Bug #54185 crash in wait_while_table_is_used
Submitted: 2 Jun 2010 15:35 Modified: 9 Jun 2010 13:35
Reporter: Matthias Leich Email Updates:
Status: Can't repeat Impact on me:
None 
Category:MySQL Server: Locking Severity:S3 (Non-critical)
Version:mysql-trunk-runtime-stage OS:Any
Assigned to: Jon Olav Hauglid CPU Architecture:Any
Tags: locking

[2 Jun 2010 15:35] Matthias Leich
Description:
The crash happens in sql/sql_base.cc:2177 :
bool wait_while_table_is_used(THD *thd, TABLE *table,
                              enum ha_extra_function function)
{
  DBUG_ENTER("wait_while_table_is_used");
->  DBUG_PRINT("enter", ("table: '%s'  share: 0x%lx  db_stat: %u  version: %lu",
                       table->s->table_name.str, (ulong) table->s,
                       table->db_stat, table->s->version));

RQG test with
- 16 threads
- 10000 queries
- current WL5005_* grammars

Result on mysql-trunk-runtime-stage revno: 3029 2010-06-02
----------------------------------------------------------
....
Thread 1 (process 12708):
#0  0x00007f2ea14e5ce6 in pthread_kill () from /lib64/libpthread.so.0
#1  0x00000000009fa889 in my_write_core (sig=11) at .../mysys/stacktrace.c:326
#2  0x000000000053ceb0 in handle_segfault (sig=11) at .../sql/mysqld.cc:2786
#3  <signal handler called>
#4  0x000000000058242b in wait_while_table_is_used (thd=0x1ef1658, table=0x0, function=HA_EXTRA_FORCE_REOPEN) at .../sql/sql_base.cc:2177
#5  0x000000000064de50 in mysql_rm_table_part2 (thd=0x1ef1658, tables=0x1f18b50, if_exists=true, drop_temporary=false, drop_view=false, dont_log_query=false) at .../sql/sql_table.cc:2067
#6  0x000000000064e82d in mysql_rm_table (thd=0x1ef1658, tables=0x1f18b50, if_exists=1 '\001', drop_temporary=0 '\0') at .../sql/sql_table.cc:1855
#7  0x00000000005cea17 in mysql_execute_command (thd=0x1ef1658) at .../sql/sql_parse.cc:3371
#8  0x00000000005d2f0a in mysql_parse (thd=0x1ef1658, inBuf=0x1f189e8 "DROP  TABLE IF EXISTS testdb_N . t1_temp1_N  , testdb_N . t1_temp1_N  CASCADE", length=77, parser_state=0x46d1f9b0)
    at .../sql/sql_parse.cc:5800
#9  0x00000000005d3b06 in dispatch_command (command=COM_QUERY, thd=0x1ef1658, packet=0x1e2a019 "DROP  TABLE IF EXISTS testdb_N . t1_temp1_N  , testdb_N . t1_temp1_N  CASCADE", packet_length=77)
    at .../sql/sql_parse.cc:1086
#10 0x00000000005d4f9f in do_command (thd=0x1ef1658) at .../sql/sql_parse.cc:772
#11 0x000000000069f7f2 in do_handle_one_connection (thd_arg=0x1ef1658) at .../sql/sql_connect.cc:1188
#12 0x000000000069f8b7 in handle_one_connection (arg=0x1ef1658) at .../sql/sql_connect.cc:1127
#13 0x00007f2ea14e1040 in start_thread () from /lib64/libpthread.so.0
#14 0x00007f2ea079e08d in clone () from /lib64/libc.so.6
#15 0x0000000000000000 in ?? ()
...
100602 17:00:28 - mysqld got signal 11 ;
...
thd: 0x1ef1658
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x46d200e0 thread_stack 0x40000
.../sql/mysqld(my_print_stacktrace+0x32)[0x9fa80c]
.../sql/mysqld(handle_segfault+0x2a6)[0x53ccc3]
/lib64/libpthread.so.0[0x7f2ea14e8b30]
.../sql/mysqld(_Z24wait_while_table_is_usedP3THDP5TABLE17ha_extra_function+0x3e)[0x58242b]
.../sql/mysqld(_Z20mysql_rm_table_part2P3THDP10TABLE_LISTbbbb+0x68a)[0x64de50]
.../sql/mysqld(_Z14mysql_rm_tableP3THDP10TABLE_LISTcc+0xd3)[0x64e82d]
.../sql/mysqld(_Z21mysql_execute_commandP3THD+0x39a0)[0x5cea17]
.../sql/mysqld(_Z11mysql_parseP3THDPKcjP12Parser_state+0x1c7)[0x5d2f0a]
.../sql/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0xaa3)[0x5d3b06]
.../sql/mysqld(_Z10do_commandP3THD+0x22b)[0x5d4f9f]
.../sql/mysqld(_Z24do_handle_one_connectionP3THD+0x137)[0x69f7f2]
.../sql/mysqld(handle_one_connection+0x2d)[0x69f8b7]
/lib64/libpthread.so.0[0x7f2ea14e1040]
/lib64/libc.so.6(clone+0x6d)[0x7f2ea079e08d]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at 0x1f189e8 = DROP  TABLE IF EXISTS testdb_N . t1_temp1_N  , testdb_N . t1_temp1_N  CASCADE
thd->thread_id=20
thd->killed=NOT_KILLED

Maybe interesting "facts":
- t1_temp1_N is most probably a temporary table
- the critical statement tries to DROP the table two times
- IF EXISTS is involved
Unfortunately I cannot tell if we would get also a crash
if we would make small modifications to this statement. 

How to repeat:
I will try to come up with simplified grammars soon.
[6 Jun 2010 10:06] Jon Olav Hauglid
Verified using RQG on mysql-trunk-runtime.

(gdb) p table
$1 = (TABLE *) 0x0
[9 Jun 2010 13:35] Jon Olav Hauglid
Unable to reproduce in a tree containing the patch for Bug#54282.

With Bug#54282, DROP TABLE with two identical table names will (again) give
an error message (ER_NONUNIQ_TABLE) before any locks are taken. Since the
assert in Bug#54282 was inside locking code and only seen for DROP TABLE with
two identical table names, I'm closing this bug as "Can't repeat".