Bug #119651 A core dump occurred during heap scan.
Submitted: 9 Jan 2:19 Modified: 9 Jan 7:39
Reporter: Ken Lau (OCA) Email Updates:
Status: Unsupported Impact on me:
None 
Category:MySQL Server: Memory storage engine Severity:S2 (Serious)
Version:5.7 OS:Any
Assigned to: CPU Architecture:Any

[9 Jan 2:19] Ken Lau
Description:
We encountered a core dump during the heap scan step while executing the statement SHOW STATUS LIKE 'Rpl_semi_sync_master_slave';. The stack trace is as follows:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000014701463d251 in pthread_kill () from /usr/lib64/libpthread.so.0
[Current thread is 1 (LWP 450521)]
(gdb) bt
#0  0x000014701463d251 in pthread_kill () from /usr/lib64/libpthread.so.0
#1  0x00000000008b4529 in handle_fatal_signal (sig=11) at /data0/jenkins/mysql-server/sql/signal_handler.cc:228
#2  <signal handler called>
#3  0x0000000000835459 in heap_scan (info=0x146dacb2d020, record=0x146daca46830 "\377") at /data0/jenkins/mysql-server/5.7/storage/heap/hp_scan.c:70
#4  0x0000000000834c86 in ha_heap::rnd_next (this=0x146daca1a030, buf=0x146daca46830 "\377") at /data0/jenkins/mysql-server/5.7/storage/heap/ha_heap.cc:382
#5  0x000000000079b96f in handler::ha_rnd_next (this=0x146daca1a030, buf=0x146daca46830 "\377") at /data0/jenkins/mysql-server/5.7/sql/handler.cc:2963
#6  0x0000000000e619ec in rr_sequential (info=0x146daca127b0) at /data0/jenkins/mysql-server/5.7/sql/records.cc:517
#7  0x00000000007b9901 in sub_select (end_of_records=false, qep_tab=0x146daca12760, join=0x146daca11550) at /data0/jenkins/mysql-server/5.7/sql/sql_executor.cc:1284
#8  sub_select (join=0x146daca11550, qep_tab=0x146daca12760, end_of_records=<optimized out>) at /data0/jenkins/mysql-server/5.7/sql/sql_executor.cc:1224
#9  0x00000000007b834d in do_select (join=0x146daca11550) at /data0/jenkins/mysql-server/5.7/sql/sql_executor.cc:957
#10 JOIN::exec (this=0x146daca11550) at /data0/jenkins/mysql-server/5.7/sql/sql_executor.cc:206
#11 0x00000000007db2cf in handle_query (thd=thd@entry=0x146daca05000, lex=lex@entry=0x146daca071c8, result=result@entry=0x146da4a15d40, added_options=added_options@entry=0, removed_options=removed_options@entry=0)
    at /data0/jenkins/mysql-server/5.7/sql/sql_select.cc:191
#12 0x00000000007d55ce in execute_sqlcom_select (thd=0x146daca05000, all_tables=<optimized out>) at /data0/jenkins/mysql-server/5.7/sql/sql_parse.cc:5183
#13 0x00000000007d25b1 in mysql_execute_command (thd=0x146daca05000, first_level=<optimized out>) at /data0/jenkins/mysql-server/5.7/sql/sql_parse.cc:2805
#14 0x00000000007d0646 in mysql_parse (thd=0x146daca05000, parser_state=<optimized out>) at /data0/jenkins/mysql-server/5.7/sql/sql_parse.cc:5612
#15 0x00000000007cea10 in dispatch_command (thd=0x146daca05000, com_data=<optimized out>, command=COM_QUERY) at /data0/jenkins/mysql-server/5.7/sql/sql_parse.cc:1516
#16 0x00000000007ce3b2 in do_command (thd=thd@entry=0x146daca05000) at /data0/jenkins/mysql-server/5.7/sql/sql_parse.cc:1055
#17 0x0000000000f938ae in handle_connection (arg=arg@entry=0x14701387f5e0) at /data0/jenkins/mysql-server/5.7/sql/conn_handler/connection_handler_per_thread.cc:314
#18 0x00000000015df05b in pfs_spawn_thread (arg=0x146e22381120) at /data0/jenkins/mysql-server/5.7/storage/perfschema/pfs.cc:2197
#19 0x0000147014635f1b in ?? () from /usr/lib64/libpthread.so.0
#20 0x0000147013de82e0 in clone () from /usr/lib64/libc.so.6
(gdb) f 3
#3  0x0000000000835459 in heap_scan (info=0x146dacb2d020, record=0x146daca46830 "\377") at /data0/jenkins/mysql-server/5.7/storage/heap/hp_scan.c:70
70	/data0/jenkins/mysql-server/5.7/storage/heap/hp_scan.c: No such file or directory.
(gdb) p info->s
$1 = (HP_SHARE *) 0x146daca00ca0
(gdb) p *info->s
$2 = {block = {root = 0x146da24bfba0, level_info = {{free_ptrs_in_block = 0, records_under_level = 1, last_blocks = 0x146d93a7b120}, {free_ptrs_in_block = 118, records_under_level = 39, 
        last_blocks = 0x146da24bfba0}, {free_ptrs_in_block = 0, records_under_level = 4992, last_blocks = 0x0}, {free_ptrs_in_block = 0, records_under_level = 638976, last_blocks = 0x0}, {
        free_ptrs_in_block = 0, records_under_level = 81788928, last_blocks = 0x0}}, levels = 2, records_in_block = 39, recbuffer = 3272, last_allocated = 0}, keydef = 0x146daca00e98, 
  min_records = 0, max_records = 5133, data_length = 1285296, index_length = 0, max_table_size = 67108864, key_stat_version = 388, records = 387, blength = 512, deleted = 0, reclength = 3268, 
  changed = 1, keys = 0, max_key_length = 0, currently_disabled_keys = 0, open_count = 1, del_link = 0x0, name = 0x146da8c0c0a0 "/data/tmp/#sql_6deae_0", create_time = 1765426817, lock = {list = {
      prev = 0x0, next = 0x0, data = 0x0}, mutex = {m_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, 
            __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, m_psi = 0x0}, read_wait = {data = 0x0, last = 0x0}, read = {data = 0x0, last = 0x0}, write_wait = {data = 0x0, 
      last = 0x0}, write = {data = 0x0, last = 0x0}, write_lock_count = 0, read_no_write_count = 0, get_status = 0x0, copy_status = 0x0, update_status = 0x0, restore_status = 0x0, 
    check_status = 0x0}, delete_on_close = 1 '\001', open_list = {prev = 0x0, next = 0x0, data = 0x0}, auto_key = 0, auto_key_type = 0, auto_increment = 0}
(gdb) p info->s->block
$3 = {root = 0x146da24bfba0, level_info = {{free_ptrs_in_block = 0, records_under_level = 1, last_blocks = 0x146d93a7b120}, {free_ptrs_in_block = 118, records_under_level = 39, 
      last_blocks = 0x146da24bfba0}, {free_ptrs_in_block = 0, records_under_level = 4992, last_blocks = 0x0}, {free_ptrs_in_block = 0, records_under_level = 638976, last_blocks = 0x0}, {
      free_ptrs_in_block = 0, records_under_level = 81788928, last_blocks = 0x0}}, levels = 2, records_in_block = 39, recbuffer = 3272, last_allocated = 0}
(gdb) p info->s->block->root
$4 = (HP_PTRS *) 0x146da24bfba0
(gdb) p info->s->block->root[0]
$5 = {blocks = {0x0, 0x0, 0x0, 0x0, 0x0, 0x146da257d820 "\375\035Innodb_buffer_pool_pages_datatuss", 0x146da25a83e0 "\375\030Innodb_row_lock_time_maxwaitsestscted", 
    0x146da2616960 "\375\"Performance_schema_index_stat_lostlost", 0x146da265e7a0 "\375\032Rpl_semi_sync_master_no_txmesstimetimesttlost", 
    0x146d93a7b120 "\375\vSsl_acceptsrenegotiatesprotect_matchedol_matched", 0x0 <repeats 118 times>}}

How to repeat:
Unable to repeat, but we want to find out why it happens. It seems like memory  there's memory corruption.

Suggested fix:
Maybe return an error at /data0/jenkins/mysql-server/5.7/storage/heap/hp_scan.c:70 when getting a null pointer.
[9 Jan 7:39] Roy Lyseng
Thank you for the bug report.
However, 5.7 is no longer a supported release.
We suggest that you upgrade to a later version, preferably 8.4 or 9.5.