Bug #38984 Crash in Field_varstring::sql_type at field.cc:7049
Submitted: 23 Aug 2008 18:53 Modified: 26 Nov 2011 12:29
Reporter: Philip Stoev Email Updates:
Status: Can't repeat Impact on me:
None 
Category:MySQL Server: Information schema Severity:S1 (Critical)
Version:6.0, 5.5.4-m3 OS:Any
Assigned to: CPU Architecture:Any

[23 Aug 2008 18:53] Philip Stoev
Description:
When executing a workload which contains SHOW FIELDS , mysqld crashed as follows:

#4  <signal handler called>
#5  0x0828546f in Field_varstring::sql_type (this=0xbbeefc0, res=@0xa7f4d460) at field.cc:7049
#6  0x08412e68 in store_column_type (table=0xbd43da8, field=0xbbeefc0, cs=0x8b09d20, offset=7) at sql_show.cc:3750
#7  0x0841f1f9 in get_schema_column_record (thd=0xba483d0, tables=0xbbf4378, table=0xbd43da8, res=false, db_name=0xa7f4d9c0, table_name=0xa7f4d9b8)
    at sql_show.cc:3957
#8  0x084136cc in fill_schema_show_cols_or_idxs (thd=0xba483d0, tables=0xbbf4be0, schema_table=0x8a28718, open_tables_state_backup=0xa7f4dc0c)
    at sql_show.cc:2883
#9  0x084232a6 in get_all_tables (thd=0xba483d0, tables=0xbbf4be0, cond=0x0) at sql_show.cc:3247
#10 0x0841037b in get_schema_tables_result (join=0xb9cb5f8, executed_place=PROCESSED_BY_JOIN_EXEC) at sql_show.cc:6304
#11 0x0834b70b in JOIN::exec (this=0xb9cb5f8) at sql_select.cc:2329
#12 0x08348026 in mysql_select (thd=0xba483d0, rref_pointer_array=0xba498d8, tables=0xbbf4be0, wild_num=0, fields=@0xba49868, conds=0x0, og_num=0,
    order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2684635648, result=0xbbf5a10, unit=0xba4953c, select_lex=0xba497d4)
    at sql_select.cc:3001
#13 0x0834d51a in handle_select (thd=0xba483d0, lex=0xba494e0, result=0xbbf5a10, setup_tables_done_option=0) at sql_select.cc:302
#14 0x082bfc3d in execute_sqlcom_select (thd=0xba483d0, all_tables=0xbbf4be0) at sql_parse.cc:4875
#15 0x082c15d2 in mysql_execute_command (thd=0xba483d0) at sql_parse.cc:2107
#16 0x082ca38d in mysql_parse (thd=0xba483d0, inBuf=0xbbf3f18 "SHOW FIELDS FROM A", length=18, found_semicolon=0xa7f4f270) at sql_parse.cc:5845
#17 0x082cadd7 in dispatch_command (command=COM_QUERY, thd=0xba483d0, packet=0xba4a251 "\n\t\tSHOW FIELDS FROM A", packet_length=21) at sql_parse.cc:1120
#18 0x082cc0ea in do_command (thd=0xba483d0) at sql_parse.cc:807
#19 0x082b9bbf in handle_one_connection (arg=0xba483d0) at sql_connect.cc:1153
#20 0x0057d32f in start_thread () from /lib/libpthread.so.0
#21 0x0049a27e in clone () from /lib/libc.so.6

The crash is here:

7044      length= cs->cset->snprintf(cs,(char*) res.ptr(),
7045                                 res.alloced_length(), "%s(%d)",
7046                                  (has_charset() ? "varchar" : "varbinary"),
7047                                 (int) field_length / charset()->mbmaxlen);
7048      res.length(length);
7049!!!HERE!!!if ((thd->variables.sql_mode & (MODE_MYSQL323 | MODE_MYSQL40)) &&
7050          has_charset() && (charset()->state & MY_CS_BINSORT))
7051        res.append(STRING_WITH_LEN(" binary"));
7052    }
7053

(gdb) print thd
$5 = (class THD *) 0x0
(gdb) print table->in_use
$6 = (class THD *) 0x0

How to repeat:
This happened only once and could not be reproduced. If it happens again, a repeatable test case will be provided.
[6 Apr 2009 10:39] Philip Stoev
This issue is reliably reproduced with the following RQG:

$ perl runall.pl \
  --engine=Falcon \
  --reporters=ErrorLog,Backtrace \
  --mysqld=--loose-falcon-lock-wait-timeout=1 \
  --mysqld=--loose-innodb-lock-wait-timeout=1 \
  --mysqld=--log-output=none \
  --mysqld=--skip-safemalloc \
  --mysqld=--transaction-isolation=REPEATABLE-READ \
  --mysqld=--falcon-page-size=4K \
  --mem \
  --rows=1000 \
  --threads=4 \
  --mysqld=--falcon-record-chill-threshold=1 \
  --mask=41567 \
  --queries=100000000 \
  --duration=900 \
  --basedir=/build/bzr/6.0-falcon-team \
  --gendata=conf/combinations.zz \
  --grammar=conf/combinations.yy

Note the --falcon-record-chill-threshold=1 , therefore this is a chill/thaw bug.
[6 Apr 2009 11:01] Philip Stoev
Please disregard last comment. wrong bug #.
[26 Nov 2011 12:29] Elena Stepanova
With no reproducible test case and numerous code changes and fixes in this area since 2008, I'm setting this bug to "can't repeat".