Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18171

Server crashes in _ma_rec_pack / _ma_write_blob_record or in _mi_rec_pack / _mi_write_blob_record upon SELECT with UNION

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 10.3(EOL), 10.4(EOL)
    • 10.3.17, 10.4.7
    • Server
    • None

    Description

      CREATE TABLE t1 (b BLOB, i INT);
      		 
      INSERT INTO t1 VALUES ('foo',1),('bar',2);
      		 
      INSERT INTO t1 SELECT * FROM t1;
      		 
       
      		 
      ( SELECT BINARY b, GROUP_CONCAT(i) FROM t1 ) UNION ( SELECT BINARY b, GROUP_CONCAT(i) FROM t1 );
      		 
       
      		 
      # Cleanup
      		 
      DROP TABLE t1;

      10.3 d27bea9e9a

      		 
      #3  <signal handler called>
      		 
      #4  0x00007fe9e3a34e31 in __memmove_avx_unaligned_erms () from /lib/x86_64-linux-gnu/libc.so.6
      		 
      #5  0x000055d150092fee in _ma_rec_pack (info=0x7fe9cc16db70, to=0x7fe9cc18fbee "", from=0x7fe9cc03885a "") at /data/src/10.3/storage/maria/ma_dynrec.c:982
      		 
      #6  0x000055d15009034c in _ma_write_blob_record (info=0x7fe9cc16db70, record=0x7fe9cc038858 "\374\003") at /data/src/10.3/storage/maria/ma_dynrec.c:258
      		 
      #7  0x000055d15011c403 in maria_write (info=0x7fe9cc16db70, record=0x7fe9cc038858 "\374\003") at /data/src/10.3/storage/maria/ma_write.c:284
      		 
      #8  0x000055d15009fdeb in ha_maria::write_row (this=0x7fe9cc181c48, buf=0x7fe9cc038858 "\374\003") at /data/src/10.3/storage/maria/ha_maria.cc:1291
      		 
      #9  0x000055d14fc2689e in handler::ha_write_tmp_row (this=0x7fe9cc181c48, buf=0x7fe9cc038858 "\374\003") at /data/src/10.3/sql/sql_class.h:6413
      		 
      #10 0x000055d14fc891e9 in select_unit::send_data (this=0x7fe9cc017580, values=...) at /data/src/10.3/sql/sql_union.cc:149
      		 
      #11 0x000055d14fc10bbe in end_send_group (join=0x7fe9cc017668, join_tab=0x7fe9cc019900, end_of_records=true) at /data/src/10.3/sql/sql_select.cc:20728
      		 
      #12 0x000055d14fc0d2d8 in sub_select (join=0x7fe9cc017668, join_tab=0x7fe9cc019550, end_of_records=true) at /data/src/10.3/sql/sql_select.cc:19347
      		 
      #13 0x000055d14fc0caa0 in do_select (join=0x7fe9cc017668, procedure=0x0) at /data/src/10.3/sql/sql_select.cc:18938
      		 
      #14 0x000055d14fbe5631 in JOIN::exec_inner (this=0x7fe9cc017668) at /data/src/10.3/sql/sql_select.cc:4040
      		 
      #15 0x000055d14fbe4a72 in JOIN::exec (this=0x7fe9cc017668) at /data/src/10.3/sql/sql_select.cc:3834
      		 
      #16 0x000055d14fc8ddb5 in st_select_lex_unit::exec (this=0x7fe9cc0049b0) at /data/src/10.3/sql/sql_union.cc:1470
      		 
      #17 0x000055d14fc88d5d in mysql_union (thd=0x7fe9cc000b00, lex=0x7fe9cc0048e8, result=0x7fe9cc017558, unit=0x7fe9cc0049b0, setup_tables_done_option=0) at /data/src/10.3/sql/sql_union.cc:41
      		 
      #18 0x000055d14fbd7b52 in handle_select (thd=0x7fe9cc000b00, lex=0x7fe9cc0048e8, result=0x7fe9cc017558, setup_tables_done_option=0) at /data/src/10.3/sql/sql_select.cc:363
      		 
      #19 0x000055d14fba2670 in execute_sqlcom_select (thd=0x7fe9cc000b00, all_tables=0x7fe9cc0156c0) at /data/src/10.3/sql/sql_parse.cc:6548
      		 
      #20 0x000055d14fb98ce1 in mysql_execute_command (thd=0x7fe9cc000b00) at /data/src/10.3/sql/sql_parse.cc:3769
      		 
      #21 0x000055d14fba6629 in mysql_parse (thd=0x7fe9cc000b00, rawbuf=0x7fe9cc014cd8 "( SELECT BINARY b, GROUP_CONCAT(i) FROM t1 ) UNION ( SELECT BINARY b, GROUP_CONCAT(i) FROM t1 )", length=95, parser_state=0x7fe9ddade5f0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:8092
      		 
      #22 0x000055d14fb937dd in dispatch_command (command=COM_QUERY, thd=0x7fe9cc000b00, packet=0x7fe9cc00b1e1 "( SELECT BINARY b, GROUP_CONCAT(i) FROM t1 ) UNION ( SELECT BINARY b, GROUP_CONCAT(i) FROM t1 )", packet_length=95, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1851
      		 
      #23 0x000055d14fb92201 in do_command (thd=0x7fe9cc000b00) at /data/src/10.3/sql/sql_parse.cc:1396
      		 
      #24 0x000055d14fcfa216 in do_handle_one_connection (connect=0x55d15210ab30) at /data/src/10.3/sql/sql_connect.cc:1402
      		 
      #25 0x000055d14fcf9f9a in handle_one_connection (arg=0x55d15210ab30) at /data/src/10.3/sql/sql_connect.cc:1308
      		 
      #26 0x000055d1501948c1 in pfs_spawn_thread (arg=0x55d152157750) at /data/src/10.3/storage/perfschema/pfs.cc:1862
      		 
      #27 0x00007fe9e560e494 in start_thread (arg=0x7fe9ddadf700) at pthread_create.c:333
      		 
      #28 0x00007fe9e39f493f in clone () from /lib/x86_64-linux-gnu/libc.so.6

      Reproducible also when the server is compiled with USE_ARIA_FOR_TMP_TABLES=OFF:

      #3  <signal handler called>
      		 
      #4  0x00007f1bceb37e31 in __memmove_avx_unaligned_erms () from /lib/x86_64-linux-gnu/libc.so.6
      		 
      #5  0x000055f98c6ec6db in _mi_rec_pack (info=0x7f1bb8069b80, to=0x7f1bb818040e "", from=0x7f1bb803887a "") at /data/src/10.3-bug/storage/myisam/mi_dynrec.c:998
      		 
      #6  0x000055f98c6e9bcd in _mi_write_blob_record (info=0x7f1bb8069b80, record=0x7f1bb8038878 "\374\003") at /data/src/10.3-bug/storage/myisam/mi_dynrec.c:290
      		 
      #7  0x000055f98c70e3f6 in mi_write (info=0x7f1bb8069b80, record=0x7f1bb8038878 "\374\003") at /data/src/10.3-bug/storage/myisam/mi_write.c:146
      		 
      #8  0x000055f98c6ca0af in ha_myisam::write_row (this=0x7f1bb8120618, buf=0x7f1bb8038878 "\374\003") at /data/src/10.3-bug/storage/myisam/ha_myisam.cc:924
      		 
      #9  0x000055f98bd7b6ae in handler::ha_write_tmp_row (this=0x7f1bb8120618, buf=0x7f1bb8038878 "\374\003") at /data/src/10.3-bug/sql/sql_class.h:6413
      		 
      #10 0x000055f98bdddff9 in select_unit::send_data (this=0x7f1bb8017580, values=...) at /data/src/10.3-bug/sql/sql_union.cc:149
      		 
      #11 0x000055f98bd659ce in end_send_group (join=0x7f1bb8017668, join_tab=0x7f1bb8019900, end_of_records=true) at /data/src/10.3-bug/sql/sql_select.cc:20728
      		 
      #12 0x000055f98bd620e8 in sub_select (join=0x7f1bb8017668, join_tab=0x7f1bb8019550, end_of_records=true) at /data/src/10.3-bug/sql/sql_select.cc:19347
      		 
      #13 0x000055f98bd618b0 in do_select (join=0x7f1bb8017668, procedure=0x0) at /data/src/10.3-bug/sql/sql_select.cc:18938
      		 
      #14 0x000055f98bd3a5cf in JOIN::exec_inner (this=0x7f1bb8017668) at /data/src/10.3-bug/sql/sql_select.cc:4040
      		 
      #15 0x000055f98bd39a10 in JOIN::exec (this=0x7f1bb8017668) at /data/src/10.3-bug/sql/sql_select.cc:3834
      		 
      #16 0x000055f98bde2bc5 in st_select_lex_unit::exec (this=0x7f1bb80049b0) at /data/src/10.3-bug/sql/sql_union.cc:1470
      		 
      #17 0x000055f98bdddb6d in mysql_union (thd=0x7f1bb8000b00, lex=0x7f1bb80048e8, result=0x7f1bb8017558, unit=0x7f1bb80049b0, setup_tables_done_option=0) at /data/src/10.3-bug/sql/sql_union.cc:41
      		 
      #18 0x000055f98bd2caf0 in handle_select (thd=0x7f1bb8000b00, lex=0x7f1bb80048e8, result=0x7f1bb8017558, setup_tables_done_option=0) at /data/src/10.3-bug/sql/sql_select.cc:363
      		 
      #19 0x000055f98bcf760e in execute_sqlcom_select (thd=0x7f1bb8000b00, all_tables=0x7f1bb80156c0) at /data/src/10.3-bug/sql/sql_parse.cc:6548
      		 
      #20 0x000055f98bcedc7f in mysql_execute_command (thd=0x7f1bb8000b00) at /data/src/10.3-bug/sql/sql_parse.cc:3769
      		 
      #21 0x000055f98bcfb5c7 in mysql_parse (thd=0x7f1bb8000b00, rawbuf=0x7f1bb8014cd8 "( SELECT BINARY b, GROUP_CONCAT(i) FROM t1 ) UNION ( SELECT BINARY b, GROUP_CONCAT(i) FROM t1 )", length=95, parser_state=0x7f1bc8be15f0, is_com_multi=false, is_next_command=false) at /data/src/10.3-bug/sql/sql_parse.cc:8092
      		 
      #22 0x000055f98bce877b in dispatch_command (command=COM_QUERY, thd=0x7f1bb8000b00, packet=0x7f1bb80a42b1 "( SELECT BINARY b, GROUP_CONCAT(i) FROM t1 ) UNION ( SELECT BINARY b, GROUP_CONCAT(i) FROM t1 )", packet_length=95, is_com_multi=false, is_next_command=false) at /data/src/10.3-bug/sql/sql_parse.cc:1851
      		 
      #23 0x000055f98bce719f in do_command (thd=0x7f1bb8000b00) at /data/src/10.3-bug/sql/sql_parse.cc:1396
      		 
      #24 0x000055f98be4f026 in do_handle_one_connection (connect=0x55f98edf6a60) at /data/src/10.3-bug/sql/sql_connect.cc:1402
      		 
      #25 0x000055f98be4edaa in handle_one_connection (arg=0x55f98edf6a60) at /data/src/10.3-bug/sql/sql_connect.cc:1308
      		 
      #26 0x000055f98c2e96d1 in pfs_spawn_thread (arg=0x55f98ee43680) at /data/src/10.3-bug/storage/perfschema/pfs.cc:1862
      		 
      #27 0x00007f1bd0711494 in start_thread (arg=0x7f1bc8be2700) at pthread_create.c:333
      		 
      #28 0x00007f1bceaf793f in clone () from /lib/x86_64-linux-gnu/libc.so.6

      All of debug, non-debug and ASAN builds are affected.
      Not reproducible on 10.2.

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-17551 Assertion `(&(&share->intern_lock)->m_mutex)->count > 0 && pthread_equal(pthread_self(), (&(&share->intern_lock)->m_mutex)->thread)' failed in _ma_state_info_write or ER_CRASHED_ON_USAGE upon SELECT with UNION

          • Major - Major loss of function.
          • Closed

          Activity

            People

              monty Michael Widenius
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.