| Bug #23651 | Server crash calling trigger | ||
|---|---|---|---|
| Submitted: | 25 Oct 2006 22:04 | Modified: | 30 Nov 2006 20:08 |
| Reporter: | Matthew Montgomery | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server | Severity: | S1 (Critical) |
| Version: | 5.0.26,5.0BK | OS: | Any (*) |
| Assigned to: | Dmitry Lenev | CPU Architecture: | Any |
| Tags: | crash, stored procedure, trigger | ||
[26 Oct 2006 11:46]
Heikki Tuuri
Matthew, the resolved stack trace looks nonsensical. innobase_get_cset_width() can only be called from within the /innobase source code. It is not called from ::fix_outer_field(). Can you get a correctly resolved stack trace so that we can identify where it crashes? Regards, Heikki
[28 Oct 2006 7:45]
MySQL Verification Team
was able to repeat this crash once. still analyzing.
[1 Nov 2006 11:09]
MySQL Verification Team
with 5.0BK debug build, I got assertion before crash: Version: '5.0.28-debug-log' socket: '/tmp/mysql.sock' port: 3306 yes mysqld: field.cc:3387: virtual longlong Field_long::val_int(): Assertion `table->in_use == _current_thd()' failed. mysqld got signal 6;
[1 Nov 2006 11:13]
MySQL Verification Team
0x80db75b handle_segfault + 417 0x83ce2ed __pthread_sighandler + 173 0x84030d1 __kill + 17 0x83cbbbb __pthread_raise + 27 0x84034a4 abort + 340 0x83feef0 __assert_fail + 224 0x80ba61a Field_long::val_int() + 72 0x807d600 Item_func_sp::val_int() + 56 0x8057968 Item::save_in_field(Field*, bool) + 494 0x8123ff2 fill_record(THD*, List<Item>&, List<Item>&, bool) + 248 0x81240d4 fill_record_n_invoke_before_triggers(THD*, List<Item>&, List<Item>&, bool, Table_triggers_list*, trg_event_type) + 56 0x814ce11 mysql_insert(THD*, st_table_list*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) + 2069 0x80f4d62 mysql_execute_command(THD*) + 10700 0x821d7c9 sp_instr_stmt::exec_core(THD*, unsigned int*) + 17 0x821d49b sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*) + 389 0x821d675 sp_instr_stmt::execute(THD*, unsigned int*) + 277 0x8219ed3 sp_head::execute(THD*) + 1425 0x821a6bf sp_head::execute_trigger(THD*, char const*, char const*, st_grant_info*) + 547 0x822b224 Table_triggers_list::process_triggers(THD*, trg_event_type, trg_action_time_type, bool) + 180 0x81240ff fill_record_n_invoke_before_triggers(THD*, List<Item>&, List<Item>&, bool, Table_triggers_list*, trg_event_type) + 99 0x815c45c mysql_update(THD*, st_table_list*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicate + 4282 0x80f4a71 mysql_execute_command(THD*) + 9947 0x80fb89e mysql_parse(THD*, char*, unsigned int) + 370 0x80f0ca8 dispatch_command(enum_server_command, THD*, char*, unsigned int) + 1940 0x80f0509 do_command(THD*) + 523 0x80ef6ad handle_one_connection + 799 0x83c91c1 pthread_start_thread + 225
[1 Nov 2006 14:47]
MySQL Verification Team
setting as verified. Will upload instructions to repeat in private section.
[3 Nov 2006 0:51]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/14780 ChangeSet@1.2285, 2006-11-03 03:51:24+03:00, dlenev@mockturtle.local +3 -0 Proposed fix for bug bug#23651 "Server crashes when trigger which uses stored function invoked from different connections". Invocation of trigger which was using stored function from different connections caused server crashes (for non-debug server this happened in highly concurrent environment, but debug server failed on assertion in relatively simple scenario). Item_func_sp was not safe to use in triggers (in other words for re-execution from different threads) as artificial TABLE object pointed by Item_func_sp::dummy_table referenced incorrect THD object. To fix the problem we force re-initialization of this object for each re-execution of statement.
[13 Nov 2006 8:09]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/15202 ChangeSet@1.2285, 2006-11-13 11:10:49+03:00, dlenev@mockturtle.local +3 -0 Fix for bug bug#23651 "Server crashes when trigger which uses stored function invoked from different connections". Invocation of trigger which was using stored function from different connections caused server crashes (for non-debug server this happened in highly concurrent environment, but debug server failed on assertion in relatively simple scenario). Item_func_sp was not safe to use in triggers (in other words for re-execution from different threads) as artificial TABLE object pointed by Item_func_sp::dummy_table referenced incorrect THD object. To fix the problem we force re-initialization of this object for each re-execution of statement.
[13 Nov 2006 11:29]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/15215 ChangeSet@1.2358, 2006-11-13 14:30:12+03:00, dlenev@mockturtle.local +1 -0 Small adjustment after merging fix for bug#23651 "Server crashes when trigger which uses stored function invoked from different connections" into 5.1.
[30 Nov 2006 1:29]
Konstantin Osipov
Fixed in 5.0.32 and 5.1.13
[30 Nov 2006 20:08]
Paul DuBois
Noted in 5.0.32, 5.1.14 changelogs. A trigger that invoked a stored function could cause a server crash when activated by different client connections.
Description: MySQL crashes repeatedly within a short period of time, each crash shows the following or similar back trace: <summary backtrace> #4 0x0817aeb7 in wait_if_global_read_lock (thd=0xb, abort_on_refresh=107, is_not_commit=128) at lock.cc:1241 #5 0xb7f8a2d6 in ?? () #6 0x0000000b in ?? () #7 <signal handler called> #8 0x0823a263 in innobase_get_cset_width (cset=1755852528, mbminlen=0x6ab3c5e0, mbmaxlen=0x68a82d18) at ha_innodb.cc:674 #9 0x0811070a in Item_field::fix_outer_field (this=0x68a82ff0, thd=0x68a807c8, from_field=0x0, reference=0x1) at item.cc:3501 <full backtrace> #4 0x0817aeb7 in wait_if_global_read_lock (thd=0xb, abort_on_refresh=107, is_not_commit=128) at lock.cc:1241 old_message = 0xb7f0c980 "\200<<AD><FB>" result = 245 need_exit_cond = 41 _db_func_ = 0x817aeb7 "P\b" _db_file_ = 0xb <Address 0xb out of bounds> _db_level_ = 138440913 _db_framep_ = (char **) 0xe16a #5 0xb7f8a2d6 in ?? () No symbol table info available. #6 0x0000000b in ?? () No symbol table info available. #7 <signal handler called> No symbol table info available. #8 0x0823a263 in innobase_get_cset_width (cset=1755852528, mbminlen=0x6ab3c5e0, mbmaxlen=0x68a82d18) at ha_innodb.cc:674 cs = (CHARSET_INFO *) 0x68a82700 #9 0x0811070a in Item_field::fix_outer_field (this=0x68a82ff0, thd=0x68a807c8, from_field=0x0, reference=0x1) at item.cc:3501 place = 8024 field_found = 104 upward_lookup = 168 last_checked_context = (Name_resolution_context *) 0x0 ref = (Item **) 0x68a807c8 outer_context = (Name_resolution_context *) 0x0 How to repeat: Unsure... The crash seems to appear when a TRIGGER is executing a stored procedure.