Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-2636

LP:682597 - Crash in copy_fields() in maria-5.3-mwl89

    Details

    • Type: Bug
    • Status: Closed
    • Resolution: Not a Bug
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Labels:

      Description

      This not entirely realistic query:

      SELECT ( SELECT SUM( f1 ) FROM t1 WHERE alias1.f1 ) AS field1 ,
      MAX( alias1.f1 )
      FROM t3 AS alias1 LEFT JOIN t1 AS alias3 ON alias3.f4
      WHERE ( alias1.f3 ) IN ( SELECT f4 FROM t2 )
      GROUP BY field1 ;

      crashes in maria-5.3-mwl89 as follows. Maria-5.3 is not affected:

      #5 0x0832bdd5 in copy_fields (param=0xa432344) at sql_select.cc:17305
      #6 0x0832455a in end_send_group (join=0xa42d6b0, join_tab=0xa42cf08,
      end_of_records=false) at sql_select.cc:14287
      #7 0x08322150 in evaluate_join_record (join=0xa42d6b0, join_tab=0xa42cd48,
      error=0) at sql_select.cc:13332
      #8 0x08321adc in sub_select (join=0xa42d6b0, join_tab=0xa42cd48,
      end_of_records=false) at sql_select.cc:13138
      #9 0x08320ed8 in do_select (join=0xa42d6b0, fields=0xa432450, table=0x0,
      procedure=0x0) at sql_select.cc:12684
      #10 0x083071f5 in JOIN::exec (this=0xa42d6b0) at sql_select.cc:2340
      #11 0x08237f14 in subselect_single_select_engine::exec (this=0xa3ef278)
      at item_subselect.cc:2749
      #12 0x0823243b in Item_subselect::exec (this=0xa3ef1b0)
      at item_subselect.cc:552
      #13 0x08233446 in Item_singlerow_subselect::val_str (this=0xa3ef1b0,
      str=0xae8820c4) at item_subselect.cc:1009
      #14 0x081c80b0 in Item::send (this=0xa3ef1b0, protocol=0xa39d3f8,
      buffer=0xae8820c4) at item.cc:5722
      #15 0x0826a8c8 in select_send::send_data (this=0xa3f0640, items=...)
      at sql_class.cc:1876
      #16 0x0831717f in return_zero_rows (join=0xa426848, result=0xa3f0640,
      tables=0xa3ef488, fields=..., send_row=true, select_options=2147764736,
      info=0x88a2b1c "Impossible WHERE noticed after reading const tables",
      having=0x0) at sql_select.cc:8359
      #17 0x083050a6 in JOIN::exec (this=0xa426848) at sql_select.cc:1838
      #18 0x08307961 in mysql_select (thd=0xa39d0e8, rref_pointer_array=0xa39eb64,
      tables=0xa3ef488, wild_num=0, fields=..., conds=0xa3f03e0, og_num=1,
      order=0x0, group=0xa3f05a0, having=0x0, proc_param=0x0,
      select_options=2147764736, result=0xa3f0640, unit=0xa39e7c4,
      select_lex=0xa39ea60) at sql_select.cc:2550
      #19 0x0830004d in handle_select (thd=0xa39d0e8, lex=0xa39e768,
      result=0xa3f0640, setup_tables_done_option=0) at sql_select.cc:281
      #20 0x0829d91b in execute_sqlcom_select (thd=0xa39d0e8, all_tables=0xa3ef488)
      at sql_parse.cc:5102
      #21 0x08294423 in mysql_execute_command (thd=0xa39d0e8) at sql_parse.cc:2281
      #22 0x0829feac in mysql_parse (thd=0xa39d0e8,
      rawbuf=0xa3ee6d0 "SELECT ( SELECT SUM( f1 ) FROM t1 WHERE alias1.f1 ) AS fie ld1 ,\nMAX( alias1.f1 ) \nFROM t3 AS alias1 LEFT JOIN t1 AS alias3 ON alias3.f4\ nWHERE ( alias1.f3 ) IN ( SELECT f4 FROM t2 )\nGROUP BY field1", length=197,
      found_semicolon=0xae883228) at sql_parse.cc:6109
      #23 0x08291f0c in dispatch_command (command=COM_QUERY, thd=0xa39d0e8,
      packet=0xa3b5789 "", packet_length=198) at sql_parse.cc:1209
      #24 0x08291376 in do_command (thd=0xa39d0e8) at sql_parse.cc:902
      #25 0x0828e454 in handle_one_connection (arg=0xa39d0e8) at sql_connect.cc:1154
      #26 0x00bea919 in start_thread () from /lib/libpthread.so.0
      #27 0x00b2ccbe in clone () from /lib/libc.so.6

      Explain in maria-5.3:

      id select_type table type possible_keys key key_len ref rows Extra
      1 PRIMARY NULL NULL NULL NULL NULL NULL NULL Impossible WHERE noticed after reading const tables
      3 DEPENDENT SUBQUERY NULL NULL NULL NULL NULL NULL NULL Impossible WHERE noticed after reading const tables
      2 DEPENDENT SUBQUERY t1 ALL NULL NULL NULL NULL 2

      expain in maria-5.3-mwl89:
      id select_type table type possible_keys key key_len ref rows Extra
      1 PRIMARY alias1 system NULL NULL NULL NULL 1
      1 PRIMARY alias3 ALL NULL NULL NULL NULL 2 Using where
      3 DEPENDENT SUBQUERY NULL NULL NULL NULL NULL NULL NULL Impossible WHERE noticed after reading const tables
      2 DEPENDENT SUBQUERY t1 ALL NULL NULL NULL NULL 2

        Gliffy Diagrams

          Attachments

            Activity

            Hide
            philipstoev Philip Stoev added a comment -

            Re: Crash in copy_fields() in maria-5.3-mwl89
            Test case. The default optimizer_switch is also sufficient to reproduce the bug:

            SET SESSION optimizer_switch = 'materialization=off,in_to_exists=on,semijoin=off,subquery_cache=off';

            CREATE TABLE t2 (f4 int) ;

            CREATE TABLE t1 (f1 int,f4 int) ;
            INSERT IGNORE INTO t1 VALUES (5,0),(NULL,0);

            CREATE TABLE t3 (f1 int,f3 int,f4 int) ;
            INSERT IGNORE INTO t3 VALUES (8,NULL,NULL);

            SELECT ( SELECT SUM( f1 ) FROM t1 WHERE alias1.f1 ) AS field1 ,
            MAX( alias1.f1 )
            FROM t3 AS alias1 LEFT JOIN t1 AS alias3 ON alias3.f4
            WHERE ( alias1.f3 ) IN ( SELECT f4 FROM t2 )
            GROUP BY field1 ;

            Show
            philipstoev Philip Stoev added a comment - Re: Crash in copy_fields() in maria-5.3-mwl89 Test case. The default optimizer_switch is also sufficient to reproduce the bug: SET SESSION optimizer_switch = 'materialization=off,in_to_exists=on,semijoin=off,subquery_cache=off'; CREATE TABLE t2 (f4 int) ; CREATE TABLE t1 (f1 int,f4 int) ; INSERT IGNORE INTO t1 VALUES (5,0),(NULL,0); CREATE TABLE t3 (f1 int,f3 int,f4 int) ; INSERT IGNORE INTO t3 VALUES (8,NULL,NULL); SELECT ( SELECT SUM( f1 ) FROM t1 WHERE alias1.f1 ) AS field1 , MAX( alias1.f1 ) FROM t3 AS alias1 LEFT JOIN t1 AS alias3 ON alias3.f4 WHERE ( alias1.f3 ) IN ( SELECT f4 FROM t2 ) GROUP BY field1 ;
            Hide
            philipstoev Philip Stoev added a comment -

            Re: Crash in copy_fields() in maria-5.3-mwl89
            See also bug 608834 (fixed and pushed previously)

            Show
            philipstoev Philip Stoev added a comment - Re: Crash in copy_fields() in maria-5.3-mwl89 See also bug 608834 (fixed and pushed previously)
            Hide
            timour Timour Katchaounov added a comment -

            Re: Crash in copy_fields() in maria-5.3-mwl89
            Not repeatable in the latest 5.3-mwl89.

            Show
            timour Timour Katchaounov added a comment - Re: Crash in copy_fields() in maria-5.3-mwl89 Not repeatable in the latest 5.3-mwl89.
            Hide
            timour Timour Katchaounov added a comment -

            Re: Crash in copy_fields() in maria-5.3-mwl89
            More precisely, not repeatable with 5.3-mwl89 with the following tip:

            revno: 2851
            committer: timour@askmonty.org
            branch nick: 5.3-mwl89-bugfix
            timestamp: Fri 2010-11-26 17:40:20 +0200
            message:
            Fix LP BUG#680846

            Show
            timour Timour Katchaounov added a comment - Re: Crash in copy_fields() in maria-5.3-mwl89 More precisely, not repeatable with 5.3-mwl89 with the following tip: revno: 2851 committer: timour@askmonty.org branch nick: 5.3-mwl89-bugfix timestamp: Fri 2010-11-26 17:40:20 +0200 message: Fix LP BUG#680846
            Hide
            ratzpo Rasmus Johansson added a comment -

            Launchpad bug id: 682597

            Show
            ratzpo Rasmus Johansson added a comment - Launchpad bug id: 682597

              People

              • Assignee:
                timour Timour Katchaounov
                Reporter:
                philipstoev Philip Stoev
              • Votes:
                0 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: