Bug #53757 assert in mysql_truncate_by_delete
Submitted: 18 May 2010 17:07 Modified: 12 Aug 2010 19:49
Reporter: Matthias Leich Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server Severity:S3 (Non-critical)
Version:mysql-next-mr, mysql-trunk-bugfixing OS:Any
Assigned to: Jon Olav Hauglid
Triage: Triaged: D1 (Critical)

[18 May 2010 17:07] Matthias Leich
Description:
The assert happens in sql_delete.cc line 1092
  if (error)
  {
    DBUG_ASSERT(thd->stmt_da->is_error()); <-------
    trans_rollback_stmt(thd);
    trans_rollback(thd);
  }

RQG test with 10 concurrent sessions

Result on mysql-next-mr revno: 3143 2010-05-07
----------------------------------------------
...
# 2010-05-18T18:25:07 #0  0x00007f86e018d1f6 in pthread_kill () from /lib/libpthread.so.0
# 2010-05-18T18:25:07 #0  0x00007f86e018d1f6 in pthread_kill () from /lib/libpthread.so.0
# 2010-05-18T18:25:07 #1  0x0000000000b7aee7 in my_write_core (sig=6) at stacktrace.c:326
# 2010-05-18T18:25:07 #2  0x00000000006bdbf2 in handle_segfault (sig=6) at mysqld.cc:2786
# 2010-05-18T18:25:07 #3  <signal handler called>
# 2010-05-18T18:25:07 #4  0x00007f86df566fb5 in raise () from /lib/libc.so.6
# 2010-05-18T18:25:07 #5  0x00007f86df568bc3 in abort () from /lib/libc.so.6
# 2010-05-18T18:25:07 #6  0x00007f86df55ff09 in __assert_fail () from /lib/libc.so.6
# 2010-05-18T18:25:07 #7  0x0000000000794e38 in mysql_truncate_by_delete (thd=0x39ab4a8,
# 2010-05-18T18:25:07     table_list=0x7f86c001d8a0) at sql_delete.cc:1092
# 2010-05-18T18:25:07 #8  0x00000000007956a0 in mysql_truncate (thd=0x39ab4a8,
# 2010-05-18T18:25:07     table_list=0x7f86c001d8a0, dont_send_ok=false) at sql_delete.cc:1288
# 2010-05-18T18:25:07 #9  0x00000000006d3de6 in mysql_execute_command (thd=0x39ab4a8)
# 2010-05-18T18:25:07     at sql_parse.cc:3284
# 2010-05-18T18:25:07 #10 0x00000000006d89e1 in mysql_parse (thd=0x39ab4a8,
# 2010-05-18T18:25:07     inBuf=0x7f86c001d798 "TRUNCATE  testdb_N . t1_part1_N", length=31,
# 2010-05-18T18:25:07     found_semicolon=0x7f86cf7029f8) at sql_parse.cc:5811
# 2010-05-18T18:25:07 #11 0x00000000006d95bd in dispatch_command (command=COM_QUERY, thd=0x39ab4a8,
# 2010-05-18T18:25:07     packet=0x3a62519 "TRUNCATE  testdb_N . t1_part1_N ", packet_length=32)
# 2010-05-18T18:25:07     at sql_parse.cc:1088
# 2010-05-18T18:25:07 #12 0x00000000006daae7 in do_command (thd=0x39ab4a8) at sql_parse.cc:774
# 2010-05-18T18:25:07 #13 0x00000000006c8780 in do_handle_one_connection (thd_arg=0x39ab4a8)
# 2010-05-18T18:25:07     at sql_connect.cc:1188
# 2010-05-18T18:25:07 #14 0x00000000006c8845 in handle_one_connection (arg=0x39ab4a8)
# 2010-05-18T18:25:07     at sql_connect.cc:1127
# 2010-05-18T18:25:07 #15 0x00007f86e01883ba in start_thread () from /lib/libpthread.so.0
# 2010-05-18T18:25:07 #16 0x00007f86df619fcd in clone () from /lib/libc.so.6
# 2010-05-18T18:25:07 #17 0x0000000000000000 in ?? ()
...
/data0/mleich/mysql-next-mr/sql/mysqld(my_print_stacktrace+0x32)[0xb7ae72]
/data0/mleich/mysql-next-mr/sql/mysqld(handle_segfault+0x2a6)[0x6bda05]
/lib/libpthread.so.0[0x7f86e0190080]
/lib/libc.so.6(gsignal+0x35)[0x7f86df566fb5]
/lib/libc.so.6(abort+0x183)[0x7f86df568bc3]
/lib/libc.so.6(__assert_fail+0xe9)[0x7f86df55ff09]
/data0/mleich/mysql-next-mr/sql/mysqld[0x794e38]
/data0/mleich/mysql-next-mr/sql/mysqld(_Z14mysql_truncateP3THDP10TABLE_LISTb+0x842)[0x7956a0]
/data0/mleich/mysql-next-mr/sql/mysqld(_Z21mysql_execute_commandP3THD+0x3456)[0x6d3de6]
/data0/mleich/mysql-next-mr/sql/mysqld(_Z11mysql_parseP3THDPKcjPS2_+0x265)[0x6d89e1]
/data0/mleich/mysql-next-mr/sql/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0xa40)[0x6d95bd]
/data0/mleich/mysql-next-mr/sql/mysqld(_Z10do_commandP3THD+0x22b)[0x6daae7]
/data0/mleich/mysql-next-mr/sql/mysqld(_Z24do_handle_one_connectionP3THD+0x137)[0x6c8780]
/data0/mleich/mysql-next-mr/sql/mysqld(handle_one_connection+0x2d)[0x6c8845]
/lib/libpthread.so.0[0x7f86e01883ba]
/lib/libc.so.6(clone+0x6d)[0x7f86df619fcd]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at 0x7f86c001d798 is an invalid pointer
thd->thread_id=26
thd->killed=KILL_CONNECTION

How to repeat:
I will upload the RQG grammars which were used.
[18 May 2010 17:33] Matthias Leich
grammars + config + protocol

Attachment: 53757.tgz (application/x-compressed-tar, text), 36.38 KiB.

[4 Jun 2010 8:20] Jon Olav Hauglid
Verified using RQG on mysql-next-mr-bugfixing.
[4 Jun 2010 9:39] Jon Olav Hauglid
Repeatable in mysql-trunk-bugfixing by adding the following sync point:

=== modified file 'sql/sql_base.cc'
--- sql/sql_base.cc	2010-06-01 13:49:31 +0000
+++ sql/sql_base.cc	2010-06-04 09:27:19 +0000
@@ -4197,6 +4197,7 @@ open_and_process_table(THD *thd, LEX *le
   bool error= FALSE;
   bool safe_to_ignore_table= FALSE;
   DBUG_ENTER("open_and_process_table");
+  DEBUG_SYNC(thd, "open_and_process_table");

And then executing the following MTR test case:

--source include/have_debug_sync.inc
--source include/have_innodb.inc

CREATE TABLE t1(a INT) Engine=InnoDB;
CREATE TABLE t2(id INT);
INSERT INTO t1 VALUES (1), (2);
FLUSH TABLE t1;

connect (con1, localhost, root);
INSERT INTO t2 VALUES(connection_id());
SET DEBUG_SYNC= "open_and_process_table SIGNAL opening WAIT_FOR killed";
--send TRUNCATE t1

connection default;
SET DEBUG_SYNC= "now WAIT_FOR opening";
SELECT ((@id := id) - id) FROM t2; 
KILL @id;
SET DEBUG_SYNC= "now SIGNAL killed";
DROP TABLE t1;
[4 Jun 2010 11:49] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/110232

3039 Jon Olav Hauglid	2010-06-04
      Bug #53757 assert in mysql_truncate_by_delete
      
      The assert was triggered if a connection executing TRUNCATE
      on a InnoDB table was killed during open_tables.
      
      This bug was fixed in the scope of Bug #45643
      "InnoDB does not support replication of TRUNCATE TABLE".
      
      This patch adds test coverage to innodb_mysql_sync.test.
[24 Jun 2010 17:28] Konstantin Osipov
The test case patch was approved on the commits@ list.
[25 Jun 2010 7:07] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/112160

3062 Jon Olav Hauglid	2010-06-25
      Bug #53757 assert in mysql_truncate_by_delete
      
      The assert was triggered if a connection executing TRUNCATE
      on a InnoDB table was killed during open_tables.
      
      This bug was fixed in the scope of Bug #45643
      "InnoDB does not support replication of TRUNCATE TABLE".
      
      This patch adds test coverage to innodb_mysql_sync.test.
[25 Jun 2010 7:07] Jon Olav Hauglid
Pushed to mysql-trunk-runtime (5.5.6).
[3 Aug 2010 7:07] Jon Olav Hauglid
The bug mentioned in the patch notes should have been bug#42643 and not bug#45643
[4 Aug 2010 7:51] Bugs System
Pushed into mysql-trunk 5.5.6-m3 (revid:alik@sun.com-20100731131027-1n61gseejyxsqk5d) (version source revid:marko.makela@oracle.com-20100621094008-o9fa153s3f09merw) (merge vers: 5.1.49) (pib:18)
[4 Aug 2010 8:10] Bugs System
Pushed into mysql-trunk 5.6.1-m4 (revid:alik@ibmvm-20100804080001-bny5271e65xo34ig) (version source revid:marko.makela@oracle.com-20100621094008-o9fa153s3f09merw) (merge vers: 5.1.49) (pib:18)
[4 Aug 2010 8:26] Bugs System
Pushed into mysql-trunk 5.6.1-m4 (revid:alik@ibmvm-20100804081533-c1d3rbipo9e8rt1s) (version source revid:marko.makela@oracle.com-20100621094008-o9fa153s3f09merw) (merge vers: 5.1.49) (pib:18)
[4 Aug 2010 9:05] Bugs System
Pushed into mysql-next-mr (revid:alik@ibmvm-20100804081630-ntapn8bf9pko9vj3) (version source revid:marko.makela@oracle.com-20100621094008-o9fa153s3f09merw) (pib:20)
[12 Aug 2010 19:49] Paul Dubois
Noted in 5.5.6 changelog.

If a session executing TRUNCATE TABLE on an InnoDB table was killed
during open_tables(), an assertion could be raised.