Bug #41820 Falcon crash in MemFreeBlock::insert

• Submitted: 1 Jan 2009 20:57
• Modified: 21 Feb 2014 18:03
• Reporter: Philip Stoev
• Status: Unsupported
• Category: MySQL Server: Falcon storage engine
• Severity: S3 (Non-critical)
• Version: 6.0-falcon-team
• OS: Any
• Assigned to: Assigned Account
• CPU Architecture: Any

[1 Jan 2009 20:57] Philip Stoev

Description:
When executing a concurrent workload, Falcon crashed as follows:

#0  MemFreeBlock::insert (this=0x7f488c425890d8, newNode=0x7f488c423e70) at MemFreeBlock.cpp:85
#1  0x00000000008c0fed in MemMgr::insert (freeBlock=<value optimized out>, this=<value optimized out>) at MemMgr.cpp:774
#2  MemMgr::alloc (this=0x130bf00, s=<value optimized out>) at MemMgr.cpp:470
#3  0x00000000008c1c3e in MemMgr::allocate (size=<value optimized out>, this=<value optimized out>) at MemMgr.cpp:534
#4  MemMgrPoolAllocate (pool=0x130bf00, s=112) at MemMgr.cpp:174
#5  0x000000000085d1c2 in operator new () at MemoryManager.h:91
#6  Table::allocRecordVersion (this=0x7f488d848ab8, format=0x0, transaction=0x7f4888a51858, priorVersion=0x7f488c4240f8) at Table.cpp:3673
#7  0x000000000086697c in Table::deleteRecord (this=0x7f488d848ab8, transaction=0x7f4888a51858, orgRecord=0x7f488c4240f8) at Table.cpp:1520
#8  0x000000000084feb4 in StorageDatabase::deleteRow (this=<value optimized out>, storageConnection=0x7f488d5213c8, table=0x7f488d848ab8,
    recordNumber=<value optimized out>) at StorageDatabase.cpp:642
#9  0x000000000084ab09 in StorageInterface::delete_row (this=0x7f4874030788, buf=<value optimized out>) at ha_falcon.cpp:1217
#10 0x0000000000755515 in handler::ha_delete_row (this=0x7f4874030788, buf=0x7f4874030a58 "Ъ") at handler.cc:5479
#11 0x00000000006f4d76 in mysql_delete (thd=0x3bc4630, table_list=0x3bcf510, conds=0x3bcfcf0, order=<value optimized out>, limit=18446744073709551615,
    options=0, reset_auto_increment=false) at sql_delete.cc:299
#12 0x000000000066744d in mysql_execute_command (thd=0x3bc4630) at sql_parse.cc:3244
#13 0x000000000066adb8 in mysql_parse (thd=0x3bc4630, inBuf=0x3bcf0e8 "DELETE FROM `table10_falcon_int_autoinc` WHERE `pk` = @@LAST_INSERT_ID", length=70,
    found_semicolon=0x7f4879b4a070) at sql_parse.cc:5735
#14 0x000000000066ba7e in dispatch_command (command=COM_QUERY, thd=0x3bc4630,
    packet=0x3bc70b1 " DELETE FROM `table10_falcon_int_autoinc` WHERE `pk` = @@LAST_INSERT_ID ", packet_length=<value optimized out>) at sql_parse.cc:1007
#15 0x000000000065f938 in handle_one_connection (arg=<value optimized out>) at sql_connect.cc:1145
#16 0x000000315b0073da in start_thread () from /lib64/libpthread.so.0
#17 0x000000315a4e627d in clone () from /lib64/libc.so.6

(gdb) list
80              MemFreeBlock *node = this;
81
82              // Find insertion point and insert new node as leaf
83
84              while (node)
85                      if (newNode->memHeader.length < node->memHeader.length)
86                              {
87                              if (node->smaller)
88                                      node = node->smaller;
89                              else

(gdb) print node->memHeader
Cannot access memory at address 0x7f488c425890e8

How to repeat:
If this is repeatable, a test case will be provided.