handle_fatal_signal in ha_partition::clone (sql/ha_partition.cc:3412)

command to reproduce:

bash -c "set -o pipefail; perl runall.pl --queries=100000000 --seed=3 --duration=300 --querytimeout=60 --short_column_names --reporter=Shutdown,Backtrace,QueryTimeout,ErrorLog,ErrorLogAlarm --mysqld=--log-output=none --mysqld=--sql_mode=ONLY_FULL_GROUP_BY --grammar=conf/percona_qa/5.6/5.6.yy --gendata=conf/percona_qa/5.6/5.6.zz --basedir=/sdd/Percona-Server-5.6.11-rc60.3-387.Linux.x86_64 --threads=25 --mask-level=1 --notnull --validator=Transformer --mysqld=--thread_handling=pool-of-threads --mysqld=--innodb_log_file_size=1048576 --mysqld=--innodb_log_files_in_group=2 --mysqld=--innodb_log_buffer_size=1048576 --mysqld=--innodb_log_block_size=512 --mysqld=--innodb_fast_shutdown=2 --mysqld=--innodb_log_group_home_dir=/sdd/223308/_epoch/1371735977789416680 --mysqld=--innodb_use_global_flush_log_at_trx_commit=0 --mysqld=--userstat --mysqld=--innodb_flush_method=O_DSYNC --mtr-build-thread=747 --mask=36130 --vardir1=/sdd/223308/cmdrun_124 > /sdd/223308/cmdrun124.log 2>&1"

See bug 1193308

Temp table in the crashing thread is belongs to Thread 77. This should be enough for a DEBUG_SYNC testcase and fix. Not a duplicate of bug 1193308, but indeed similar.

Thread 77 (Thread 0x7fe73f535700 (LWP 12875)):
+bt
#0 0x00007fe758901c0d in fsync () from /lib64/libpthread.so.0
#1 0x000000000093958d in os_file_fsync (file=131) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/os/os0file.cc:2285
#2 0x0000000000939639 in os_file_flush_func (file=<optimized out>) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/os/os0file.cc:2386
#3 0x0000000000a383a4 in pfs_os_file_flush_func (file=131, src_line=3440, src_file=0xc013f0 "/bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/fil/fil0fil.cc") at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/include/os0file.ic:355
#4 0x0000000000a43cf0 in fil_create_new_single_table_tablespace (space_id=69, tablename=0x7fe6c40089c0 "query112928/#sql-ib70", dir_path=<optimized out>, flags=0, flags2=<optimized out>, size=4) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/fil/fil0fil.cc:3440
#5 0x0000000000a15ba3 in dict_build_table_def_step (thr=0x7fe6c40224e0, node=0x7fe6c403bc68) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/dict/dict0crea.cc:306
#6 0x0000000000a161db in dict_create_table_step (thr=0x7fe6c40224e0) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/dict/dict0crea.cc:1030
#7 0x000000000095acdd in que_thr_step (thr=0x7fe6c40224e0) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/que/que0que.cc:1123
#8 que_run_threads_low (thr=0x7fe6c40224e0) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/que/que0que.cc:1177
#9 que_run_threads (thr=0x7fe6c40224e0) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/que/que0que.cc:1218
#10 0x000000000098357c in row_create_table_for_mysql (table=0x7fe6c40107a8, trx=0x7fe6c4020bb0, commit=false) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/row/row0mysql.cc:2263
#11 0x00000000008fe413 in prepare_inplace_alter_table_dict (ha_alter_info=0x7fe73f532ca0, altered_table=0x7fe6c4010ae0, old_table=0x7fe62800e390, table_name=0x7fe62800834c "t1", flags=1, flags2=16, fts_doc_id_col=18446744073709551615, add_fts_doc_id=false, add_fts_doc_id_idx=<optimized out>) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/handler/handler0alter.cc:2812
#12 0x000000000090031f in ha_innobase::prepare_inplace_alter_table (this=<optimized out>, altered_table=<optimized out>, ha_alter_info=<optimized out>) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/storage/innobase/handler/handler0alter.cc:3821
#13 0x0000000000b09e1a in ha_partition::prepare_inplace_alter_table (this=0x7fe62800ec80, altered_table=0x7fe6c4010ae0, ha_alter_info=0x7fe73f532ca0) at /bzr/5.6_opt/Percona-Server-5.6.11-rc60.3/sql/ha_partition.cc:7950
#14 0x000000000072eba5 in mysql_inplace_alter_table (thd=0x1c609f0, table_list=0x7fe628004da0, table=0x7fe62800e390, altered_table=0x7fe6c4010ae0, ha_alter_info=0x7fe73f532ca0, inplace_supported=HA_ALTER_INPLACE_NO_LOCK_AFTER_PREPARE, target_mdl_request=0x7fe73f532a10, alter_ctx=0x7fe73f5313f0) at /bzr/5.6_opt/Percona-Server-5.6.11-r...

Adding qablock; seeing this is a lot of runs

Added one more occurrence in #8-#10. Run details:

[roel@qaserver 209184]$ cat cmd414
ps -ef | grep 'cmdrun_414' | grep -v grep | awk '{print $2}' | xargs sudo kill -9
rm -Rf /ssd/209184/cmdrun_414
mkdir /ssd/209184/cmdrun_414
cd /ssd/randgen
bash -c "set -o pipefail; perl /ssd/randgen/runall.pl --queries=100000000 --seed=7272 --duration=300 --querytimeout=60 --reporter=Shutdown,Backtrace,QueryTimeout,ErrorLog,ErrorLogAlarm --mysqld=--log-output=none --mysqld=--sql_mode=ONLY_FULL_GROUP_BY --mysqld=--slow_query_log --mysqld=--userstat --threads=25 --basedir=/ssd/Percona-Server-5.6.12-rc60.4-405-debug.Linux.x86_64 --grammar=/tmp/976291/75.yy --gendata=/ssd/randgen/conf/replication/replication_single_engine_pk.zz --mtr-build-thread=769 --mask=19835 --vardir1=/ssd/209184/cmdrun_414 > /ssd/209184/cmdrun414.log 2>&1"

MTR testcase, almost identical to that of bug 1193308, but with partitioning specified:

# Test for bug 1193264 (handle_fatal_signal in ha_partition::clone (sql/ha_partition.cc:3412))

--source include/have_innodb.inc
--source include/have_debug_sync.inc

--disable_warnings
DROP TABLE IF EXISTS t1;
--enable_warnings

CREATE TABLE t1(a INT PRIMARY KEY, b INT, c INT) ENGINE=InnoDB PARTITION BY HASH(a) PARTITIONS 2;
INSERT INTO t1 VALUES (1, 1, 1);

SET DEBUG_SYNC= 'innodb_alter_commit_after_lock_table SIGNAL alter_ready WAIT_FOR i_s_completed';
send ALTER TABLE t1 DROP COLUMN c, ALGORITHM=INPLACE;

connect (conn2,localhost,root,,);
connection conn2;

SET DEBUG_SYNC= 'now WAIT_FOR alter_ready';
SELECT COUNT(*) FROM INFORMATION_SCHEMA.GLOBAL_TEMPORARY_TABLES;
SET DEBUG_SYNC= 'now SIGNAL i_s_completed';

disconnect conn2;
connection default;
reap;

DROP TABLE t1;

The cause is similar to bug 1193308. ha_partition::clone() dereferences NULL if this->table == NULL, which will happen for temp tables created for 5.6 ALTER.

Percona now uses JIRA for bug reports so this bug report is migrated to: https://jira.percona.com/browse/PS-681