, thd=0x14b35c000c58, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_parse.cc:1960
#8  0x00005615fc79d31b in do_command (thd=0x14b35c000c58) at /test/10.4_opt/sql/sql_parse.cc:1378
#9  0x00005615fc89b2ee in do_handle_one_connection (connect=connect@entry=0x561600ae9448) at /test/10.4_opt/sql/sql_connect.cc:1419
#10 0x00005615fc89b40f in handle_one_connection (arg=0x561600ae9448) at /test/10.4_opt/sql/sql_connect.cc:1323
#11 0x000014b3c9894ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#12 0x000014b3c9926850 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment by Roel Van de Paar [ 2024-01-17 ]

The test setup from this comment also yields a different/new, but similar, stack on 10.4:

SIGSEGV|ha_resolve_storage_engine_name|add_partition_options|generate_partition_syntax|generate_partition_syntax_for_frm

10.4.33 1b747ffd05dd524f8d43b35a2b583dc4c00d767b (Optimized)

Core was generated by `/test/MD271223-mariadb-10.4.33-linux-x86_64-opt/bin/mariadbd --no-defaults --ma'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055eb8ea23d5b in ha_resolve_storage_engine_name (
    db_type=0x154f240325d8) at /test/10.4_opt/sql/handler.h:4914
[Current thread is 1 (Thread 0x154f7804a640 (LWP 1090637))]
(gdb) bt
#0  0x000055eb8ea23d5b in ha_resolve_storage_engine_name (db_type=0x154f240325d8) at /test/10.4_opt/sql/handler.h:4914
#1  add_partition_options (str=str@entry=0x154f780460b0, p_elem=p_elem@entry=0x154f1c011238) at /test/10.4_opt/sql/sql_partition.cc:2237
#2  0x000055eb8ea2472f in generate_partition_syntax (thd=<optimized out>, part_info=0x154f1c010ff8, buf_length=<optimized out>, show_partition_options=<optimized out>, create_info=<optimized out>, alter_info=<optimized out>) at /test/10.4_opt/sql/sql_partition.cc:2759
#3  0x000055eb8ea25639 in generate_partition_syntax_for_frm (thd=thd@entry=0x154f1c000c58, part_info=part_info@entry=0x154f1c010ff8, buf_length=buf_length@entry=0x154f780465cc, create_info=create_info@entry=0x154f780472a0, alter_info=alter_info@entry=0x154f780471e0) at /test/10.4_opt/sql/sql_partition.cc:2593
#4  0x000055eb8e73182e in mysql_create_frm_image (thd=0x154f1c000c58, db=@0x154f1c010360: {str = 0x154f1c010a38 "test", length = 4}, table_name=@0x154f1c010370: {str = 0x154f1c010310 "t", length = 1}, create_info=0x154f780472a0, alter_info=0x154f780471e0, create_table_mode=0, key_info=0x154f78046ea8, key_count=0x154f78046ea4, frm=0x154f78046eb0) at /test/10.4_opt/sql/sql_table.cc:4849
#5  0x000055eb8e739b9e in create_table_impl (thd=thd@entry=0x154f1c000c58, orig_db=@0x154f1c010360: {str = 0x154f1c010a38 "test", length = 4}, orig_table_name=@0x154f1c010370: {str = 0x154f1c010310 "t", length = 1}, db=@0x154f1c010360: {str = 0x154f1c010a38 "test", length = 4}, table_name=@0x154f1c010370: {str = 0x154f1c010310 "t", length = 1}, path=path@entry=0x154f78046ec0 "./test/t", options={m_options = DDL_options_st::OPT_NONE}, create_info=0x154f780472a0, alter_info=0x154f780471e0, create_table_mode=0, is_trans=0x154f78047147, key_info=0x154f78046ea8, key_count=0x154f78046ea4, frm=0x154f78046eb0) at /test/10.4_opt/sql/sql_table.cc:5195
#6  0x000055eb8e73a1bf in mysql_create_table_no_lock (thd=thd@entry=0x154f1c000c58, db=db@entry=0x154f1c010360, table_name=table_name@entry=0x154f1c010370, create_info=create_info@entry=0x154f780472a0, alter_info=alter_info@entry=0x154f780471e0, is_trans=is_trans@entry=0x154f78047147, create_table_mode=0, table_list=0x154f1c010348) at /test/10.4_opt/sql/sql_table.cc:5298
#7  0x000055eb8e73a437 in mysql_create_table (thd=thd@entry=0x154f1c000c58, create_table=create_table@entry=0x154f1c010348, create_info=create_info@entry=0x154f780472a0, alter_info=alter_info@entry=0x154f780471e0) at /test/10.4_opt/sql/sql_table.cc:5457
#8  0x000055eb8e73b93d in Sql_cmd_create_table_like::execute (this=<optimized out>, thd=0x154f1c000c58) at /test/10.4_opt/sql/sql_table.cc:11943
#9  0x000055eb8e692685 in mysql_execute_command (thd=0x154f1c000c58) at /test/10.4_opt/sql/sql_parse.cc:6266
#10 0x000055eb8e694687 in mysql_parse (thd=0x154f1c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_parse.cc:8062
#11 0x000055eb8e6970cd in dispatch_command (command=COM_QUERY, thd=0x154f1c000c58, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_parse.cc:1960
#12 0x000055eb8e69931b in do_command (thd=0x154f1c000c58) at /test/10.4_opt/sql/sql_parse.cc:1378
#13 0x000055eb8e7972ee in do_handle_one_connection (connect=connect@entry=0x55eb9213b258) at /test/10.4_opt/sql/sql_connect.cc:1419
#14 0x000055eb8e79740f in handle_one_connection (arg=0x55eb9213b258) at /test/10.4_opt/sql/sql_connect.cc:1323
#15 0x0000154f8d494ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#16 0x0000154f8d526850 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Generated at Thu Feb 08 10:31:44 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.