Crash/segfault #1 0x0000000000849721 in drizzled::TransactionServices::getInsertStatement (this=0xe84990, in_session=0x284eca0, in_table=0x7f8e800e5760, next_segment_id=0x7f8e949d75bc) at drizzled/transaction_services.cc:1115

[Patrick Crews]

Crashing bug / segfault. Still working on analyzing / producing a test case. Unsure if this is related to concurrent users or just a single, badly-handled query. Will update the bug as I know more.

Server built:
./config/autorun.sh && ./configure --with-debug

Server started:
./test-run --start-and-exit --mysqld=--transaction-log.enable

Randgen command line:
perl ./gentest.pl --dsn=dbi:drizzle:host=localhost:port=9306:user=root:password="":database=test --gendata=conf/drizzle/drizzle.zz --grammar=conf/drizzle/engine_stress_drizzle.yy --queries=10000 --threads=3 --debug

Backtrace:
#0 0x00007f8e8c068f60 in ?? ()
#1 0x0000000000849721 in drizzled::TransactionServices::getInsertStatement (this=0xe84990, in_session=0x284eca0,
    in_table=0x7f8e800e5760, next_segment_id=0x7f8e949d75bc) at drizzled/transaction_services.cc:1115
#2 0x0000000000849b9e in drizzled::TransactionServices::insertRecord (this=0xe84990, in_session=0x284eca0,
    in_table=0x7f8e800e5760) at drizzled/transaction_services.cc:1234
#3 0x0000000000621796 in log_row_for_replication (table=0x7f8e800e5760, before_record=0x0,
    after_record=0x7f8e800d6438 "\213\361\304\t") at drizzled/cursor.cc:1373
#4 0x0000000000621c1c in drizzled::Cursor::insertRecord (this=0x7f8e800e5fc0, buf=0x7f8e800d6438 "\213\361\304\t")
    at drizzled/cursor.cc:1512
#5 0x00000000007bcb5e in drizzled::write_record (session=0x284eca0, table=0x7f8e800e5760, info=0x2b0a990)
    at drizzled/sql_insert.cc:915
#6 0x00000000007bdb0b in drizzled::select_insert::send_data (this=0x2b0a958, values=...) at drizzled/sql_insert.cc:1256
#7 0x0000000000707fa2 in drizzled::end_send (join=0x2b0a9e8, end_of_records=false) at drizzled/join.cc:2767
#8 0x0000000000707886 in drizzled::evaluate_join_record (join=0x2b0a9e8, join_tab=0x2d8c298, error=0) at drizzled/join.cc:2556
#9 0x00000000007d7f2f in drizzled::sub_select (join=0x2b0a9e8, join_tab=0x2d8c298, end_of_records=false)
    at drizzled/sql_select.cc:3564
#10 0x00000000007d7b15 in drizzled::do_select (join=0x2b0a9e8, fields=0x2b0c030, table=0x0) at drizzled/sql_select.cc:3333
#11 0x0000000000705973 in drizzled::Join::exec (this=0x2b0a9e8) at drizzled/join.cc:1695
#12 0x00000000007d0d71 in drizzled::mysql_select (session=0x284eca0, rref_pointer_array=0x284fad0, tables=0x7f8e8c0677f0,
    wild_num=0, fields=..., conds=0x0, og_num=26, order=0x7f8e8c067a10, group=0x0, having=0x0, select_options=3490201600,
    result=0x2b0a958, unit=0x284f718, select_lex=0x284f918) at drizzled/sql_select.cc:427
#13 0x00000000007d0625 in drizzled::handle_select (session=0x284eca0, lex=0x284f6f8, result=0x2b0a958,
    setup_tables_done_option=1073741824) at drizzled/sql_select.cc:146
#14 0x000000000081bb31 in drizzled::statement::InsertSelect::execute (this=0x7f8e8c033e60)
    at drizzled/statement/insert_select.cc:77
#15 0x00000000007cc7ba in mysql_execute_command (session=0x284eca0) at drizzled/sql_parse.cc:479
#16 0x00000000007cd57c in drizzled::mysql_parse (session=0x284eca0,
    inBuf=0x2847588 "INSERT INTO `c` ( `col_char_10` , `col_char_10_key` , `col_char_10_not_null` , `col_char_10_not_null_key` , `col_char_1024` , `col_char_1024_key` , `col_char_1024_not_null` , `col_char_1024_not_null_k"..., length=1535)
    at drizzled/sql_parse.cc:750
#17 0x00000000007cc10e in drizzled::dispatch_command (command=drizzled::COM_QUERY, session=0x284eca0,
    packet=0x283f551 "INSERT INTO `c` ( `col_char_10` , `col_char_10_key` , `col_char_10_not_null` , `col_char_10_not_null_key` , `col_char_1024` , `col_char_1024_key` , `col_char_1024_not_null` , `col_char_1024_not_null_k"..., packet_length=1535)
    at drizzled/sql_parse.cc:224
#18 0x000000000078ef41 in drizzled::Session::executeStatement (this=0x284eca0) at drizzled/session.cc:667
---Type <return> to continue, or q <return> to quit---
#19 0x000000000078e7db in drizzled::Session::run (this=0x284eca0) at drizzled/session.cc:522
#20 0x00007f8ea6970b54 in MultiThreadScheduler::runSession (this=0x2509220, session=0x284eca0)
    at ./plugin/multi_thread/multi_thread.h:67
#21 0x00007f8ea696e9e2 in session_thread (arg=0x284eca0) at plugin/multi_thread/multi_thread.cc:52
#22 0x00007f8eaa6509ca in start_thread (arg=<value optimized out>) at pthread_create.c:300
#23 0x00007f8eaa3ad6fd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#24 0x0000000000000000 in ?? ()

[Patrick Crews (patrick-crews)]

This occurs in single-thread testing.

Query (note that it is badly-formed - where_insert rather than a proper WHERE clause):
INSERT INTO `cc`
 ( `col_char_10` , `col_char_10_key` , `col_char_10_not_null` , `col_char_10_not_null_key` , `col_char_1024` , `col_char_1024_key` , `col_char_1024_not_null` , `col_char_1024_not_null_key` , `col_int` , `col_int_key` , `col_int_not_null` , `col_int_not_null_key` , `col_bigint` , `col_bigint_key` , `col_bigint_not_null` , `col_bigint_not_null_key` , `col_enum` , `col_enum_key` , `col_enum_not_null` , `col_enum_not_null_key` , `col_text` , `col_text_key` , `col_text_not_null` , `col_text_not_null_key` )
SELECT
`col_char_10` , `col_char_10_key` , `col_char_10_not_null` , `col_char_10_not_null_key` , `col_char_1024` , `col_char_1024_key` , `col_char_1024_not_null` , `col_char_1024_not_null_key` , `col_int` , `col_int_key` , `col_int_not_null` , `col_int_not_null_key` , `col_bigint` , `col_bigint_key` , `col_bigint_not_null` , `col_bigint_not_null_key` , `col_enum` , `col_enum_key` , `col_enum_not_null` , `col_enum_not_null_key` , `col_text` , `col_text_key` , `col_text_not_null` , `col_text_not_null_key`
 FROM `aa`
 where_insert
ORDER BY pk, `col_bigint`,`col_bigint_key`,`col_bigint_not_null`,`col_bigint_not_null_key`,`col_char_10`,`col_char_1024`,`col_char_1024_key`,`col_char_1024_not_null`,`col_char_1024_not_null_key`,`col_char_10_key`,`col_char_10_not_null`,`col_char_10_not_null_key`,`col_enum`,`col_enum_key`,`col_enum_not_null`,`col_enum_not_null_key`,`col_int`,`col_int_key`,`col_int_not_null`,`col_int_not_null_key`,`col_text`,`col_text_key`,`col_text_not_null`,`col_text_not_null_key`,`pk` LIMIT 50

[Patrick Crews (patrick-crews)]

This isn't failing simply because of the query, but rather through some sequence of queries that are issued during the entire randgen run.

[Patrick Crews (patrick-crews)]

As an FYI, this appears likely to the data in the tables. After the crash, a --start-dirty reveals:

Original population counts are
aa: 10
cc: 100

drizzle> select count(*) from cc;
+----------+
| count(*) |
+----------+
| 3227 |
+----------+
1 row in set (0.04 sec)

drizzle> select count(*) from aa;
+----------+
| count(*) |
+----------+
| 2755 |
+----------+
1 row in set (0.03 sec)

[Patrick Crews (patrick-crews)]

Multiple attempts have been made to reproduce this crash with no effect.

Additionally, the server has been subjected to rigorous stress testing without any repeat of this crash.

The assumption is that another crash fix remedied this problem.

Closing out as Invalid as we can no longer repeat this bug.