MySQL Bugs: #39673: Server crashes in close_thread_tables() called from plugin

Bug #39673	Server crashes in close_thread_tables() called from plugin_load()
Submitted:	26 Sep 2008 14:35	Modified:	28 Jun 2009 0:54
Reporter:	Paul McCullagh (Basic Quality Contributor) (OCA)	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server	Severity:	S1 (Critical)
Version:	6.0	OS:	Any
Assigned to:	Magne Mæhre	CPU Architecture:	Any
Tags:	close_thread_tables, crash, free_root, mdl, qc, server

Description:
When loading a pluggable engine, the server crashes in the close_thread_tables() function called plugin_load().

The reason for the crash is that the free_root(tmp_root, MYF(MY_MARK_BLOCKS_FREE)) call free memory that is later used in close_thread_tables().

Here is the stack trace:

#0  0x002f9b61 in release_lock (lock_data=0x201a028) at mdl.cc:1247
#1  0x002fa822 in mdl_release_locks (context=0xbfffcb4c) at mdl.cc:1329
#2  0x0014ba6e in close_thread_tables (thd=0xbfffcad8, skip_mdl=false) at sql_base.cc:1433
#3  0x002e8689 in plugin_load (tmp_root=0xbfffe808, argc=0x9cf69c, argv=0x1900830) at sql_plugin.cc:1400
#4  0x002e8d28 in plugin_init (argc=0x9cf69c, argv=0x1900830, flags=0) at sql_plugin.cc:1199
#5  0x000f48a4 in init_server_components () at mysqld.cc:4042
#6  0x000fadb3 in main (argc=2, argv=0xbfffebc0) at mysqld.cc:4489

How to repeat:
I repeated this bug using the PBXT 1.0.05 pluggable storage engine.

You need a debug build of MySQL 6.0.6. 

Download the engine from PBXT from launchpad (do not place it in the storage directory):

bzr branch lp:pbxt/1.0.05-beta pbxt
cd pbxt
./configure --with-mysql=<path-to_mysql-tree>
make install

Start the server and enter:
install plugin PBXT soname 'libpbxt.so';

The error occurs after restart.

Thank you for the bug report. I was able compile and install without crash on 5.1,
however with current source 6.0 I got the below compile error:

ha_pbxt.cc:4426: warning: missing initializer for member âXTDictionary::dic_key_countâ
ha_pbxt.cc:4426: warning: missing initializer for member âXTDictionary::dic_keysâ
ha_pbxt.cc:4426: warning: missing initializer for member âXTDictionary::dic_my_tableâ
ha_pbxt.cc:4449: error: cannot convert âTABLE*â to âst_table*â for argument â2â to âXTDDTable* myxt_create_table_from_table(XTThread*, st_table*)â
ha_pbxt.cc:4453: error: cannot convert âTABLE*â to âst_table*â in assignment
ha_pbxt.cc: At global scope:
ha_pbxt.cc:2072: warning: âint equ_bin(const uchar*, const char*)â defined but not used
ha_pbxt.cc:2082: warning: âvoid dump_bin(const uchar*, int, int)â defined but not used
make[1]: *** [libpbxt_a-ha_pbxt.o] Error 1
make[1]: Leaving directory `/home/miguel/bzr/pbxt/src'
make: *** [install-recursive] Error 1
[miguel@hegel pbxt]$

Hi Miguel,

In 6.0.6 in handler.h, TABLE is defined as follows:

struct st_table;
typedef struct st_table TABLE;

struct st_table is defined in table.h.

If you are not using 6.0.6, then this may have changed, in which case, references to st_table in PBXT will have to be changed as well.

Hi Paul,

Indeed I used the current source server 6.0, so are you able to test PBXT with
the latest 6.0 source?. I tried to compile on 64-bit FC 8.0 and 5.1 didn't presented that issue.

No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

same with the latest 6.0, without pbxt.

start the server, install, for example, fulltext example plugin, restart the server. You need debug server for that (with dbug and safemalloc)

Closing the bug as it is no longer reproducible.

Investigations indicate it was fixed by:

 Bug#44137: Transactional DDL locking broke dynamic plugins

(Setting to Documenting in case the doc team wants to add some notes in the changelog -- otherwise it can be closed)

No changelog entry needed.