Hi!

I was able to repeat this in our computer. mysqld crashes inside the MySQL
code. It did not crash if the primary key length was < 500 bytes. This looks
like a memory overrun bug. I have forwarded this bug report for Monty to check.

Regards,

Heikki Tuuri
Innobase Oy
---
Order commercial MySQL/InnoDB support at https://order.mysql.com/
See http://www.innodb.com for the online manual and latest news on InnoDB


(gdb) bt full
#0  0x81ea196 in free_root (root=0xbe7ff614, MyFlags=0) at my_alloc.c:117
        root = (MEM_ROOT *) 0xbe7ff614
        MyFlags = 538976288
        next = (USED_MEM *) 0x20202020
        old = (USED_MEM *) 0x20202020
#1  0x80ff07b in SQL_SELECT::test_quick_select (this=0x83461c0, keys_to_use=1,
    prev_tables=0, limit=4294967295, force_quick_range=false)
    at opt_range.cc:728
        old_root = (MEM_ROOT *) 0x83510e4
        alloc = {free = 0x20202020, used = 0x20202020, pre_alloc = 0x0,
  min_malloc = 32, block_size = 2020,
  error_handler = 0x80ad2d0 <sql_alloc_error_handler>}
        tree = (SEL_TREE *) 0x8358358
        key_parts = (KEY_PART *) 0x83461c0
        param = {baseflag = 836807799, keys = 1, max_key_part = 2,
  prev_tables = 0, read_tables = 0, current_table = 1, table = 0x8347d70,
  quick = false, key_parts = 0x8358330, key_parts_end = 0x8358354, key = {
    0x8358330, 0x72660034, 0x823006d, 0x40047652, 0xbe7ff5cc, 0x0, 0xbe7fef74,
    0x40047652, 0xbe7ff5dc, 0x1, 0xbe7ff5e4, 0x400428be, 0x40225828, 0x0,
    0xbe7ff5f4, 0x400474bc, 0x40225828, 0x0, 0xbe7ff594, 0x4016198f,
    0xbe7ff19c, 0x0, 0x0, 0x4015d4f7, 0x40225828, 0xbe7ff6f4, 0xbe7ff5f4, 0x0,
    0x0, 0x0, 0x0, 0x0}, real_keynr = {0, 0, 3196055540, 1075310637,
    1075992616, 3196055972, 3196055540, 1075312407, 3196055612, 3196055536,
    3196055556, 1075313717, 3196055636, 3196055972, 3263164835, 0, 1075992616,
    3196055972, 3196055796, 1075274402, 3196055636, 136533345, 3196055872,
    1075274385, 3196055636, 3196055972, 4294967295, 3196055972, 1075992616,
    137649624, 137694480, 1074033421},
  min_key = "foo", ' ' <repeats 252 times>, "bar", ' ' <repeats 252 times>, "baz
", ' ' <repeats 243 times>,
  max_key = ' ' <repeats 255 times>, "bar", ' ' <repeats 252 times>, "baz", ' '
<repeats 243 times>}
        limit = 137650624
        basflag = 3196057108
        idx = 1
        scan_time = 9.1245819032751532e-313
#2  0x80efda2 in mysql_delete (thd=0x8350d10, table_list=0x8345dd8,
    conds=0x8346148, limit=4294967295, lock_type=TL_WRITE, options=0)
    at opt_range.h:99
        thd = (THD *) 0x1
        error = 0
        table = (TABLE *) 0x83461c0
        select = (SQL_SELECT *) 0x83461c0
        info = {table = 0x8350d1c, file = 0x8341c50, forms = 0x40225828,
  read_record = 0x4005249c <__DTOR_END__+4>, thd = 0x4, select = 0xd,
  cache_records = 136259779, ref_length = 2, struct_length = 3196057380,
  reclength = 0, rec_cache_size = 136259766, error_offset = 2050,
  index = 1076010228,
  ref_pos = 0xbe7ff724 "$�\177��\177\f\b\020\r5\b�]4\bHa4\b����\n",
  record = 0x81f2445 "\211F\b\203��Vh@�(\b�����\203�\020\200�\177���",
---Type <return> to continue, or q <return> to quit---
  cache = 0x8350d10 "P`(\bT`(\b G(\b�\0245\b\r", cache_pos = 0x8350e2c "\001",
  cache_end = 0x3 <Address 0x3 out of bounds>,
  read_positions = 0x4004730d "[\201�\217�", io_cache = 0x8350d10,
  print_error = 44}
        using_limit = false
        use_generate_table = 20
        using_transactions = 20
        deleted = 3196057460
#3  0x80c7ffc in mysql_execute_command () at sql_parse.cc:1644
        res = 0
        thd = (THD *) 0x8350d10
        lex = (LEX *) 0x8350e2c
        tables = (TABLE_LIST *) 0x8345dd8
#4  0x80cab28 in mysql_parse (thd=0x8350d10,
    inBuf=0x8345d68 "delete from chump4 where f1 = 'foo' and f2 = 'bar' and f3 =
 'baz'", length=65) at sql_parse.cc:2339
        thd = (THD *) 0x8350d10
        inBuf = 0x8352ff0 "\230<\"@"
        length = 538976288
        lex = (LEX *) 0x8350e2c
#5  0x80c5b64 in do_command (thd=0x8350d10) at sql_parse.cc:834
        pos = 0x8352ff0 "\230<\"@"
        packet = 0x8341c50 "\003delete from chump4 where f1 = 'foo' and f2 = 'ba
r' and f3 = 'baz'"
        old_timeout = 16384
        packet_length = 66
        error = false
        net = (NET *) 0x8350d1c
        command = COM_QUERY
        slow_command = false
        start_of_query = 16384
#6  0x80c4f17 in handle_one_connection (arg=0x8350d10) at sql_parse.cc:554
        error = 538976288
        net = (NET *) 0x8350d1c
        arg = (void *) 0x20202020
        thd = (THD *) 0x8350d10
        set = {__val = {0 <repeats 32 times>}}
#7  0x40043ba3 in pthread_start_thread () from /lib/libpthread.so.0
No symbol table info available.
#8  0x4004466e in pthread_start_thread_event () from /lib/libpthread.so.0
No symbol table info available.
(gdb) frame 1
#1  0x80ff07b in SQL_SELECT::test_quick_select (this=0x83461c0, keys_to_use=1,
    prev_tables=0, limit=4294967295, force_quick_range=false)
    at opt_range.cc:728
728         free_root(&alloc,MYF(0));                   // Return memory & alloc
ator
Current language:  auto; currently c++
(gdb) list
723                 quick->read_time=read_time;
724               }
725             }
726           }
727         }
728         free_root(&alloc,MYF(0));                   // Return memory & alloc
ator
729         my_pthread_setspecific_ptr(THR_MALLOC,old_root);
730         current_thd->no_errors=0;
731       }
732       DBUG_EXECUTE("info",print_quick(quick,needed_reg););
(gdb) frame 1
#1  0x80ff07b in SQL_SELECT::test_quick_select (this=0x83461c0, keys_to_use=1,
    prev_tables=0, limit=4294967295, force_quick_range=false)
    at opt_range.cc:728
728         free_root(&alloc,MYF(0));                   // Return memory & alloc
ator
(gdb) list
723                 quick->read_time=read_time;
724               }
725             }
726           }
727         }
728         free_root(&alloc,MYF(0));                   // Return memory & alloc
ator
729         my_pthread_setspecific_ptr(THR_MALLOC,old_root);
730         current_thd->no_errors=0;
731       }
732       DBUG_EXECUTE("info",print_quick(quick,needed_reg););
(gdb) frame 0
#0  0x81ea196 in free_root (root=0xbe7ff614, MyFlags=0) at my_alloc.c:117
117         old=next; next= next->next ;
Current language:  auto; currently c
(gdb) list
112       if (!(MyFlags & MY_KEEP_PREALLOC))
113         root->pre_alloc=0;
114
115       for ( next=root->used; next ;)
116       {
117         old=next; next= next->next ;
118         if (old != root->pre_alloc)
119           my_free((gptr) old,MYF(0));
120       }
121       for (next= root->free ; next ; )
(gdb)

>>Description:
>       It is possible to create an InnoDB table that has a composite primary key 
>        longer than 500 characters.  Trying to delete from this table 
>        specifying all fields of the PK causes mysqld to crash.  
>>How-To-Repeat:
>       mysql> create table chump (
>           -> f1 varchar(255) not null,
>           -> f2 varchar(255) not null,
>           -> f3 varchar(255) not null,
>           -> primary key (f1, f2, f3)
>           -> ) type=innodb;
>       Query OK, 0 rows affected (0.44 sec)
>       mysql> delete from chump where f1 = 'foo' and f2 = 'bar' and f3 = 'baz';
>       ERROR 2013: Lost connection to MySQL server during query
>
>       /var/lib/mysql/xxx.err reports:
>
>               mysqld got signal 11;
>               This could be because you hit a bug. It is also possible that this 
>binary
>               or one of the libraries it was linked agaist is corrupt, improperly 
>built,
>               or misconfigured. This error can also be caused by malfunctioning 
>hardware.
>               We will try our best to scrape up some info that will hopefully help 
>diagnose
>               the problem, but since we have already crashed, something is 
>definitely wrong
>               and this may fail
>               
>               key_buffer_size=8388600
>               record_buffer=131072
>               sort_buffer=2097144
>               max_used_connections=4
>               max_connections=100
>               threads_connected=4
>               It is possible that mysqld could use up to 
>               key_buffer_size + (record_buffer + sort_buffer)*max_connections = 
>225791 K
>               bytes of memory
>               Hope that's ok, if not, decrease some variables in the equation
>               
>               Attempting backtrace. You can use the following information to find out
>               where mysqld died. If you see no messages after this, something went
>               terribly wrong...
>               Stack range sanity check OK, backtrace follows:
>               0x80bfe74
>               0x4002f4c7
>               0x827e98a
>               0x80fe4d3
>               0x80ef6f2
>               0x80c81f6
>               0x80caca8
>               0x80c5e54
>               0x80c5227
>               Stack trace seems successful - bottom reached
>               Please read http://www.mysql.com/doc/U/s/Using_stack_trace.html and
follow instructions 
>on how to resolve the stack trace. Resolved
>               stack trace is much more helpful in diagnosing the problem, so please 
>do 
>               resolve it
>               Trying to get some variables.
>               Some pointers may be invalid and cause the dump to abort...
>               thd->query at 0x83da8c0 = delete from chump where f1 = 'foo' and f2 =
'bar' and 
>f3 = 'baz'
>               thd->thread_id=2
>               
>               Successfully dumped variables, if you ran with --log, take a look at 
>the
>               details of what thread 2 did to cause the crash.  In some cases of 
>really
>               bad corruption, the values shown above may be invalid
>               
>               The manual page at http://www.mysql.com/doc/C/r/Crashing.html contains
>               information that should help you find out what is causing the crash
>               
>               Number of processes running now: 0
>               011221 15:03:28  mysqld restarted
>               InnoDB: Database was not shut down normally.
>               InnoDB: Starting recovery from log files...
>               InnoDB: Starting log scan based on checkpoint at
>               InnoDB: log sequence number 0 10556554
>               011221 15:03:30  InnoDB: Started
>               /usr/local/mysql/libexec/mysqld: ready for connections
>>Fix:
>       Shorten PK to <= 500 chars.
>
>>Submitter-Id: <submitter ID>
>>Originator:   
>>Organization:
>CodeIt Computing
>>MySQL support: [none | licence | email support | extended email support ]
>>Synopsis:     deleting from an InnoDB table with a composite PK > 500 chars
crashes 
>mysqld
>>Severity:     
>>Priority:     
>>Category:     mysql
>>Class:                
>>Release:      mysql-3.23.46 (Source distribution)
>
>>Environment:
>       
>System: Linux dev2.codeit.com 2.2.16-22enterprise #1 SMP Tue Aug 22
16:29:32 EDT 
>2000 i686 unknown
>Architecture: i686
>
>Some paths:  /usr/bin/perl /usr/bin/make /usr/bin/gmake /usr/bin/gcc
/usr/bin/cc
>GCC: Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/2.96/specs
>gcc version 2.96 20000731 (Red Hat Linux 7.1 2.96-85)
>Compilation info: CC='gcc'  CFLAGS=''  CXX='c++'  CXXFLAGS=''  LDFLAGS=''
>LIBC: 
>lrwxrwxrwx    1 root     root           13 Dec 18 10:03 /lib/libc.so.6 ->
libc-2.2.4.so
>-rwxr-xr-x    1 root     root      5725295 Dec  8 07:04 /lib/libc-2.2.4.so
>-rw-r--r--    1 root     root     27315960 Dec  8 07:02 /usr/lib/libc.a
>-rw-r--r--    1 root     root          178 Dec  8 07:02 /usr/lib/libc.so
>lrwxrwxrwx    1 root     root           10 Apr 10  2001
/usr/lib/libc-client.a -> 
>c-client.a
>Configure command: ./configure  --prefix=/usr/local/mysql
--with-berkeley-db --with-innodb
>
>



---------------------------------------------------------------------
Before posting, please check:
   http://www.mysql.com/manual.php   (the manual)
   http://lists.mysql.com/           (the list archive)

To request this thread, e-mail <[EMAIL PROTECTED]>
To unsubscribe, e-mail <[EMAIL PROTECTED]>
Trouble unsubscribing? Try: http://lists.mysql.com/php/unsubscribe.php

Reply via email to