Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-3682

LP:881318 - Crash in JOIN_CACHE::write_record_data with derived_merge + semijoin + innodb + nested views

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Labels:

      Description

      backtrace:

      #5 0x007b7836 in __memcpy_ssse3 () from /lib/libc.so.6
      #6 0x082f2381 in JOIN_CACHE::write_record_data (this=0x9b0439b8, link=0x0, is_full=0xa1571f1b) at sql_join_cache.cc:1421
      #7 0x082f2632 in JOIN_CACHE::put_record (this=0x9b0439b8) at sql_join_cache.cc:1530
      #8 0x0833daf8 in sub_select_cache (join=0xa162fe08, join_tab=0x9b042f1c, end_of_records=false) at sql_select.cc:14916
      #9 0x0833e8c9 in evaluate_null_complemented_join_record (join=0xa162fe08, join_tab=0x9b042d18) at sql_select.cc:15434
      #10 0x0833e05f in sub_select (join=0xa162fe08, join_tab=0x9b042b14, end_of_records=false) at sql_select.cc:15167
      #11 0x0833d709 in do_select (join=0xa162fe08, fields=0xa82bcdc, table=0x0, procedure=0x0) at sql_select.cc:14785
      #12 0x08321f61 in JOIN::exec (this=0xa162fe08) at sql_select.cc:2679
      #13 0x0832278e in mysql_select (thd=0xa82a208, rref_pointer_array=0xa82bd84, tables=0xa1613d70, wild_num=1, fields=..., conds=0xa1614ff8, og_num=0,
      order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xa162db70, unit=0xa82b968, select_lex=0xa82bc48)
      at sql_select.cc:2900
      #14 0x0831a55f in handle_select (thd=0xa82a208, lex=0xa82b90c, result=0xa162db70, setup_tables_done_option=0) at sql_select.cc:283
      #15 0x082b4d18 in execute_sqlcom_select (thd=0xa82a208, all_tables=0xa1613d70) at sql_parse.cc:5112
      #16 0x082abad5 in mysql_execute_command (thd=0xa82a208) at sql_parse.cc:2250
      #17 0x082b7347 in mysql_parse (thd=0xa82a208, rawbuf=0xa1613bb0 "SELECT *\nFROM t3\nLEFT JOIN v5\nON ( t3.a = v5.a )\nWHERE t3.b IN ( SELECT b FROM t4 )",
      length=83, found_semicolon=0xa1573228) at sql_parse.cc:6112
      #18 0x082a9724 in dispatch_command (command=COM_QUERY, thd=0xa82a208, packet=0xa8828d9 "", packet_length=83) at sql_parse.cc:1221
      #19 0x082a8b7f in do_command (thd=0xa82a208) at sql_parse.cc:916
      #20 0x082a5b63 in handle_one_connection (arg=0xa82a208) at sql_connect.cc:1191
      #21 0x00821919 in start_thread () from /lib/libpthread.so.0
      #22 0x0076acce in clone () from /lib/libc.so.6

      minimal switch: derived_merge=on,semijoin=on

      full switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=off,derived_merge=on,derived_with_keys=off,firstmatch=off,loosescan=off,materialization=off,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=off,semijoin_with_cache=off,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on

      explain:

      id select_type table type possible_keys key key_len ref rows Extra
      1 PRIMARY t3 system NULL NULL NULL NULL 1
      1 PRIMARY t1 ALL NULL NULL NULL NULL 0 Using where; Start temporary
      1 PRIMARY <derived4> ALL NULL NULL NULL NULL 2
      1 PRIMARY t4 ALL NULL NULL NULL NULL 1 Using where; End temporary; Using join buffer (flat, BNL join)
      4 DERIVED t2 ALL NULL NULL NULL NULL 1

      bzr version-info
      revision-id: <email address hidden>
      date: 2011-10-24 12:54:28 -0700
      build-date: 2011-10-25 12:05:43 +0300
      revno: 3249
      branch-nick: maria-5.3

      test case:

      --source include/have_innodb.inc
      CREATE TABLE t1 ( a varchar(1) );

      CREATE TABLE t2 ( b varchar(1) ) ENGINE=InnoDB;

      CREATE TABLE t3 ( a varchar(1), b varchar(1) );
      INSERT INTO t3 VALUES ('c','c');

      CREATE TABLE t4 ( b varchar(1) ) ENGINE=InnoDB;

      CREATE ALGORITHM=TEMPTABLE VIEW v2 AS SELECT * FROM t2;
      CREATE VIEW v5 AS SELECT t1.* FROM t1, v2 ;

      SET SESSION optimizer_switch='derived_merge=on,semijoin=on';

      SELECT *
      FROM t3
      LEFT JOIN v5
      ON ( t3.a = v5.a )
      WHERE t3.b IN ( SELECT b FROM t4 );

        Gliffy Diagrams

          Attachments

            Activity

            Hide
            philipstoev Philip Stoev added a comment -

            Re: Crash in JOIN_CACHE::write_record_data with derived_merge + semijoin + innodb + nested views
            valgrind:

            ==11013== Thread 20:
            ==11013== Invalid read of size 2
            ==11013== at 0x4007A0E: memcpy (mc_replace_strmem.c:635)
            ==11013== by 0x82F2380: JOIN_CACHE::write_record_data(unsigned char*, bool*) (sql_join_cache.cc:1421)
            ==11013== by 0x82F2631: JOIN_CACHE::put_record() (sql_join_cache.cc:1530)
            ==11013== by 0x833DAF7: sub_select_cache(JOIN*, st_join_table*, bool) (sql_select.cc:14916)
            ==11013== by 0x833E8C8: evaluate_null_complemented_join_record(JOIN*, st_join_table*) (sql_select.cc:15434)
            ==11013== by 0x833E05E: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:15167)
            ==11013== by 0x833D708: do_select(JOIN*, List<Item>, st_table, Procedure*) (sql_select.cc:14785)
            ==11013== by 0x8321F60: JOIN::exec() (sql_select.cc:2679)
            ==11013== by 0x832278D: mysql_select(THD*, Item**, TABLE_LIST, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, un
            signed long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2900)
            ==11013== by 0x831A55E: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:283)
            ==11013== by 0x82B4D17: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5112)
            ==11013== by 0x82ABAD4: mysql_execute_command(THD*) (sql_parse.cc:2250)
            ==11013== by 0x82B7346: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6112)
            ==11013== by 0x82A9723: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1221)
            ==11013== by 0x82A8B7E: do_command(THD*) (sql_parse.cc:916)
            ==11013== by 0x82A5B62: handle_one_connection (sql_connect.cc:1191)

            Show
            philipstoev Philip Stoev added a comment - Re: Crash in JOIN_CACHE::write_record_data with derived_merge + semijoin + innodb + nested views valgrind: ==11013== Thread 20: ==11013== Invalid read of size 2 ==11013== at 0x4007A0E: memcpy (mc_replace_strmem.c:635) ==11013== by 0x82F2380: JOIN_CACHE::write_record_data(unsigned char*, bool*) (sql_join_cache.cc:1421) ==11013== by 0x82F2631: JOIN_CACHE::put_record() (sql_join_cache.cc:1530) ==11013== by 0x833DAF7: sub_select_cache(JOIN*, st_join_table*, bool) (sql_select.cc:14916) ==11013== by 0x833E8C8: evaluate_null_complemented_join_record(JOIN*, st_join_table*) (sql_select.cc:15434) ==11013== by 0x833E05E: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:15167) ==11013== by 0x833D708: do_select(JOIN*, List<Item> , st_table , Procedure*) (sql_select.cc:14785) ==11013== by 0x8321F60: JOIN::exec() (sql_select.cc:2679) ==11013== by 0x832278D: mysql_select(THD*, Item** , TABLE_LIST , unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, un signed long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2900) ==11013== by 0x831A55E: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:283) ==11013== by 0x82B4D17: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5112) ==11013== by 0x82ABAD4: mysql_execute_command(THD*) (sql_parse.cc:2250) ==11013== by 0x82B7346: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6112) ==11013== by 0x82A9723: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1221) ==11013== by 0x82A8B7E: do_command(THD*) (sql_parse.cc:916) ==11013== by 0x82A5B62: handle_one_connection (sql_connect.cc:1191)
            Hide
            ratzpo Rasmus Johansson added a comment -

            Launchpad bug id: 881318

            Show
            ratzpo Rasmus Johansson added a comment - Launchpad bug id: 881318

              People

              • Assignee:
                igor Igor Babaev
                Reporter:
                philipstoev Philip Stoev
              • Votes:
                0 Vote for this issue
                Watchers:
                0 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: