Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-14241

Server crash in key_copy / get_matching_chain_by_join_key or valgrind warnings

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 5.5, 10.0, 10.1, 10.2
    • Fix Version/s: 5.5.59
    • Component/s: Optimizer
    • Labels:
      None
    • Sprint:
      10.1.30

      Description

      The stack trace is very similar to what we have in MDEV-10397, but there are behavioral differences, so I'm filing it separately to make sure both are fixed:

      • no BIT fields in this test case
      • no LEFT JOIN
      • at least for me, this one only crashes on a non-debug build, and produces valgring warnings on a valgrind build; no crash on debug build.

      CREATE TABLE t1 (a VARCHAR(10)) ENGINE=MyISAM;
      CREATE OR REPLACE ALGORITHM=TEMPTABLE VIEW v1 AS SELECT * FROM t1;
      INSERT INTO t1 VALUES ('foo'),('bar');
       
      CREATE TABLE t2 (b integer auto_increment primary key) ENGINE=MyISAM;
      INSERT INTO t2 VALUES (NULL),(NULL);
       
      CREATE TABLE t3 (c VARCHAR(1024) CHARACTER SET utf8, d INT) ENGINE=MyISAM;
      CREATE OR REPLACE ALGORITHM=TEMPTABLE VIEW v3 AS SELECT * FROM t3;
      INSERT INTO t3 VALUES ('abc',NULL),('def',4);
       
      SET join_cache_level= 8;
      SELECT * FROM v1, t2, v3 WHERE a = c AND b = d;
       
      # Cleanup
      DROP VIEW v1, v3;
      DROP TABLE t1, t2, t3;
      

      5.5.56 release

      #2  <signal handler called>
      #3  key_copy (to_key=0x7f1931dcda25 "", from_record=0x7f1931cfa018 "\375\003", key_info=<optimized out>, key_length=3070, with_zerofill=with_zerofill@entry=true) at /home/buildbot/buildbot/build/sql/key.cc:155
      #4  0x0000000000679c8c in get_matching_chain_by_join_key (this=0x7f1931dcd870) at /home/buildbot/buildbot/build/sql/sql_join_cache.cc:3640
      #5  JOIN_CACHE_BNLH::prepare_look_for_matches (this=0x7f1931dcd870, skip_last=<optimized out>) at /home/buildbot/buildbot/build/sql/sql_join_cache.cc:3677
      #6  0x0000000000678e69 in JOIN_CACHE::join_matching_records (this=0x7f1931dcd870, skip_last=false) at /home/buildbot/buildbot/build/sql/sql_join_cache.cc:2277
      #7  0x0000000000678948 in JOIN_CACHE::join_records (this=this@entry=0x7f1931dcd870, skip_last=skip_last@entry=false) at /home/buildbot/buildbot/build/sql/sql_join_cache.cc:2091
      #8  0x00000000005c381a in sub_select_cache (join=0x7f1931cf2018, join_tab=0x7f1931d63918, end_of_records=<optimized out>) at /home/buildbot/buildbot/build/sql/sql_select.cc:16768
      #9  0x00000000005da513 in sub_select (join_tab=0x7f1931d635f8, join=0x7f1931cf2018, end_of_records=<optimized out>) at /home/buildbot/buildbot/build/sql/sql_select.cc:16938
      #10 do_select (join=join@entry=0x7f1931cf2018, fields=fields@entry=0x7f1932603980, table=table@entry=0x0, procedure=0x0) at /home/buildbot/buildbot/build/sql/sql_select.cc:16649
      #11 0x00000000005efd94 in JOIN::exec (this=this@entry=0x7f1931cf2018) at /home/buildbot/buildbot/build/sql/sql_select.cc:2878
      #12 0x00000000005eb0a5 in mysql_select (thd=thd@entry=0x7f1932600000, rref_pointer_array=rref_pointer_array@entry=0x7f1932603ad8, tables=0x7f1931d02238, wild_num=<optimized out>, fields=..., conds=<optimized out>, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=result@entry=0x7f1931cf7f00, unit=0x7f1932603188, select_lex=select_lex@entry=0x7f1932603868) at /home/buildbot/buildbot/build/sql/sql_select.cc:3099
      #13 0x00000000005f1cc3 in handle_select (thd=thd@entry=0x7f1932600000, lex=lex@entry=0x7f19326030d8, result=result@entry=0x7f1931cf7f00, setup_tables_done_option=setup_tables_done_option@entry=0) at /home/buildbot/buildbot/build/sql/sql_select.cc:319
      #14 0x000000000059bd18 in execute_sqlcom_select (thd=thd@entry=0x7f1932600000, all_tables=0x7f1931d02238) at /home/buildbot/buildbot/build/sql/sql_parse.cc:4686
      #15 0x00000000005a3ba3 in mysql_execute_command (thd=thd@entry=0x7f1932600000) at /home/buildbot/buildbot/build/sql/sql_parse.cc:2234
      #16 0x00000000005a74c4 in mysql_parse (thd=thd@entry=0x7f1932600000, parser_state=parser_state@entry=0x7f19384bc6e0, length=<optimized out>, rawbuf=<optimized out>) at /home/buildbot/buildbot/build/sql/sql_parse.cc:5931
      #17 0x00000000005a9983 in dispatch_command (command=COM_QUERY, thd=0x7f1932600000, packet=<optimized out>, packet_length=46) at /home/buildbot/buildbot/build/sql/sql_parse.cc:1245
      #18 0x00000000005a9afe in do_command (thd=<optimized out>) at /home/buildbot/buildbot/build/sql/sql_parse.cc:793
      #19 0x000000000065c58b in do_handle_one_connection (thd_arg=thd_arg@entry=0x7f1932600000) at /home/buildbot/buildbot/build/sql/sql_connect.cc:1268
      #20 0x000000000065c60c in handle_one_connection (arg=arg@entry=0x7f1932600000) at /home/buildbot/buildbot/build/sql/sql_connect.cc:1184
      #21 0x0000000000979828 in pfs_spawn_thread (arg=0x7f1936441d30) at /home/buildbot/buildbot/build/storage/perfschema/pfs.cc:1015
      #22 0x00007f1937aaa494 in start_thread (arg=0x7f19384bd700) at pthread_create.c:333
      #23 0x00007f193716793f in clone () from /lib/x86_64-linux-gnu/libc.so.6
      

      5.5 93aadda513d8b5 valgrind build

      ==29579== Thread 4:
      ==29579== Invalid read of size 1
      ==29579==    at 0x87E2CA: key_copy(unsigned char*, unsigned char*, st_key*, unsigned int, bool) (key.cc:124)
      ==29579==    by 0x73B9A2: JOIN_CACHE_BNLH::get_matching_chain_by_join_key() (sql_join_cache.cc:3640)
      ==29579==    by 0x73BA33: JOIN_CACHE_BNLH::prepare_look_for_matches(bool) (sql_join_cache.cc:3677)
      ==29579==    by 0x739A68: JOIN_CACHE::join_matching_records(bool) (sql_join_cache.cc:2277)
      ==29579==    by 0x739532: JOIN_CACHE::join_records(bool) (sql_join_cache.cc:2091)
      ==29579==    by 0x660045: sub_select_cache(JOIN*, st_join_table*, bool) (sql_select.cc:16843)
      ==29579==    by 0x660250: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:17013)
      ==29579==    by 0x65FD39: do_select(JOIN*, List<Item>*, TABLE*, Procedure*) (sql_select.cc:16724)
      ==29579==    by 0x63DF57: JOIN::exec() (sql_select.cc:2882)
      ==29579==    by 0x63E735: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:3103)
      ==29579==    by 0x634DD9: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:319)
      ==29579==    by 0x60D4D0: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:4685)
      ==29579==    by 0x606843: mysql_execute_command(THD*) (sql_parse.cc:2233)
      ==29579==    by 0x6100B9: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5930)
      ==29579==    by 0x603D9E: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1075)
      ==29579==    by 0x602FAA: do_command(THD*) (sql_parse.cc:793)
      ==29579==  Address 0xa957353 is 19 bytes after a block of size 64 in arena "client"
      

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                varun Varun Gupta
                Reporter:
                elenst Elena Stepanova
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: