Crash in check_table_is_closed with concurrent workload

Bug #884101 reported by Philip Stoev
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
MariaDB
Fix Released
Medium
Michael Widenius

Bug Description

When executing a concurrent workload involving CREATE and DROP on per-thread tables, the server crashed as follows:

# 2011-10-29T06:01:37 #4 0x0000000000971837 in check_table_is_closed (
# 2011-10-29T06:01:37 name=0x7f254c0828e0 "./transforms/where_subselect_31133",
# 2011-10-29T06:01:37 where=0xe36557 "delete") at mi_dbug.c:179
# 2011-10-29T06:01:37 #5 0x000000000098f2e8 in mi_delete_table (
# 2011-10-29T06:01:37 name=0x7f254c0828e0 "./transforms/where_subselect_31133")
# 2011-10-29T06:01:37 at mi_delete_table.c:66
# 2011-10-29T06:01:37 #6 0x000000000093c314 in ha_myisam::delete_table (this=0x7f24c00076f8,
# 2011-10-29T06:01:37 name=0x7f254c0828e0 "./transforms/where_subselect_31133")
# 2011-10-29T06:01:37 at ha_myisam.cc:2004
# 2011-10-29T06:01:37 #7 0x000000000083947e in handler::ha_delete_table (this=0x7f24c00076f8,
# 2011-10-29T06:01:37 name=0x7f254c0828e0 "./transforms/where_subselect_31133")
# 2011-10-29T06:01:37 at handler.cc:3560
# 2011-10-29T06:01:37 #8 0x00000000008363bd in ha_delete_table (thd=0x4927ec8,
# 2011-10-29T06:01:37 table_type=0x358d768,
# 2011-10-29T06:01:37 path=0x7f254c0828e0 "./transforms/where_subselect_31133",
# 2011-10-29T06:01:37 db=0x7f24c00072b8 "transforms",
# 2011-10-29T06:01:37 alias=0x7f24c00072c8 "where_subselect_31133", generate_warning=true)
# 2011-10-29T06:01:37 at handler.cc:2066
# 2011-10-29T06:01:37 #9 0x0000000000859a79 in mysql_rm_table_part2 (thd=0x4927ec8,
# 2011-10-29T06:01:37 tables=0x7f24c0007320, if_exists=false, drop_temporary=false,
# 2011-10-29T06:01:37 drop_view=false, dont_log_query=false) at sql_table.cc:2067
# 2011-10-29T06:01:37 #10 0x000000000085903e in mysql_rm_table (thd=0x4927ec8,
# 2011-10-29T06:01:37 tables=0x7f24c0007320, if_exists=0 '\000', drop_temporary=0 '\000')
# 2011-10-29T06:01:37 at sql_table.cc:1845
# 2011-10-29T06:01:37 #11 0x00000000006c2d6b in mysql_execute_command (thd=0x4927ec8)
# 2011-10-29T06:01:37 at sql_parse.cc:3411
# 2011-10-29T06:01:37 #12 0x00000000006cb25f in mysql_parse (thd=0x4927ec8,
# 2011-10-29T06:01:37 rawbuf=0x7f24c00071f0 "DROP TABLE transforms.where_subselect_31133",
# 2011-10-29T06:01:37 length=43, found_semicolon=0x7f254c083c68) at sql_parse.cc:6112
# 2011-10-29T06:01:37 #13 0x00000000006bcccb in dispatch_command (command=COM_QUERY, thd=0x4927ec8,
# 2011-10-29T06:01:37 packet=0x492bb99 "DROP TABLE transforms.where_subselect_31133",
# 2011-10-29T06:01:37 packet_length=43) at sql_parse.cc:1221
# 2011-10-29T06:01:37 #14 0x00000000006bc04b in do_command (thd=0x4927ec8) at sql_parse.cc:916
# 2011-10-29T06:01:37 #15 0x00000000006b8f27 in handle_one_connection (arg=0x4927ec8)
# 2011-10-29T06:01:37 at sql_connect.cc:1191
# 2011-10-29T06:01:37 #16 0x00000035a7207761 in start_thread () from /lib64/libpthread.so.0
# 2011-10-29T06:01:37 #17 0x00000035a6ee098d in clone () from /lib64/libc.so.6

Each thread operates on a separate set of tables so there are no concurrent DDL statements that involve the same table.

RQG command line:

perl runall.pl --queries=100000000 --debug --mysqld1=--sql_mode=ONLY_FULL_GROUP_BY --queries=100M --duration=600 --threads=4 --seed=time --mysqld1=--log-output=file --no-mask --reporter=QueryTimeout,Backtrace,ErrorLog,Deadlock --mysqld1=--optimizer_switch=derived_merge=ON,derived_with_keys=ON,index_condition_pushdown=ON,mrr=ON,mrr_sort_keys=ON,semijoin=ON,subquery_cache=OFF,join_cache_hashed=ON,materialization=OFF --validator=Transformer --transformers=DisableChosenPlan,ExecuteAsPreparedOnce,ExecuteAsView,ExecuteAsWhereSubquery,ExecuteAsDerived,ConvertTablesToViews,ConvertTablesToDerived --mysqld1=--join_cache_level=1 --views=TEMPTABLE --engine=MyISAM --varchar-length=48 --grammar=conf/optimizer/optimizer_no_subquery_simple.yy --seed=1319856919 --basedir1=/home/philips/bzr/maria-5.3

Related branches

Revision history for this message
Philip Stoev (pstoev-askmonty) wrote :
Changed in maria:
assignee: nobody → Michael Widenius (monty)
Revision history for this message
Philip Stoev (pstoev-askmonty) wrote :

revision-id: <email address hidden>
date: 2011-10-28 12:38:36 +0400
build-date: 2011-10-31 11:26:39 +0200
revno: 3258
branch-nick: maria-5.3

Michael Widenius (monty)
Changed in maria:
status: New → In Progress
Revision history for this message
Michael Widenius (monty) wrote :

I have now added a mutex to protect the structure that caused a crash.
I tried to repeat the original problem for some time, but was not successful with that.
I also did run the test for couple of hours after adding the patch without any core dumping issues, so I
assume this should now be fixed.

Changed in maria:
status: In Progress → Fix Released
milestone: none → 5.3
importance: Undecided → Medium
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.