MySQL Bugs: #84786: --performance-schema-digests-size=1 leads to SIGSEGV

Bug #84786	--performance-schema-digests-size=1 leads to SIGSEGV
Submitted:	2 Feb 2017 8:17	Modified:	3 Feb 2017 16:04
Reporter:	Roel Van de Paar	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Performance Schema	Severity:	S1 (Critical)
Version:	5.7.17-11	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
See attached Valgrind log, including;

valgrind: m_mallocfree.c:303 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 640, hi = 0.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata.  If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away.  Please try that before reporting this as a bug.

How to repeat:
1) Build a standard DEBUG server
2) Start server with --no-defaults --performance-schema-digests-size=1 and under Valgrind (no -DWITH_VALGRIND=ON needed)
3) At mysql> prompt execute any query (for example SELECT 1;)
4) Check error log

Error/Valgrind log

Attachment: master_ms.err (application/octet-stream, text), 37.09 KiB.

On PS, it crashes (https://bugs.launchpad.net/percona-server/+bug/1660828)

Thank you for the bug report. Verified with most recent source server.

<CUT>

==16159==    by 0x161453B: std::vector<st_mysql_show_var, std::allocator<st_mysql_show_var> >::push_back(st_mysql_show_var const&) (stl_vector.h:926)
==16159==    by 0x15FDEBC: add_status_vars(st_mysql_show_var const*) (sql_show.cc:2606)
==16159==    by 0xF0A4F7: init_common_variables() (mysqld.cc:2764)
==16159==    by 0xF0E1AC: mysqld_main(int, char**) (mysqld.cc:4556)
==16159==    by 0xF06405: main (main.cc:25)
==16159== 

valgrind: m_mallocfree.c:303 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 640, hi = 0.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata.  If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away.  Please try that before reporting this as a bug.

host stacktrace:
==16159==    at 0x38085208: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==16159==    by 0x38085324: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==16159==    by 0x380854B1: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==16159==    by 0x38092F44: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==16159==    by 0x3807E773: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==16159==    by 0x3807CFF3: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==16159==    by 0x3808124A: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==16159==    by 0x3807C36B: ??? (in /usr/lib/valgrind/memcheck-amd64-linux)
==16159==    by 0x80BF2DF0D: ???
==16159==    by 0x80D856F1F: ???
<cut>

valgrind log

Attachment: valgrind_bug_84786.txt (text/plain), 38.04 KiB.

Posted by developer:
 
Noted in 5.6.36, 5.7.18, 8.0.1 changelogs.

Starting the server with --performance-schema-digests-size=1 caused
an abnormal exit.