FROM ps_product p INNER JOIN ps_product_shop product_shop
ON (product_shop.id_product = p.id_product AND product_shop.id_shop = 1)
INNER JOIN ps_category_product cp ON (cp.id_product = p.id_product)
INNER JOIN ps_category c ON (c.id_category = cp.id_category AND c.nleft >= 3 AND c.nright <= 24 AND c.active = 1)
LEFT JOIN `ps_stock_available` sa ON (sa.id_product = p.id_product AND sa.id_shop = 1)
INNER JOIN `ps_layered_price_index` psi ON (psi.id_product = p.id_product AND psi.id_currency = 1)
WHERE product_shop.`active` = 1 AND product_shop.`visibility` IN ("both","catalog") AND p.id_product IN
(SELECT id_product FROM ps_feature_product fp WHERE fp.`id_feature_value` = 32) AND p.id_product IN
(SELECT id_product FROM ps_feature_product fp WHERE fp.`id_feature_value` = 15) AND p.id_product IN
(SELECT id_product FROM ps_feature_product fp WHERE fp.`id_feature_value` = 18 OR fp.`id_feature_value` = 19) AND p.id_product IN
(SELECT id_product FROM ps_feature_product fp WHERE fp.`id_feature_value` = 34 OR fp.`id_feature_value` = 23) AND p.id_product IN
(SELECT id_product FROM ps_feature_product fp WHERE fp.`id_feature_value` = 29 OR fp.`id_feature_value` = 28 OR fp.`id_feature_value` = 26)
GROUP BY p.id_product;
Log:
Feb 8 10:26:19 uvn-234-24 mysqld: Version: '10.2.12-MariaDB' socket: '/var/lib/mysql/mysql.sock' port: 3306 MariaDB Server
Feb 8 10:26:19 uvn-234-24 systemd: Started MariaDB database server.
Feb 8 10:26:55 uvn-234-24 systemd: Started Session 1150 of user root.
Feb 8 10:26:55 uvn-234-24 systemd-logind: New session 1150 of user root.
Feb 8 10:26:55 uvn-234-24 systemd: Starting Session 1150 of user root.
Feb 8 10:26:55 uvn-234-24 systemd-logind: Removed session 1150.
Feb 8 10:28:31 uvn-234-24 mysqld: 180208 10:28:31 [ERROR] mysqld got signal 11 ;
Feb 8 10:28:31 uvn-234-24 mysqld: This could be because you hit a bug. It is also possible that this binary
Feb 8 10:28:31 uvn-234-24 mysqld: or one of the libraries it was linked against is corrupt, improperly built,
Feb 8 10:28:31 uvn-234-24 mysqld: or misconfigured. This error can also be caused by malfunctioning hardware.
Feb 8 10:28:31 uvn-234-24 mysqld: To report this bug, see https://mariadb.com/kb/en/reporting-bugs
Feb 8 10:28:31 uvn-234-24 mysqld: We will try our best to scrape up some info that will hopefully help
Feb 8 10:28:31 uvn-234-24 mysqld: diagnose the problem, but since we have already crashed,
Feb 8 10:28:31 uvn-234-24 mysqld: something is definitely wrong and this may fail.
Feb 8 10:28:31 uvn-234-24 mysqld: Server version: 10.2.12-MariaDB
Feb 8 10:28:31 uvn-234-24 mysqld: key_buffer_size=134217728
Feb 8 10:28:31 uvn-234-24 mysqld: read_buffer_size=131072
Feb 8 10:28:31 uvn-234-24 mysqld: max_used_connections=1
Feb 8 10:28:31 uvn-234-24 mysqld: max_threads=153
Feb 8 10:28:31 uvn-234-24 mysqld: thread_count=7
Feb 8 10:28:31 uvn-234-24 mysqld: It is possible that mysqld could use up to
Feb 8 10:28:31 uvn-234-24 mysqld: key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 467244 K bytes of memory
Feb 8 10:28:31 uvn-234-24 mysqld: Hope that's ok; if not, decrease some variables in the equation.
Feb 8 10:28:31 uvn-234-24 mysqld: Thread pointer: 0x7fe6e9a04e38
Feb 8 10:28:31 uvn-234-24 mysqld: Attempting backtrace. You can use the following information to find out
Feb 8 10:28:31 uvn-234-24 mysqld: where mysqld died. If you see no messages after this, something went
Feb 8 10:28:31 uvn-234-24 mysqld: terribly wrong...
Feb 8 10:28:31 uvn-234-24 mysqld: stack_bottom = 0x7fe6d80c6d70 thread_stack 0x49000
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(my_print_stacktrace+0x2e)[0x7fe6e6511c4e]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(handle_fatal_signal+0x355)[0x7fe6e5f9c825]
Feb 8 10:28:31 uvn-234-24 mysqld: /lib64/libpthread.so.0(+0xf130)[0x7fe6e5501130]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_ZN10TABLE_LIST33is_with_table_recursive_referenceEv+0x0)[0x7fe6e5f2e4a0]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_ZN13st_join_table7cleanupEv+0x18)[0x7fe6e5e489d8]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_ZN4JOIN7cleanupEb+0x368)[0x7fe6e5e49058]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_ZN4JOIN9join_freeEv+0x4c)[0x7fe6e5e4934c]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_ZN4JOIN10exec_innerEv+0x9b5)[0x7fe6e5e60635]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_ZN4JOIN4execEv+0x33)[0x7fe6e5e608d3]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_Z12mysql_selectP3THDP10TABLE_LISTjR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x11a)[0x7fe6e5e60a2a]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_Z13handle_selectP3THDP3LEXP13select_resultm+0x254)[0x7fe6e5e61584]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(+0x415dcc)[0x7fe6e5d46dcc]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x6d85)[0x7fe6e5e113a5]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_statebb+0x2de)[0x7fe6e5e13a5e]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcjbb+0x209f)[0x7fe6e5e16a6f]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_Z10do_commandP3THD+0x149)[0x7fe6e5e17669]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(_Z24do_handle_one_connectionP7CONNECT+0x1aa)[0x7fe6e5edaefa]
Feb 8 10:28:31 uvn-234-24 mysqld: /usr/sbin/mysqld(handle_one_connection+0x3d)[0x7fe6e5edb01d]
Feb 8 10:28:31 uvn-234-24 mysqld: /lib64/libpthread.so.0(+0x7df3)[0x7fe6e54f9df3]
Feb 8 10:28:31 uvn-234-24 mysqld: /lib64/libc.so.6(clone+0x6d)[0x7fe6e3b511ad]
Feb 8 10:28:31 uvn-234-24 mysqld: Trying to get some variables.
Feb 8 10:28:31 uvn-234-24 mysqld: Some pointers may be invalid and cause the dump to abort.
Feb 8 10:28:31 uvn-234-24 mysqld: Query (0x7fe6e9a12400): SELECT p.`id_product`, product_shop.`condition`, p.`id_manufacturer`, sa.`quantity`, p.`weight` , psi.price_min, psi.price_max FROM ps_product p INNER JOIN ps_product_shop product_shop ON (product_shop.id_product = p.id_product AND product_shop.id_shop = 1) INNER JOIN ps_category_product cp ON (cp.id_product = p.id_product) INNER JOIN ps_category c ON (c.id_category = cp.id_category AND c.nleft >= 3 AND c.nright <= 24 AND c.active = 1) LEFT JOIN `ps_stock_available` sa ON (sa.id_product = p.id_product AND sa.id_shop = 1) INNER JOIN `ps_layered_price_index` psi ON (psi.id_product = p.id_product AND psi.id_currency = 1) WHERE product_shop.`active` = 1 AND product_shop.`visibility` IN ("both","catalog") AND p.id_product IN (SELECT id_product FROM ps_feature_product fp WHERE fp.`id_feature_value` = 32) AND p.id_product IN (SELECT id_product FROM ps_feature_product fp WHERE fp.`id_feature_value` = 15) AND p.id_product IN (SELECT id_product FROM ps_feature_product fp WHERE fp.`id_feature_value` = 18 OR fp.`id_feature_value` = 19) AND p.id_product IN (SELECT id_product FROM ps_feature_product fp WHERE fp.`id_feature_value` = 34 OR fp.`id_feature_value` = 23) AND p.id_product IN (SELECT id_product FROM ps_feature_product fp WHERE fp.`id_feature_value` = 29 OR fp.`id_feature_value` = 28 OR fp.`id_feature_value` = 26) GROUP BY p.id_product
Feb 8 10:28:31 uvn-234-24 mysqld: Connection ID (thread ID): 10
Feb 8 10:28:31 uvn-234-24 mysqld: Status: NOT_KILLED
Feb 8 10:28:31 uvn-234-24 mysqld: Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on
Feb 8 10:28:31 uvn-234-24 mysqld: The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
Feb 8 10:28:31 uvn-234-24 mysqld: information that should help you find out what is causing the crash.
Feb 8 10:28:31 uvn-234-24 systemd: mariadb.service: main process exited, code=killed, status=11/SEGV
Feb 8 10:28:31 uvn-234-24 systemd: Unit mariadb.service entered failed state.
Feb 8 10:28:31 uvn-234-24 systemd: mariadb.service failed.
Feb 8 10:28:36 uvn-234-24 systemd: mariadb.service holdoff time over, scheduling restart.
Feb 8 10:28:36 uvn-234-24 systemd: Starting MariaDB database server...
Oddly, for me the crash is only reproducible with a non-debug build.
ASAN also throws errors, but also on a non-debug build.
Valgrind produces 'Invalid read'.
Here is a somewhat shortened test case. I've intentionally kept the problematic query intact, only the dump is a bit reduced, and put together with the query in an MTR-like test case.
#13 0x5591b41866ff in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1360
#14 0x5591b440a5c7 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
#15 0x5591b440aaba in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#16 0x5591b4d59426 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
#17 0x7f327f7ba493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#18 0x7f327dba093e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
10.2 non-debug 5a7b6db6711
#2 <signal handler called>
#3 TABLE_LIST::is_with_table_recursive_reference (this=0x4048800000000000) at /data/src/10.2/sql/sql_cte.cc:1097
#4 0x000055b532617197 in st_join_table::cleanup (this=0x7fc3301873d8) at /data/src/10.2/sql/sql_select.cc:11767
#5 0x000055b532617848 in JOIN::cleanup (this=0x7fc3300429e0, full=full@entry=true) at /data/src/10.2/sql/sql_select.cc:12200
#6 0x000055b532617bd9 in JOIN::join_free (this=this@entry=0x7fc3300429e0) at /data/src/10.2/sql/sql_select.cc:12106
#7 0x000055b532630cdc in do_select (procedure=<optimized out>, join=0x7fc3300429e0) at /data/src/10.2/sql/sql_select.cc:18281
#8 JOIN::exec_inner (this=this@entry=0x7fc3300429e0) at /data/src/10.2/sql/sql_select.cc:3566
#9 0x000055b532630fb9 in JOIN::exec (this=this@entry=0x7fc3300429e0) at /data/src/10.2/sql/sql_select.cc:3361
#10 0x000055b5326310fb in mysql_select (thd=thd@entry=0x7fc3300009a8, tables=0x7fc3300104a8, wild_num=0, fields=..., conds=0x7fc33004e098, og_num=1, order=0x0, group=0x7fc330042760, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fc3300429c0, unit=0x7fc330004390, select_lex=0x7fc330004ac8) at /data/src/10.2/sql/sql_select.cc:3761
#11 0x000055b532631b06 in handle_select (thd=thd@entry=0x7fc3300009a8, lex=lex@entry=0x7fc3300042c8, result=result@entry=0x7fc3300429c0, setup_tables_done_option=setup_tables_done_option@entry=0) at /data/src/10.2/sql/sql_select.cc:376
#12 0x000055b53252275f in execute_sqlcom_select (thd=0x7fc3300009a8, all_tables=0x7fc3300104a8) at /data/src/10.2/sql/sql_parse.cc:6456
#13 0x000055b5325e05c9 in mysql_execute_command (thd=0x7fc3300009a8) at /data/src/10.2/sql/sql_parse.cc:3467
#14 0x000055b5325e2bc9 in mysql_parse (thd=0x7fc3300009a8, rawbuf=<optimized out>, length=1357, parser_state=0x7fc340377240, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /data/src/10.2/sql/sql_parse.cc:7902
#15 0x000055b5325e5624 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7fc3300009a8, packet=packet@entry=0x7fc330035109 "", packet_length=packet_length@entry=1357, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/src/10.2/sql/sql_parse.cc:1806
#16 0x000055b5325e5ec3 in do_command (thd=0x7fc3300009a8) at /data/src/10.2/sql/sql_parse.cc:1360
#17 0x000055b5326ad924 in do_handle_one_connection (connect=connect@entry=0x55b534b5d088) at /data/src/10.2/sql/sql_connect.cc:1335
#18 0x000055b5326adac4 in handle_one_connection (arg=arg@entry=0x55b534b5d088) at /data/src/10.2/sql/sql_connect.cc:1241
#19 0x000055b53296e1c4 in pfs_spawn_thread (arg=0x55b534b125f8) at /data/src/10.2/storage/perfschema/pfs.cc:1862
#20 0x00007fc347d74494 in start_thread (arg=0x7fc340378700) at pthread_create.c:333
#21 0x00007fc34615a93f in clone () from /lib/x86_64-linux-gnu/libc.so.6
JOIN t6 ON (t6.id_product = t5.id_product AND t6.id_shop = 1)
JOIN t2 ON (t2.id_product = t5.id_product)
JOIN t1 ON (t1.id_category = t2.id_category AND t1.nleft >= 3 AND t1.nright <= 24 AND t1.active = 1)
LEFTJOIN t7 ON (t7.id_product = t5.id_product)
JOIN t4 ON (t4.id_product = t5.id_product AND t4.id_currency = 1)
WHERE 1=1
AND t5.id_product IN (SELECT id_product FROM t3 WHERE t3.`id_t3` = 32)
AND t5.id_product IN (SELECT id_product FROM t3 WHERE t3.`id_t3` = 15)
AND t5.id_product IN (SELECT id_product FROM t3 WHERE t3.`id_t3` = 18 OR t3.`id_t3` = 19)
AND t5.id_product IN (SELECT id_product FROM t3 WHERE t3.`id_t3` = 34 OR t3.`id_t3` = 23)
AND t5.id_product IN (SELECT id_product FROM t3 WHERE t3.`id_t3` = 29 OR t3.`id_t3` = 28 OR t3.`id_t3` = 26);
droptable t1,t2,t3,t4,t5,t6,t7;
on debug, built as cmake -DWITH_EMBEDDED_SERVER=OFF -DWITH_UNIT_TESTS=OFF -DCMAKE_BUILD_TYPE=Debug -DPLUGIN_TOKUDB=NO -DPLUGIN_MROONGA=NO -DPLUGIN_OQGRAPH=NO -DPLUGIN_ROCKSDB=NO -DWITH_SSL=bundled -DWITH_VALGRIND=ON
#13 0x5586ceb2ad46 in do_command(THD*) /home/alice/git/10.2/sql/sql_parse.cc:1360
#14 0x5586cee4836a in do_handle_one_connection(CONNECT*) /home/alice/git/10.2/sql/sql_connect.cc:1335
#15 0x5586cee47d72 in handle_one_connection /home/alice/git/10.2/sql/sql_connect.cc:1241
#16 0x5586cf618a27 in pfs_spawn_thread /home/alice/git/10.2/storage/perfschema/pfs.cc:1862
#17 0x7f6e144426b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
Thread T5 created by T0 here:
#0 0x7f6e14ee6253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
#1 0x5586cf618e14 in spawn_thread_v1 /home/alice/git/10.2/storage/perfschema/pfs.cc:1912
#2 0x5586ce93bc26 in inline_mysql_thread_create /home/alice/git/10.2/include/mysql/psi/mysql_thread.h:1239
#3 0x5586ce94ffed in create_thread_to_handle_connection(CONNECT*) /home/alice/git/10.2/sql/mysqld.cc:6431
#4 0x5586ce9506ed in create_new_thread /home/alice/git/10.2/sql/mysqld.cc:6501
#5 0x5586ce951719 in handle_connections_sockets() /home/alice/git/10.2/sql/mysqld.cc:6776
#6 0x5586ce94f53a in mysqld_main(int, char**) /home/alice/git/10.2/sql/mysqld.cc:6050
#7 0x5586ce93a5bf in main /home/alice/git/10.2/sql/main.cc:25
#8 0x7f6e137f082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
if I build only with -DCMAKE_BUILD_TYPE=Debug, I get sql_class.cc:1650: virtual THD::~THD(): Assertion `status_var.local_memory_used == 0 || !debug_assert_on_not_freed_memory' failed, but no backtrace.
It looks like I hit the same problem on MariaDB 10.2.13. The database server produces a segmentation fault on a specific SELECT query.
My application sets the character set to utf8mb4. When I change it to utf8, the query does not trigger the crash anymore. When I prefix the query with EXPLAIN to see the query plan, the crash is triggered for both the utf8mb4 and utf8 character sets as well as the latin1 character set (did not try others yet).
The query is a select query reading from InnoDB tables. I run the CentOS RPMs that are offered here:
In case it is valuable to try and produce more details about the crash, please let me know.
Dik Takken
added a comment - It looks like I hit the same problem on MariaDB 10.2.13. The database server produces a segmentation fault on a specific SELECT query.
My application sets the character set to utf8mb4 . When I change it to utf8 , the query does not trigger the crash anymore. When I prefix the query with EXPLAIN to see the query plan, the crash is triggered for both the utf8mb4 and utf8 character sets as well as the latin1 character set (did not try others yet).
The query is a select query reading from InnoDB tables. I run the CentOS RPMs that are offered here:
http://yum.mariadb.org/10.2/centos7-amd64/rpms/
which do not include a version with debugging symbols. So, the stack trace is not very detailed but here it is:
180319 12:28:11 [ERROR] mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
To report this bug, see https://mariadb.com/kb/en/reporting-bugs
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.
Server version: 10.2.13-MariaDB
key_buffer_size=33554432
read_buffer_size=131072
max_used_connections=73
max_threads=502
thread_count=79
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 1135817 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
Thread pointer: 0x7f0de99bc8e8
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f0e74a30d70 thread_stack 0x49000
//sbin/mysqld(my_print_stacktrace+0x2e)[0x560fcb8566ce]
//sbin/mysqld(handle_fatal_signal+0x355)[0x560fcb2de085]
sigaction.c:0(__restore_rt)[0x7f0eda2b25e0]
//sbin/mysqld(_ZN10TABLE_LIST33is_with_table_recursive_referenceEv+0x1)[0x560fcb26fc61]
sql/sql_cte.cc:1093(TABLE_LIST::is_with_table_recursive_reference())[0x560fcb187df8]
sql/sql_select.cc:11767(st_join_table::cleanup())[0x560fcb188478]
sql/sql_select.cc:12201(JOIN::cleanup(bool))[0x560fcb18876c]
sql/sql_select.cc:12102(JOIN::join_free())[0x560fcb19fc55]
sql/sql_select.cc:18283(JOIN::exec_inner())[0x560fcb19fef3]
sql/sql_select.cc:3362(JOIN::exec())[0x560fcb1a004a]
sql/sql_select.cc:3763(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x560fcb1a0ba4]
sql/sql_select.cc:376(handle_select(THD*, LEX*, select_result*, unsigned long))[0x560fcb085eb9]
sql/sql_parse.cc:6457(execute_sqlcom_select(THD*, TABLE_LIST*))[0x560fcb150495]
sql/sql_parse.cc:3467(mysql_execute_command(THD*))[0x560fcb152d5e]
sql/sql_parse.cc:1806(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x560fcb155d9e]
sql/sql_parse.cc:1362(do_command(THD*))[0x560fcb156999]
sql/sql_connect.cc:1335(do_handle_one_connection(CONNECT*))[0x560fcb21b23a]
sql/sql_connect.cc:1243(handle_one_connection)[0x560fcb21b35d]
pthread_create.c:0(start_thread)[0x7f0eda2aae25]
/lib64/libc.so.6(clone+0x6d)[0x7f0ed888234d]
In case it is valuable to try and produce more details about the crash, please let me know.
#0 0x00007fde412dd428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1 0x00007fde412df02a in __GI_abort () at abort.c:89
#2 0x00007fde4131f7ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fde41438ed8 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3 0x00007fde4132a651 in malloc_printerr (ar_ptr=0x7fde3c41f0b0, ptr=0x7fde201782e0, str=0x7fde414392e0 "malloc(): memory corruption (fast)", action=3) at malloc.c:5006
#4 _int_malloc (av=av@entry=0x7fde20000020, bytes=bytes@entry=56) at malloc.c:3386
#5 0x00007fde4132c184 in __GI___libc_malloc (bytes=bytes@entry=56) at malloc.c:2913
#6 0x00007fde4307c737 in _dl_map_object_deps (map=map@entry=0x7fde43269000, preloads=preloads@entry=0x0, npreloads=npreloads@entry=0, trace_mode=trace_mode@entry=0, open_mode=open_mode@entry=-2147483648) at dl-deps.c:499
#7 0x00007fde430835e2 in dl_open_worker (a=a@entry=0x7fde3c41f520) at dl-open.c:280
#8 0x00007fde4307e564 in _dl_catch_error (objname=objname@entry=0x7fde3c41f510, errstring=errstring@entry=0x7fde3c41f518, mallocedp=mallocedp@entry=0x7fde3c41f50f, operate=operate@entry=0x7fde430834d0 <dl_open_worker>, args=args@entry=0x7fde3c41f520) at dl-error.c:187
#9 0x00007fde43082da9 in _dl_open (file=0x7fde41434686 "libgcc_s.so.1", mode=-2147483647, caller_dlopen=0x7fde413bda85 <init+21>, nsid=-2, argc=<optimized out>, argv=<optimized out>, env=0x7ffec9f594a0) at dl-open.c:660
#10 0x00007fde413eb5ad in do_dlopen (ptr=ptr@entry=0x7fde3c41f740) at dl-libc.c:87
#11 0x00007fde4307e564 in _dl_catch_error (objname=0x7fde3c41f730, errstring=0x7fde3c41f738, mallocedp=0x7fde3c41f72f, operate=0x7fde413eb570 <do_dlopen>, args=0x7fde3c41f740) at dl-error.c:187
#12 0x00007fde413eb664 in dlerror_run (args=0x7fde3c41f740, operate=0x7fde413eb570 <do_dlopen>) at dl-libc.c:46
#13 __GI___libc_dlopen_mode (name=name@entry=0x7fde41434686 "libgcc_s.so.1", mode=mode@entry=-2147483647) at dl-libc.c:163
#14 0x00007fde413bda85 in init () at ../sysdeps/x86_64/backtrace.c:52
#15 0x00007fde41f21a99 in __pthread_once_slow (once_control=0x7fde41670110 <once>, init_routine=0x7fde413bda70 <init>) at pthread_once.c:116
#16 0x00007fde413bdba4 in __GI___backtrace (array=<optimized out>, size=<optimized out>) at ../sysdeps/x86_64/backtrace.c:105
#17 0x000055a32e4a270b in my_print_stacktrace (stack_bottom=0x7fde3c420e70 "\230\n", thread_stack=299008, silent=0 '\000') at /home/alice/git/10.3/mysys/stacktrace.c:269
#18 0x000055a32dc90d68 in handle_fatal_signal (sig=11) at /home/alice/git/10.3/sql/signal_handler.cc:166
#19 <signal handler called>
#20 __memset_avx2 () at ../sysdeps/x86_64/multiarch/memset-avx2.S:161
#21 0x000055a32e49a0c9 in my_free (ptr=0x7fde20037398) at /home/alice/git/10.3/mysys/my_malloc.c:220
#22 0x000055a32e48ac26 in free_root (root=0x7fde20006110, MyFlags=1) at /home/alice/git/10.3/mysys/my_alloc.c:418
#23 0x000055a32d993df4 in dispatch_command (command=COM_QUERY, thd=0x7fde20000a98, packet=0x7fde2014e539 '\217' <repeats 200 times>..., packet_length=786, is_com_multi=false, is_next_command=false) at /home/alice/git/10.3/sql/sql_parse.cc:2436
#24 0x000055a32d990a14 in do_command (thd=0x7fde20000a98) at /home/alice/git/10.3/sql/sql_parse.cc:1391
#25 0x000055a32dafb957 in do_handle_one_connection (connect=0x55a331c25778) at /home/alice/git/10.3/sql/sql_connect.cc:1402
#26 0x000055a32dafb6a8 in handle_one_connection (arg=0x55a331c25778) at /home/alice/git/10.3/sql/sql_connect.cc:1308
#27 0x000055a32dee18d6 in pfs_spawn_thread (arg=0x55a331c1f648) at /home/alice/git/10.3/storage/perfschema/pfs.cc:1862
#28 0x00007fde41f1a6ba in start_thread (arg=0x7fde3c421700) at pthread_create.c:333
#29 0x00007fde413af41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
Alice Sherepa
added a comment - 10.3 3bbc30c73b3db
Thread 1 (Thread 0x7fde3c421700 (LWP 4528)):
#0 0x00007fde412dd428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1 0x00007fde412df02a in __GI_abort () at abort.c:89
#2 0x00007fde4131f7ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fde41438ed8 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3 0x00007fde4132a651 in malloc_printerr (ar_ptr=0x7fde3c41f0b0, ptr=0x7fde201782e0, str=0x7fde414392e0 "malloc(): memory corruption (fast)", action=3) at malloc.c:5006
#4 _int_malloc (av=av@entry=0x7fde20000020, bytes=bytes@entry=56) at malloc.c:3386
#5 0x00007fde4132c184 in __GI___libc_malloc (bytes=bytes@entry=56) at malloc.c:2913
#6 0x00007fde4307c737 in _dl_map_object_deps (map=map@entry=0x7fde43269000, preloads=preloads@entry=0x0, npreloads=npreloads@entry=0, trace_mode=trace_mode@entry=0, open_mode=open_mode@entry=-2147483648) at dl-deps.c:499
#7 0x00007fde430835e2 in dl_open_worker (a=a@entry=0x7fde3c41f520) at dl-open.c:280
#8 0x00007fde4307e564 in _dl_catch_error (objname=objname@entry=0x7fde3c41f510, errstring=errstring@entry=0x7fde3c41f518, mallocedp=mallocedp@entry=0x7fde3c41f50f, operate=operate@entry=0x7fde430834d0 <dl_open_worker>, args=args@entry=0x7fde3c41f520) at dl-error.c:187
#9 0x00007fde43082da9 in _dl_open (file=0x7fde41434686 "libgcc_s.so.1", mode=-2147483647, caller_dlopen=0x7fde413bda85 <init+21>, nsid=-2, argc=<optimized out>, argv=<optimized out>, env=0x7ffec9f594a0) at dl-open.c:660
#10 0x00007fde413eb5ad in do_dlopen (ptr=ptr@entry=0x7fde3c41f740) at dl-libc.c:87
#11 0x00007fde4307e564 in _dl_catch_error (objname=0x7fde3c41f730, errstring=0x7fde3c41f738, mallocedp=0x7fde3c41f72f, operate=0x7fde413eb570 <do_dlopen>, args=0x7fde3c41f740) at dl-error.c:187
#12 0x00007fde413eb664 in dlerror_run (args=0x7fde3c41f740, operate=0x7fde413eb570 <do_dlopen>) at dl-libc.c:46
#13 __GI___libc_dlopen_mode (name=name@entry=0x7fde41434686 "libgcc_s.so.1", mode=mode@entry=-2147483647) at dl-libc.c:163
#14 0x00007fde413bda85 in init () at ../sysdeps/x86_64/backtrace.c:52
#15 0x00007fde41f21a99 in __pthread_once_slow (once_control=0x7fde41670110 <once>, init_routine=0x7fde413bda70 <init>) at pthread_once.c:116
#16 0x00007fde413bdba4 in __GI___backtrace (array=<optimized out>, size=<optimized out>) at ../sysdeps/x86_64/backtrace.c:105
#17 0x000055a32e4a270b in my_print_stacktrace (stack_bottom=0x7fde3c420e70 "\230\n", thread_stack=299008, silent=0 '\000') at /home/alice/git/10.3/mysys/stacktrace.c:269
#18 0x000055a32dc90d68 in handle_fatal_signal (sig=11) at /home/alice/git/10.3/sql/signal_handler.cc:166
#19 <signal handler called>
#20 __memset_avx2 () at ../sysdeps/x86_64/multiarch/memset-avx2.S:161
#21 0x000055a32e49a0c9 in my_free (ptr=0x7fde20037398) at /home/alice/git/10.3/mysys/my_malloc.c:220
#22 0x000055a32e48ac26 in free_root (root=0x7fde20006110, MyFlags=1) at /home/alice/git/10.3/mysys/my_alloc.c:418
#23 0x000055a32d993df4 in dispatch_command (command=COM_QUERY, thd=0x7fde20000a98, packet=0x7fde2014e539 '\217' <repeats 200 times>..., packet_length=786, is_com_multi=false, is_next_command=false) at /home/alice/git/10.3/sql/sql_parse.cc:2436
#24 0x000055a32d990a14 in do_command (thd=0x7fde20000a98) at /home/alice/git/10.3/sql/sql_parse.cc:1391
#25 0x000055a32dafb957 in do_handle_one_connection (connect=0x55a331c25778) at /home/alice/git/10.3/sql/sql_connect.cc:1402
#26 0x000055a32dafb6a8 in handle_one_connection (arg=0x55a331c25778) at /home/alice/git/10.3/sql/sql_connect.cc:1308
#27 0x000055a32dee18d6 in pfs_spawn_thread (arg=0x55a331c1f648) at /home/alice/git/10.3/storage/perfschema/pfs.cc:1862
#28 0x00007fde41f1a6ba in start_thread (arg=0x7fde3c421700) at pthread_create.c:333
#29 0x00007fde413af41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
[ Looks like another materialization bug.
If I run the query provided in description with the optimizer_switch='materialization=off ', then i don't see any crash.
]
Thanks for the report and test case.
Oddly, for me the crash is only reproducible with a non-debug build.
ASAN also throws errors, but also on a non-debug build.
Valgrind produces 'Invalid read'.
Here is a somewhat shortened test case. I've intentionally kept the problematic query intact, only the dump is a bit reduced, and put together with the query in an MTR-like test case.
10.2 valgrind 5a7b6db6711
==13948== Invalid write of size 8
==13948== at 0x7194CE: make_join_select(JOIN*, SQL_SELECT*, Item*) (sql_select.cc:10174)
==13948== by 0x70103B: JOIN::optimize_inner() (sql_select.cc:1735)
==13948== by 0x6FEA4C: JOIN::optimize() (sql_select.cc:1113)
==13948== by 0x707CEB: mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:3747)
==13948== by 0x6FC241: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:376)
==13948== by 0x6C7516: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:6456)
==13948== by 0x6BD59B: mysql_execute_command(THD*) (sql_parse.cc:3467)
==13948== by 0x6CAF4C: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:7902)
==13948== by 0x6B8E6A: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1806)
==13948== by 0x6B77CD: do_command(THD*) (sql_parse.cc:1360)
==13948== by 0x80B6BD: do_handle_one_connection(CONNECT*) (sql_connect.cc:1335)
==13948== by 0x80B44A: handle_one_connection (sql_connect.cc:1241)
==13948== by 0xC4BE85: pfs_spawn_thread (pfs.cc:1862)
==13948== by 0x4E3F493: start_thread (pthread_create.c:333)
==13948== by 0x6A9A93E: clone (clone.S:97)
==13948== Address 0xe663bd0 is 8 bytes after a block of size 17,512 alloc'd
==13948== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
==13948== by 0x10EE236: my_malloc (my_malloc.c:101)
==13948== by 0x10DF18C: alloc_root (my_alloc.c:188)
==13948== by 0x10DF3AD: multi_alloc_root (my_alloc.c:309)
==13948== by 0x708218: make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*) (sql_select.cc:3871)
==13948== by 0x7002B7: JOIN::optimize_inner() (sql_select.cc:1537)
==13948== by 0x6FEA4C: JOIN::optimize() (sql_select.cc:1113)
==13948== by 0x707CEB: mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:3747)
==13948== by 0x6FC241: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:376)
==13948== by 0x6C7516: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:6456)
==13948== by 0x6BD59B: mysql_execute_command(THD*) (sql_parse.cc:3467)
==13948== by 0x6CAF4C: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:7902)
==13948== by 0x6B8E6A: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1806)
==13948== by 0x6B77CD: do_command(THD*) (sql_parse.cc:1360)
==13948== by 0x80B6BD: do_handle_one_connection(CONNECT*) (sql_connect.cc:1335)
==13948== by 0x80B44A: handle_one_connection (sql_connect.cc:1241)
10.2 non-debug asan 5a7b6db671
==14160==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5591b4515122 sp 0x7f3273428330 bp 0x0c5a00051d0e T5)
#0 0x5591b4515121 in TABLE_LIST::is_with_table_recursive_reference() /data/src/10.2/sql/sql_cte.cc:1097
#1 0x5591b421a026 in st_join_table::cleanup() /data/src/10.2/sql/sql_select.cc:11767
#2 0x5591b421b236 in JOIN::cleanup(bool) /data/src/10.2/sql/sql_select.cc:12200
#3 0x5591b421c6d3 in JOIN::join_free() /data/src/10.2/sql/sql_select.cc:12106
#4 0x5591b42733ac in do_select /data/src/10.2/sql/sql_select.cc:18281
#5 0x5591b42733ac in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3566
#6 0x5591b4274233 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3361
#7 0x5591b4274636 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3761
#8 0x5591b4276f4b in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:376
#9 0x5591b3f315f6 in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6456
#10 0x5591b416bc80 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3467
#11 0x5591b417d593 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7902
#12 0x5591b418466a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1806
#13 0x5591b41866ff in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1360
#14 0x5591b440a5c7 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
#15 0x5591b440aaba in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#16 0x5591b4d59426 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
#17 0x7f327f7ba493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#18 0x7f327dba093e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
10.2 non-debug 5a7b6db6711
#2 <signal handler called>
#3 TABLE_LIST::is_with_table_recursive_reference (this=0x4048800000000000) at /data/src/10.2/sql/sql_cte.cc:1097
#4 0x000055b532617197 in st_join_table::cleanup (this=0x7fc3301873d8) at /data/src/10.2/sql/sql_select.cc:11767
#5 0x000055b532617848 in JOIN::cleanup (this=0x7fc3300429e0, full=full@entry=true) at /data/src/10.2/sql/sql_select.cc:12200
#6 0x000055b532617bd9 in JOIN::join_free (this=this@entry=0x7fc3300429e0) at /data/src/10.2/sql/sql_select.cc:12106
#7 0x000055b532630cdc in do_select (procedure=<optimized out>, join=0x7fc3300429e0) at /data/src/10.2/sql/sql_select.cc:18281
#8 JOIN::exec_inner (this=this@entry=0x7fc3300429e0) at /data/src/10.2/sql/sql_select.cc:3566
#9 0x000055b532630fb9 in JOIN::exec (this=this@entry=0x7fc3300429e0) at /data/src/10.2/sql/sql_select.cc:3361
#10 0x000055b5326310fb in mysql_select (thd=thd@entry=0x7fc3300009a8, tables=0x7fc3300104a8, wild_num=0, fields=..., conds=0x7fc33004e098, og_num=1, order=0x0, group=0x7fc330042760, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fc3300429c0, unit=0x7fc330004390, select_lex=0x7fc330004ac8) at /data/src/10.2/sql/sql_select.cc:3761
#11 0x000055b532631b06 in handle_select (thd=thd@entry=0x7fc3300009a8, lex=lex@entry=0x7fc3300042c8, result=result@entry=0x7fc3300429c0, setup_tables_done_option=setup_tables_done_option@entry=0) at /data/src/10.2/sql/sql_select.cc:376
#12 0x000055b53252275f in execute_sqlcom_select (thd=0x7fc3300009a8, all_tables=0x7fc3300104a8) at /data/src/10.2/sql/sql_parse.cc:6456
#13 0x000055b5325e05c9 in mysql_execute_command (thd=0x7fc3300009a8) at /data/src/10.2/sql/sql_parse.cc:3467
#14 0x000055b5325e2bc9 in mysql_parse (thd=0x7fc3300009a8, rawbuf=<optimized out>, length=1357, parser_state=0x7fc340377240, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /data/src/10.2/sql/sql_parse.cc:7902
#15 0x000055b5325e5624 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7fc3300009a8, packet=packet@entry=0x7fc330035109 "", packet_length=packet_length@entry=1357, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/src/10.2/sql/sql_parse.cc:1806
#16 0x000055b5325e5ec3 in do_command (thd=0x7fc3300009a8) at /data/src/10.2/sql/sql_parse.cc:1360
#17 0x000055b5326ad924 in do_handle_one_connection (connect=connect@entry=0x55b534b5d088) at /data/src/10.2/sql/sql_connect.cc:1335
#18 0x000055b5326adac4 in handle_one_connection (arg=arg@entry=0x55b534b5d088) at /data/src/10.2/sql/sql_connect.cc:1241
#19 0x000055b53296e1c4 in pfs_spawn_thread (arg=0x55b534b125f8) at /data/src/10.2/storage/perfschema/pfs.cc:1862
#20 0x00007fc347d74494 in start_thread (arg=0x7fc340378700) at pthread_create.c:333
#21 0x00007fc34615a93f in clone () from /lib/x86_64-linux-gnu/libc.so.6