-
Notifications
You must be signed in to change notification settings - Fork 5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
MDEV-14821 Assertion !is_set() || (m_status == DA_OK_BULK && is_bulk_op())
failed in Diagnostics_area::set_ok_status
#441
Comments
Here is the problem. (gdb) bt
#0 Field_timestampf::cmp (this=0x61d000244108, a_ptr=0x62b000000ea0 '\217' <repeats 200 times>..., b_ptr=0x61d000245670 "\177\377\377\376") at field.h:2650
#1 partition_info_compare_column_values (first_arg=0x61d000245148, second_arg=0x61d000245250) at partition_info.cc:1700
#2 partition_info::compare_column_values (first_arg=0x61d000245148, second_arg=0x61d000245250) at partition_info.cc:1712
#3 partition_info::check_range_constants (this=0x61d000244290, thd=0x62a0000ba270, alloc=false) at partition_info.cc:1561
#4 partition_info::vers_update_range_constants (this=0x61d000244290, thd=0x62a0000ba270) at partition_info.h:565
#5 prune_partitions (thd=0x62a0000ba270, table=0x61f0000540f0, pprune_cond=0x62b000000b50) at opt_range.cc:3460
#6 mysql_delete (thd=0x62a0000ba270, table_list=0x62b000000370, conds=0x62b000000b50, order_list=0x62a0000be9d0, limit=18446744073709551615, options=0, result=0x0) at sql_delete.cc:482
#7 mysql_execute_command (thd=0x62a0000ba270) at sql_parse.cc:4902
#8 mysql_parse (thd=0x62a0000ba270, rawbuf=0x62b000000288 "DELETE FROM t1 WHERE a = 5", length=26, parser_state=0x7fffdeb989e0, is_com_multi=false, is_next_command=false) at sql_parse.cc:7991
(gdb) p/x *a_ptr@7
$1 = {0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f}
(gdb) p/x *b_ptr@7
$2 = {0x7f, 0xff, 0xff, 0xfe, 0x0, 0x0, 0x0}
|
Debug print every such comparison: b field.h:2650
commands
p/x *a_ptr@7
p/x *b_ptr@7
end $1 = {0x7f, 0xff, 0xff, 0xfd, 0x0, 0x0, 0x0}
$2 = {0x7f, 0xff, 0xff, 0xfe, 0x0, 0x0, 0x0}
$3 = {0x7f, 0xff, 0xff, 0xfd, 0x0, 0x0, 0x0}
$4 = {0x7f, 0xff, 0xff, 0xfe, 0x0, 0x0, 0x0}
$5 = {0x7f, 0xff, 0xff, 0xfd, 0x0, 0x0, 0x0}
$6 = {0x7f, 0xff, 0xff, 0xfe, 0x0, 0x0, 0x0}
$7 = {0x7f, 0xff, 0xff, 0xff, 0xf, 0x42, 0x3f}
$8 = {0x7f, 0xff, 0xff, 0xff, 0xf, 0x42, 0x3f}
$9 = {0x7f, 0xff, 0xff, 0xff, 0xf, 0x42, 0x3f}
$10 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}
$11 = {0x7f, 0xff, 0xff, 0xfd, 0x0, 0x0, 0x0}
$12 = {0x7f, 0xff, 0xff, 0xfe, 0x0, 0x0, 0x0}
$13 = {0x5a, 0x4b, 0xe7, 0x62, 0x8, 0x70, 0xca}
$14 = {0x7f, 0xff, 0xff, 0xff, 0xf, 0x42, 0x3f}
$15 = {0x5a, 0x4b, 0xe7, 0x62, 0x8, 0x70, 0xca}
$16 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}
$17 = {0x5a, 0x4b, 0xe7, 0x62, 0x8, 0x70, 0xca}
$18 = {0x5a, 0x4b, 0xe7, 0x62, 0x8, 0x70, 0xca}
$19 = {0x5a, 0x4b, 0xe7, 0x62, 0x8, 0x70, 0xca}
$20 = {0x5a, 0x4b, 0xe7, 0x62, 0x8, 0x70, 0xca}
$21 = {0x5a, 0x4b, 0xe7, 0x62, 0x8, 0x70, 0xca}
$22 = {0x5a, 0x4b, 0xe7, 0x62, 0x8, 0x70, 0xca}
$23 = {0x5a, 0x4b, 0xe7, 0x62, 0x8, 0x70, 0xca}
$24 = {0x5a, 0x4b, 0xe7, 0x62, 0x8, 0x70, 0xca}
$25 = {0x7f, 0xff, 0xff, 0xff, 0xf, 0x42, 0x3f}
$26 = {0x7f, 0xff, 0xff, 0xff, 0xf, 0x42, 0x3f}
$27 = {0x7f, 0xff, 0xff, 0xff, 0xf, 0x42, 0x3f}
$28 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}
$29 = {0x7f, 0xff, 0xff, 0xfd, 0x0, 0x0, 0x0}
$30 = {0x7f, 0xff, 0xff, 0xfe, 0x0, 0x0, 0x0}
$31 = {0x5a, 0x4b, 0xe7, 0x66, 0xb, 0xab, 0x5}
$32 = {0x7f, 0xff, 0xff, 0xff, 0xf, 0x42, 0x3f}
$33 = {0x5a, 0x4b, 0xe7, 0x66, 0xb, 0xab, 0x5}
$34 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}
$35 = {0x5a, 0x4b, 0xe7, 0x66, 0x0, 0x0, 0x0}
$36 = {0x7f, 0xff, 0xff, 0xfe, 0x0, 0x0, 0x0}
$37 = {0x5a, 0x4b, 0xe7, 0x71, 0x6, 0x53, 0xf1}
$38 = {0x5a, 0x4b, 0xe7, 0x66, 0xb, 0xab, 0x5}
$39 = {0x5a, 0x4b, 0xe7, 0x71, 0x6, 0x53, 0xf1}
$40 = {0x5a, 0x4b, 0xe7, 0x66, 0xb, 0xab, 0x5}
$41 = {0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8f}
$42 = {0x7f, 0xff, 0xff, 0xfe, 0x0, 0x0, 0x0} Those are datetimes: class Field_timestampf :public Field_timestamp_with_dec {
...
int cmp(const uchar *a_ptr,const uchar *b_ptr)
{
return memcmp(a_ptr, b_ptr, pack_length());
} |
#define TRASH_FREE(A,B) TRASH_FILL(A,(size_t) (B),0x8F)
#define TRASH(A,B) TRASH_FREE(A,B) |
Do not set #0 partition_info::vers_update_col_vals (this=0x7fff9c17ade0, thd=0x7fff9c000d50, el0=0x7fff9c17b018, el1=0x7fff9c17b140) at partition_info.cc:1196
#1 partition_info::vers_update_stats (this=0x7fff9c17ade0, thd=0x7fff9c000d50, el=0x7fff9c17b140) at partition_info.h:536
#2 partition_info::vers_update_stats (this=0x7fff9c17ade0, thd=0x7fff9c000d50, part_id=1) at partition_info.h:545
#3 ha_partition::update_row (this=0x7fff9c17f518, old_data=0x7fff9c006c00 "\341\001", new_data=0x7fff9c006be8 "\341\001") at ha_partition.cc:4399
#4 handler::ha_update_row (this=0x7fff9c17f518, old_data=0x7fff9c006c00 "\341\001", new_data=0x7fff9c006be8 "\341\001") at handler.cc:6238
#5 TABLE::delete_row (this=0x7fff9c17e8e0) at sql_delete.cc:257
#6 mysql_delete (thd=0x7fff9c000d50, table_list=0x7fff9c015030, conds=0x7fff9c015810, order_list=0x7fff9c0054b0, limit=18446744073709551615, options=0, result=0x0) at sql_delete.cc:752
#7 mysql_execute_command (thd=0x7fff9c000d50) at sql_parse.cc:4902
#8 mysql_parse (thd=0x7fff9c000d50, rawbuf=0x7fff9c014f48 "DELETE FROM t1 WHERE a = 1", length=26, parser_state=0x7fffec560410, is_com_multi=false, is_next_command=false) at sql_parse.cc:7991
#9 dispatch_command (command=COM_QUERY, thd=0x7fff9c000d50, packet=0x7fff9c00b3a1 "DELETE FROM t1 WHERE a = 1", packet_length=26, is_com_multi=false, is_next_command=false) at sql_parse.cc:1824 |
Watchpoint on use-after-free piece of memory: awatch *(const uchar *) 0x7fff9c015b60
commands
bt
end Breakpoints on various bbt partition_info.cc:1019
bbt partition_info.cc:1199
bbt partition_info.cc:1212
bbt partition_info.cc:2848
bbt partition_info.cc:2876
bbt partition_info.cc:2936
bbt partition_info.cc:2984 Breakpoint on timestamp compare code: b field.h:2650
commands
p/x *a_ptr@7
p/x *b_ptr@7
end A lot of stuff in printed in gdb. Here is the quotes:
So, a problem piece of memory was freed long before the read-after-free query. This memory is a part of
This resulted in bool partition_info::check_range_constants(THD *thd, bool alloc)
{
// ...
range_not_increasing_error:
my_error(ER_RANGE_NOT_INCREASING_ERROR, MYF(0));
goto end;
} which is a source of original observable assertion failure. |
Assigning a pointer to a memory allocated in bool partition_info::fix_column_value_functions(THD *thd,
// ...
if (!(val_ptr= (uchar*) thd->memdup(field->ptr, len)))
{
mem_alloc_error(len);
result= TRUE;
goto end;
}
col_val->column_value= val_ptr; Thread 28 "mysqld" hit Breakpoint 2, partition_info::fix_column_value_functions (this=0x7fff9c17ade0, thd=0x7fff9c000d50, val=0x7fff9c17b3c0, part_id=0) at partition_info.cc:2981
2981 col_val->column_value= val_ptr;
#0 partition_info::fix_column_value_functions (this=0x7fff9c17ade0, thd=0x7fff9c000d50, val=0x7fff9c17b3c0, part_id=0) at partition_info.cc:2981
#1 partition_info::check_range_constants (this=0x7fff9c17ade0, thd=0x7fff9c000d50, alloc=false) at partition_info.cc:1555
#2 partition_info::vers_update_range_constants (this=0x7fff9c17ade0, thd=0x7fff9c000d50) at partition_info.h:565
#3 prune_partitions (thd=0x7fff9c000d50, table=0x7fff9c17e8e0, pprune_cond=0x7fff9c015810) at opt_range.cc:3460
#4 mysql_delete (thd=0x7fff9c000d50, table_list=0x7fff9c015030, conds=0x7fff9c015810, order_list=0x7fff9c0054b0, limit=18446744073709551615, options=0, result=0x0) at sql_delete.cc:482
#5 mysql_execute_command (thd=0x7fff9c000d50) at sql_parse.cc:4902
#6 mysql_parse (thd=0x7fff9c000d50, rawbuf=0x7fff9c014f48 "DELETE FROM t1 WHERE a = 1", length=26, parser_state=0x7fffec560410, is_com_multi=false, is_next_command=false) at sql_parse.cc:7991
#7 dispatch_command (command=COM_QUERY, thd=0x7fff9c000d50, packet=0x7fff9c00b3a1 "DELETE FROM t1 WHERE a = 1", packet_length=26, is_com_multi=false, is_next_command=false) at sql_parse.cc:1824
#8 do_command (thd=0x7fff9c000d50) at sql_parse.cc:1369
#9 do_handle_one_connection (connect=0x2abc250) at sql_connect.cc:1420
#10 handle_one_connection (arg=0x2abc250) at sql_connect.cc:1326
#11 pfs_spawn_thread (arg=0x2bae230) at pfs.cc:1863
#12 start_thread (arg=0x7fffec561700) at pthread_create.c:465
#13 clone () at clone.S:95
$51 = (uchar *) 0x7fff9c015b60 "ZN3l"
$52 = {0x5a, 0x4e, 0x33, 0x6c, 0x0, 0x0, 0x0} Freeing Old value = 90 'Z'
New value = 143 '\217'
__memset_avx2_erms () at memset-vec-unaligned-erms.S:141
141 memset-vec-unaligned-erms.S: No such file or directory.
#0 __memset_avx2_erms () at memset-vec-unaligned-erms.S:141
#1 free_root (root=0x7fff9c006138, MyFlags=1) at my_alloc.c:422
#2 dispatch_command (command=COM_QUERY, thd=0x7fff9c000d50, packet=0x7fff9c00b3a1 "", packet_length=26, is_com_multi=false, is_next_command=false) at sql_parse.cc:2414
#3 do_command (thd=0x7fff9c000d50) at sql_parse.cc:1369
#4 do_handle_one_connection (connect=0x2abc250) at sql_connect.cc:1420
#5 handle_one_connection (arg=0x2abc250) at sql_connect.cc:1326
#6 pfs_spawn_thread (arg=0x2bae230) at pfs.cc:1863
#7 start_thread (arg=0x7fffec561700) at pthread_create.c:465
#8 clone () at clone.S:95 Then reading it in the next query:
|
Reproduce
Result
Expected
No assertion failure.
The text was updated successfully, but these errors were encountered: