Bug #39746 Debug flag breaks struct definition (server crash)

• Submitted: 30 Sep 2008 5:00
• Modified: 29 Jan 2009 5:21
• Reporter: Hiroaki Kawai (OCA)
• Status: Closed
• Category: MySQL Server: FULLTEXT search
• Severity: S6 (Debug Builds)
• Version: 5.1.28, 5.1.29
• OS: Any
• Assigned to: Sergey Vojtovich
• CPU Architecture: Any
• Tags: debug, fulltext, parser, plugin

[30 Sep 2008 5:00] Hiroaki Kawai

Description:
KEY has LEX_STRING *parser_name and plugin_ref parser as a union defined in sql/structs.h. On the other hand, the definition of plugin_ref is in sql/plugin.h. The union is OK when DBUG_OFF. But once we configure mysql with --debug configure option, DBUG_OFF preprocessor flag is switched, and typedef of plugin_ref is swapped to pointer. By nature of union, *parser_name is no longer be a valid LEX_STRING.

With debug option, I experienced mysqld crash very often on both Linux and Solaris with fulltext parser plugin.
# Linux hostname 2.6.9-42.0.10.plus.c4smp #1 SMP Tue Feb 27 17:29:28 EST 2007 i686 i686 i386 GNU/Linux
# SunOS hostname 5.11 snv_79a i86pc i386 i86pc

How to repeat:
1. Build mysqld with --debug=full option
2. You need a FTPARSER plugin. Check out space fulltext parser-plugin for example.
 svn co http://mysqlftppc.svn.sourceforge.net/svnroot/mysqlftppc/space/trunk/ space
 cd space
 automake --add-missing
 automake
 autoconf
 ./configure --with-mysql-config=/path/to/mysql_config CFLAGS=-DSAFEMALLOC
3. Execute SQLs
 install plugin space soname 'libftspace.so'
 use test
 create table t (a text, b text)
 alter table t add fulltext(a) with parser space
 alter table t add fulltext(b) with parser space /* CRASH */

Suggested fix:
Suggestion A:
1. stop using union
2. rewrite keyinfo->parser_name to plugin_name(keyinfo->parser)

Suggestion B:
1. remove DBUG_OFF switch of plugin_ref definition

[7 Oct 2008 8:55] Sveta Smirnova

Thank you for the report.

Verified as described using our example fulltext parser plugin.

[1 Nov 2008 13:52] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/57626

2690 Sergey Vojtovich	2008-11-01
      BUG#39746 - Debug flag breaks struct definition
                  (server crash)
      
      Altering a table with fulltext index[es] which use
      pluggable fulltext parser may cause server crash
      in debug builds.
      
      The problem was that ALTER TABLE code wrongly assigned
      fulltext parser name.
      
      Also fixed that altering a table with fulltext index[es]
      leave stale fulltext parser locks, which prevent
      fulltext parsers from being uninstalled after
      ALTER TABLE.

[1 Nov 2008 13:54] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/57627

2691 Sergey Vojtovich	2008-11-01
      BUG#39746 - Debug flag breaks struct definition
                  (server crash)
      
      Added a test case for BUG#39746.

[1 Nov 2008 13:59] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/57628

2690 Sergey Vojtovich	2008-11-01
      BUG#39746 - Debug flag breaks struct definition
                  (server crash)
      
      Altering a table with fulltext index[es] which use
      pluggable fulltext parser may cause server crash
      in debug builds.
      
      The problem was that ALTER TABLE code wrongly assigned
      fulltext parser name.
      
      Also fixed that altering a table with fulltext index[es]
      leave stale fulltext parser locks, which prevent
      fulltext parsers from being uninstalled after
      ALTER TABLE.

[17 Nov 2008 7:06] Hiroaki Kawai

The patch would be OK for the test code. But the patch does nothing about the inconsistency of union definition (of KEY). I think it may introduce another bug in some time, and so the inconsistency itself should be fixed.

[17 Nov 2008 9:22] Sergey Vojtovich

The union seems to be fine. There were no intention to make both plugin_name and plugin_ref accessible at the same time. See a comment in structs.h:

    Note that parser is used when the table is opened for use, and
    parser_name is used when the table is being created.

[18 Nov 2008 4:05] Hiroaki Kawai

OK. I feel that rule is a little bit dangerous, but it would be OK.

[22 Nov 2008 4:13] Hiroaki Kawai

I tested the patch against my projects, and confirmed that works fine. Looks good for me :)

[17 Dec 2008 14:26] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/61866

2739 Sergey Vojtovich	2008-12-17
      BUG#39746 - Debug flag breaks struct definition
                  (server crash)
      
      Altering a table with fulltext index[es] which use
      pluggable fulltext parser may cause server crash
      in debug builds.
      
      The problem was that ALTER TABLE code wrongly assigned
      fulltext parser name.
      
      Also fixed that altering a table with fulltext index[es]
      leave stale fulltext parser locks, which prevent
      fulltext parsers from being uninstalled after
      ALTER TABLE.

[15 Jan 2009 6:39] Bugs System

Pushed into 5.1.31 (revid:[e-mail]-20090115053147-tx1oapthnzgvs1ro) (version source revid:[e-mail]-20081230114838-cn52tu180wcrvh0h) (merge vers: 5.1.31) (pib:6)

[19 Jan 2009 11:28] Bugs System

Pushed into 5.1.31-ndb-6.2.17 (revid:[e-mail]-20090119095303-uwwvxiibtr38djii) (version source revid:[e-mail]-20090115073240-1wanl85vlvw2she1) (merge vers: 5.1.31-ndb-6.2.17) (pib:6)

[19 Jan 2009 13:06] Bugs System

Pushed into 5.1.31-ndb-6.3.21 (revid:[e-mail]-20090119104956-guxz190n2kh31fxl) (version source revid:[e-mail]-20090119104956-guxz190n2kh31fxl) (merge vers: 5.1.31-ndb-6.3.21) (pib:6)

[19 Jan 2009 16:12] Bugs System

Pushed into 5.1.31-ndb-6.4.1 (revid:[e-mail]-20090119144033-4aylstx5czzz88i5) (version source revid:[e-mail]-20090119144033-4aylstx5czzz88i5) (merge vers: 5.1.31-ndb-6.4.1) (pib:6)

[20 Jan 2009 18:58] Bugs System

Pushed into 6.0.10-alpha (revid:[e-mail]-20090119171328-2hemf2ndc1dxl0et) (version source revid:[e-mail]-20081230114916-c290n83z25wkt6e4) (merge vers: 6.0.9-alpha) (pib:6)

[27 Jan 2009 19:28] Sergey Vojtovich

BUG#37652 was closed as duplicate.

[29 Jan 2009 5:21] Paul DuBois

Noted in 5.1.31, 6.0.10 changelogs.

ALTER TABLE on a table with FULLTEXT index that used a pluggable
FULLTEXT parser could cause debug servers to crash.