Bug #53779 mtr --debug was broken by bugfix 52629

Submitted: 19 May 2010 7:17 Modified: 19 May 2010 19:08
Reporter: Tor Didriksen Email Updates:
Status: Duplicate Impact on me:
None 
Category:MySQL Server: Logging Severity:S3 (Non-critical)
Version:5.1-bugteam, pe OS:Any
Assigned to: CPU Architecture:Any

[19 May 2010 7:17] Tor Didriksen
Description:
bugfix #52629 contains two diffs.
This one makes the server crash at exit (the bootstrap when running mtr)
For me the 5.1 server hangs (needs a kill -9)
For mysql-pe I get a call stack.

   while ((discard= cs->stack))
   {
     if (discard == &init_settings)
+    {
+      FreeState (cs, discard, 0);
       break;
+    }
     cs->stack= discard->next;
     FreeState(cs, discard, 1);
   }

*** glibc detected *** /export/home/didrik/mysqldev51/5.1-bugteam-bug50087/sql/mysqld: corrupted double-linked list: 0x0000000002e41530 ***

*** glibc detected *** /export/home/didrik/mysqldev-pe/pe-bug50087/sql/mysqld: double free or corruption (!prev): 0x0000000001f43460 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3f23874576]
/lib64/libc.so.6(fclose+0x14d)[0x3f23864ead]
/export/home/didrik/mysqldev-pe/pe-bug50087/sql/mysqld[0xa961e2]
/export/home/didrik/mysqldev-pe/pe-bug50087/sql/mysqld[0xa95987]
/export/home/didrik/mysqldev-pe/pe-bug50087/sql/mysqld(_db_end_+0x152)[0xa95b54]
/export/home/didrik/mysqldev-pe/pe-bug50087/sql/mysqld(my_end+0x362)[0xa780ab]
/export/home/didrik/mysqldev-pe/pe-bug50087/sql/mysqld[0x5583ad]
/export/home/didrik/mysqldev-pe/pe-bug50087/sql/mysqld[0x558344]
/export/home/didrik/mysqldev-pe/pe-bug50087/sql/mysqld(_Z11mysqld_mainiPPc+0x667)[0x55d36d]
/export/home/didrik/mysqldev-pe/pe-bug50087/sql/mysqld(main+0x20)[0x555fc4]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x3f2381eb1d]
/export/home/didrik/mysqldev-pe/pe-bug50087/sql/mysqld[0x555ee9]

Commenting out the diff above, this diff gives lots of valgrind warnings:
   rel= control[0] == '+' || control[0] == '-';
   if ((!rel || (!stack->out_file && !stack->next)))
   {
+    /*
+      We need to free what's already in init_settings, because unlike
+      the thread related stack frames there's a chance that something
+      is in these variables already.
+    */
+    if (stack == &init_settings)
+      FreeState(cs, stack, 0);
     stack->flags= 0;
     stack->delay= 0;
     stack->maxdepth= 0;

==28270== Thread 3:
==28270== Invalid read of size 2
==28270==    at 0x3F238652FD: fflush (in /lib64/libc-2.11.so)
==28270==    by 0xB3911F: FreeState (dbug.c:1484)
==28270==    by 0xB36F73: DbugParse (dbug.c:464)
==28270==    by 0xB37A45: _db_set_init_ (dbug.c:752)
==28270==    by 0x6C416D: sys_var_thd_dbug::update(THD*, set_var*) (set_var.cc:4243)
==28270==    by 0x6C296A: set_var::update(THD*) (set_var.cc:3606)
==28270==    by 0x6C23EF: sql_set_variables(THD*, List<set_var_base>*) (set_var.cc:3481)
==28270==    by 0x6B04EF: mysql_execute_command(THD*) (sql_parse.cc:3493)
==28270==    by 0x6B7C70: mysql_parse(THD*, char const*, unsigned int, char const**) (sql_parse.cc:5986)
==28270==    by 0x6AA210: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1233)
==28270==    by 0x6A91C7: do_command(THD*) (sql_parse.cc:874)
==28270==    by 0x6A74C6: handle_one_connection (sql_connect.cc:1134)
==28270==    by 0x3F24406A39: start_thread (in /lib64/libpthread-2.11.so)
==28270==  Address 0x50cd750 is 0 bytes inside a block of size 568 free'd
==28270==    at 0x4A04D72: free (vg_replace_malloc.c:325)
==28270==    by 0x3F23864EAC: fclose@@GLIBC_2.2.5 (in /lib64/libc-2.11.so)
==28270==    by 0xB39913: DBUGCloseFile (dbug.c:1963)
==28270==    by 0xB3910B: FreeState (dbug.c:1483)
==28270==    by 0xB36F73: DbugParse (dbug.c:464)
==28270==    by 0xB37A45: _db_set_init_ (dbug.c:752)
==28270==    by 0x6C416D: sys_var_thd_dbug::update(THD*, set_var*) (set_var.cc:4243)
==28270==    by 0x6C296A: set_var::update(THD*) (set_var.cc:3606)
==28270==    by 0x6C23EF: sql_set_variables(THD*, List<set_var_base>*) (set_var.cc:3481)
==28270==    by 0x6B04EF: mysql_execute_command(THD*) (sql_parse.cc:3493)
==28270==    by 0x6B7C70: mysql_parse(THD*, char const*, unsigned int, char const**) (sql_parse.cc:5986)
==28270==    by 0x6AA210: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1233)
==28270==    by 0x6A91C7: do_command(THD*) (sql_parse.cc:874)
==28270==    by 0x6A74C6: handle_one_connection (sql_connect.cc:1134)
==28270==    by 0x3F24406A39: start_thread (in /lib64/libpthread-2.11.so)

==28270== Invalid read of size 8
==28270==    at 0x3F23865303: fflush (in /lib64/libc-2.11.so)
==28270==    by 0xB3911F: FreeState (dbug.c:1484)
==28270==    by 0xB36F73: DbugParse (dbug.c:464)
==28270==    by 0xB37A45: _db_set_init_ (dbug.c:752)
==28270==    by 0x6C416D: sys_var_thd_dbug::update(THD*, set_var*) (set_var.cc:4243)
==28270==    by 0x6C296A: set_var::update(THD*) (set_var.cc:3606)
==28270==    by 0x6C23EF: sql_set_variables(THD*, List<set_var_base>*) (set_var.cc:3481)
==28270==    by 0x6B04EF: mysql_execute_command(THD*) (sql_parse.cc:3493)
==28270==    by 0x6B7C70: mysql_parse(THD*, char const*, unsigned int, char const**) (sql_parse.cc:5986)
==28270==    by 0x6AA210: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1233)
==28270==    by 0x6A91C7: do_command(THD*) (sql_parse.cc:874)
==28270==    by 0x6A74C6: handle_one_connection (sql_connect.cc:1134)
==28270==    by 0x3F24406A39: start_thread (in /lib64/libpthread-2.11.so)
==28270==  Address 0x50cd7d8 is 136 bytes inside a block of size 568 free'd
==28270==    at 0x4A04D72: free (vg_replace_malloc.c:325)
==28270==    by 0x3F23864EAC: fclose@@GLIBC_2.2.5 (in /lib64/libc-2.11.so)
==28270==    by 0xB39913: DBUGCloseFile (dbug.c:1963)
==28270==    by 0xB3910B: FreeState (dbug.c:1483)
==28270==    by 0xB36F73: DbugParse (dbug.c:464)
==28270==    by 0xB37A45: _db_set_init_ (dbug.c:752)
==28270==    by 0x6C416D: sys_var_thd_dbug::update(THD*, set_var*) (set_var.cc:4243)
==28270==    by 0x6C296A: set_var::update(THD*) (set_var.cc:3606)
==28270==    by 0x6C23EF: sql_set_variables(THD*, List<set_var_base>*) (set_var.cc:3481)
==28270==    by 0x6B04EF: mysql_execute_command(THD*) (sql_parse.cc:3493)
==28270==    by 0x6B7C70: mysql_parse(THD*, char const*, unsigned int, char const**) (sql_parse.cc:5986)
==28270==    by 0x6AA210: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1233)
==28270==    by 0x6A91C7: do_command(THD*) (sql_parse.cc:874)
==28270==    by 0x6A74C6: handle_one_connection (sql_connect.cc:1134)
==28270==    by 0x3F24406A39: start_thread (in /lib64/libpthread-2.11.so)

(more warning omitted)

How to repeat:
./mtr --debug --valgrind-mysqld variables_debug
[19 May 2010 12:59] Davi Arnaut
Duplicate of Bug#46165

Portions of this website are copyright © 2001, 2002 The PHP Group

Page generated in 0.050 sec. using MySQL 8.4.7-u6-cloud

Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the respective copyright holders.
It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.