MySQL Bugs: #59876: Valgrind warning in i_s_innodb_set_page

Bug #59876	Valgrind warning in i_s_innodb_set_page_type()
Submitted:	1 Feb 2011 18:08	Modified:	10 Feb 2011 19:55
Reporter:	Vasil Dimov	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: InnoDB storage engine	Severity:	S3 (Non-critical)
Version:	trunk	OS:	Any
Assigned to:	Jimmy Yang	CPU Architecture:	Any

Description:
After InnoDB valgrind instrumentation got enabled on PB2/valgrind runs we got the
following failure:

in trunk innodb.innodb_information_schema_buffer fails with:

==4535== Conditional jump or move depends on uninitialised value(s)
==4535==    at 0x9797C8: i_s_innodb_set_page_type(buffer_page_info_struct*, unsigned long, unsigned char const*) (i_s.cc:3188)
==4535==    by 0x97E760: i_s_innodb_buffer_page_get_info(buf_page_struct const*, unsigned long, unsigned long, buffer_page_info_struct*) (i_s.cc:3298)
==4535==    by 0x9809AD: i_s_innodb_fill_buffer_pool(THD*, TABLE_LIST*, buf_pool_struct*, unsigned long) (i_s.cc:3364)
==4535==    by 0x980B3B: i_s_innodb_buffer_page_fill_table(THD*, TABLE_LIST*, Item*) (i_s.cc:3422)
==4535==    by 0x646BAF: get_schema_tables_result(JOIN*, enum_schema_table_state) (sql_show.cc:6741)
==4535==    by 0x63B04F: JOIN::exec() (sql_select.cc:2839)
==4535==    by 0x6372FC: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:3584)
==4535==    by 0x63D66A: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:323)
==4535==    by 0x5DD861: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:4513)
==4535==    by 0x5DE7CA: mysql_execute_command(THD*) (sql_parse.cc:2096)
==4535==    by 0x5FB73E: Prepared_statement::execute(String*, bool) (sql_prepare.cc:3766)
==4535==    by 0x5FBA92: Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) (sql_prepare.cc:3419)
==4535==    by 0x5FBF45: mysqld_stmt_execute(THD*, char*, unsigned int) (sql_prepare.cc:2561)
==4535==    by 0x5E6B89: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1030)
==4535==    by 0x5E82B6: do_command(THD*) (sql_parse.cc:815)
==4535==    by 0x6B9FC5: do_handle_one_connection(THD*) (sql_connect.cc:748)

How to repeat:
http://pb2.norway.sun.com/?template=show_pushes&branch=mysql-trunk-innodb-pb2

Looks like a bogus warning. Since we call "page_type = fil_page_get_type(frame)" to initialize page_type before passing to i_s_innodb_set_page_type().

However, to eliminate this bogus warning, we can add one additiona initialize "page_type = I_S_PAGE_TYPE_UNKNOWN", this makes all related valgrind warning disappear.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/130164

3475 Jimmy Yang	2011-02-01
      Fix Bug #59876 Valgrind warning in i_s_innodb_set_page_type()

This seems to indicate a real bug. This block in the function i_s_innodb_buffer_page_get_info() is bogus, because it is reading blocks that are not allocated for file pages:

	} else if (page_info->page_state == BUF_BLOCK_MEMORY) {
		const byte*	frame;
		const buf_block_t*block;
		ulint		page_type;

		block = reinterpret_cast<const buf_block_t*>(bpage);

		frame = block->frame;

		page_type = fil_page_get_type(frame);

		i_s_innodb_set_page_type(page_info, page_type, frame);

There are many uses of BUF_BLOCK_MEMORY blocks. Only one of them is buf0buddy.c, which uses the UNIV_PAGE_SIZE blocks as backing store. If the beginning of a UNIV_PAGE_SIZE block happened to be allocated for a compressed page frame by buf0buddy.c, this would be correct. In all other cases, this is entirely bogus. For accessing information about the compressed blocks in the buffer pool, there is i_s_innodb_fill_buffer_lru().

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/130171

3475 Jimmy Yang	2011-02-01
      Fix Bug #59876 Valgrind warning in i_s_innodb_set_page_type()

Marko's point is that we should not look into the block frame if page state is BUF_BLOCK_MEMORY, as it could contain junk. The original idea for this block is to check some compressed page such as compress BLOB. The suggstion is that for compressed page info, user would look into "innodb_buf_page_lru" table.

OK to push the removal of the else if () block, as in http://lists.mysql.com/commits/130171. The extra initialization of page_type is unnecessary and should not have any effect on Valgrind warnings.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/130175

3475 Jimmy Yang	2011-02-01
      Fix Bug #59876 Valgrind warning in i_s_innodb_set_page_type()

Pushed into mysql-trunk 5.6.2 (revid:vasil.dimov@oracle.com-20110208173442-ocy58fdcuew3xvex) (version source revid:vasil.dimov@oracle.com-20110208173331-fu0j2s14jbg915zu) (merge vers: 5.6.2) (pib:24)