Querying I_S.GLOBAL_TEMPORARY_TABLES or TEMPORARY_TABLES crashes threads working with temp tables

[Alexey Kopytov]

Querying I_S.GLOBAL_TEMPORARY_TABLES while there's an internal temporary tables created by ALTER TABLE crashes the server. What's interesting is that it crashes in the thread running ALTER TABLE, not in the one running SELECT from the I_S table.

How to repeat:

create table t1(a int);
insert into t1 values(1), (2), (3);
insert into t1 select * from t1; /* repeat to make the table sufficient big */
alter table t1 add column b varchar(10);

/* in another session, while the previous ALTER TABLE is running */
select * from information_schema.global_temporary_tables;

Assertion failure which is the reason for the crash:

Assertion failed: (!table || !table->in_use || table->in_use == _current_thd()), function ha_thd, file /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/handler.cc, line 2172.

Backtrace:

#0 0x00007fff9020bce2 in __pthread_kill ()
#1 0x00007fff8bc7f7d2 in pthread_kill ()
#2 0x00007fff8bc70a7a in abort ()
#3 0x00007fff8bca35de in __assert_rtn ()
#4 0x000000010003b003 in handler::ha_thd () at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/handler.cc:2172
#5 0x000000010003b003 in handler::mark_trx_read_write () at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/handler.cc:3261
#6 0x000000010003b003 in handler::ha_write_row (this=0x10d07c410, buf=0x10c943f20 "?\002")
    at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/handler.cc:4978
#7 0x00000001002a4205 in mysql_alter_table (thd=0x10104ec00, new_db=0x10d077038 "test", new_name=0x10d076ad8 "t1", create_info=0x10cbc6420, table_list=0x10d076b10,
    alter_info=0x10cbc6500, order_num=0, order=0x0, ignore=false) at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/sql_table.cc:7271
#8 0x000000010030d8b1 in Alter_table_statement::execute (this=<value temporarily unavailable, due to optimizations>, thd=0x10104ec00)
    at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/sql_alter.cc:106
#9 0x0000000100215fbc in mysql_execute_command (thd=0x10104ec00) at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/sql_parse.cc:4576
#10 0x000000010021d30b in mysql_parse (thd=0x10104ec00, rawbuf=<value temporarily unavailable, due to optimizations>,
    length=<value temporarily unavailable, due to optimizations>, parser_state=0x10cbc8040)
    at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/sql_parse.cc:5805
#11 0x000000010021eaab in dispatch_command (command=COM_QUERY, thd=0x10104ec00, packet=<value temporarily unavailable, due to optimizations>, packet_length=39)
    at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/sql_parse.cc:1060
#12 0x000000010021f06e in do_command (thd=0x10104ec00) at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/sql_parse.cc:788
#13 0x0000000100308735 in do_handle_one_connection (thd_arg=0x10104ec00)
    at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/sql_connect.cc:1409
#14 0x0000000100308864 in handle_one_connection (arg=<value temporarily unavailable, due to optimizations>)
    at /Users/kaa/src/launchpad/percona-server/5.5/Percona-Server-5.5.19-rel24.0/sql/sql_connect.cc:1315
#15 0x00007fff8bc7d8bf in _pthread_start ()
#16 0x00007fff8bc80b75 in thread_start ()

I didn't verify on 5.1, but most likely it's also affected.

[Laurynas Biveinis (laurynas-biveinis)]

Encountered similar problem with INFORMATION_SCHEMA.TEMPORARY_TABLES. (without GLOBAL_). The problem is that sql_show.cc:fill_global_temporary_tables enumerates existing temp table handler objects. Then for each object the handler ::info method is called in store_temporary_table_record that proceeds to overwrite current_thd, prebuilt->trx and possibly other fields of any operation in progress for that temp table handler.

[Laurynas Biveinis (laurynas-biveinis)]

The straightforward testcase passes on 5.1 because the bug is hidden by bug 1008984.

[yinfeng (yinfeng-zwx)]

does this bug only affect debug version ?

[Laurynas Biveinis (laurynas-biveinis)]

No, the bug affects both release and debug versions.

[yinfeng (yinfeng-zwx)]

thank you for your reply

I will backport the patch to Percona Server 5.5.18 we are using now.

[Laurynas Biveinis (laurynas-biveinis)]

See bug 1113388.

[Laurynas Biveinis (laurynas-biveinis)]

Opening for 5.6: the testcase and debug sync points need to be ported there, and the fix itself too if applies.

[Laurynas Biveinis (laurynas-biveinis)]

They have been ported in the big 5.5 -> 5.6 merge.

[Laurynas Biveinis (laurynas-biveinis)]

See bug 1222709.

[Shahriyar Rzayev (rzayev-sehriyar)]

Percona now uses JIRA for bug reports so this bug report is migrated to: https://jira.percona.com/browse/PS-545