Crash on truncate table operation

[Partha Dutta]

Was testing version 1.0.11-6 Pre-GA compiled against version 5.1.48 and came across this issue while running dbbenchmark:

#0 0x0000003b13a0b9b2 in pthread_kill () from /lib64/libpthread.so.0
#1 0x00000000005bcf9d in handle_segfault (sig=11) at mysqld.cc:2591
#2 <signal handler called>
#3 0x00002aaab3d4c8bf in ha_pbxt::external_lock (this=0xde04fa0, thd=0xdda9210, lock_type=1) at src/ha_pbxt.cc:4830
#4 0x00000000006d2593 in handler::ha_external_lock (this=0xde04fa0, thd=0xdda9210, lock_type=1) at handler.cc:4729
#5 0x00000000005b7755 in mysql_lock_tables (thd=0xdda9210, tables=0xde08810, count=1, flags=<value optimized out>, need_reopen=0x41331257)
    at lock.cc:364
#6 0x0000000000614e4d in lock_tables (thd=0xdda9210, tables=0xde084d8, count=<value optimized out>, need_reopen=0x41331257) at sql_base.cc:5403
#7 0x000000000061efd0 in open_and_lock_tables_derived (thd=0xdda9210, tables=0xde084d8, derived=true) at sql_base.cc:5056
#8 0x000000000066bdc2 in mysql_delete (thd=0xdda9210, table_list=0xde084d8, conds=0x0, order=0x0, limit=18446744073709551615, options=0,
    reset_auto_increment=true) at mysql_priv.h:1648
#9 0x000000000066cd25 in mysql_truncate (thd=0xdda9210, table_list=0xde084d8, dont_send_ok=<value optimized out>) at sql_delete.cc:1082
#10 0x00000000005d4ad8 in mysql_execute_command (thd=0xdda9210) at sql_parse.cc:3362
#11 0x00000000005d7cb7 in mysql_parse (thd=0xdda9210, inBuf=0xde08400 "truncate table dbbench", length=22, found_semicolon=0x41333d48)
    at sql_parse.cc:6100
#12 0x00000000005d8145 in dispatch_command (command=COM_QUERY, thd=0xdda9210, packet=<value optimized out>, packet_length=<value optimized out>)
    at sql_parse.cc:1253
#13 0x00000000005d965a in do_command (thd=0xdda9210) at sql_parse.cc:891
#14 0x00000000005c897c in handle_one_connection (arg=0xdda9210) at sql_connect.cc:1736
#15 0x0000003b13a064a7 in start_thread () from /lib64/libpthread.so.0
#16 0x0000003b132d3c2d in clone () from /lib64/libc.so.6

The operation was "truncate table dbbench" against an empty table.

The block of code:
                if (!pb_open_tab->ot_thread->st_stat_trans) {
                        trans_register_ha(pb_mysql_thd, FALSE, pbxt_hton);
                        XT_PRINT0(pb_open_tab->ot_thread, "STAT START - ha_pbxt::external_lock --> trans_register_ha\n");
                        pb_open_tab->ot_thread->st_stat_trans = TRUE;
                }
pb_open_tab is null at this point, hence the seg fault.

Partha Dutta
Sr. Mgr, MySQL Infrastructure & Operations

[Partha Dutta (pdutta)]

More info. This happens if the truncate operation occurs twice in a row against the same table.

[Paul McCullagh (paul-mccullagh)]

Hi Partha,

Thanks for the bug report! Confirmed this bug as described.

[Paul McCullagh (paul-mccullagh)]

A fix to this bug has been pushed to 1.0.11-7.