MySQL Bugs: #109033: Contribution by Tencent: crash after ha_commit_inplace_alter

Bug #109033	Contribution by Tencent: crash after ha_commit_inplace_alter_table is unsafe
Submitted:	9 Nov 2022 3:43	Modified:	14 Nov 2022 10:30
Reporter:	yewei Xu (OCA)	Email Updates:
Status:	Verified	Impact on me:	None
Category:	MySQL Server: DDL	Severity:	S2 (Serious)
Version:	5.7.39	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
1.alter partition table.
2.crash after ha_commit_inplace_alter_table, before mysql_rename_table.
3.restart mysql and execute show create table will crash.

2022-11-09T03:30:12.295206Z 2 [ERROR] InnoDB: Found index `PRIMARY` whose column info does not match that of MySQL.                                                              
2022-11-09 06:30:12 0x7f36d4724700  InnoDB: Assertion failure in thread 139873469220608 in file dict0dict.ic line 1257                                                           
InnoDB: Failing assertion: index 

(gdb) bt
#0  0x00007f36dd3639b1 in pthread_kill () from /lib64/libpthread.so.0
#1  0x000000000196629b in my_write_core (sig=6) at /data/integration/public/mysql-5.7.39/mysys/stacktrace.c:261
#2  0x0000000000fa91fc in handle_fatal_signal (sig=6) at /data/integration/public/mysql-5.7.39/sql/signal_handler.cc:227
#3  <signal handler called>
#4  0x00007f36db6021f7 in raise () from /lib64/libc.so.6
#5  0x00007f36db6038e8 in abort () from /lib64/libc.so.6
#6  0x0000000001bee92b in ut_dbg_assertion_failed (expr=0x2367a82 "index", file=0x23679c0 "/data/integration/public/mysql-5.7.39/storage/innobase/include/dict0dict.ic", 
    line=1257) at /data/integration/public/mysql-5.7.39/storage/innobase/ut/ut0dbg.cc:75
#7  0x0000000001b3ec97 in dict_index_get_nth_field (index=0x0, pos=0) at /data/integration/public/mysql-5.7.39/storage/innobase/include/dict0dict.ic:1257
#8  0x0000000001b4f9ab in row_search_max_autoinc (index=0x0, col_name=0x7f3680011b71 "id", value=0x7f36d4720620)
    at /data/integration/public/mysql-5.7.39/storage/innobase/row/row0sel.cc:6725
#9  0x00000000019ec2eb in ha_innopart::initialize_auto_increment (this=0x7f368000f840) at /data/integration/public/mysql-5.7.39/storage/innobase/handler/ha_innopart.cc:929
#10 0x00000000019e3819 in ha_innopart::open (this=0x7f368000f840, name=0x7f3680010ee0 "./test/sbtest1")
    at /data/integration/public/mysql-5.7.39/storage/innobase/handler/ha_innopart.cc:1296
#11 0x000000000102800b in handler::ha_open (this=0x7f368000f840, table_arg=0x7f368000ee80, name=0x7f3680010ee0 "./test/sbtest1", mode=2, test_if_locked=2)
    at /data/integration/public/mysql-5.7.39/sql/handler.cc:2775
#12 0x000000000171201d in open_table_from_share (thd=0x7f3680000b70, share=0x7f3680010b10, alias=0x7f3680006230 "sbtest1", db_stat=39, prgflag=8, ha_open_flags=0, 
    outparam=0x7f368000ee80, is_create_table=false) at /data/integration/public/mysql-5.7.39/sql/table.cc:3406
#13 0x00000000015a502c in open_table (thd=0x7f3680000b70, table_list=0x7f3680006238, ot_ctx=0x7f36d4721820) at /data/integration/public/mysql-5.7.39/sql/sql_base.cc:3632
#14 0x00000000015a7b63 in open_and_process_table (thd=0x7f3680000b70, lex=0x7f3680002e98, tables=0x7f3680006238, counter=0x7f36d4721b5c, flags=1024, 
    prelocking_strategy=0x7f36d47218e8, has_prelocking_list=false, ot_ctx=0x7f36d4721820) at /data/integration/public/mysql-5.7.39/sql/sql_base.cc:5260
#15 0x00000000015a8caf in open_tables (thd=0x7f3680000b70, start=0x7f36d4721910, counter=0x7f36d4721b5c, flags=1024, prelocking_strategy=0x7f36d47218e8)
    at /data/integration/public/mysql-5.7.39/sql/sql_base.cc:5883
#16 0x00000000015b372a in open_tables (thd=0x7f3680000b70, tables=0x7f36d4721910, counter=0x7f36d4721b5c, flags=1024)
    at /data/integration/public/mysql-5.7.39/sql/sql_base.h:468
#17 0x00000000016893d1 in mysqld_show_create (thd=0x7f3680000b70, table_list=0x7f3680006238) at /data/integration/public/mysql-5.7.39/sql/sql_show.cc:937
#18 0x00000000016295fe in mysql_execute_command (thd=0x7f3680000b70, first_level=true) at /data/integration/public/mysql-5.7.39/sql/sql_parse.cc:3588
#19 0x000000000162f1d4 in mysql_parse (thd=0x7f3680000b70, parser_state=0x7f36d4723580) at /data/integration/public/mysql-5.7.39/sql/sql_parse.cc:5589
#20 0x0000000001624787 in dispatch_command (thd=0x7f3680000b70, com_data=0x7f36d4723d10, command=COM_QUERY) at /data/integration/public/mysql-5.7.39/sql/sql_parse.cc:1492
#21 0x00000000016235d1 in do_command (thd=0x7f3680000b70) at /data/integration/public/mysql-5.7.39/sql/sql_parse.cc:1031
#22 0x000000000175565b in handle_connection (arg=0x44063e0) at /data/integration/public/mysql-5.7.39/sql/conn_handler/connection_handler_per_thread.cc:313
#23 0x0000000001e2eb80 in pfs_spawn_thread (arg=0x43b2db0) at /data/integration/public/mysql-5.7.39/storage/perfschema/pfs.cc:2197
#24 0x00007f36dd35ee25 in start_thread () from /lib64/libpthread.so.0
#25 0x00007f36db6c535d in clone () from /lib64/libc.so.6

How to repeat:
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 7bf8ee8a0b0..891f977f745 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -7643,6 +7643,10 @@ static bool mysql_inplace_alter_table(THD *thd,
   table_list->table= table= NULL;
   close_temporary_table(thd, altered_table, true, false);
 
+  DBUG_EXECUTE_IF("crash_after_commit_inplace_alter_table",
+                  DBUG_SET("-d,crash_after_commit_inplace_alter_table");
+                  DBUG_SUICIDE(););
+
   /*
     Replace the old .FRM with the new .FRM, but keep the old name for now.
     Rename to the new name (if needed) will be handled separately below.

Apply diff upside and run mtr test below.

--source include/have_innodb.inc                                                                                                                                                 
--source include/have_debug.inc                                                                                                                                                  
                                                                                                                                                                                 
CREATE TABLE `sbtest1` (                                                                                                                                                         
  `id` int(11) NOT NULL AUTO_INCREMENT,                                                                                                                                          
  `k` int(11) NOT NULL DEFAULT '0',                                                                                                                                              
  `c` char(120) NOT NULL DEFAULT '',                                                                                                                                             
  `pad` char(60) NOT NULL DEFAULT '',                                                                                                                                            
  PRIMARY KEY (`id`),                                                                                                                                                            
  KEY `k_1` (`k`)                                                                                                                                                                
) PARTITION BY RANGE (id)                                                                                                                                                        
(PARTITION p0 VALUES LESS THAN (1000) ENGINE = InnoDB,                                                                                                                           
 PARTITION p1 VALUES LESS THAN (2000) ENGINE = InnoDB,                                                                                                                           
 PARTITION p2 VALUES LESS THAN (3000) ENGINE = InnoDB,                                                                                                                           
 PARTITION p3 VALUES LESS THAN MAXVALUE ENGINE = InnoDB);                                                                                                                        
                                                                                                                                                                                 
--exec echo "restart" > $MYSQLTEST_VARDIR/tmp/mysqld.1.expect                                                                                                                    
set session debug='+d, crash_after_commit_inplace_alter_table';                                                                                                                  
--error 2013                                                                                                                                                                     
alter table sbtest1 drop primary key, add primary key(id, c);                                                                                                                    
                                                                                                                                                                                 
--enable_reconnect                                                                                                                                                               
--source include/wait_until_connected_again.inc                                                                                                                                  
                                                                                                                                                                                 
show create table sbtest1; 

Suggested fix:
Return error if m_index_mapping set to null.

diff --git a/storage/innobase/handler/ha_innopart.cc b/storage/innobase/handler/ha_innopart.cc
index aa3e3c71194..4b9ce99c472 100644
--- a/storage/innobase/handler/ha_innopart.cc
+++ b/storage/innobase/handler/ha_innopart.cc
@@ -417,6 +417,7 @@ Ha_innopart_share::open_table_parts(
        if (!index_loaded && m_index_mapping != NULL) {
                ut_free(m_index_mapping);
                m_index_mapping = NULL;
+               goto err;
        }
 
        /* Successfully built the translation table. */

Hello  Yewei Xu,

Thank you for the report and contribution.

regards,
Umesh

Posted by developer:
 
The bug does not reproduce on current mysql-trunk