Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-13166

Server crashes in Item_ref::used_tables on subquery from a view

    Details

      Description

      CREATE TABLE t (i INT);
      INSERT INTO t VALUES (1),(2); # Unimportant, can also be an empty table
      CREATE VIEW v AS SELECT MAX(i) AS f FROM t;
      SELECT * FROM ( SELECT * FROM v ) AS sq WHERE f > 0;
      

      10.2 0d69d313a11fb03f31d71282f622b25d0a4764b8

      #3  <signal handler called>
      #4  0x000056381e7f932a in Item_ref::used_tables (this=0x7f1c480378b8) at /data/src/10.2/sql/item.cc:10573
      #5  0x000056381e7f94b5 in Item_direct_view_ref::used_tables (this=0x7f1c480376b8) at /data/src/10.2/sql/item.cc:10599
      #6  0x000056381e7ee9cc in Item_direct_view_ref::derived_field_transformer_for_having (this=0x7f1c480376b8, thd=0x7f1c48000b00, arg=0x7f1c48014ab8 "\220\037|\037\070V") at /data/src/10.2/sql/item.cc:7178
      #7  0x000056381e7f0003 in Item_ref::transform (this=0x7f1c480376b8, thd=0x7f1c48000b00, transformer=&virtual Item::derived_field_transformer_for_having(THD*, unsigned char*), arg=0x7f1c48014ab8 "\220\037|\037\070V") at /data/src/10.2/sql/item.cc:7745
      #8  0x000056381e83e106 in Item_args::transform_args (this=0x7f1c480375e0, thd=0x7f1c48000b00, transformer=&virtual table offset 1208, arg=0x7f1c48014ab8 "\220\037|\037\070V") at /data/src/10.2/sql/item_func.cc:328
      #9  0x000056381e83e1ed in Item_func::transform (this=0x7f1c48037558, thd=0x7f1c48000b00, transformer=&virtual table offset 1208, argument=0x7f1c48014ab8 "\220\037|\037\070V") at /data/src/10.2/sql/item_func.cc:364
      #10 0x000056381e52cdea in pushdown_cond_for_derived (thd=0x7f1c48000b00, cond=0x7f1c48013fc0, derived=0x7f1c480131a0) at /data/src/10.2/sql/sql_derived.cc:1284
      #11 0x000056381e59be1a in JOIN::optimize_inner (this=0x7f1c48016798) at /data/src/10.2/sql/sql_select.cc:1334
      #12 0x000056381e59b0a5 in JOIN::optimize (this=0x7f1c48016798) at /data/src/10.2/sql/sql_select.cc:1085
      #13 0x000056381e5a3fc2 in mysql_select (thd=0x7f1c48000b00, tables=0x7f1c48013808, wild_num=1, fields=..., conds=0x7f1c48013fc0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f1c48016778, unit=0x7f1c480045e0, select_lex=0x7f1c48004d18) at /data/src/10.2/sql/sql_select.cc:3654
      #14 0x000056381e5989d6 in handle_select (thd=0x7f1c48000b00, lex=0x7f1c48004518, result=0x7f1c48016778, setup_tables_done_option=0) at /data/src/10.2/sql/sql_select.cc:373
      #15 0x000056381e564946 in execute_sqlcom_select (thd=0x7f1c48000b00, all_tables=0x7f1c48013808) at /data/src/10.2/sql/sql_parse.cc:6438
      #16 0x000056381e55a985 in mysql_execute_command (thd=0x7f1c48000b00) at /data/src/10.2/sql/sql_parse.cc:3453
      #17 0x000056381e568318 in mysql_parse (thd=0x7f1c48000b00, rawbuf=0x7f1c48012368 "SELECT * FROM ( SELECT * FROM v ) AS sq WHERE f > 0", length=51, parser_state=0x7f1c5f7fd200, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7875
      #18 0x000056381e5563f1 in dispatch_command (command=COM_QUERY, thd=0x7f1c48000b00, packet=0x7f1c480087c1 "SELECT * FROM ( SELECT * FROM v ) AS sq WHERE f > 0", packet_length=51, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1817
      #19 0x000056381e554d32 in do_command (thd=0x7f1c48000b00) at /data/src/10.2/sql/sql_parse.cc:1362
      #20 0x000056381e6a03ad in do_handle_one_connection (connect=0x5638207e2340) at /data/src/10.2/sql/sql_connect.cc:1354
      #21 0x000056381e6a013a in handle_one_connection (arg=0x5638207e2340) at /data/src/10.2/sql/sql_connect.cc:1260
      #22 0x000056381eabad78 in pfs_spawn_thread (arg=0x56382081abb0) at /data/src/10.2/storage/perfschema/pfs.cc:1862
      #23 0x00007f1c6b49c494 in start_thread (arg=0x7f1c5f7fe700) at pthread_create.c:333
      #24 0x00007f1c6961493f in clone () from /lib/x86_64-linux-gnu/libc.so.6
      

      The problem appeared in 10.2 with this revision:

      commit 9f3622191df074d9f4e512320effe86f06b250fb
      Author: Igor Babaev <igor@askmonty.org>
      Date:   Thu Jun 22 00:41:44 2017 -0700
       
          Fixed the bug mdev-12845.
      

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                igor Igor Babaev
                Reporter:
                elenst Elena Stepanova
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: