[MDEV-6759] innodb valgrind failures Created: 2014-09-19  Updated: 2016-12-19  Resolved: 2014-10-27

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - InnoDB
Affects Version/s: 10.0.14
Fix Version/s: 10.0.15

Type: Bug Priority: Major
Reporter: Sergei Golubchik Assignee: Jan Lindström (Inactive)
Resolution: Fixed Votes: 0
Labels: innodb, valgrind

Issue Links:
Relates
relates to MDEV-11602 InnoDB leaks foreign key metadata on ... Closed
relates to MDEV-6922 mysqld signal 11 crash when running m... Closed

 Description   

10.0 fails in valgrind like

innodb.innodb 'innodb_plugin'            w6 [ fail ]  Found warnings/errors in server log file!
 
        Test ended at 2014-09-18 19:41:40
 
line
 
==10503== Thread 19:
 
==10503== Invalid free() / delete / delete[] / realloc()
 
==10503==    at 0x4C257D8: free (vg_replace_malloc.c:446)
 
==10503==    by 0xA25EDF: mem_area_free(void*, mem_pool_t*) (mem0pool.cc:519)
 
==10503==    by 0xA2528F: mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) (mem0mem.cc:521)
 
==10503==    by 0xB7FBDA: mem_heap_free_func(mem_block_info_t*, char const*, unsigned long) (mem0mem.ic:510)
 
==10503==    by 0xB91317: dict_foreign_remove_partial std::for_each<std::_Rb_tree_const_iterator<dict_foreign_t*>, dict_foreign_remove_partial>(std::_Rb_tree_const_iterator<dict_foreign_t*>, std::_Rb_tree_const_iterator<dict_foreign_t*>, dict_foreign_remove_partial) (dict0mem.h:804)
 
==10503==    by 0xBFF4450: dict_table_rename_in_cache(dict_table_t*, char const*, unsigned long) (dict0dict.cc:1664)
 
==10503==    by 0xC089A56: commit_cache_rebuild(ha_innobase_inplace_ctx*) (handler0alter.cc:5027)
 
==10503==    by 0xC0817D0: ha_innodb::commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) (handler0alter.cc:5705)
 
==10503==    by 0x686E19: mysql_inplace_alter_table(THD*, TABLE_LIST*, TABLE*, TABLE*, Alter_inplace_info*, enum_alter_inplace_result, MDL_request*, Alter_table_ctx*) (sql_table.cc:7054)
 
==10503==    by 0x68A460: mysql_alter_table(THD*, char*, char*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) (sql_table.cc:8803)
 
==10503==    by 0x5EC4D2: mysql_execute_command(THD*) (sql_parse.cc:3078)
 
==10503==    by 0x5EDBD9: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:6415)
 
==10503==    by 0x5EF5EB: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1307)
 
==10503==    by 0x5F0DD1: do_command(THD*) (sql_parse.cc:1004)
 
==10503==    by 0x6E025E: do_handle_one_connection(THD*) (sql_connect.cc:1379)
 
==10503==    by 0x6E0384: handle_one_connection (sql_connect.cc:1293)
 
==10503==  Address 0xc90a478 is 623,672 bytes inside a block of size 8,388,640 alloc'd
 
==10503==    at 0x4C25DD6: malloc (vg_replace_malloc.c:270)
 
==10503==    by 0xC1BE9F6: ut_malloc_low(unsigned long, unsigned long) (ut0mem.cc:117)
 
==10503==    by 0xC0CD027: mem_pool_create(unsigned long) (mem0pool.cc:231)
 
==10503==    by 0xC0CBD3B: mem_init(unsigned long) (mem0dbg.cc:177)
 
==10503==    by 0xC184280: srv_boot() (srv0srv.cc:1033)
 
==10503==    by 0xC18B4DA: innobase_start_or_create_for_mysql() (srv0start.cc:1823)
 
==10503==    by 0xC06845B: innobase_init(void*) (ha_innodb.cc:3369)
 
==10503==    by 0x7A099B: ha_initialize_handlerton(st_plugin_int*) (handler.cc:502)
 
==10503==    by 0x5F83A9: plugin_initialize(st_mem_root*, st_plugin_int*, int*, char**, bool) (sql_plugin.cc:1378)
 
==10503==    by 0x5FA3AB: plugin_init(int*, char**, int) (sql_plugin.cc:1665)
 
==10503==    by 0x53C6D4: init_server_components() (mysqld.cc:4811)
 
==10503==    by 0x53D39D: mysqld_main(int, char**) (mysqld.cc:5405)
 
==10503==    by 0x6242585: (below main) (in /lib64/libc-2.9.so)
 
^ Found warnings in /dev/shm/var_auto_HweU/6/log/mysqld.1.err
 
ok

All tests below fail in a very similar fashion:

innodb.innodb 'innodb_plugin'
 
innodb.innodb-index 'innodb_plugin'
 
innodb.innodb_bug12902967 'innodb_plugin'
 
innodb.innodb_bug47621 'innodb_plugin'
 
main.alter_table 'innodb_plugin'
 
main.subselect2 'innodb_plugin'
 
vcol.vcol_ins_upd_innodb 'innodb_plugin'



 Comments   
Comment by Jan Lindström (Inactive) [ 2014-10-26 ]

I really do not know what is wrong with this, I can't repeat this on my machine and reading the code it looks correct.

Comment by Sergei Petrunia [ 2014-10-27 ]

One can repeat this as follows:

ssh work.askmonty.org
 
git clone https://github.com/MariaDB/server.git 10.1
 
cd 10.1
 
cmake . -DWITH_VALGRIND:BOOL=ON
 
make
 
cd mysql-test
 
./mysql-test-run  --valgrind t/alter_table.test

The output is:

main.alter_table 'innodb_plugin'         [ fail ]  Found warnings/errors in server log file!
 
        Test ended at 2014-10-27 14:01:28
 
line
 
==828== Conditional jump or move depends on uninitialised value(s)
 
==828==    at 0x5B8CD6A: BN_bin2bn (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5B90408: ??? (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5BB207D: ??? (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
 
==828==    by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
 
==828==    by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
 
==828==    by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
 
==828==    by 0x6825585: (below main) (in /lib64/libc-2.9.so)
 
==828== Conditional jump or move depends on uninitialised value(s)
 
==828==    at 0x5B8C15D: BN_num_bits_word (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5B8C2A4: BN_num_bits (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5B8AF29: BN_mod_exp_mont_consttime (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5BB20DB: ??? (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
 
==828==    by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
 
==828==    by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
 
==828==    by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
 
==828==    by 0x6825585: (below main) (in /lib64/libc-2.9.so)
 
==828== Conditional jump or move depends on uninitialised value(s)
 
==828==    at 0x5B8C16C: BN_num_bits_word (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5B8C2A4: BN_num_bits (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5B8AF29: BN_mod_exp_mont_consttime (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5BB20DB: ??? (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
 
==828==    by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
 
==828==    by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
 
==828==    by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
 
==828==    by 0x6825585: (below main) (in /lib64/libc-2.9.so)
 
==828== Conditional jump or move depends on uninitialised value(s)
 
==828==    at 0x5B8C17B: BN_num_bits_word (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5B8C2A4: BN_num_bits (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5B8AF29: BN_mod_exp_mont_consttime (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5BB20DB: ??? (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
 
==828==    by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
 
==828==    by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
 
==828==    by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
 
==828==    by 0x6825585: (below main) (in /lib64/libc-2.9.so)
 
==828== Use of uninitialised value of size 8
 
==828==    at 0x5B8C18C: BN_num_bits_word (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5B8C2A4: BN_num_bits (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5B8AF29: BN_mod_exp_mont_consttime (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5BB20DB: ??? (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
 
==828==    by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
 
==828==    by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
 
==828==    by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
 
==828==    by 0x6825585: (below main) (in /lib64/libc-2.9.so)
 
==828== Use of uninitialised value of size 8
 
==828==    at 0x5B8B42B: BN_mod_exp_mont_consttime (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x5BB20DB: ??? (in /usr/lib64/libcrypto.so.0.9.8)
 
==828==    by 0x58CA797: ssl3_ctx_ctrl (in /usr/lib64/libssl.so.0.9.8)
 
==828==    by 0xB6FDE5: new_VioSSLFd (viosslfactories.c:286)
 
==828==    by 0xB700B4: new_VioSSLAcceptorFd (viosslfactories.c:336)
 
==828==    by 0x52F5F1: mysqld_main(int, char**) (mysqld.cc:4658)
 
==828==    by 0x6825585: (below main) (in /lib64/libc-2.9.so)
 
==828== Thread 21:
 
==828== Invalid free() / delete / delete[] / realloc()
 
==828==    at 0x4C257D8: free (vg_replace_malloc.c:446)
 
==828==    by 0x9CB412: mem_area_free(void*, mem_pool_t*) (mem0pool.cc:519)
 
==828==    by 0x9CA317: mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) (mem0mem.cc:521)
 
==828==    by 0xABB371: dict_foreign_remove_partial std::for_each<std::_Rb_tree_const_iterator<dict_foreign_t*>, dict_foreign_remove_partial>(std::_Rb_tree_const_iterator<dict_foreign_t*>, std::_Rb_tree_const_iterator<dict_foreign_t*>, dict_foreign_remove_partial) (mem0mem.ic:510)
 
==828==    by 0xCDB3211: dict_table_rename_in_cache(dict_table_t*, char const*, unsigned long) (dict0dict.cc:1666)
 
==828==    by 0xCEA0288: row_rename_table_for_mysql(char const*, char const*, trx_t*, bool) (row0mysql.cc:5099)
 
==828==    by 0xCE1B449: ha_innodb::rename_table(char const*, char const*) (ha_innodb.cc:12023)
 
==828==    by 0x625EB2: mysql_rename_table(handlerton*, char const*, char const*, char const*, char const*, unsigned int) (sql_table.cc:5187)
 
==828==    by 0x634579: mysql_alter_table(THD*, char*, char*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) (sql_table.cc:9008)
 
==828==    by 0x67C9FB: Sql_cmd_alter_table::execute(THD*) (sql_alter.cc:329)
 
==828==    by 0x5AD617: mysql_execute_command(THD*) (sql_parse.cc:5461)
 
==828==    by 0x5B41DD: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:6953)
 
==828==    by 0x5B7217: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1466)
 
==828==    by 0x5B756E: do_command(THD*) (sql_parse.cc:1095)
 
==828==    by 0x678FB6: do_handle_one_connection(THD*) (sql_connect.cc:1351)
 
==828==    by 0x6790EF: handle_one_connection (sql_connect.cc:1262)
 
==828==  Address 0xd231878 is 714,808 bytes inside a block of size 8,388,640 alloc'd
 
==828==    at 0x4C25DD6: malloc (vg_replace_malloc.c:270)
 
==828==    by 0xCEEDE9D: ut_malloc_low(unsigned long, unsigned long) (ut0mem.cc:117)
 
==828==    by 0xCE53499: mem_pool_create(unsigned long) (mem0pool.cc:231)
 
==828==    by 0xCE5275B: mem_init(unsigned long) (mem0dbg.cc:177)
 
==828==    by 0xCEC60C8: srv_general_init() (srv0srv.cc:1084)
 
==828==    by 0xCEC657F: srv_boot() (srv0srv.cc:1131)
 
==828==    by 0xCECC4E6: innobase_start_or_create_for_mysql() (srv0start.cc:1837)
 
==828==    by 0xCE107B4: innobase_init(void*) (ha_innodb.cc:3569)
 
==828==    by 0x72B306: ha_initialize_handlerton(st_plugin_int*) (handler.cc:523)
 
==828==    by 0x5BCC12: plugin_initialize(st_mem_root*, st_plugin_int*, int*, char**, bool) (sql_plugin.cc:1359)
 
==828==    by 0x5BF66B: plugin_init(int*, char**, int) (sql_plugin.cc:1630)
 
==828==    by 0x52D103: init_server_components() (mysqld.cc:5020)
 
==828==    by 0x52F3AD: mysqld_main(int, char**) (mysqld.cc:5606)
 
==828==    by 0x6825585: (below main) (in /lib64/libc-2.9.so)
 
^ Found warnings in /home/psergey/dev-git/10.1/mysql-test/var/log/mysqld.1.err

Comment by Jan Lindström (Inactive) [ 2014-10-27 ]

Repeated.

Comment by Jan Lindström (Inactive) [ 2014-10-27 ]

revno: 4464
committer: Jan Lindström <jplindst@mariadb.org>
branch nick: 10.0
timestamp: Mon 2014-10-27 16:58:16 +0200
message:
MDEV-6759: innodb valgrind failures

Fix failure seen on dict_foreign_remove_partial().

Comment by Marko Mäkelä [ 2016-12-19 ]

For which SQL statement was the double free reported?
The ‘fix’ here introduced memory leaks. For example, the following simple tests case will leak the dict_foreign_t when table t2 is dropped:

--source include/have_innodb.inc
 
CREATE TABLE t1 (id INT PRIMARY KEY) ENGINE=INNODB;
 
CREATE TABLE t2 (id INT PRIMARY KEY, t1_id INT, FOREIGN KEY (t1_id) REFERENCES t1(id)) ENGINE=INNODB;
 
DROP TABLE t2,t1;

Comment by Marko Mäkelä [ 2016-12-19 ]

With the patch for MDEV-11602 (effectively reverting this change) applied to 10.1 and 10.0, I did not observe any double free in main.alter_table or any other test with a -DWITH_ASAN executable. Only memory leaks were reported for InnoDB/XtraDB tests in 10.0 in the server error logs (which are ignored by mtr): innodb.innodb_file_format innodb.innodb_prefix_index_restart_server

I was unable to build 8777e801517d503aa5cf7a038610fe27f91ba730~ (the 10.0 version immediately before this change), so I cannot confirm if a double free was present before the change.

Generated at Thu Feb 08 07:14:22 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.