mirror of
https://github.com/MariaDB/server.git
synced 2025-01-18 13:02:28 +01:00
318096074e
There was a race condition in the rollback of TRX_UNDO_UPD_DEL_REC. Once row_undo_mod_clust() has rolled back the changes by the rolling-back transaction, it attempts to purge the delete-marked record, if possible, in a separate mini-transaction. However, row_undo_mod_remove_clust_low() fails to check if the DB_TRX_ID of the record that it found after repositioning the cursor, is still the same. If it is not, it means that the record was purged and another record was inserted in its place. So, the rollback would have performed an incorrect purge, breaking the locking rules and causing corruption. The problem was found by creating a table that contains a unique secondary index and a primary key, and two threads running REPLACE with only one value for the unique column, so that the uniqueness constraint would be violated all the time, leading to statement rollback. This bug exists in all InnoDB versions (I checked MySQL 3.23.53). It has become easier to repeat in 5.5 and 5.6 thanks to scalability improvements and a dedicated purge thread. rb#3085 approved by Jimmy Yang |
||
|---|---|---|
| .. | ||
| row0ins.c | ||
| row0mysql.c | ||
| row0purge.c | ||
| row0row.c | ||
| row0sel.c | ||
| row0uins.c | ||
| row0umod.c | ||
| row0undo.c | ||
| row0upd.c | ||
| row0vers.c | ||