mysql bug 一则

背景：

    上午9点刚过，运维就打过来电话，说是生产数据库崩了，要求支援，于是马上到现场，了解情况。

现象：

    01:26:52 UTC - mysqld got signal 11 ;

Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware.
Thread pointer: 0x7fc401a5f2a0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7fc417ef6d80 thread_stack 0x40000
/u01/mysql/app/mysql8.0/bin/mysqld(my_print_stacktrace(unsigned char const*, unsigned long)+0x2e) [0x1ed6cce]
/u01/mysql/app/mysql8.0/bin/mysqld(handle_fatal_signal+0x323) [0xfb2d23]
/lib64/libpthread.so.0(+0xf5f0) [0x7fc95b3f25f0]
/u01/mysql/app/mysql8.0/bin/mysqld(temptable::Handler::index_next_conditional(unsigned char*, temptable::Handler::NextCondition)+0xc8) [0x2432528]
/u01/mysql/app/mysql8.0/bin/mysqld(handler::ha_index_next(unsigned char*)+0x1cf) [0x10bd71f]
/u01/mysql/app/mysql8.0/bin/mysqld(IndexScanIterator<false>::Read()+0x4d) [0xdda02d]
/u01/mysql/app/mysql8.0/bin/mysqld(AggregateIterator::Read()+0x14b) [0x106d9cb]
/u01/mysql/app/mysql8.0/bin/mysqld(SELECT_LEX_UNIT::ExecuteIteratorQuery(THD*)+0x2cb) [0xf412cb]
/u01/mysql/app/mysql8.0/bin/mysqld(subselect_hash_sj_engine::exec(THD*)+0x110) [0x11adcd0]
/u01/mysql/app/mysql8.0/bin/mysqld(Item_subselect::exec(THD*)+0x185) [0x11a4f65]
/u01/mysql/app/mysql8.0/bin/mysqld(Item_in_subselect::val_bool_naked()+0x3c) [0x11a68bc]
/u01/mysql/app/mysql8.0/bin/mysqld(Item_in_optimizer::val_int()+0x168) [0x11078d8]
/u01/mysql/app/mysql8.0/bin/mysqld(Item::val_bool()+0xa4) [0x10eace4]
/u01/mysql/app/mysql8.0/bin/mysqld(Item_cond_and::val_int()+0x3a) [0x1104c9a]
/u01/mysql/app/mysql8.0/bin/mysqld(FilterIterator::Read()+0x28) [0x106cfc8]
/u01/mysql/app/mysql8.0/bin/mysqld(SELECT_LEX_UNIT::ExecuteIteratorQuery(THD*)+0x2cb) [0xf412cb]
/u01/mysql/app/mysql8.0/bin/mysqld(SELECT_LEX_UNIT::execute(THD*)+0xf9) [0xf43489]
/u01/mysql/app/mysql8.0/bin/mysqld(Sql_cmd_dml::execute_inner(THD*)+0x20b) [0xed0d4b]
/u01/mysql/app/mysql8.0/bin/mysqld(Sql_cmd_dml::execute(THD*)+0x3e8) [0xed98b8]
/u01/mysql/app/mysql8.0/bin/mysqld(mysql_execute_command(THD*, bool)+0x3af7) [0xe8cb77]
/u01/mysql/app/mysql8.0/bin/mysqld(mysql_parse(THD*, Parser_state*)+0x327) [0xe8e8b7]
/u01/mysql/app/mysql8.0/bin/mysqld(dispatch_command(THD*, COM_DATA const*, enum_server_command)+0x2474) [0xe91244]
/u01/mysql/app/mysql8.0/bin/mysqld(do_command(THD*)+0x174) [0xe91cb4]
/u01/mysql/app/mysql8.0/bin/mysqld() [0xfa4c78]
/u01/mysql/app/mysql8.0/bin/mysqld() [0x23b04ac]
/lib64/libpthread.so.0(+0x7e65) [0x7fc95b3eae65]
/lib64/libc.so.6(clone+0x6d) [0x7fc95957a88d]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (7fc401357f88): is an invalid pointer
Connection ID (thread ID): 1649106
Status: NOT_KILLED

MySQL架构是一主一从的架构，过程如下：

1、09:26:52触发bug，导致数据库重启，诱发主从切换。

2、10s主从切换成功

3、从库在09:27:03触发相同的bug，导致从库也重启

4、由于短时间内频繁发生切换，orch不再主导切换过程，导致两个库是独立的，且都是只读的

进展：

搜索到官方类似的bug说明：https://github.com/mysql/mysql-server/commit/f462d0d2802dfd2ee7057c99e967c428bd046c69

但是根据官方的例子，并没有在8.0.18-9这个版本复现成功。有待进一步排查和复现。各位如果遇到相同的bug，可以相互交流。