[Bugfix] Issue alibaba#45 Issue #577 InnoDB crash when master thread evict dict_table_t object

AliSQL · AliSQL · commit 58ebcbd5c899 · 2017-07-17T14:55:45.000+08:00
Problem
================
The innodb will crash when master thread wants to evict an unused object.
The backtrace:
  ut_ad(dict_index_is_clust(index))
  row_merge_drop_indexes
  dict_table_remove_from_cache_low
  dict_make_room_in_cache ()
  srv_master_evict_from_table_cache ()
  srv_master_do_idle_tasks ()
  srv_master_thread (arg=0x0)
  start_thread (arg=0x2b21c8200700)
  clone ()

Solution
================
The wrong position of judgement logic code about variable 'drop_aborted' in function
dict_table_close() may be the root cause.
We simply move this piece of codes prior to the decrement of
table-&gt;n_ref_count, thus aborted index will be discard when this table
is being closed.
diff --git a/mysql-test/suite/rds/r/bugfix_crash_dict_table_t_evict.result b/mysql-test/suite/rds/r/bugfix_crash_dict_table_t_evict.result
@@ -0,0 +1,25 @@
+set global table_definition_cache=400;
+set global table_open_cache= 1024;
+use test;
+create table t_bug(id int primary key, col1 int) engine=innodb;
+insert into t_bug values(1, 2);
+insert into t_bug values(2, 2);
+commit;
+alter table t_bug add unique key(col1);
+use test;
+select * from t_bug;
+id	col1
+1	2
+2	2
+insert into t_bug values(3, 2);
+commit;
+ERROR 23000: Duplicate entry '2' for key 'col1'
+select sleep(10);
+sleep(10)
+0
+flush tables;
+sleep(10)
+0
+set global table_definition_cache = default;
+set global table_open_cache = default;
+drop table t_bug;
diff --git a/mysql-test/suite/rds/t/bugfix_crash_dict_table_t_evict.test b/mysql-test/suite/rds/t/bugfix_crash_dict_table_t_evict.test
@@ -0,0 +1,61 @@
+connect(con1,localhost,root,,);
+connect(con2,localhost,root,,);
+
+connection con1;
+set global table_definition_cache=400;
+set global table_open_cache= 1024;
+
+use test;
+create table t_bug(id int primary key, col1 int) engine=innodb;
+insert into t_bug values(1, 2);
+insert into t_bug values(2, 2);
+commit;
+
+# table->n_ref_count has increased
+--send
+alter table t_bug add unique key(col1);
+
+connection con2;
+use test;
+select * from t_bug;
+
+insert into t_bug values(3, 2);
+commit;
+
+# So ALTER statement failed, left table->drop_abort=true;
+connection con1;
+--error 1062
+--reap
+
+disconnect con2;
+
+connection con1;
+select sleep(10);
+
+# Flush tables, so t_bug table can be evicted by master thread.
+flush tables;
+
+# Create 1000 tables, try the best to evict t_bug since table_def_size.
+--disable_query_log
+let $loop=1000;
+while($loop)
+{
+        eval create table t_$loop(id int)engine=innodb;
+            dec $loop;
+}
+
+select sleep(10);
+
+let $loop=1000;
+while($loop)
+{
+        eval drop table t_$loop;
+            dec $loop;
+}
+
+--enable_query_log
+set global table_definition_cache = default;
+set global table_open_cache = default;
+drop table t_bug;
+
+disconnect con1;
diff --git a/storage/innobase/dict/dict0dict.cc b/storage/innobase/dict/dict0dict.cc
@@ -564,13 +564,18 @@ dict_table_close(
 					indexes after an aborted online
 					index creation */
 {
+	ibool		drop_aborted;
 	if (!dict_locked) {
 		mutex_enter(&dict_sys->mutex);
 	}
 
 	ut_ad(mutex_own(&dict_sys->mutex));
 	ut_a(table->n_ref_count > 0);
 
+	drop_aborted = try_drop
+		&& table->drop_aborted
+		&& table->n_ref_count == 1
+		&& dict_table_get_first_index(table);
 	--table->n_ref_count;
 
 	/* Force persistent stats re-read upon next open of the table
@@ -599,12 +604,6 @@ dict_table_close(
 
 	if (!dict_locked) {
 		table_id_t	table_id	= table->id;
-		ibool		drop_aborted;
-
-		drop_aborted = try_drop
-			&& table->drop_aborted
-			&& table->n_ref_count == 1
-			&& dict_table_get_first_index(table);
 
 		mutex_exit(&dict_sys->mutex);
 
