Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-7751

Server crashes in TABLE_LIST::reset_const_table on 2nd execution of PS with ONLY_FULL_GROUP_BY, view, subqueries

        Details

          Description

          Attention: I am only getting the crash on a VALGRIND build
          cmake . -DCMAKE_BUILD_TYPE=Debug -DWITH_VALGRIND=YES

          See also MDEV-7688, MDEV-7689, MDEV-7690, MDEV-7696 - they all are somewhat similar, probably there are duplicates among them; but effects are different everywhere.

          The problem appeared in 5.5 tree with the following revision:

          revno: 4255
revision-id: sanja@askmonty.org-20140731071110-4uyuza0ykesfxe1b
parent: monty@mariadb.org-20140730102752-3ilbpvmbhr2r9a4x
committer: sanja@askmonty.org
branch nick: work-maria-5.5-MDEV-6441
timestamp: Thu 2014-07-31 10:11:10 +0300
message:
  MDEV-6441: memory leak
  
  mysql_derived_prepare() was executed on the statement memory.
  Now it is executed on the runtime memory.
  All bugs induced by this were fixed.
          Stack trace from 5.5 commit 34f37aa0c0aa87cfb6908500e937516ff37ea6f0
          #2  0x00000000007f0def in handle_fatal_signal (sig=11) at sql/signal_handler.cc:262
#3  <signal handler called>
#4  0x00000000007083ad in TABLE_LIST::reset_const_table (this=0x7f5fea045f18) at sql/table.cc:6631
#5  0x0000000000708404 in TABLE_LIST::reset_const_table (this=0x7f5fea04b418) at sql/table.cc:6638
#6  0x00000000005e6bbc in setup_table_map (table=0x7f5fea0e5018, table_list=0x7f5fea04b418, tablenr=0) at sql/sql_base.h:358
#7  0x00000000005e0e61 in setup_tables (thd=0x7f5fead18000, context=0x7f5fea088068, from_clause=0x7f5fea0881b0, tables=0x7f5fea04b418, leaves=..., select_insert=false, full_table_list=false) at sql/sql_base.cc:8321
#8  0x00000000005e1300 in setup_tables_and_check_access (thd=0x7f5fead18000, context=0x7f5fea088068, from_clause=0x7f5fea0881b0, tables=0x7f5fea04b418, leaves=..., select_insert=false, want_access_first=1, want_access=1, full_table_list=false) at sql/sql_base.cc:8431
#9  0x0000000000664861 in JOIN::prepare (this=0x7f5fea04ea18, rref_pointer_array=0x7f5fea0882d8, tables_init=0x7f5fea04b418, wild_num=0, conds_init=0x7f5fea020498, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7f5fea088018, unit_arg=0x7f5fea030018) at sql/sql_select.cc:651
#10 0x00000000006e7245 in st_select_lex_unit::prepare (this=0x7f5fea030018, thd_arg=0x7f5fead18000, sel_result=0x7f5fea0485d8, additional_options=0) at sql/sql_union.cc:332
#11 0x000000000060f1af in mysql_derived_prepare (thd=0x7f5fead18000, lex=0x7f5fea0e0018, derived=0x7f5fea04c018) at sql/sql_derived.cc:657
#12 0x000000000060e60f in mysql_handle_single_derived (lex=0x7f5fea0e0018, derived=0x7f5fea04c018, phases=2) at sql/sql_derived.cc:192
#13 0x00000000007084b7 in TABLE_LIST::handle_derived (this=0x7f5fea04c018, lex=0x7f5fea0e0018, phases=2) at sql/table.cc:6666
#14 0x000000000062adde in st_select_lex::handle_derived (this=0x7f5fea0e07c8, lex=0x7f5fea0e0018, phases=2) at sql/sql_lex.cc:3554
#15 0x000000000066476e in JOIN::prepare (this=0x7f5fea04de18, rref_pointer_array=0x7f5fea0e0a88, tables_init=0x7f5fea04c018, wild_num=0, conds_init=0x7f5fea047818, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7f5fea0e07c8, unit_arg=0x7f5fea0e00c8) at sql/sql_select.cc:636
#16 0x000000000066d531 in mysql_select (thd=0x7f5fead18000, rref_pointer_array=0x7f5fea0e0a88, tables=0x7f5fea04c018, wild_num=0, fields=..., conds=0x7f5fea047818, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184064, result=0x7f5fea044098, unit=0x7f5fea0e00c8, select_lex=0x7f5fea0e07c8) at sql/sql_select.cc:3074
#17 0x0000000000663e63 in handle_select (thd=0x7f5fead18000, lex=0x7f5fea0e0018, result=0x7f5fea044098, setup_tables_done_option=0) at sql/sql_select.cc:319
#18 0x000000000063c293 in execute_sqlcom_select (thd=0x7f5fead18000, all_tables=0x7f5fea04c018) at sql/sql_parse.cc:4689
#19 0x000000000063546c in mysql_execute_command (thd=0x7f5fead18000) at sql/sql_parse.cc:2234
#20 0x0000000000656b1b in Prepared_statement::execute (this=0x7f5fea0d6280, expanded_query=0x7f5feabb4c50, open_cursor=false) at sql/sql_prepare.cc:3928
#21 0x0000000000655c32 in Prepared_statement::execute_loop (this=0x7f5fea0d6280, expanded_query=0x7f5feabb4c50, open_cursor=false, packet=0x0, packet_end=0x0) at sql/sql_prepare.cc:3587
#22 0x0000000000653d56 in mysql_sql_stmt_execute (thd=0x7f5fead18000) at sql/sql_prepare.cc:2737
#23 0x000000000063549a in mysql_execute_command (thd=0x7f5fead18000) at sql/sql_parse.cc:2244
#24 0x000000000063ed98 in mysql_parse (thd=0x7f5fead18000, rawbuf=0x7f5fea01c0d8 "EXECUTE stmt", length=12, parser_state=0x7f5feabb5610) at sql/sql_parse.cc:5909
#25 0x00000000006329b3 in dispatch_command (command=COM_QUERY, thd=0x7f5fead18000, packet=0x7f5fead8c001 "EXECUTE stmt", packet_length=12) at sql/sql_parse.cc:1079
#26 0x0000000000631b3f in do_command (thd=0x7f5fead18000) at sql/sql_parse.cc:793
#27 0x0000000000739b14 in do_handle_one_connection (thd_arg=0x7f5fead18000) at sql/sql_connect.cc:1266
#28 0x00000000007395d3 in handle_one_connection (arg=0x7f5fead18000) at sql/sql_connect.cc:1181
#29 0x0000000000b836e3 in pfs_spawn_thread (arg=0x7f5feefed760) at storage/perfschema/pfs.cc:1015
#30 0x00007f5ff0db0b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
#31 0x00007f5fef6be70d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
          Test case
          SET sql_mode=ONLY_FULL_GROUP_BY;

CREATE TABLE t1 (a INT, f1 INT, f2 INT, f3 INT, f4 INT);
INSERT INTO t1 VALUES (1,10,11,12,13),(8,20,21,22,23);
CREATE VIEW v1 AS SELECT * FROM t1;

CREATE TABLE t2 (b INT);
INSERT INTO t2 VALUES (8),(6);

CREATE TABLE t3 (c INT);
INSERT INTO t3 VALUES (12),(22);

PREPARE stmt FROM "
  SELECT * FROM ( SELECT t1.* FROM v1 INNER JOIN t1 ON (t1.a = v1.a) WHERE 0 ) AS sq 
  WHERE a NOT IN ( SELECT MAX(b) FROM t1 INNER JOIN ( t2 INNER JOIN t3 ON (c = b) ) ON (c = b) ) 
";

EXECUTE stmt;
EXECUTE stmt;

            Gliffy Diagrams

              Attachments

                Issue Links

                relates to

                Bug - A problem which impairs or prevents the functions of the product. MDEV-7688 Server crashes in TABLE_LIST::is_view_or_derived on 2nd execution of PS with ONLY_FULL_GROUP_BY

                • Major - Major loss of function.
                • Open

                Bug - A problem which impairs or prevents the functions of the product. MDEV-7689 Server crashes in Item_subselect::recalc_used_tables on 2nd execution of PS with view, ONLY_FULL_GROUP_BY, HAVING subquery

                • Major - Major loss of function.
                • Open

                Bug - A problem which impairs or prevents the functions of the product. MDEV-7690 Server crashes in Item_field::used_tables on 2nd execution of PS with view, ONLY_FULL_GROUP_BY, WHERE subquery

                • Major - Major loss of function.
                • Open

                Bug - A problem which impairs or prevents the functions of the product. MDEV-7696 Server goes into an endless loop on 2nd execution of PS with ONLY_FULL_GROUP_BY, subqueries

                • Major - Major loss of function.
                • Open

                Bug - A problem which impairs or prevents the functions of the product. MDEV-7688 Server crashes in TABLE_LIST::is_view_or_derived on 2nd execution of PS with ONLY_FULL_GROUP_BY

                • Major - Major loss of function.
                • Open

                Bug - A problem which impairs or prevents the functions of the product. MDEV-7689 Server crashes in Item_subselect::recalc_used_tables on 2nd execution of PS with view, ONLY_FULL_GROUP_BY, HAVING subquery

                • Major - Major loss of function.
                • Open

                Bug - A problem which impairs or prevents the functions of the product. MDEV-7690 Server crashes in Item_field::used_tables on 2nd execution of PS with view, ONLY_FULL_GROUP_BY, WHERE subquery

                • Major - Major loss of function.
                • Open

                Bug - A problem which impairs or prevents the functions of the product. MDEV-7696 Server goes into an endless loop on 2nd execution of PS with ONLY_FULL_GROUP_BY, subqueries

                • Major - Major loss of function.
                • Open

                  Activity

                  There are no comments yet on this issue.

                    People

                    • Assignee:
                      sanja Oleksandr Byelkin
                      Reporter:
                      elenst Elena Stepanova
                    • Votes:
                      0 Vote for this issue
                      Watchers:
                      1 Start watching this issue

                      Dates

                      • Created:
                        Updated: