crash from select from IS.INNODB_SYS_TABLES
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
MariaDB |
New
|
Undecided
|
Unassigned | ||
Percona Server moved to https://jira.percona.com/projects/PS |
Triaged
|
Critical
|
Unassigned | ||
5.1 |
Triaged
|
Critical
|
Unassigned | ||
5.5 |
Triaged
|
Critical
|
Unassigned |
Bug Description
select from IS.INNODB_
Why are there are no tests in mysql-test for this feature?
1) add this to the end of mysql-test/
select * from INNODB_SYS_TABLES;
2) run that test
3) segfault
The crash happens on the next iteration of the for loop in i_s_innodb_
if (rec_get_
}
The crash stack:
#0 0x00007f3fa9539cfc in pthread_kill () from /lib/libpthread
#0 0x00007f3fa9539cfc in pthread_kill () from /lib/libpthread
#1 0x0000000000a2153e in my_write_core (sig=11) at stacktrace.c:333
#2 0x0000000000604b6b in handle_segfault (sig=11) at mysqld.cc:2652
#3 <signal handler called>
#4 0x000000000087f805 in mach_read_from_2 (b=0x2a <Address 0x2a out of bounds>) at ./include/
#5 0x000000000087ff84 in page_header_
#6 0x000000000087ffa3 in page_is_comp (page=0x0) at ./include/
#7 0x000000000087ffca in page_rec_is_comp (rec=0x0) at ./include/
#8 0x00000000008801f7 in page_rec_get_next (rec=0x0) at ./include/
#9 0x00000000008802ca in page_cur_
#10 0x0000000000880494 in btr_pcur_
#11 0x0000000000880522 in btr_pcur_
#12 0x00000000008862e9 in i_s_innodb_
#13 0x00000000007c3924 in get_schema_
#14 0x000000000068e5a2 in JOIN::exec (this=0x27c45c0) at sql_select.cc:1878
#15 0x0000000000690ce0 in mysql_select (thd=0x27c18d0, rref_pointer_
#16 0x00000000006889fc in handle_select (thd=0x27c18d0, lex=0x27c3538, result=0x28009e0, setup_tables_
#17 0x0000000000621977 in execute_
#18 0x0000000000618780 in mysql_execute_
#19 0x00000000006240e7 in mysql_parse (thd=0x27c18d0, rawbuf=0x1b72cb0 "select * from INNODB_SYS_TABLES", length=31, found_semicolon
#20 0x0000000000615d8e in dispatch_command (command=COM_QUERY, thd=0x27c18d0, packet=0x27d37d1 "select * from INNODB_SYS_TABLES", packet_length=31) at sql_parse.cc:1278
#21 0x0000000000614cef in do_command (thd=0x27c18d0) at sql_parse.cc:903
#22 0x0000000000612e92 in handle_
#23 0x00007f3fa9534971 in start_thread () from /lib/libpthread
#24 0x00007f3fa807a92d in clone () from /lib/libc.so.6
#25 0x0000000000000000 in ?? ()
Changed in percona-server: | |
milestone: | none → release-5.1.54-12.5 |
Changed in percona-server: | |
importance: | Undecided → High |
Changed in percona-server: | |
assignee: | Vadim Tkachenko (vadim-tk) → Valentine Gostev (core-longbow) |
Changed in percona-server: | |
importance: | High → Critical |
status: | Confirmed → Triaged |
Changed in percona-server: | |
milestone: | none → 5.1.58-12.9 |
This diff fixes the crash for me. I don't know much about this part of InnoDB but I looked at other code that uses a cursor and I think it is wrong to close the cursor and commit the minitransaction on the first deleted row, and then continue to use the cursor.
2505c2505,2508 move_to_ next_user_ rec(&pcur, &mtr); move_to_ next_user_ rec(&pcur, &mtr)) { close(& pcur);
< btr_pcur_
---
> if (!btr_pcur_
> mtr_commit(&mtr);
> break;
> }
2516,2517d2518
< btr_pcur_
< mtr_commit(&mtr);