Thanks for the report.
The workaround might be optimizer_switch='condition_pushdown_for_derived=off'.
10.2.10 release build
#2 <signal handler called>
#3 0x00007f3d433d3fcf in raise () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x00007f3d433d53fa in abort () from /lib/x86_64-linux-gnu/libc.so.6
#5 0x00007f3d43411bd0 in __libc_message () from /lib/x86_64-linux-gnu/libc.so.6
#6 0x00007f3d43417f96 in malloc_printerr () from /lib/x86_64-linux-gnu/libc.so.6
#7 0x00007f3d4341878e in _int_free () from /lib/x86_64-linux-gnu/libc.so.6
#8 0x000055adee3c67b3 in cleanup (this=0x7f3d2c0121f0) at /home/buildbot/buildbot/build/sql/item_cmpfunc.h:2090
#9 Item_func_regexp_substr::cleanup (this=0x7f3d2c012130) at /home/buildbot/buildbot/build/sql/item_strfunc.h:352
#10 0x000055adee35092a in cleanup_processor (this=<optimized out>, arg=<optimized out>) at /home/buildbot/buildbot/build/sql/item.cc:657
#11 Item::cleanup_processor (this=<optimized out>, arg=<optimized out>) at /home/buildbot/buildbot/build/sql/item.cc:654
#12 0x000055adee17cbe2 in Item_args::walk_args (processor=&virtual table offset 784, walk_subquery=<optimized out>, arg=arg@entry=0x0, this=0x7f3d2c011b30, this=0x7f3d2c011b30) at /home/buildbot/buildbot/build/sql/item.h:3873
#13 0x000055adee1885ec in Item_func_or_sum::walk (this=0x7f3d2c011aa8, processor=&virtual table offset 784, walk_subquery=<optimized out>, arg=0x0) at /home/buildbot/buildbot/build/sql/item.h:4158
#14 0x000055adee1a24b8 in pushdown_cond_for_derived (thd=0x7f3d2c0009a8, cond=<optimized out>, derived=derived@entry=0x7f3d2c010190) at /home/buildbot/buildbot/build/sql/sql_derived.cc:1238
#15 0x000055adee20f545 in JOIN::optimize_inner (this=this@entry=0x7f3d2c010be0) at /home/buildbot/buildbot/build/sql/sql_select.cc:1334
#16 0x000055adee21292f in JOIN::optimize (this=this@entry=0x7f3d2c010be0) at /home/buildbot/buildbot/build/sql/sql_select.cc:1085
#18 0x000055adee213ef4 in handle_select (thd=thd@entry=0x7f3d2c0009a8, lex=lex@entry=0x7f3d2c0042c0, result=result@entry=0x7f3d2c010bc0, setup_tables_done_option=setup_tables_done_option@entry=0) at /home/buildbot/buildbot/build/sql/sql_select.cc:373
#19 0x000055adee105b40 in execute_sqlcom_select (thd=thd@entry=0x7f3d2c0009a8, all_tables=0x7f3d2c010190) at /home/buildbot/buildbot/build/sql/sql_parse.cc:6420
#20 0x000055adee1c2e1a in mysql_execute_command (thd=thd@entry=0x7f3d2c0009a8) at /home/buildbot/buildbot/build/sql/sql_parse.cc:3454
#21 0x000055adee1c81ba in mysql_parse (thd=thd@entry=0x7f3d2c0009a8, rawbuf=<optimized out>, length=71, parser_state=parser_state@entry=0x7f3d3d490260, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /home/buildbot/buildbot/build/sql/sql_parse.cc:7861
#22 0x000055adee1ca581 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f3d2c0009a8, packet=<optimized out>, packet_length=738258960, packet_length@entry=71, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /home/buildbot/buildbot/build/sql/sql_parse.cc:1805
#23 0x000055adee1cab5e in do_command (thd=0x7f3d2c0009a8) at /home/buildbot/buildbot/build/sql/sql_parse.cc:1360
#24 0x000055adee287e4f in do_handle_one_connection (connect=connect@entry=0x55adefefa668) at /home/buildbot/buildbot/build/sql/sql_connect.cc:1354
#25 0x000055adee287f74 in handle_one_connection (arg=arg@entry=0x55adefefa668) at /home/buildbot/buildbot/build/sql/sql_connect.cc:1260
#26 0x000055adee4c0c2d in pfs_spawn_thread (arg=0x55adefea4fb8) at /home/buildbot/buildbot/build/storage/perfschema/pfs.cc:1863
#27 0x00007f3d43dcc494 in start_thread (arg=0x7f3d3d491700) at pthread_create.c:333
#28 0x00007f3d4348993f in clone () from /lib/x86_64-linux-gnu/libc.so.6
Here's a more natural test case causing the same problem:
create table t1 (a char(8));
insert into t1 values ('b', 'a', 'xx');
select *
from ( select distinct regexp_substr(t1.a,'^[A-Za-z]+') as f from t1) as t
where t.f = 'a' or t.f = 'b'
Igor Babaev
added a comment - Here's a more natural test case causing the same problem:
create table t1 (a char(8));
insert into t1 values ('b', 'a', 'xx');
select *
from ( select distinct regexp_substr(t1.a,'^[A-Za-z]+') as f from t1) as t
where t.f = 'a' or t.f = 'b'
Thanks for the report.
The workaround might be optimizer_switch='condition_pushdown_for_derived=off'.
10.2.10 release build
#2 <signal handler called>
#3 0x00007f3d433d3fcf in raise () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x00007f3d433d53fa in abort () from /lib/x86_64-linux-gnu/libc.so.6
#5 0x00007f3d43411bd0 in __libc_message () from /lib/x86_64-linux-gnu/libc.so.6
#6 0x00007f3d43417f96 in malloc_printerr () from /lib/x86_64-linux-gnu/libc.so.6
#7 0x00007f3d4341878e in _int_free () from /lib/x86_64-linux-gnu/libc.so.6
#8 0x000055adee3c67b3 in cleanup (this=0x7f3d2c0121f0) at /home/buildbot/buildbot/build/sql/item_cmpfunc.h:2090
#9 Item_func_regexp_substr::cleanup (this=0x7f3d2c012130) at /home/buildbot/buildbot/build/sql/item_strfunc.h:352
#10 0x000055adee35092a in cleanup_processor (this=<optimized out>, arg=<optimized out>) at /home/buildbot/buildbot/build/sql/item.cc:657
#11 Item::cleanup_processor (this=<optimized out>, arg=<optimized out>) at /home/buildbot/buildbot/build/sql/item.cc:654
#12 0x000055adee17cbe2 in Item_args::walk_args (processor=&virtual table offset 784, walk_subquery=<optimized out>, arg=arg@entry=0x0, this=0x7f3d2c011b30, this=0x7f3d2c011b30) at /home/buildbot/buildbot/build/sql/item.h:3873
#13 0x000055adee1885ec in Item_func_or_sum::walk (this=0x7f3d2c011aa8, processor=&virtual table offset 784, walk_subquery=<optimized out>, arg=0x0) at /home/buildbot/buildbot/build/sql/item.h:4158
#14 0x000055adee1a24b8 in pushdown_cond_for_derived (thd=0x7f3d2c0009a8, cond=<optimized out>, derived=derived@entry=0x7f3d2c010190) at /home/buildbot/buildbot/build/sql/sql_derived.cc:1238
#15 0x000055adee20f545 in JOIN::optimize_inner (this=this@entry=0x7f3d2c010be0) at /home/buildbot/buildbot/build/sql/sql_select.cc:1334
#16 0x000055adee21292f in JOIN::optimize (this=this@entry=0x7f3d2c010be0) at /home/buildbot/buildbot/build/sql/sql_select.cc:1085
#17 0x000055adee212b6d in mysql_select (thd=thd@entry=0x7f3d2c0009a8, tables=0x7f3d2c010190, wild_num=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=result@entry=0x7f3d2c010bc0, unit=unit@entry=0x7f3d2c004388, select_lex=select_lex@entry=0x7f3d2c004ac0) at /home/buildbot/buildbot/build/sql/sql_select.cc:3664
#18 0x000055adee213ef4 in handle_select (thd=thd@entry=0x7f3d2c0009a8, lex=lex@entry=0x7f3d2c0042c0, result=result@entry=0x7f3d2c010bc0, setup_tables_done_option=setup_tables_done_option@entry=0) at /home/buildbot/buildbot/build/sql/sql_select.cc:373
#19 0x000055adee105b40 in execute_sqlcom_select (thd=thd@entry=0x7f3d2c0009a8, all_tables=0x7f3d2c010190) at /home/buildbot/buildbot/build/sql/sql_parse.cc:6420
#20 0x000055adee1c2e1a in mysql_execute_command (thd=thd@entry=0x7f3d2c0009a8) at /home/buildbot/buildbot/build/sql/sql_parse.cc:3454
#21 0x000055adee1c81ba in mysql_parse (thd=thd@entry=0x7f3d2c0009a8, rawbuf=<optimized out>, length=71, parser_state=parser_state@entry=0x7f3d3d490260, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /home/buildbot/buildbot/build/sql/sql_parse.cc:7861
#22 0x000055adee1ca581 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f3d2c0009a8, packet=<optimized out>, packet_length=738258960, packet_length@entry=71, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /home/buildbot/buildbot/build/sql/sql_parse.cc:1805
#23 0x000055adee1cab5e in do_command (thd=0x7f3d2c0009a8) at /home/buildbot/buildbot/build/sql/sql_parse.cc:1360
#24 0x000055adee287e4f in do_handle_one_connection (connect=connect@entry=0x55adefefa668) at /home/buildbot/buildbot/build/sql/sql_connect.cc:1354
#25 0x000055adee287f74 in handle_one_connection (arg=arg@entry=0x55adefefa668) at /home/buildbot/buildbot/build/sql/sql_connect.cc:1260
#26 0x000055adee4c0c2d in pfs_spawn_thread (arg=0x55adefea4fb8) at /home/buildbot/buildbot/build/storage/perfschema/pfs.cc:1863
#27 0x00007f3d43dcc494 in start_thread (arg=0x7f3d3d491700) at pthread_create.c:333
#28 0x00007f3d4348993f in clone () from /lib/x86_64-linux-gnu/libc.so.6
10.2 debug 7cca0df0d75
Error: Freeing overrun buffer 0x560f73e9da4c, 0x560f73e8b1f5, 0x560f733def88, 0x560f737816f2, 0x560f737e7cea, 0x560f73741d2b, 0x560f733f9c7e, 0x560f7345bb6b
Allocated at 0x560f733def6e, 0x560f73f06da2, 0x560f73f060bf, 0x560f73779dca, 0x560f73779f21, 0x560f7377a5ec, 0x560f737d9ba8, 0x560f737a3a5b
Error: Freeing overrun buffer 0x560f73e9da4c, 0x560f73e8b1f5, 0x560f733def88, 0x560f737816f2, mysys/safemalloc.c:194, sql/item_cmpfunc.h:2091, sql/item.cc:658, 0x560f73474db9
Allocated at 0x560f733def6e, 0x560f73f06da2, 0x560f73f060bf, 0x560f73779dca, 0x560f73779f21, 0x560f7377a5ec, 0x560f737d9ba8, 0x560f737a3a5b
Not reproducible on 10.1.
Not reproducible on 10.2 with condition_pushdown_for_derived=off.