MySQL Bugs: #46030: rpl_truncate_3innodb causes server crash on windows

Bug #46030	rpl_truncate_3innodb causes server crash on windows
Submitted:	8 Jul 2009 7:30	Modified:	16 Sep 2009 9:39
Reporter:	Georgi Kodinov	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Replication	Severity:	S3 (Non-critical)
Version:	5.1	OS:	Windows (test-max-win_ws2008-x86)
Assigned to:	Davi Arnaut	CPU Architecture:	Any

Description:
in pb2: 
rpl.rpl_truncate_3innodb                 [ fail ]
        Test ended at 2009-07-07 23:01:37

CURRENT_TEST: rpl.rpl_truncate_3innodb
mysqltest: In included file ".\include\start_slave.inc": At line 18: query 'START SLAVE' failed: 2013: Lost connection to MySQL server during query

....

STACK_TEXT:  
ntdll!RtlpAllocateHeap
ntdll!RtlAllocateHeap
mysqld!malloc [f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.c @ 163]
mysqld!my_malloc [g:\pb2\build\sb_0-630652-1246997436.81\mysql-5.1.37-win-x86\mysys\my_malloc.c @ 34]
mysqld!vio_new [g:\pb2\build\sb_0-630652-1246997436.81\mysql-5.1.37-win-x86\vio\vio.c @ 143]
mysqld!mysql_real_connect [g:\pb2\build\sb_0-630652-1246997436.81\mysql-5.1.37-win-x86\sql-common\client.c @ 2052]
mysqld!connect_to_master [g:\pb2\build\sb_0-630652-1246997436.81\mysql-5.1.37-win-x86\sql\slave.cc @ 3684]
mysqld!safe_connect [g:\pb2\build\sb_0-630652-1246997436.81\mysql-5.1.37-win-x86\sql\slave.cc @ 3631]
mysqld!handle_slave_io [g:\pb2\build\sb_0-630652-1246997436.81\mysql-5.1.37-win-x86\sql\slave.cc @ 2431]
mysqld!pthread_start [g:\pb2\build\sb_0-630652-1246997436.81\mysql-5.1.37-win-x86\mysys\my_winthread.c @ 85]
mysqld!_callthreadstart [f:\dd\vctools\crt_bld\self_x86\crt\src\thread.c @ 293]
mysqld!_threadstart [f:\dd\vctools\crt_bld\self_x86\crt\src\thread.c @ 275]
kernel32!BaseThreadInitThunk
ntdll!__RtlUserThreadStart
ntdll!_RtlUserThreadStart

How to repeat:
run the test enough times on windows

Suggested fix:
n/a

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/78181

3013 Georgi Kodinov	2009-07-08
      Bug#38998, Bug#46029, Bug#45243, Bug#46030 making tests experimental

Pushed into 5.1.37 (revid:joro@sun.com-20090708131116-kyz8iotbum8w9yic) (version source revid:joro@sun.com-20090708073149-qxyfa5vkh1m0pvol) (merge vers: 5.1.37) (pib:11)

Pushed into 5.1.37 (revid:joro@sun.com-20090708131116-kyz8iotbum8w9yic) (version source revid:joro@sun.com-20090708073149-qxyfa5vkh1m0pvol) (merge vers: 5.1.37) (pib:11)

Pushed into 5.4.4-alpha (revid:anozdrin@bk-internal.mysql.com-20090710111017-bnh2cau84ug1hvei) (version source revid:joro@sun.com-20090708121727-rekm6n1iu4vmvcfa) (merge vers: 5.4.4-alpha) (pib:11)

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

http://lists.mysql.com/commits/80781

2788 Davi Arnaut 2009-08-13
Bug#46013: rpl_extraColmaster_myisam fails on pb2
Bug#45243: crash on win in sql thread clear_tables_to_lock() -> free()
Bug#45242: crash on win in mysql_close() -> free()
Bug#45238: rpl_slave_skip, rpl_change_master failed (lost connection) for STOP SLAVE
Bug#46030: rpl_truncate_3innodb causes server crash on windows
Bug#46014: rpl_stm_reset_slave crashes the server sporadically in pb2

When killing a user session on the server, it's necessary to
interrupt (notify) the thread associated with the session that
the connection is being killed so that the thread is woken up
if waiting for I/O. On a few platforms (Mac, Windows and HP-UX)
where the SIGNAL_WITH_VIO_CLOSE flag is defined, this interruption
procedure is to asynchronously close the underlying socket of
the connection.

In order to enable this schema, each connection serving thread
registers its VIO (I/O interface) so that other threads can
access it and close the connection. But only the owner thread of
the VIO might delete it as to guarantee that other threads won't
see freed memory (the thread unregisters the VIO before deleting
it). A side note: closing the socket introduces a harmless race
that might cause a thread attempt to read from a closed socket,
but this is deemed acceptable.

The problem is that this infrastructure was meant to only be used
by server threads, but the slave I/O thread was registering the
VIO of a mysql handle (a client API structure that represents a
connection to another server instance) as a active connection of
the thread. But under some circumstances such as network failures,
the client API might destroy the VIO associated with a handle at
will, yet the VIO wouldn't be properly unregistered. This could
lead to accesses to freed data if a thread attempted to kill a
slave I/O thread whose connection was already broken.

There was a attempt to work around this by checking whether
the socket was being interrupted, but this hack didn't work as
intended due to the aforementioned race -- attempting to read
from the socket would yield a "bad file descriptor" error.

The solution is to add a hook to the client API that is called
from the client code before the VIO of a handle is deleted.
This hook allows the slave I/O thread to detach the active vio
so it does not point to freed memory.
@ server-tools/instance-manager/mysql_connection.cc
Add stub method required for linking.
@ sql-common/client.c
Invoke hook.
@ sql/client_settings.h
Export hook.
@ sql/slave.cc
Introduce hook that clears the active VIO before it is freed
by the client API.

Queued to 5.0-bugteam

The user visible effect is that a STOP SLAVE statement might lead to a crash on Windows or Mac.

Pushed into 5.1.37-ndb-7.0.8 (revid:jonas@mysql.com-20090826132541-yablppc59e3yb54l) (version source revid:jonas@mysql.com-20090826132541-yablppc59e3yb54l) (merge vers: 5.1.37-ndb-7.0.8) (pib:11)

Pushed into 5.1.37-ndb-6.3.27 (revid:jonas@mysql.com-20090826105955-bkj027t47gfbamnc) (version source revid:jonas@mysql.com-20090826105955-bkj027t47gfbamnc) (merge vers: 5.1.37-ndb-6.3.27) (pib:11)

Pushed into 5.1.37-ndb-6.2.19 (revid:jonas@mysql.com-20090825194404-37rtosk049t9koc4) (version source revid:jonas@mysql.com-20090825194404-37rtosk049t9koc4) (merge vers: 5.1.37-ndb-6.2.19) (pib:11)

Pushed into 5.1.35-ndb-7.1.0 (revid:magnus.blaudd@sun.com-20090827163030-6o3kk6r2oua159hr) (version source revid:jonas@mysql.com-20090826132541-yablppc59e3yb54l) (merge vers: 5.1.37-ndb-7.0.8) (pib:11)

See BUG#45243 for documentation info.

Pushed into 5.0.86 (revid:joro@sun.com-20090902102337-n5rw8227wwp5cpx8) (version source revid:davi.arnaut@sun.com-20090813200720-utqy73cj0orcy80z) (merge vers: 5.0.86) (pib:11)

Bugfix also noted in 5.0.86 changelog.

Set status to Patch Pending, waiting for 5.4 push.

Pushed into 5.1.39 (revid:joro@sun.com-20090902154533-8actmfcsjfqovgsb) (version source revid:ramil@mysql.com-20090814091316-07dvnrvaj0th0th2) (merge vers: 5.1.38) (pib:11)

Now documented in the following changelogs: 5.0.86, NDB-6.2.19, NDB-6.3.27, NDB-7.0.8, 5.1.39 (should have documented for Cluster releases, not 5.1.37-main).

Set status to NDI, waiting for push to 5.4.

Pushed into 5.4.4-alpha (revid:alik@sun.com-20090914155317-m1g9wodmndzdj4l1) (version source revid:alik@sun.com-20090914155317-m1g9wodmndzdj4l1) (merge vers: 5.4.4-alpha) (pib:11)

Also documented bugfix in the 5.4.4 changelog.

Closed.

Pushed into 5.1.39-ndb-6.3.28 (revid:jonas@mysql.com-20091001055605-ap2kiaarr7p40mmv) (version source revid:jonas@mysql.com-20091001055605-ap2kiaarr7p40mmv) (merge vers: 5.1.39-ndb-6.3.28) (pib:11)

Pushed into 5.1.39-ndb-7.0.9 (revid:jonas@mysql.com-20091001072547-kv17uu06hfjhgjay) (version source revid:jonas@mysql.com-20091001071652-irejtnumzbpsbgk2) (merge vers: 5.1.39-ndb-7.0.9) (pib:11)

Pushed into 5.1.39-ndb-7.1.0 (revid:jonas@mysql.com-20091001123013-g9ob2tsyctpw6zs0) (version source revid:jonas@mysql.com-20091001123013-g9ob2tsyctpw6zs0) (merge vers: 5.1.39-ndb-7.1.0) (pib:11)

Moved 5.4 changelog entry from 5.4.4 to 5.4.3.

Pushed into 5.1.39-ndb-6.2.19 (revid:jonas@mysql.com-20091005103850-dwij2dojwpvf5hi6) (version source revid:jonas@mysql.com-20090930185117-bhud4ek1y0hsj1nv) (merge vers: 5.1.39-ndb-6.2.19) (pib:11)