MySQL Bugs: #41346: Queries against INFORMATION

Bug #41346	Queries against INFORMATION_SCHEMA crash mysql
Submitted:	10 Dec 2008 2:13	Modified:	11 Jan 2009 7:50
Reporter:	Ryan Lowe	Email Updates:
Status:	No Feedback	Impact on me:	None
Category:	MySQL Server: Information schema	Severity:	S2 (Serious)
Version:	5.1.30	OS:	Linux (CentOS release 5.2 (Final) )
Assigned to:		CPU Architecture:	Any
Tags:	information_schema

Description:
When I issue the following query against INFORMATION_SCHEMA, mysql crashes

SELECT COUNT(*) FROM TRIGGERS;

and gives me the following stack trace:

/usr/sbin/mysqld(my_print_stacktrace+0x2e)[0x83d6ee]
/usr/sbin/mysqld(handle_segfault+0x322)[0x5b9992]
/lib64/libpthread.so.0[0x2ab2a34f3e70]
/usr/sbin/mysqld[0x701c16]
/usr/sbin/mysqld(_Z11plugin_lockP3THDPP13st_plugin_int+0x31)[0x703231]
/usr/sbin/mysqld(_Z25ha_resolve_by_legacy_typeP3THD14legacy_db_type+0x25)[0x68e6b5]
/usr/sbin/mysqld(_Z12ha_checktypeP3THD14legacy_db_typebb+0x28)[0x68e708]
/usr/sbin/mysqld(_Z14open_table_defP3THDP14st_table_sharej+0xbac)[0x60a6cc]
/usr/sbin/mysqld(_Z15get_table_shareP3THDP10TABLE_LISTPcjjPi+0x1d8)[0x6001b8]
/usr/sbin/mysqld[0x6029d2]
/usr/sbin/mysqld(_Z10open_tableP3THDP10TABLE_LISTP11st_mem_rootPbj+0x657)[0x6043b7]
/usr/sbin/mysqld(_Z11open_tablesP3THDPP10TABLE_LISTPjj+0x48a)[0x60505a]
/usr/sbin/mysqld(_Z30open_normal_and_derived_tablesP3THDP10TABLE_LISTj+0x1e)[0x60527e]
/usr/sbin/mysqld(_Z14get_all_tablesP3THDP10TABLE_LISTP4Item+0x85c)[0x6b552c]
/usr/sbin/mysqld(_Z24get_schema_tables_resultP4JOIN23enum_schema_table_state+0x1e0)[0x6ae1e0]
/usr/sbin/mysqld(_ZN4JOIN4execEv+0x434)[0x62d494]
/usr/sbin/mysqld(_Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x16e)[0x62f37e]
/usr/sbin/mysqld(_Z13handle_selectP3THDP6st_lexP13select_resultm+0x169)[0x62fc99]
/usr/sbin/mysqld[0x5c3cc4]
/usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x38f9)[0x5c9e59]
/usr/sbin/mysqld(_Z11mysql_parseP3THDPKcjPS2_+0x1f1)[0x5cbc41]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x420)[0x5cc080]
/usr/sbin/mysqld(_Z10do_commandP3THD+0xe4)[0x5cd184]
/usr/sbin/mysqld(handle_one_connection+0x6ef)[0x5c06ef]
/lib64/libpthread.so.0[0x2ab2a34ec2f7]
/lib64/libc.so.6(clone+0x6d)[0x2ab2a40a9e3d]
081209 16:39:00 - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.

key_buffer_size=4294967296
read_buffer_size=131072
max_used_connections=19
max_threads=600
threads_connected=5
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 5505993 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

thd: 0x2aabb804a300
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x432b8f20 thread_stack 0x20000
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at 0x7a939d0 = SELECT *,
                   `TABLE_SCHEMA`       AS `Db`,
                   `TABLE_NAME`         AS `Name`,
                   `ENGINE`             AS `Engine`,
                   `ENGINE`             AS `Type`,
                   `VERSION`            AS `Version`,
                   `ROW_FORMAT`         AS `Row_format`,
                   `TABLE_ROWS`         AS `Rows`,
                   `AVG_ROW_LENGTH`     AS `Avg_row_length`,
                   `DATA_LENGTH`        AS `Data_length`,
                   `MAX_DATA_LENGTH`    AS `Max_data_length`,
                   `INDEX_LENGTH`       AS `Index_length`,
                   `DATA_FREE`          AS `Data_free`,
                   `AUTO_INCREMENT`     AS `Auto_increment`,
                   `CREATE_TIME`        AS `Create_time`,
                   `UPDATE_TIME`        AS `Update_time`,
                   `CHECK_TIME`         AS `Check_time`,
                   `TABLE_COLLATION`    AS `Collation`,
                   `CHECKSUM`           AS `
thd->thread_id=3678
thd->killed=NOT_KILLED
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.
081209 16:39:00 mysqld_safe Number of processes running now: 0
081209 16:39:00 mysqld_safe mysqld restarted

How to repeat:
SELECT COUNT(*) FROM TRIGGERS;

Suggested fix:
Do Not Crash

Whoops, looks like I posted the wrong stack trace before.  Here is the correct one:

/usr/sbin/mysqld(my_print_stacktrace+0x2e)[0x83d6ee]
/usr/sbin/mysqld(handle_segfault+0x322)[0x5b9992]
/lib64/libpthread.so.0[0x2ae61835fe70]
/usr/sbin/mysqld[0x701c16]
/usr/sbin/mysqld(_Z11plugin_lockP3THDPP13st_plugin_int+0x31)[0x703231]
/usr/sbin/mysqld(_Z25ha_resolve_by_legacy_typeP3THD14legacy_db_type+0x25)[0x68e6b5]
/usr/sbin/mysqld(_Z12ha_checktypeP3THD14legacy_db_typebb+0x28)[0x68e708]
/usr/sbin/mysqld(_Z14open_table_defP3THDP14st_table_sharej+0xbac)[0x60a6cc]
/usr/sbin/mysqld(_Z15get_table_shareP3THDP10TABLE_LISTPcjjPi+0x1d8)[0x6001b8]
/usr/sbin/mysqld[0x6029d2]
/usr/sbin/mysqld(_Z10open_tableP3THDP10TABLE_LISTP11st_mem_rootPbj+0x657)[0x6043b7]
/usr/sbin/mysqld(_Z11open_tablesP3THDPP10TABLE_LISTPjj+0x48a)[0x60505a]
/usr/sbin/mysqld(_Z30open_normal_and_derived_tablesP3THDP10TABLE_LISTj+0x1e)[0x60527e]
/usr/sbin/mysqld(_Z14get_all_tablesP3THDP10TABLE_LISTP4Item+0x85c)[0x6b552c]
/usr/sbin/mysqld(_Z24get_schema_tables_resultP4JOIN23enum_schema_table_state+0x1e0)[0x6ae1e0]
/usr/sbin/mysqld(_ZN4JOIN4execEv+0x434)[0x62d494]
/usr/sbin/mysqld(_Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x16e)[0x62f37e]
/usr/sbin/mysqld(_Z13handle_selectP3THDP6st_lexP13select_resultm+0x169)[0x62fc99]
/usr/sbin/mysqld[0x5c3cc4]
/usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x38f9)[0x5c9e59]
/usr/sbin/mysqld(_Z11mysql_parseP3THDPKcjPS2_+0x1f1)[0x5cbc41]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x420)[0x5cc080]
/usr/sbin/mysqld(_Z10do_commandP3THD+0xe4)[0x5cd184]
/usr/sbin/mysqld(handle_one_connection+0x6ef)[0x5c06ef]
/lib64/libpthread.so.0[0x2ae6183582f7]
/lib64/libc.so.6(clone+0x6d)[0x2ae618f15e3d]
081209 17:42:48 - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.

key_buffer_size=4294967296
read_buffer_size=131072
max_used_connections=6
max_threads=600
threads_connected=1
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 5505993 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

thd: 0x7622820
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x40d48f20 thread_stack 0x20000
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at 0x76016d0 = select count(*) from TRIGGERS
thd->thread_id=19
thd->killed=NOT_KILLED
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.

Thank you for a problem report. Please, send your my.cnf and the results of

free

Linux command. 

Do you know how many triggers do you have in total?

There are five triggers.  But *any* query against information schema will crash the server:

$ free 
             total       used       free     shared    buffers     cached
Mem:      16443920   13547380    2896540          0     156808   12341732
-/+ buffers/cache:    1048840   15395080
Swap:      4192888        156    4192732

$ cat /etc/mysql/my.cnf
[client]
port                    = 3306

[mysqld_safe]
nice                    = 0

[mysqldump]
quick
quote-names
max_allowed_packet      = 16M

[mysqld]

# General Settings
user                    = mysql
port                    = 3306
basedir                 = /usr
tmpdir                  = /tmp
tmp_table_size          = 78M
max_heap_table_size     = 78M
language                = /usr/share/mysql/english
skip-external-locking
max_allowed_packet      = 16M
thread_stack            = 128K
thread_cache_size       = 16
max_connect_errors      = 100
max_connections         = 600
table_cache             = 512
open_files_limit        = 48000
thread_concurrency      = 10

# Query Cache Configuration
query_cache_limit       = 1M
query_cache_size        = 64M
query_cache_type        = 1

# Log Settings
log_output=FILE
log_slow_queries        = /var/lib/mysql/mysql-slow.log
long_query_time         = 1
log-queries-not-using-indexes
log_bin                 = /var/lib/mysql/mysql-bin.log
log_slave_updates       = 1
expire_logs_days        = 3
max_binlog_size         = 100M

# MyISAM Settings
key_buffer              = 4G
myisam_sort_buffer_size = 250M

# InnoDB Settings
innodb_data_file_path   = ibdata1:100M:autoextend
innodb_buffer_pool_size = 100M

# General Configuration
datadir       = /var/lib/mysql/

# Replication
server-id     = 5
relay-log     = /var/lib/mysql/mysql-relay.bin

Is this a new installation of 5.1.30 or you had upgraded from 5.0.x?

Fresh Install

I can not repeat this crash. Can you send a mysqldump of all your tables with triggers defined on them, without data?

I do not see any triggers in the file uploaded. Am I missing something? Had you used --triggers option for mysqldump? See http://dev.mysql.com/doc/refman/5.1/en/mysqldump.html.

No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/70145

2792 Rafal Somla	2009-03-23
      Remove SELECTs from I_S.PROCESSLIST from tests, because such selects are unstable
      in the current server (see bug#37990, bug#41346, bug#43357). These selects increase
      feedback given by test and thus increases chances of detecting problems, but are
      not essential for test purposes.
     @ mysql-test/suite/backup/include/bml_test.inc
        Comment-out SELECTs from I_S.PROCESSLIST.
     @ mysql-test/suite/backup/t/backup_bml.test
        Comment-out SELECTs from I_S.PROCESSLIST.
     @ mysql-test/suite/backup_engines/include/backup_restore_interrupt.inc
        Comment-out SELECTs from I_S.PROCESSLIST.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/70165

2793 Rafal Somla	2009-03-23
      Remove SELECTs from I_S.PROCESSLIST from tests, because such selects are unstable
      in the current server (see bug#37990, bug#41346, bug#43357). These selects increase
      feedback given by test and thus increases chances of detecting problems, but are
      not essential for test purposes.
     @ mysql-test/suite/backup/include/bml_test.inc
        Comment-out SELECTs from I_S.PROCESSLIST.
     @ mysql-test/suite/backup/t/backup_bml.test
        Comment-out SELECTs from I_S.PROCESSLIST.
     @ mysql-test/suite/backup_engines/include/backup_restore_interrupt.inc
        Comment-out SELECTs from I_S.PROCESSLIST.

Pushed into 6.0.11-alpha (revid:alik@sun.com-20090423070920-e5lq3vrrqi016z2c) (version source revid:alik@sun.com-20090423070920-e5lq3vrrqi016z2c) (merge vers: 6.0.11-alpha) (pib:6)