Bug #105657 | Valgrind complains "Invalid write of size 8" | ||
---|---|---|---|
Submitted: | 22 Nov 2021 10:21 | Modified: | 22 Nov 2021 15:09 |
Reporter: | Xiong Wang | Email Updates: | |
Status: | Can't repeat | Impact on me: | |
Category: | MySQL Server | Severity: | S2 (Serious) |
Version: | 8.0.27 | OS: | Any |
Assigned to: | CPU Architecture: | Any |
[22 Nov 2021 10:21]
Xiong Wang
[22 Nov 2021 11:00]
MySQL Verification Team
I couldn't repeat please try current released version 8.0.27. Thanks.
[22 Nov 2021 11:56]
Xiong Wang
I think it's a source code error. I checked the source code even in 8.0.27. (gdb) f 5 #5 0x0000000003225d28 in remove_eq_conds (thd=0x7fff3c000da0, cond=0x7fff3c11bc08, retcond=0x7fffe2bca568, cond_value=0x7fffe2bca564) at /home/simon/parallel-query-document/sql/sql_optimizer.cc:11462 11462 return fold_condition_exec(thd, cond, retcond, cond_value); (gdb) f 6 #6 0x0000000003225996 in remove_eq_conds (thd=0x7fff3c000da0, cond=0x7fff3c157338, retcond=0x7fff3c157198, cond_value=0x7fff3c11992c) at /home/simon/parallel-query-document/sql/sql_optimizer.cc:11348 11348 if (remove_eq_conds(thd, item, &new_item, &tmp_cond_value)) return true; (gdb) p new_item $7 = (Item *) 0x7fff3c11bc08 (gdb) p &new_item $8 = (Item **) 0x7fffe2bca568 ====> Here is a temporary variable (gdb) f 0 #0 THD::nocheck_register_item_tree_change (this=0x7fff3c000da0, place=0x7fffe2bca568, new_value=0x7fff3c157608) at /home/simon/parallel-query-document/sql/sql_class.cc:1722 1722 change_list.push_front(change); (gdb) p place $9 = (Item **) 0x7fffe2bca568 (gdb) p change->place $10 = (Item **) 0x7fffe2bca568 =====>Here, it's registered in change->place. A temporary pointer is referenced. (gdb) b THD::rollback_item_tree_changes() Breakpoint 2 at 0x3193d25: file /home/simon/parallel-query-document/sql/sql_class.cc, line 1738. (gdb) c Continuing. Breakpoint 2, THD::rollback_item_tree_changes (this=0x7fff3c000da0) at /home/simon/parallel-query-document/sql/sql_class.cc:1738 1738 I_List_iterator<Item_change_record> it(change_list); (gdb) n 1740 DBUG_TRACE; (gdb) 1742 while ((change = it++)) { (gdb) 1743 if (change->m_cancel) continue; (gdb) 1745 DBUG_PRINT("info", ("rollback_item_tree_changes " (gdb) 1748 *change->place = change->old_value; (gdb) p change $11 = (Item_change_record *) 0x7fff3c157718 (gdb) p change->place $12 = (Item **) 0x7fffe2bca568 =========>Here, you see change->place tries to be rollbacked. Valgrind will warn.
[22 Nov 2021 15:09]
MySQL Verification Team
Hi Mr. Wang, We tried to repeat the behaviour that you are reporting , but we were not successful. We used AddressSanitizer and couple more tools and not reports what so ever. Much more important are some other facts. Your line numbers in the source files do not correspond at all, with the current source of 8.0.27. Hence, you are not building your MySQL binaries from our sources. Can't repeat.