Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-10824

Crash in CREATE OR REPLACE TABLE t1 AS SELECT spfunc()

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 10.0(EOL), 10.1(EOL)
    • 10.0.28, 10.1.19
    • Locking
    • None
    • 10.0.28

    Description

      This script crashes the server:

      CREATE TABLE IF NOT EXISTS t1 (i INT);
      		 
      DROP FUNCTION IF EXISTS f1;
      		 
      DELIMITER $$
      		 
      CREATE FUNCTION f1() RETURNS VARCHAR(16383)
      		 
      BEGIN
      		 
        RETURN 'test';
      		 
      END;
      		 
      $$
      		 
      DELIMITER ;
      		 
      CREATE OR REPLACE TABLE t1 AS SELECT f1();

      Note, if I replace CREATE OR REPLACE to a DROP followed by CREATE, it works fine:

      CREATE TABLE IF NOT EXISTS t1 (i INT);
      		 
      DROP FUNCTION IF EXISTS f1;
      		 
      DELIMITER $$
      		 
      CREATE FUNCTION f1() RETURNS VARCHAR(16383)
      		 
      BEGIN
      		 
        RETURN 'test';
      		 
      END;
      		 
      $$
      		 
      DELIMITER ;
      		 
      DROP TABLE IF EXISTS t1;
      		 
      CREATE TABLE t1 AS SELECT f1();

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-11129 CREATE OR REPLACE TABLE t1 AS SELECT spfunc() crashes if spfunc() references t1

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-9496 Crash in CREATE OR REPLACE TABLE t1 AS SELECT stored_function()

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            bar Alexander Barkov created issue -
            bar Alexander Barkov made changes -
            Field Original Value New Value
            Description This script crashes the server:
            {code:sql}
            DROP FUNCTION IF EXISTS f1;
            DELIMITER $$
            CREATE FUNCTION f1() RETURNS VARCHAR(16383)
            BEGIN
              RETURN 'test';
            END;
            $$
            DELIMITER ;
            CREATE OR REPLACE TABLE t1 AS SELECT f1();
            {code}

            Note, if I replace {{CREATE OR REPLACE}} to a {{DROP}} followed by {{CREATE}}, it works fine:
            {code:sql}
            DROP FUNCTION IF EXISTS f1;
            DELIMITER $$
            CREATE FUNCTION f1() RETURNS VARCHAR(16383)
            BEGIN
              RETURN 'test';
            END;
            $$
            DELIMITER ;
            DROP TABLE IF EXISTS t1;
            CREATE TABLE t1 AS SELECT f1();
            CREATE OR REPLACE TABLE t1 AS SELECT f1();
            {code}
            		This script crashes the server:
            {code:sql}
            DROP FUNCTION IF EXISTS f1;
            DELIMITER $$
            CREATE FUNCTION f1() RETURNS VARCHAR(16383)
            BEGIN
              RETURN 'test';
            END;
            $$
            DELIMITER ;
            CREATE OR REPLACE TABLE t1 AS SELECT f1();
            {code}

            Note, if I replace {{CREATE OR REPLACE}} to a {{DROP}} followed by {{CREATE}}, it works fine:
            {code:sql}
            DROP FUNCTION IF EXISTS f1;
            DELIMITER $$
            CREATE FUNCTION f1() RETURNS VARCHAR(16383)
            BEGIN
              RETURN 'test';
            END;
            $$
            DELIMITER ;
            DROP TABLE IF EXISTS t1;
            CREATE TABLE t1 AS SELECT f1();
            {code}
            elenst Elena Stepanova added a comment - - edited

            To get the crash, the table needs to exist before it's re-created. I've added the statement to the test case.
            10.2 is also affected, I removed it from the 'affected versions' because that's our current routine.

            Stack trace from 10.0 b34d7fba31

            		 
            #3  <signal handler called>
            		 
            #4  0x00000000005e5eb8 in wait_while_table_is_used (thd=0x7f281f0ab070, table=0x0, function=HA_EXTRA_NOT_USED) at /data/src/10.0/sql/sql_base.cc:1819
            		 
            #5  0x00000000006ef000 in mysql_rm_table_no_locks (thd=0x7f281f0ab070, tables=0x7f2821e45bb0, if_exists=false, drop_temporary=false, drop_view=false, dont_log_query=true, dont_free_locks=true) at /data/src/10.0/sql/sql_table.cc:2469
            		 
            #6  0x00000000006f53db in create_table_impl (thd=0x7f281f0ab070, orig_db=0x7f27f5c22768 "test", orig_table_name=0x7f27f5c22150 "t1", db=0x7f27f5c22768 "test", table_name=0x7f27f5c22150 "t1", path=0x7f2821e46630 "./test/t1", create_info=0x7f2821e47d80, alter_info=0x7f2821e47cf0, create_table_mode=1, is_trans=0x0, key_info=0x7f2821e46858, key_count=0x7f2821e46854, frm=0x7f2821e46840) at /data/src/10.0/sql/sql_table.cc:4762
            		 
            #7  0x00000000006f5cc0 in mysql_create_table_no_lock (thd=0x7f281f0ab070, db=0x7f27f5c22768 "test", table_name=0x7f27f5c22150 "t1", create_info=0x7f2821e47d80, alter_info=0x7f2821e47cf0, is_trans=0x0, create_table_mode=1) at /data/src/10.0/sql/sql_table.cc:4965
            		 
            #8  0x000000000063183e in create_table_from_items (thd=0x7f281f0ab070, create_info=0x7f2821e47d80, create_table=0x7f27f5c22188, alter_info=0x7f2821e47cf0, items=0x7f281f0af218, lock=0x7f2821e479c8, hooks=0x7f2821e479a0) at /data/src/10.0/sql/sql_insert.cc:3986
            		 
            #9  0x0000000000631eb7 in select_create::prepare (this=0x7f27f5c23e50, values=..., u=0x7f281f0aea10) at /data/src/10.0/sql/sql_insert.cc:4158
            		 
            #10 0x000000000067c564 in JOIN::prepare (this=0x7f27f5d91088, rref_pointer_array=0x7f281f0af378, tables_init=0x0, wild_num=0, conds_init=0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7f281f0af100, unit_arg=0x7f281f0aea10) at /data/src/10.0/sql/sql_select.cc:967
            		 
            #11 0x00000000006844c8 in mysql_select (thd=0x7f281f0ab070, rref_pointer_array=0x7f281f0af378, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184064, result=0x7f27f5c23e50, unit=0x7f281f0aea10, select_lex=0x7f281f0af100) at /data/src/10.0/sql/sql_select.cc:3286
            		 
            #12 0x000000000067a93a in handle_select (thd=0x7f281f0ab070, lex=0x7f281f0ae948, result=0x7f27f5c23e50, setup_tables_done_option=0) at /data/src/10.0/sql/sql_select.cc:373
            		 
            #13 0x0000000000648755 in mysql_execute_command (thd=0x7f281f0ab070) at /data/src/10.0/sql/sql_parse.cc:3015
            		 
            #14 0x0000000000651e18 in mysql_parse (thd=0x7f281f0ab070, rawbuf=0x7f27f5c22088 "CREATE OR REPLACE TABLE t1 AS SELECT f1()", length=41, parser_state=0x7f2821e486a0) at /data/src/10.0/sql/sql_parse.cc:6576
            		 
            #15 0x0000000000644918 in dispatch_command (command=COM_QUERY, thd=0x7f281f0ab070, packet=0x7f28075b3071 "CREATE OR REPLACE TABLE t1 AS SELECT f1()", packet_length=41) at /data/src/10.0/sql/sql_parse.cc:1309
            		 
            #16 0x0000000000643bdb in do_command (thd=0x7f281f0ab070) at /data/src/10.0/sql/sql_parse.cc:999
            		 
            #17 0x0000000000761efa in do_handle_one_connection (thd_arg=0x7f281f0ab070) at /data/src/10.0/sql/sql_connect.cc:1378
            		 
            #18 0x0000000000761c6c in handle_one_connection (arg=0x7f281f0ab070) at /data/src/10.0/sql/sql_connect.cc:1293
            		 
            #19 0x00007f2821aa40a4 in start_thread (arg=0x7f2821e49700) at pthread_create.c:309
            		 
            #20 0x00007f281fc5c87d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

            elenst Elena Stepanova added a comment - - edited To get the crash, the table needs to exist before it's re-created. I've added the statement to the test case. 10.2 is also affected, I removed it from the 'affected versions' because that's our current routine. Stack trace from 10.0 b34d7fba31 #3 <signal handler called> #4 0x00000000005e5eb8 in wait_while_table_is_used (thd=0x7f281f0ab070, table=0x0, function=HA_EXTRA_NOT_USED) at /data/src/10.0/sql/sql_base.cc:1819 #5 0x00000000006ef000 in mysql_rm_table_no_locks (thd=0x7f281f0ab070, tables=0x7f2821e45bb0, if_exists=false, drop_temporary=false, drop_view=false, dont_log_query=true, dont_free_locks=true) at /data/src/10.0/sql/sql_table.cc:2469 #6 0x00000000006f53db in create_table_impl (thd=0x7f281f0ab070, orig_db=0x7f27f5c22768 "test", orig_table_name=0x7f27f5c22150 "t1", db=0x7f27f5c22768 "test", table_name=0x7f27f5c22150 "t1", path=0x7f2821e46630 "./test/t1", create_info=0x7f2821e47d80, alter_info=0x7f2821e47cf0, create_table_mode=1, is_trans=0x0, key_info=0x7f2821e46858, key_count=0x7f2821e46854, frm=0x7f2821e46840) at /data/src/10.0/sql/sql_table.cc:4762 #7 0x00000000006f5cc0 in mysql_create_table_no_lock (thd=0x7f281f0ab070, db=0x7f27f5c22768 "test", table_name=0x7f27f5c22150 "t1", create_info=0x7f2821e47d80, alter_info=0x7f2821e47cf0, is_trans=0x0, create_table_mode=1) at /data/src/10.0/sql/sql_table.cc:4965 #8 0x000000000063183e in create_table_from_items (thd=0x7f281f0ab070, create_info=0x7f2821e47d80, create_table=0x7f27f5c22188, alter_info=0x7f2821e47cf0, items=0x7f281f0af218, lock=0x7f2821e479c8, hooks=0x7f2821e479a0) at /data/src/10.0/sql/sql_insert.cc:3986 #9 0x0000000000631eb7 in select_create::prepare (this=0x7f27f5c23e50, values=..., u=0x7f281f0aea10) at /data/src/10.0/sql/sql_insert.cc:4158 #10 0x000000000067c564 in JOIN::prepare (this=0x7f27f5d91088, rref_pointer_array=0x7f281f0af378, tables_init=0x0, wild_num=0, conds_init=0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7f281f0af100, unit_arg=0x7f281f0aea10) at /data/src/10.0/sql/sql_select.cc:967 #11 0x00000000006844c8 in mysql_select (thd=0x7f281f0ab070, rref_pointer_array=0x7f281f0af378, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184064, result=0x7f27f5c23e50, unit=0x7f281f0aea10, select_lex=0x7f281f0af100) at /data/src/10.0/sql/sql_select.cc:3286 #12 0x000000000067a93a in handle_select (thd=0x7f281f0ab070, lex=0x7f281f0ae948, result=0x7f27f5c23e50, setup_tables_done_option=0) at /data/src/10.0/sql/sql_select.cc:373 #13 0x0000000000648755 in mysql_execute_command (thd=0x7f281f0ab070) at /data/src/10.0/sql/sql_parse.cc:3015 #14 0x0000000000651e18 in mysql_parse (thd=0x7f281f0ab070, rawbuf=0x7f27f5c22088 "CREATE OR REPLACE TABLE t1 AS SELECT f1()", length=41, parser_state=0x7f2821e486a0) at /data/src/10.0/sql/sql_parse.cc:6576 #15 0x0000000000644918 in dispatch_command (command=COM_QUERY, thd=0x7f281f0ab070, packet=0x7f28075b3071 "CREATE OR REPLACE TABLE t1 AS SELECT f1()", packet_length=41) at /data/src/10.0/sql/sql_parse.cc:1309 #16 0x0000000000643bdb in do_command (thd=0x7f281f0ab070) at /data/src/10.0/sql/sql_parse.cc:999 #17 0x0000000000761efa in do_handle_one_connection (thd_arg=0x7f281f0ab070) at /data/src/10.0/sql/sql_connect.cc:1378 #18 0x0000000000761c6c in handle_one_connection (arg=0x7f281f0ab070) at /data/src/10.0/sql/sql_connect.cc:1293 #19 0x00007f2821aa40a4 in start_thread (arg=0x7f2821e49700) at pthread_create.c:309 #20 0x00007f281fc5c87d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
            elenst Elena Stepanova made changes -
            Description This script crashes the server:
            {code:sql}
            DROP FUNCTION IF EXISTS f1;
            DELIMITER $$
            CREATE FUNCTION f1() RETURNS VARCHAR(16383)
            BEGIN
              RETURN 'test';
            END;
            $$
            DELIMITER ;
            CREATE OR REPLACE TABLE t1 AS SELECT f1();
            {code}

            Note, if I replace {{CREATE OR REPLACE}} to a {{DROP}} followed by {{CREATE}}, it works fine:
            {code:sql}
            DROP FUNCTION IF EXISTS f1;
            DELIMITER $$
            CREATE FUNCTION f1() RETURNS VARCHAR(16383)
            BEGIN
              RETURN 'test';
            END;
            $$
            DELIMITER ;
            DROP TABLE IF EXISTS t1;
            CREATE TABLE t1 AS SELECT f1();
            {code}
            		This script crashes the server:
            {code:sql}
            CREATE TABLE IF NOT EXISTS t1 (i INT);
            DROP FUNCTION IF EXISTS f1;
            DELIMITER $$
            CREATE FUNCTION f1() RETURNS VARCHAR(16383)
            BEGIN
              RETURN 'test';
            END;
            $$
            DELIMITER ;
            CREATE OR REPLACE TABLE t1 AS SELECT f1();
            {code}

            Note, if I replace {{CREATE OR REPLACE}} to a {{DROP}} followed by {{CREATE}}, it works fine:
            {code:sql}
            CREATE TABLE IF NOT EXISTS t1 (i INT);
            DROP FUNCTION IF EXISTS f1;
            DELIMITER $$
            CREATE FUNCTION f1() RETURNS VARCHAR(16383)
            BEGIN
              RETURN 'test';
            END;
            $$
            DELIMITER ;
            DROP TABLE IF EXISTS t1;
            CREATE TABLE t1 AS SELECT f1();
            {code}
            elenst Elena Stepanova made changes -
            Assignee Sergey Vojtovich [ svoj ]
            elenst Elena Stepanova made changes -
            Fix Version/s 10.1 [ 16100 ]
            elenst Elena Stepanova made changes -
            Affects Version/s 10.2 [ 14601 ]
            ratzpo Rasmus Johansson (Inactive) made changes -
            Sprint 10.0.28 [ 107 ]
            ratzpo Rasmus Johansson (Inactive) made changes -
            Rank Ranked lower
            svoj Sergey Vojtovich added a comment -

            serg, please review fix for this bug.

            svoj Sergey Vojtovich added a comment - serg , please review fix for this bug.
            svoj Sergey Vojtovich made changes -
            Assignee Sergey Vojtovich [ svoj ] Sergei Golubchik [ serg ]
            Status Open [ 1 ] In Review [ 10002 ]
            svoj Sergey Vojtovich made changes -
            serg Sergei Golubchik made changes -
            Assignee Sergei Golubchik [ serg ] Sergey Vojtovich [ svoj ]
            Status In Review [ 10002 ] Stalled [ 10000 ]
            svoj Sergey Vojtovich made changes -
            Component/s OTHER [ 10125 ]
            Fix Version/s 10.0.28 [ 22107 ]
            Fix Version/s 10.1.19 [ 22111 ]
            Fix Version/s 10.0 [ 16000 ]
            Fix Version/s 10.1 [ 16100 ]
            Resolution Fixed [ 1 ]
            Status Stalled [ 10000 ] Closed [ 6 ]
            serg Sergei Golubchik made changes -
            Component/s Locking [ 10900 ]
            Component/s OTHER [ 10125 ]
            svoj Sergey Vojtovich added a comment -

            I'd say "Locking" category is rather a rough choice for this bug. Locking subsystems were generally fine, bug was in DDL code.

            svoj Sergey Vojtovich added a comment - I'd say "Locking" category is rather a rough choice for this bug. Locking subsystems were generally fine, bug was in DDL code.
            elenst Elena Stepanova made changes -
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 77121 ] MariaDB v4 [ 150925 ]

            People

              svoj Sergey Vojtovich
              bar Alexander Barkov
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.