Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18335

Assertion `!error || error == 137' failed in subselect_rowid_merge_engine::init

    XMLWordPrintable

    Details

      Description

      --source include/have_innodb.inc
      CREATE TABLE t1 (i1 int,v1 varchar(1),KEY (v1,i1)) engine=innodb;
      INSERT INTO t1 VALUES (8,'x'),(7,'d'),(1,'r'),(7,'f'),(9,'y'),(null,'u'),(1,'m'),(9,null),(2,'o'),(9,'w'),(2,'m'),(4,'q'),(0,null),(4,'d'),(8,'g'),(null,'x'),(null,'f'),(0,'p'),(null,'j'),(8,'c');
       
      CREATE TABLE t2 (pk int) engine=innodb;
       
      CREATE TABLE t3 (v2 varchar(1)) engine=innodb;
      INSERT INTO t3 VALUES ('i'),('e'),('p'),('s'),('j'),('z'),('c'),('a'),('q'),('y'),(NULL),('r'),('v'),(NULL),('r');
       
      CREATE TABLE t4 (v2 varchar(1)) engine=innodb;
      INSERT INTO t4 VALUES ('c'),('c'),('q'),('g'),('e'),('l'),(NULL),('v'),('c'),('u'),('x'),('x'),('x'),('l'),('e'),('s'),('k'),('m'),('x'),('s'),('h'),('u'),('x'),('l'),('p'),('i'),('u'),('i'),('i'),('e'),('h'),('f'),(NULL),('p'),('n'),('h'),('m'),('x'),('d'),('d'),('t'),(NULL),(NULL),('v'),('u'),('p'),('o'),('v'),('m'),('x'),('n'),('b'),(NULL),('r'),('v'),('a'),('u'),(NULL),('b'),('s'),('t'),('b'),('m'),('v'),('n'),('j'),(NULL),(NULL),('h'),('k'),('k'),(NULL),('n'),('e'),('s'),('w'),('y'),('z'),('b'),('f'),('s'),('d'),(NULL),('d'),('n'),('i'),(NULL),('h'),('d'),('c'),('i'),('t'),('g'),('q'),('l'),('n'),('z'),('n'),('r'),('p');
       
      SET SESSION join_cache_level=0;
       
      select 1
      from t2 join t1 on 
      ('i','w') not in (select t1.v1,t4.v2 from t4,(t1 join t3 on t3.v2 = t1.v1))
      limit rows examined 1000 ;
       
      #Cleanup
      drop table t1,t2,t3,t4;
      

      10.3 d4144c8e010b61a440d42

      /10.3/sql/item_subselect.cc:6251: bool subselect_rowid_merge_engine::init(MY_BITMAP*, MY_BITMAP*): Assertion `!error || error == 137' failed.
      190122 12:51:04 [ERROR] mysqld got signal 6 ;
       
      assert/assert.c:92(__assert_fail_base)[0x7f6eae1d3bd7]
      /lib/x86_64-linux-gnu/libc.so.6(+0x2dc82)[0x7f6eae1d3c82]
      sql/item_subselect.cc:6252(subselect_rowid_merge_engine::init(st_bitmap*, st_bitmap*))[0x556c222731eb]
      sql/item_subselect.cc:5544(subselect_hash_sj_engine::exec())[0x556c2226e4ec]
      sql/item_subselect.cc:727(Item_subselect::exec())[0x556c22245122]
      sql/item_subselect.cc:907(Item_in_subselect::exec())[0x556c22246327]
      sql/item_subselect.cc:1757(Item_in_subselect::val_bool())[0x556c2224e6ad]
      /home/alice/git/10.3/sql/mysqld(+0xd562cc)[0x556c217442cc]
      sql/item.h:1275(Item::val_bool_result())[0x556c22112900]
      sql/item_cmpfunc.cc:1602(Item_in_optimizer::val_int())[0x556c2174417c]
      sql/item.h:1271(Item::val_int_result())[0x556c220e8a1d]
      sql/item.cc:9872(Item_cache_int::cache_value())[0x556c220faade]
      sql/item.cc:8698(Item_cache_wrapper::cache())[0x556c220e17a7]
      sql/item.cc:8862(Item_cache_wrapper::val_bool())[0x556c22102369]
      sql/item_cmpfunc.cc:224(Item_func_not::val_int())[0x556c21a33c5e]
      sql/sql_select.cc:3942(JOIN::exec_inner())[0x556c21a326aa]
      sql/sql_select.cc:3835(JOIN::exec())[0x556c21a35b1c]
      sql/sql_select.cc:4241(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x556c21a10ec7]
      sql/sql_select.cc:385(handle_select(THD*, LEX*, select_result*, unsigned long))[0x556c219976a6]
      sql/sql_parse.cc:6548(execute_sqlcom_select(THD*, TABLE_LIST*))[0x556c21985e01]
      sql/sql_parse.cc:3769(mysql_execute_command(THD*))[0x556c219a00c1]
      sql/sql_parse.cc:8092(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x556c2197ab86]
      sql/sql_parse.cc:1853(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x556c21977d1e]
      sql/sql_parse.cc:1396(do_command(THD*))[0x556c21ccae63]
      sql/sql_connect.cc:1402(do_handle_one_connection(CONNECT*))[0x556c21cca840]
      sql/sql_connect.cc:1309(handle_one_connection)[0x556c22ff2359]
      /lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7f6eaee186ba]
      x86_64/clone.S:111(clone)[0x7f6eae2ad41d]
       
      Query (0x62b000000288): select 1 from t2 join t1 on  ('i','w') not in (select t1.v1,t4.v2 from t4,(t1 join t3 on t3.v2 = 
      

      Not reproducible on 10.2.

      10.3 non-debug build also fails, but later:

      10.3 d4144c8e0

      *** Error in `/data/bld/10.3-rel/bin/mysqld': free(): invalid next size (normal): 0x00007f1dc80c82f0 ***
      ======= Backtrace: =========
      /lib/x86_64-linux-gnu/libc.so.6(+0x70bcb)[0x7f1e27ae0bcb]
      /lib/x86_64-linux-gnu/libc.so.6(+0x76f96)[0x7f1e27ae6f96]
      /lib/x86_64-linux-gnu/libc.so.6(+0x7778e)[0x7f1e27ae778e]
      /data/bld/10.3-rel/bin/mysqld(delete_dynamic+0x17)[0x55e8a8403687]
      /data/bld/10.3-rel/bin/mysqld(_ZN11sp_pcontextD1Ev+0x7b)[0x55e8a7d10bfb]
      /data/bld/10.3-rel/bin/mysqld(_ZN7sp_headD2Ev+0x55)[0x55e8a7d057f5]
      /data/bld/10.3-rel/bin/mysqld(_ZN7sp_headD0Ev+0x9)[0x55e8a7d079b9]
      /data/bld/10.3-rel/bin/mysqld(_ZN19Table_triggers_listD1Ev+0x29)[0x55e8a7e22999]
      /data/bld/10.3-rel/bin/mysqld(+0x6de355)[0x55e8a7ee3355]
      /data/bld/10.3-rel/bin/mysqld(_Z8tc_purgeb+0x4d)[0x55e8a7ee4b8d]
      /data/bld/10.3-rel/bin/mysqld(_Z19close_cached_tablesP3THDP10TABLE_LISTbm+0x7d)[0x55e8a7d37b1d]
      /data/bld/10.3-rel/bin/mysqld(+0x4d6217)[0x55e8a7cdb217]
      /data/bld/10.3-rel/bin/mysqld(_Z10unireg_endv+0x2d)[0x55e8a7cdb57d]
      /data/bld/10.3-rel/bin/mysqld(+0x4da6c9)[0x55e8a7cdf6c9]
      /data/bld/10.3-rel/bin/mysqld(kill_server_thread+0xe)[0x55e8a7cdf77e]
      /data/bld/10.3-rel/bin/mysqld(+0x947db4)[0x55e8a814cdb4]
      /lib/x86_64-linux-gnu/libpthread.so.0(+0x7494)[0x7f1e29772494]
      /lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7f1e27b5893f]
      ======= Memory map: ========
      55e8a7805000-55e8a89fa000 r-xp 00000000 08:11 37313396                   /data/bld/10.3-rel/bin/mysqld
      55e8a8bf9000-55e8a8cff000 r--p 011f4000 08:11 37313396                   /data/bld/10.3-rel/bin/mysqld
      55e8a8cff000-55e8a8dba000 rw-p 012fa000 08:11 37313396                   /data/bld/10.3-rel/bin/mysqld
      55e8a8dba000-55e8a9656000 rw-p 00000000 00:00 0 
      55e8a9c18000-55e8aa109000 rw-p 00000000 00:00 0                          [heap]
      7f1dc8000000-7f1dc81f1000 rw-p 00000000 00:00 0 
      7f1dc81f1000-7f1dcc000000 ---p 00000000 00:00 0 
      7f1dcc000000-7f1dcc021000 rw-p 00000000 00:00 0 
      7f1dcc021000-7f1dd0000000 ---p 00000000 00:00 0 
      7f1dd0000000-7f1dd0021000 rw-p 00000000 00:00 0 
      7f1dd0021000-7f1dd4000000 ---p 00000000 00:00 0 
      7f1dd4000000-7f1dd4021000 rw-p 00000000 00:00 0 
      7f1dd4021000-7f1dd8000000 ---p 00000000 00:00 0 
      7f1dd8000000-7f1dd8021000 rw-p 00000000 00:00 0 
      7f1dd8021000-7f1ddc000000 ---p 00000000 00:00 0 
      7f1ddc000000-7f1ddc021000 rw-p 00000000 00:00 0 
      7f1ddc021000-7f1de0000000 ---p 00000000 00:00 0 
      7f1de0000000-7f1de0029000 rw-p 00000000 00:00 0 
      7f1de0029000-7f1de4000000 ---p 00000000 00:00 0 
      7f1de4000000-7f1de4021000 rw-p 00000000 00:00 0 
      7f1de4021000-7f1de8000000 ---p 00000000 00:00 0 
      7f1de8000000-7f1de8021000 rw-p 00000000 00:00 0 
      7f1de8021000-7f1dec000000 ---p 00000000 00:00 0 
      7f1df0000000-7f1df0021000 rw-p 00000000 00:00 0 
      7f1df0021000-7f1df4000000 ---p 00000000 00:00 0 
      7f1df8000000-7f1df8021000 rw-p 00000000 00:00 0 
      7f1df8021000-7f1dfc000000 ---p 00000000 00:00 0 
      7f1dfcffa000-7f1dfcffb000 ---p 00000000 00:00 0 
      7f1dfcffb000-7f1dfd7fb000 rw-p 00000000 00:00 0 
      7f1dfd7fb000-7f1dfd7fc000 ---p 00000000 00:00 0 
      7f1dfd7fc000-7f1dfdffc000 rw-p 00000000 00:00 0                          [stack:16461]
      7f1dfdffc000-7f1dfdffd000 ---p 00000000 00:00 0 
      7f1dfdffd000-7f1dfe7fd000 rw-p 00000000 00:00 0                          [stack:16460]
      7f1dfe7fd000-7f1dfe7fe000 ---p 00000000 00:00 0 
      7f1dfe7fe000-7f1dfeffe000 rw-p 00000000 00:00 0                          [stack:16459]
      7f1dff7ff000-7f1dff800000 ---p 00000000 00:00 0 
      7f1dff800000-7f1e00000000 rw-p 00000000 00:00 0 
      7f1e00000000-7f1e00021000 rw-p 00000000 00:00 0 
      7f1e00021000-7f1e04000000 ---p 00000000 00:00 0 
      7f1e04000000-7f1e04021000 rw-p 00000000 00:00 0 
      7f1e04021000-7f1e08000000 ---p 00000000 00:00 0 
      7f1e08000000-7f1e08021000 rw-p 00000000 00:00 0 
      7f1e08021000-7f1e0c000000 ---p 00000000 00:00 0 
      7f1e0c000000-7f1e0c021000 rw-p 00000000 00:00 0 
      7f1e0c021000-7f1e10000000 ---p 00000000 00:00 0 
      7f1e107f9000-7f1e107fa000 ---p 00000000 00:00 0 
      7f1e107fa000-7f1e10ffa000 rw-p 00000000 00:00 0 
      7f1e10ffa000-7f1e10ffb000 ---p 00000000 00:00 0 
      7f1e10ffb000-7f1e117fb000 rw-p 00000000 00:00 0 
      7f1e117fb000-7f1e117fc000 ---p 00000000 00:00 0 
      7f1e117fc000-7f1e11ffc000 rw-p 00000000 00:00 0 
      7f1e127fd000-7f1e127fe000 ---p 00000000 00:00 0 
      7f1e127fe000-7f1e12ffe000 rw-p 00000000 00:00 0                          [stack:16451]
      7f1e12ffe000-7f1e12fff000 ---p 00000000 00:00 0 
      7f1e12fff000-7f1e137ff000 rw-p 00000000 00:00 0                          [stack:16450]
      7f1e137ff000-7f1e13800000 ---p 00000000 00:00 0 
      7f1e13800000-7f1e14000000 rw-p 00000000 00:00 0                          [stack:16449]
      7f1e14000000-7f1e14021000 rw-p 00000000 00:00 0 
      7f1e14021000-7f1e18000000 ---p 00000000 00:00 0 
      7f1e18729000-7f1e1872a000 ---p 00000000 00:00 0 
      7f1e1872a000-7f1e18f2a000 rw-p 00000000 00:00 0                          [stack:16454]
      7f1e18f2a000-7f1e18f2b000 ---p 00000000 00:00 0 
      7f1e18f2b000-7f1e1972b000 rw-p 00000000 00:00 0                          [stack:16447]
      7f1e1972b000-7f1e1972c000 ---p 00000000 00:00 0 
      7f1e1972c000-7f1e19f2c000 rw-p 00000000 00:00 0                          [stack:16446]
      7f1e19f2c000-7f1e19f2d000 ---p 00000000 00:00 0 
      7f1e19f2d000-7f1e1a72d000 rw-p 00000000 00:00 0                          [stack:16445]
      7f1e1a72d000-7f1e1a72e000 ---p 00000000 00:00 0 
      7f1e1a72e000-7f1e1af2e000 rw-p 00000000 00:00 0                          [stack:16444]
      7f1e1af2e000-7f1e1af2f000 ---p 00000000 00:00 0 
      7f1e1af2f000-7f1e1b72f000 rw-p 00000000 00:00 0                          [stack:16443]
      7f1e1b72f000-7f1e1b730000 ---p 00000000 00:00 0 
      7f1e1b730000-7f1e1c000000 rw-p 00000000 00:00 0                          [stack:16442]
      7f1e1c000000-7f1e1c021000 rw-p 00000000 00:00 0 
      7f1e1c021000-7f1e20000000 ---p 00000000 00:00 0 
      7f1e2036f000-7f1e20574000 rw-p 00000000 00:00 0 
      7f1e20574000-7f1e20575000 ---p 00000000 00:00 0 
      7f1e20575000-7f1e20d75000 rw-p 00000000 00:00 0                          [stack:16441]
      7f1e20e4d000-7f1e20e4e000 ---p 00000000 00:00 0 
      7f1e20e4e000-7f1e20e97000 rw-p 00000000 00:00 0                          [stack:16478]
      7f1e20f2b000-7f1e20f2c000 ---p 00000000 00:00 0 
      7f1e20f2c000-7f1e20f75000 rw-p 00000000 00:00 0                          [stack:16463]
      7f1e20f75000-7f1e219a5000 rw-p 00000000 00:00 0 
      7f1e219a5000-7f1e21da6000 rw-p 00000000 00:00 0 
      7f1e21da6000-7f1e21da7000 ---p 00000000 00:00 0 
      7f1e21da7000-7f1e23042000 rw-p 00000000 00:00 0                          [stack:16440]
      7f1e23042000-7f1e23043000 ---p 00000000 00:00 0 
      7f1e23043000-7f1e23843000 rw-p 00000000 00:00 0                          [stack:16439]
      7f1e2393f000-7f1e27a70000 rw-p 00000000 00:00 0 
      7f1e27a70000-7f1e27c05000 r-xp 00000000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
      7f1e27c05000-7f1e27e04000 ---p 00195000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
      7f1e27e04000-7f1e27e08000 r--p 00194000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
      7f1e27e08000-7f1e27e0a000 rw-p 00198000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
      7f1e27e0a000-7f1e27e0e000 rw-p 00000000 00:00 0 
      7f1e27e0e000-7f1e27e24000 r-xp 00000000 08:05 3145732                    /lib/x86_64-linux-gnu/libgcc_s.so.1
      7f1e27e24000-7f1e28023000 ---p 00016000 08:05 3145732                    /lib/x86_64-linux-gnu/libgcc_s.so.1
      7f1e28023000-7f1e28024000 rw-p 00015000 08:05 3145732                    /lib/x86_64-linux-gnu/libgcc_s.so.1
      7f1e28024000-7f1e28127000 r-xp 00000000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
      7f1e28127000-7f1e28326000 ---p 00103000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
      7f1e28326000-7f1e28327000 r--p 00102000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
      7f1e28327000-7f1e28328000 rw-p 00103000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
      7f1e28328000-7f1e2849a000 r-xp 00000000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
      7f1e2849a000-7f1e2869a000 ---p 00172000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
      7f1e2869a000-7f1e286a4000 r--p 00172000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
      7f1e286a4000-7f1e286a6000 rw-p 0017c000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
      7f1e286a6000-7f1e286aa000 rw-p 00000000 00:00 0 
      7f1e286aa000-7f1e286ad000 r-xp 00000000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
      7f1e286ad000-7f1e288ac000 ---p 00003000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
      7f1e288ac000-7f1e288ad000 r--p 00002000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
      7f1e288ad000-7f1e288ae000 rw-p 00003000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
      7f1e288ae000-7f1e28a7b000 r-xp 00000000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
      7f1e28a7b000-7f1e28c7a000 ---p 001cd000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
      7f1e28c7a000-7f1e28c97000 r--p 001cc000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
      7f1e28c97000-7f1e28ca7000 rw-p 001e9000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
      7f1e28ca7000-7f1e28caa000 rw-p 00000000 00:00 0 
      7f1e28caa000-7f1e28d01000 r-xp 00000000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
      7f1e28d01000-7f1e28f01000 ---p 00057000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
      7f1e28f01000-7f1e28f04000 r--p 00057000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
      7f1e28f04000-7f1e28f0a000 rw-p 0005a000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
      7f1e28f0a000-7f1e28f0b000 rw-p 00000000 00:00 0 
      7f1e28f0b000-7f1e28f13000 r-xp 00000000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
      7f1e28f13000-7f1e29113000 ---p 00008000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
      7f1e29113000-7f1e29114000 r--p 00008000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
      7f1e29114000-7f1e29115000 rw-p 00009000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
      7f1e29115000-7f1e29143000 rw-p 00000000 00:00 0 
      7f1e29143000-7f1e2915d000 r-xp 00000000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
      7f1e2915d000-7f1e2935c000 ---p 0001a000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
      7f1e2935c000-7f1e2935d000 r--p 00019000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
      7f1e2935d000-7f1e2935e000 rw-p 0001a000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
      7f1e2935e000-7f1e29368000 r-xp 00000000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
      7f1e29368000-7f1e29567000 ---p 0000a000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
      7f1e29567000-7f1e29568000 r--p 00009000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
      7f1e29568000-7f1e29569000 rw-p 0000a000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
      7f1e29569000-7f1e2956a000 r-xp 00000000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
      7f1e2956a000-7f1e29769000 ---p 00001000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
      7f1e29769000-7f1e2976a000 r--p 00000000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
      7f1e2976a000-7f1e2976b000 rw-p 00001000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
      7f1e2976b000-7f1e29783000 r-xp 00000000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
      7f1e29783000-7f1e29982000 ---p 00018000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
      7f1e29982000-7f1e29983000 r--p 00017000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
      7f1e29983000-7f1e29984000 rw-p 00018000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
      7f1e29984000-7f1e29988000 rw-p 00000000 00:00 0 
      7f1e29988000-7f1e299ab000 r-xp 00000000 08:05 3145795                    /lib/x86_64-linux-gnu/ld-2.24.so
      7f1e299af000-7f1e299b5000 rw-s 00000000 08:11 37522030                   /data/bld/10.3-rel/mysql-test/var/mysqld.1/data/tc.log
      7f1e299b5000-7f1e299ba000 rw-s 00000000 00:0a 92024715                   /[aio] (deleted)
      7f1e299ba000-7f1e299bf000 rw-s 00000000 00:0a 92024714                   /[aio] (deleted)
      7f1e299bf000-7f1e29b91000 rw-p 00000000 00:00 0 
      7f1e29b91000-7f1e29b93000 rw-s 00000000 00:0a 92024716                   /[aio] (deleted)
      7f1e29b93000-7f1e29b98000 rw-s 00000000 00:0a 92024713                   /[aio] (deleted)
      7f1e29b98000-7f1e29b9d000 rw-s 00000000 00:0a 92024712                   /[aio] (deleted)
      7f1e29b9d000-7f1e29ba2000 rw-s 00000000 00:0a 92024711                   /[aio] (deleted)
      7f1e29ba2000-7f1e29ba7000 rw-s 00000000 00:0a 92024710                   /[aio] (deleted)
      7f1e29ba7000-7f1e29ba8000 rw-s 00000000 00:0a 92024709                   /[aio] (deleted)
      7f1e29ba8000-7f1e29bab000 rw-p 00000000 00:00 0 
      7f1e29bab000-7f1e29bac000 r--p 00023000 08:05 3145795                    /lib/x86_64-linux-gnu/ld-2.24.so
      7f1e29bac000-7f1e29bad000 rw-p 00024000 08:05 3145795                    /lib/x86_64-linux-gnu/ld-2.24.so
      7f1e29bad000-7f1e29bae000 rw-p 00000000 00:00 0 
      7ffdffa61000-7ffdffa84000 rw-p 00000000 00:00 0                          [stack]
      7ffdffb82000-7ffdffb84000 r-xp 00000000 00:00 0                          [vdso]
      7ffdffb84000-7ffdffb86000 r--p 00000000 00:00 0                          [vvar]
      ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
      ***Warnings generated in error logs during shutdown after running tests: bug.t2
      

      10.3 non-debug ASAN build produces heap-buffer-overflow:

      ==16621==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6190001238c0 at pc 0x55eed45c4e2e bp 0x7f79ce5c1a60 sp 0x7f79ce5c1a58
      WRITE of size 8 at 0x6190001238c0 thread T27
          #0 0x55eed45c4e2d in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
          #1 0x55eed45c4e2d in subselect_rowid_merge_engine::init(st_bitmap*, st_bitmap*) /data/src/10.3/sql/item_subselect.cc:6264
          #2 0x55eed45c78f8 in subselect_hash_sj_engine::exec() /data/src/10.3/sql/item_subselect.cc:5547
          #3 0x55eed4598aa3 in Item_subselect::exec() /data/src/10.3/sql/item_subselect.cc:727
          #4 0x55eed459c4a1 in Item_in_subselect::val_bool() /data/src/10.3/sql/item_subselect.cc:1757
          #5 0x55eed4457f76 in Item_in_optimizer::val_int() /data/src/10.3/sql/item_cmpfunc.cc:1602
          #6 0x55eed43be09c in Item_cache_int::cache_value() /data/src/10.3/sql/item.cc:9922
          #7 0x55eed4408b22 in Item_cache_wrapper::cache() /data/src/10.3/sql/item.cc:8770
          #8 0x55eed4408b22 in Item_cache_wrapper::val_bool() /data/src/10.3/sql/item.cc:8934
          #9 0x55eed442a36a in Item_func_not::val_int() /data/src/10.3/sql/item_cmpfunc.cc:224
          #10 0x55eed3ed2d71 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:3938
          #11 0x55eed3ed4b03 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3829
          #12 0x55eed3ed4f02 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4234
          #13 0x55eed3ed788b in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:382
          #14 0x55eed3b0d6a4 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6547
          #15 0x55eed3dc3642 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3769
          #16 0x55eed3dcbcb8 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8089
          #17 0x55eed3dd2cc7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
          #18 0x55eed3dd4e26 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
          #19 0x55eed407a287 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
          #20 0x55eed407a78a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #21 0x55eed4a0cd26 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
          #22 0x7f79d9d40493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
          #23 0x7f79d812693e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
       
      0x6190001238c0 is located 0 bytes to the right of 1088-byte region [0x619000123480,0x6190001238c0)
      allocated by thread T27 here:
          #0 0x7f79d9faa73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
          #1 0x55eed520bbbc in my_malloc /data/src/10.3/mysys/my_malloc.c:101
       
      Thread T27 created by T0 here:
          #0 0x7f79d9f79bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x55eed4a15446 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
       
      SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/include/x86_64-linux-gnu/bits/string3.h:53 memcpy
      Shadow bytes around the buggy address:
        0x0c328001c6c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c328001c6d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c328001c6e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c328001c6f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c328001c700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      =>0x0c328001c710: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
        0x0c328001c720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c328001c730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328001c740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328001c750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328001c760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Contiguous container OOB:fc
        ASan internal:           fe
      ==16621==ABORTING
      

        Attachments

          Activity

            People

            Assignee:
            varun Varun Gupta (Inactive)
            Reporter:
            alice Alice Sherepa
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: