Bug #51356 many valgrind errors in error messages with concurrent ddl

• Submitted: 20 Feb 2010 20:16
• Modified: 20 Jul 2010 23:43
• Reporter: Shane Bester (Platinum Quality Contributor)
• Status: Closed
• Category: MySQL Server: InnoDB Plugin storage engine
• Severity: S1 (Critical)
• Version: 5.5.99-m3-debug
• OS: Any
• Assigned to: Jimmy Yang
• CPU Architecture: Any
• Tags: valgrind

[20 Feb 2010 20:16] Shane Bester

Description:
many valgrind errors in the delivery and construction of errors during concurrent ddl. Here is a sample (full output attached).

33 errors in context 28 of 34:
Conditional jump or move depends on uninitialised value(s)
at: strdup_root (my_alloc.c:398)
by: MYSQL_ERROR::set_builtin_message_text(char const*) (sql_error.cc:297)
by: MYSQL_ERROR::set (sql_error.cc:284)

16 errors in context 26 of 34:
Conditional jump or move depends on uninitialised value(s)
at: strnlen (mc_replace_strmem.c:259)
by: process_str_arg (my_vsnprintf.c:195)
by: my_vsnprintf_ex (my_vsnprintf.c:603)
by: my_error (my_error.c:92)

12 errors in context 25 of 34:
Conditional jump or move depends on uninitialised value(s)
at: my_utf8_uni (ctype-utf8.c:1955)
by: my_well_formed_len_mb (ctype-mb.c:401)
by: process_str_arg (my_vsnprintf.c:198)

12 errors in context 24 of 34:
Conditional jump or move depends on uninitialised value(s)
at: strnmov (in /home/sbester/mysql/5.5/mysql-5.5.99-m3-linux-i686/bin/mysqld)
by: my_vsnprintf_ex (my_vsnprintf.c:603)
by: my_error (my_error.c:92)

How to repeat:
run mysqld under valgrind, or observe corrupted table name in the nonsensical error message.

delimiter $
drop table if exists t1$
create table t1(a char(20),key a(a))engine=innodb$
drop procedure if exists p1 $
create procedure p1()
begin
  declare i int default '0';
  declare continue handler for sqlexception begin end;
  repeat
   truncate t1;
   alter table t1 engine=innodb;
   alter table t1 engine=myisam;
   set i=i+1;
  until i>100000 end repeat;
end $

delimiter ;

set names utf8;call p1(); #run this in 2 threads.

[20 Feb 2010 20:20] MySQL Verification Team

in 5.1.45 the innodb data dictionary gets messed up, maybe another bug:

3:29:36  InnoDB: Error: table `test`.`t1` already exists in InnoDB internal
InnoDB: data dictionary. Have you deleted the .frm file ...
<cut>

[21 Feb 2010 16:33] MySQL Verification Team

full outputs from valgrind

Attachment: bug51356_valgrind_output_5.5.99-m3.txt (text/plain), 18.17 KiB.

[21 Feb 2010 16:36] Valeriy Kravchuk

Numerous "Conditional jump or move depends on uninitialised value(s)" Valgrind error messages are easily repeatable with resent next-mt tree on Linux.

[4 Mar 2010 12:55] Alexander Nozdrin

There are two different problems in this report:

1. Valgrind errors.

They are caused by a mistake in ha_innodb.cc:
	if (error == DB_DUPLICATE_KEY) {
		char buf[100];
		innobase_convert_identifier(buf, sizeof buf,
					    table_name, strlen(table_name),
					    trx->mysql_thd, TRUE);
		my_error(ER_TABLE_EXISTS_ERROR, MYF(0), buf);
	}

innobase_convert_identifier() returns a pointer to the end of buffer.
The code should be fixed like:

char *s= innobase_convert_identifier(buf, sizeof buf,
                                     table_name, strlen(table_name),
                                     trx->mysql_thd, TRUE);
*s= 0;

2. MySQL problem with TRUNCATE TABLE.

In this particular case execution should not have gone into InnoDB,
but an error should have been thrown in the MySQL server layer.

This is known issue of TRUNCATE TABLE and will be fixed by a patch
for Bug#42463.

Based on this, unassigning myself and setting Calvin as a lead.

[10 Mar 2010 11:06] Jimmy Yang

r6790 | jyang | 2010-03-10 03:09:41 -0800 (Wed, 10 Mar 2010) | 7 lines

branches/zip: Fix bug #51356: "many valgrind errors in error messages
with concurrent ddl". Null terminate the name string returned
from innobase_convert_identifier() call when reporting DB_DUPLICATE_KEY
error in create_table_def().

[1 Apr 2010 12:16] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/104881

3527 Sergey Vojtovich	2010-04-01
      Applying InnoDB snapshot, fixes BUG#51356.
      
      Detailed revision comments:
      
      r6790 | jyang | 2010-03-10 13:09:41 +0200 (Wed, 10 Mar 2010) | 7 lines
      branches/zip: Fix bug #51356: "many valgrind errors in error messages
      with concurrent ddl". Null terminate the name string returned
      from innobase_convert_identifier() call when reporting DB_DUPLICATE_KEY
      error in create_table_def().
      rb://266 approved by Marko

[6 Apr 2010 7:59] Bugs System

Pushed into 5.1.46 (revid:[e-mail]-20100405111026-7kz1p8qlzglqgfmu) (version source revid:[e-mail]-20100401151005-c6re90vdvutln15d) (merge vers: 5.1.46) (pib:16)

[5 May 2010 15:13] Bugs System

Pushed into 5.1.47 (revid:[e-mail]-20100505145753-ivlt4hclbrjy8eye) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

[28 May 2010 6:11] Bugs System

Pushed into mysql-next-mr (revid:[e-mail]-20100524190136-egaq7e8zgkwb9aqi) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (pib:16)

[28 May 2010 6:39] Bugs System

Pushed into 6.0.14-alpha (revid:[e-mail]-20100524190941-nuudpx60if25wsvx) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

[28 May 2010 7:07] Bugs System

Pushed into 5.5.5-m3 (revid:[e-mail]-20100524185725-c8k5q7v60i5nix3t) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

[15 Jun 2010 8:14] Bugs System

Pushed into 5.5.5-m3 (revid:[e-mail]-20100615080459-smuswd9ooeywcxuc) (version source revid:[e-mail]-20100415070122-1nxji8ym4mao13ao) (merge vers: 5.1.47) (pib:16)

[15 Jun 2010 8:30] Bugs System

Pushed into mysql-next-mr (revid:[e-mail]-20100615080558-cw01bzdqr1bdmmec) (version source revid:[e-mail]-20100415070122-1nxji8ym4mao13ao) (pib:16)

[17 Jun 2010 12:16] Bugs System

Pushed into 5.1.47-ndb-7.0.16 (revid:[e-mail]-20100617114014-bva0dy24yyd67697) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

[17 Jun 2010 13:04] Bugs System

Pushed into 5.1.47-ndb-6.2.19 (revid:[e-mail]-20100617115448-idrbic6gbki37h1c) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

[17 Jun 2010 13:44] Bugs System

Pushed into 5.1.47-ndb-6.3.35 (revid:[e-mail]-20100617114611-61aqbb52j752y116) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)