Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-3398

LP:777745 - Crash in Field::eq in maria-5.3 and NOT NULL fields

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Labels:

      Description

      Not repeatable in maria-5.2. The following query:

      SELECT * FROM t1 LEFT JOIN v2 ON t1.f10 != 0 WHERE v2.f1 = v2.f3 AND v2.f1 = 68 AND v2.f1 IS NULL

      crashes as follows:

      #3 0x08289e44 in handle_segfault (sig=11) at mysqld.cc:2774
      #4 <signal handler called>
      #5 0x082698f6 in Field::eq (this=0xae61ae60, field=0x8f8f8f00) at field.h:236
      #6 0x0820f900 in Item_equal::contains (this=0xae623a00, field=0xae61ae60) at item_cmpfunc.cc:5652
      #7 0x081ccb68 in Item_field::find_item_equal (this=0xae613550, cond_equal=0xae623908) at item.cc:4658
      #8 0x081ccd9f in Item_field::equal_fields_propagator (this=0xae613550, arg=0xae623908 ":\314w\b") at item.cc:4767
      #9 0x081d939c in Item::compile (this=0xae613550, analyzer=&virtual Item::subst_argument_checker(uchar**), arg_p=0xae99ee20,
      transformer=&virtual Item::equal_fields_propagator(uchar*), arg_t=0xae623908 ":\314w\b") at item.h:951
      #10 0x081eb195 in Item_func::compile (this=0xae613660, analyzer=&virtual table offset 336, arg_p=0xae99ee8c, transformer=&virtual table offset 344,
      arg_t=0xae623908 ":\314w\b") at item_func.cc:382
      #11 0x0832082e in build_equal_items_for_cond (thd=0xb101da8, cond=0xae613660, inherited=0xae623908) at sql_select.cc:9796
      #12 0x08320433 in build_equal_items_for_cond (thd=0xb101da8, cond=0xae623870, inherited=0xae623908) at sql_select.cc:9713
      #13 0x083208a5 in build_equal_items (thd=0xb101da8, cond=0xae623870, inherited=0x0, join_list=0xb103808, cond_equal_ref=0xae62a30c) at sql_select.cc:9878
      #14 0x083233f1 in optimize_cond (join=0xae625140, conds=0xae623870, join_list=0xb103808, cond_value=0xae62a27c, cond_equal=0xae62a30c) at sql_select.cc:11256
      #15 0x08309d7c in JOIN::optimize (this=0xae625140) at sql_select.cc:855
      #16 0x0830fd2d in mysql_select (thd=0xb101da8, rref_pointer_array=0xb103848, tables=0xae6130c8, wild_num=1, fields=..., conds=0xae613e58, og_num=0,
      order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xae614e88, unit=0xb1034a8, select_lex=0xb103744)
      at sql_select.cc:2687
      #17 0x0830860f in handle_select (thd=0xb101da8, lex=0xb10344c, result=0xae614e88, setup_tables_done_option=0) at sql_select.cc:282
      #18 0x082a5954 in execute_sqlcom_select (thd=0xb101da8, all_tables=0xae6130c8) at sql_parse.cc:5094
      #19 0x0829c79e in mysql_execute_command (thd=0xb101da8) at sql_parse.cc:2239
      #20 0x082a7ef7 in mysql_parse (thd=0xb101da8,
      rawbuf=0xae612ee8 "SELECT * FROM t1 LEFT JOIN v2 ON t1.f10 != 0\nWHERE v2.f1 = v2.f3 AND v2.f1 = 68 AND v2.f1 IS NULL", length=98,
      found_semicolon=0xae9a0228) at sql_parse.cc:6094
      #21 0x0829a427 in dispatch_command (command=COM_QUERY, thd=0xb101da8,
      packet=0xb15c901 "SELECT * FROM t1 LEFT JOIN v2 ON t1.f10 != 0\nWHERE v2.f1 = v2.f3 AND v2.f1 = 68 AND v2.f1 IS NULL", packet_length=98)
      at sql_parse.cc:1215
      #22 0x08299885 in do_command (thd=0xb101da8) at sql_parse.cc:904
      #23 0x08296938 in handle_one_connection (arg=0xb101da8) at sql_connect.cc:1154
      #24 0x00821919 in start_thread () from /lib/libpthread.so.0
      #25 0x0076acce in clone () from /lib/libc.so.6

      test case:

      CREATE TABLE t1 ( f10 int NOT NULL ) ;
      INSERT IGNORE INTO t1 VALUES (2),(2);

      DROP TABLE IF EXISTS t2;
      CREATE TABLE t2 ( f1 int NOT NULL , f3 int NOT NULL ) ;
      INSERT INTO t2 VALUES (2,2),(2,2);
      CREATE OR REPLACE VIEW v2 AS SELECT * FROM t2;

      SELECT * FROM t1 LEFT JOIN v2 ON t1.f10 != 0 WHERE v2.f1 = v2.f3 AND v2.f1 = 68 AND v2.f1 IS NULL;

      bzr version-info
      revision-id: <email address hidden>
      date: 2011-05-04 18:08:44 -0700
      build-date: 2011-05-05 13:56:40 +0300
      revno: 2980
      branch-nick: maria-5.3

        Gliffy Diagrams

          Attachments

            Activity

            Hide
            philipstoev Philip Stoev added a comment -

            Re: Crash in Field::eq in maria-5.3
            Also observed without IS NULL

            Show
            philipstoev Philip Stoev added a comment - Re: Crash in Field::eq in maria-5.3 Also observed without IS NULL
            Hide
            ratzpo Rasmus Johansson added a comment -

            Launchpad bug id: 777745

            Show
            ratzpo Rasmus Johansson added a comment - Launchpad bug id: 777745

              People

              • Assignee:
                igor Igor Babaev
                Reporter:
                philipstoev Philip Stoev
              • Votes:
                0 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: