[MDEV-6493] Assertion `table->file->stats.records > 0 || error' failure, or 'Invalid write' valgrind warnings, or crash on scenario with Aria table, view, LOCK TABLES Created: 2014-07-27  Updated: 2014-07-30  Resolved: 2014-07-30

Status: Closed
Project: MariaDB Server
Component/s: None
Affects Version/s: 5.1.67, 5.2.14, 5.3.12, 5.5.38, 10.1.0
Fix Version/s: 5.5.38, 10.0.13

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: Aria


 Description    

--source include/have_partition.inc
 
 
 
--disable_abort_on_error
 
 
 
CREATE TABLE t1 (pk INT PRIMARY KEY) ENGINE=Aria PARTITION BY KEY() PARTITIONS 2;
 
CREATE VIEW v1 AS SELECT * FROM t1;
 
 
 
LOCK TABLE v1 WRITE;
 
CREATE TABLE v1 (i INT);
 
INSERT INTO v1 VALUES (1);
 
UNLOCK TABLES;
 
 
 
SELECT * FROM t1;

The provided test case ends with the assertion failure on 5.5 and higher:

mysqld: 5.5/sql/sql_select.cc:17280: int join_read_const_table(JOIN_TAB*, POSITION*): Assertion `table->file->stats.records > 0 || error' failed.
 
140727 17:55:00 [ERROR] mysqld got signal 6 ;
 
 
 
#6  0x00007fc057e22621 in *__GI___assert_fail (assertion=0xd99138 "table->file->stats.records > 0 || error", file=<optimized out>, line=17280, function=0xd9a940 "int join_read_const_table(JOIN_TAB*, POSITION*)") at assert.c:81
 
#7  0x000000000068a891 in join_read_const_table (tab=0x7fc052948fe0, pos=0x7fc052949510) at 5.5/sql/sql_select.cc:17280
 
#8  0x0000000000669943 in make_join_statistics (join=0x7fc0529488f0, tables_list=..., conds=0x0, keyuse_array=0x7fc052948bf8) at 5.5/sql/sql_select.cc:3410
 
#9  0x00000000006620be in JOIN::optimize (this=0x7fc0529488f0) at 5.5/sql/sql_select.cc:1229
 
#10 0x0000000000668927 in mysql_select (thd=0x7fc056749060, rref_pointer_array=0x7fc05674ccc8, tables=0x7fc052948258, wild_num=1, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fc0529488d0, unit=0x7fc05674c380, select_lex=0x7fc05674ca58) at 5.5/sql/sql_select.cc:3080
 
#11 0x000000000065f489 in handle_select (thd=0x7fc056749060, lex=0x7fc05674c2d0, result=0x7fc0529488d0, setup_tables_done_option=0) at 5.5/sql/sql_select.cc:319
 
#12 0x0000000000638a9f in execute_sqlcom_select (thd=0x7fc056749060, all_tables=0x7fc052948258) at 5.5/sql/sql_parse.cc:4688
 
#13 0x0000000000631c81 in mysql_execute_command (thd=0x7fc056749060) at 5.5/sql/sql_parse.cc:2233
 
#14 0x000000000063b1ae in mysql_parse (thd=0x7fc056749060, rawbuf=0x7fc052948078 "SELECT * FROM t1", length=16, parser_state=0x7fc0533b5630) at 5.5/sql/sql_parse.cc:5799
 
#15 0x000000000062f1f9 in dispatch_command (command=COM_QUERY, thd=0x7fc056749060, packet=0x7fc053afa061 "SELECT * FROM t1", packet_length=16) at 5.5/sql/sql_parse.cc:1079
 
#16 0x000000000062e385 in do_command (thd=0x7fc056749060) at 5.5/sql/sql_parse.cc:793
 
#17 0x0000000000730006 in do_handle_one_connection (thd_arg=0x7fc056749060) at 5.5/sql/sql_connect.cc:1266
 
#18 0x000000000072fac5 in handle_one_connection (arg=0x7fc056749060) at 5.5/sql/sql_connect.cc:1181
 
#19 0x0000000000b65105 in pfs_spawn_thread (arg=0x7fc0547fa8e0) at 5.5/storage/perfschema/pfs.cc:1015
 
#20 0x00007fc059382b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
 
#21 0x00007fc057ed1a7d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

Stack trace from:

revision-id: jplindst@mariadb.org-20140727054445-c4dp836fcgt69e8w
 
revno: 4244
 
branch-nick: 5.5

Without the last SELECT, the same test case causes valgrind warnings:

==31970== Thread 5:
 
==31970== Invalid write of size 8
 
==31970==    at 0xBCFA69: _ma_new (ma_page.c:406)
 
==31970==    by 0xBF7216: _ma_enlarge_root (ma_write.c:573)
 
==31970==    by 0xBF6FB9: _ma_ck_real_write_btree (ma_write.c:527)
 
==31970==    by 0xBF6E57: _ma_ck_write_btree_with_log (ma_write.c:491)
 
==31970==    by 0xBF6CD6: _ma_ck_write_btree (ma_write.c:449)
 
==31970==    by 0xBF6C4F: _ma_ck_write (ma_write.c:434)
 
==31970==    by 0xBF64A6: maria_write (ma_write.c:188)
 
==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
 
==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
 
==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==  Address 0xb929e90 is 144 bytes inside a block of size 256 free'd
 
==31970==    at 0xD3441D: free (jemalloc.c:1273)
 
==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
 
==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
 
==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
 
==31970==    by 0xCB342E: delete_dynamic (array.c:303)
 
==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
 
==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
 
==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
 
==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
 
==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
 
==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970== Invalid read of size 4
 
==31970==    at 0xBF6587: maria_write (ma_write.c:286)
 
==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
 
==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
 
==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
 
==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
 
==31970==    by 0x6320A7C: clone (clone.S:112)
 
==31970==  Address 0xb929ea0 is 160 bytes inside a block of size 256 free'd
 
==31970==    at 0xD3441D: free (jemalloc.c:1273)
 
==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
 
==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
 
==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
 
==31970==    by 0xCB342E: delete_dynamic (array.c:303)
 
==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
 
==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
 
==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
 
==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
 
==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
 
==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970== Invalid write of size 4
 
==31970==    at 0xBF6599: maria_write (ma_write.c:286)
 
==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
 
==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
 
==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
 
==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
 
==31970==    by 0x6320A7C: clone (clone.S:112)
 
==31970==  Address 0xb929ea0 is 160 bytes inside a block of size 256 free'd
 
==31970==    at 0xD3441D: free (jemalloc.c:1273)
 
==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
 
==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
 
==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
 
==31970==    by 0xCB342E: delete_dynamic (array.c:303)
 
==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
 
==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
 
==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
 
==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
 
==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
 
==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970== Invalid read of size 8
 
==31970==    at 0xBF6677: maria_write (ma_write.c:298)
 
==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
 
==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
 
==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
 
==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
 
==31970==    by 0x6320A7C: clone (clone.S:112)
 
==31970==  Address 0xb929e70 is 112 bytes inside a block of size 256 free'd
 
==31970==    at 0xD3441D: free (jemalloc.c:1273)
 
==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
 
==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
 
==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
 
==31970==    by 0xCB342E: delete_dynamic (array.c:303)
 
==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
 
==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
 
==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
 
==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
 
==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
 
==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970== Invalid write of size 8
 
==31970==    at 0xBF667E: maria_write (ma_write.c:298)
 
==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
 
==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
 
==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
 
==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
 
==31970==    by 0x6320A7C: clone (clone.S:112)
 
==31970==  Address 0xb929e70 is 112 bytes inside a block of size 256 free'd
 
==31970==    at 0xD3441D: free (jemalloc.c:1273)
 
==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
 
==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
 
==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
 
==31970==    by 0xCB342E: delete_dynamic (array.c:303)
 
==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
 
==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
 
==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
 
==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
 
==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
 
==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970== Invalid read of size 1
 
==31970==    at 0xBF66D9: maria_write (ma_write.c:303)
 
==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
 
==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
 
==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
 
==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
 
==31970==    by 0x6320A7C: clone (clone.S:112)
 
==31970==  Address 0xb929ea4 is 164 bytes inside a block of size 256 free'd
 
==31970==    at 0xD3441D: free (jemalloc.c:1273)
 
==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
 
==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
 
==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
 
==31970==    by 0xCB342E: delete_dynamic (array.c:303)
 
==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
 
==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
 
==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
 
==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
 
==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
 
==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970== Invalid write of size 1
 
==31970==    at 0xBF66E0: maria_write (ma_write.c:303)
 
==31970==    by 0xB807B8: ha_maria::write_row(unsigned char*) (ha_maria.cc:1266)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0xCA9440: ha_partition::write_row(unsigned char*) (ha_partition.cc:3596)
 
==31970==    by 0x7EDCE8: handler::ha_write_row(unsigned char*) (handler.cc:5198)
 
==31970==    by 0x61770A: write_record(THD*, TABLE*, st_copy_info*) (sql_insert.cc:1843)
 
==31970==    by 0x6153F4: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) (sql_insert.cc:986)
 
==31970==    by 0x6337E7: mysql_execute_command(THD*) (sql_parse.cc:2973)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)
 
==31970==    by 0xB65104: pfs_spawn_thread (pfs.cc:1015)
 
==31970==    by 0x4E35B4F: start_thread (pthread_create.c:304)
 
==31970==    by 0x6320A7C: clone (clone.S:112)
 
==31970==  Address 0xb929ea4 is 164 bytes inside a block of size 256 free'd
 
==31970==    at 0xD3441D: free (jemalloc.c:1273)
 
==31970==    by 0xCEDFE8: free_memory (safemalloc.c:205)
 
==31970==    by 0xCEDF0C: sf_free (safemalloc.c:182)
 
==31970==    by 0xCDA7CB: my_free (my_malloc.c:119)
 
==31970==    by 0xCB342E: delete_dynamic (array.c:303)
 
==31970==    by 0x917D35: Dynamic_array<Item_splocal*>::~Dynamic_array() (sql_array.h:62)
 
==31970==    by 0x90FB2F: subst_spvars(THD*, sp_instr*, st_mysql_lex_string*) (sp_head.cc:1056)
 
==31970==    by 0x9144AB: sp_instr_stmt::execute(THD*, unsigned int*) (sp_head.cc:3133)
 
==31970==    by 0x9103A8: sp_head::execute(THD*, bool) (sp_head.cc:1431)
 
==31970==    by 0x9120F1: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:2197)
 
==31970==    by 0x636FB7: mysql_execute_command(THD*) (sql_parse.cc:4122)
 
==31970==    by 0x63B1AD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5799)
 
==31970==    by 0x62F1F8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1079)
 
==31970==    by 0x62E384: do_command(THD*) (sql_parse.cc:793)
 
==31970==    by 0x730005: do_handle_one_connection(THD*) (sql_connect.cc:1266)
 
==31970==    by 0x72FAC4: handle_one_connection (sql_connect.cc:1181)

Please also note that CREATE TABLE v1 ends with ER_TABLE_NOT_LOCKED, even though there was LOCK TABLE v1 before.

For the record, the same scenario also fails on 5.1-5.3, only there it causes a crash on UNLOCK TABLES:

#2  0x00000000007fd86d in handle_fatal_signal (sig=11) at signal_handler.cc:249
 
#3  <signal handler called>
 
#4  malloc_consolidate (av=0x7fa18058ce60) at malloc.c:5155
 
#5  0x00007fa1802804d4 in _int_malloc (av=0x7fa18058ce60, bytes=2092) at malloc.c:4373
 
#6  0x00007fa180282b90 in *__GI___libc_malloc (bytes=2092) at malloc.c:3660
 
#7  0x0000000000b8b24b in _mymalloc (size=2048, filename=0xde12d0 "thr_mutex.c", lineno=179, MyFlags=0) at safemalloc.c:140
 
#8  0x0000000000b99f73 in init_dynamic_array2 (array=0x348db50, element_size=16, init_buffer=0x0, init_alloc=128, alloc_increment=64, sFile=0xde12d0 "thr_mutex.c", uLine=179) at array.c:67
 
#9  0x0000000000b986b2 in _my_hash_init (hash=0x348db28, growth_size=64, charset=0x1216360, size=128, key_offset=40, key_length=8, get_key=0, free_element=0, flags=1, sFile=0xde12d0 "thr_mutex.c", uLine=179) at hash.c:94
 
#10 0x0000000000baee6d in safe_mutex_lazy_init_deadlock_detection (mp=0x162e768) at thr_mutex.c:175
 
#11 0x0000000000baf2e9 in safe_mutex_lock (mp=0x162e768, my_flags=0, file=0xd8ba00 "ma_loghandler.c", line=1617) at thr_mutex.c:325
 
#12 0x00000000009887ae in translog_buffer_lock (buffer=0x152e6e8) at ma_loghandler.c:1617
 
#13 0x0000000000997d29 in translog_force_current_buffer_to_finish () at ma_loghandler.c:7380
 
#14 0x0000000000998912 in translog_flush (lsn=4294976781) at ma_loghandler.c:7642
 
#15 0x0000000000965150 in ma_commit (trn=0x34291b8) at ma_commit.c:65
 
#16 0x000000000094bdde in ha_maria::external_lock (this=0x342b2b0, thd=0x3383618, lock_type=2) at ha_maria.cc:2555
 
#17 0x00000000007e8d8d in handler::ha_external_lock (this=0x342b2b0, thd=0x3383618, lock_type=2) at handler.cc:4754
 
#18 0x00000000007f1893 in ha_partition::external_lock (this=0x342ad30, thd=0x3383618, lock_type=2) at ha_partition.cc:2991
 
#19 0x00000000007e8d8d in handler::ha_external_lock (this=0x342ad30, thd=0x3383618, lock_type=2) at handler.cc:4754
 
#20 0x0000000000692b73 in unlock_external (thd=0x3383618, table=0x3429820, count=1) at lock.cc:829
 
#21 0x0000000000691b19 in mysql_unlock_tables (thd=0x3383618, sql_lock=0x34297e8) at lock.cc:390
 
#22 0x00000000006f702d in close_thread_tables (thd=0x3383618) at sql_base.cc:1353
 
#23 0x00000000006a901e in unlock_locked_tables (thd=0x3383618) at sql_parse.cc:162
 
#24 0x00000000006b1d74 in mysql_execute_command (thd=0x3383618) at sql_parse.cc:3687
 
#25 0x00000000006b9666 in mysql_parse (thd=0x3383618, rawbuf=0x3411680 "UNLOCK TABLES", length=13, found_semicolon=0x7fa177332ca0) at sql_parse.cc:6231
 
#26 0x00000000006aba69 in dispatch_command (command=COM_QUERY, thd=0x3383618, packet=0x33f0b19 "UNLOCK TABLES", packet_length=13) at sql_parse.cc:1303
 
#27 0x00000000006aa93d in do_command (thd=0x3383618) at sql_parse.cc:906
 
#28 0x00000000006a78da in handle_one_connection (arg=0x3383618) at sql_connect.cc:1238
 
#29 0x00007fa180597b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
 
#30 0x00007fa1802e1a7d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

Stack trace from:

revision-id: elenst@montyprogram.com-20140422211641-fc02411zu0z1wgyk
 
revno: 3221
 
branch-nick: 5.1



 Comments   
Comment by Michael Widenius [ 2014-07-30 ]

Pushed into 5.5 tree

Generated at Thu Feb 08 07:12:20 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.