Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-20224

main.derived crashes with ASAN with error use-after-poison

Details

    Description

      When I run the main.derived test on 10.5 with ASAN enabled then the test fails and the stack trace is

      Server log from this test:
      ----------SERVER LOG START-----------
      =================================================================
      ==27857==ERROR: AddressSanitizer: use-after-poison on address 0x62b000174cf8 at pc 0x561e0a9d36ec bp 0x7f110b606820 sp 0x7f110b606810
      READ of size 8 at 0x62b000174cf8 thread T8
          #0 0x561e0a9d36eb in st_select_lex::collect_grouping_fields(THD*) /home/varunraiko/MariaDB/maria-dev/sql/sql_lex.cc:7901
          #1 0x561e0a9e2b67 in st_select_lex::pushdown_from_having_into_where(THD*, Item*) /home/varunraiko/MariaDB/maria-dev/sql/sql_lex.cc:10194
          #2 0x561e0aad2cfe in JOIN::optimize_inner() /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:1980
          #3 0x561e0aace910 in JOIN::optimize() /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:1575
          #4 0x561e0aaee72a in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:4598
          #5 0x561e0aac1795 in handle_select(THD*, LEX*, select_result*, unsigned long) /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:425
          #6 0x561e0aa38205 in execute_sqlcom_select /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:6319
          #7 0x561e0aa24810 in mysql_execute_command(THD*) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:3882
          #8 0x561e0aa413fd in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:7868
          #9 0x561e0aa172c2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:1826
          #10 0x561e0aa13a62 in do_command(THD*) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:1359
          #11 0x561e0ae1dfd8 in do_handle_one_connection(CONNECT*, bool) /home/varunraiko/MariaDB/maria-dev/sql/sql_connect.cc:1413
          #12 0x561e0ae1d883 in handle_one_connection /home/varunraiko/MariaDB/maria-dev/sql/sql_connect.cc:1309
          #13 0x561e0ba86b58 in pfs_spawn_thread /home/varunraiko/MariaDB/maria-dev/storage/perfschema/pfs.cc:1862
          #14 0x7f11156506da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
          #15 0x7f111483688e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)
      
      

      The commit I tested against

      commit 46553c250808f0cc21e91f7e13439add2903aea0 (origin/HEAD, origin/10.5, 10.5)
      Author: Noel Kuntze <noel@familie-kuntze.de>
      Date:   Fri May 31 04:18:24 2019 +0200
       
          Fix compiler warnings GCC8
      

      Attachments

        Issue Links

          Activity

            varun Varun Gupta (Inactive) created issue -
            varun Varun Gupta (Inactive) made changes -
            Field Original Value New Value
            Assignee Galina Shalygina [ shagalla ] Varun Gupta [ varun ]
            varun Varun Gupta (Inactive) made changes -
            Description When I run the main.derived test on 10.5 with ASAN enabled then the test fails and the stack trace is


            {noformat}
            Server log from this test:
            ----------SERVER LOG START-----------
            =================================================================
            ==27857==ERROR: AddressSanitizer: use-after-poison on address 0x62b000174cf8 at pc 0x561e0a9d36ec bp 0x7f110b606820 sp 0x7f110b606810
            READ of size 8 at 0x62b000174cf8 thread T8
                #0 0x561e0a9d36eb in st_select_lex::collect_grouping_fields(THD*) /home/varunraiko/MariaDB/maria-dev/sql/sql_lex.cc:7901
                #1 0x561e0a9e2b67 in st_select_lex::pushdown_from_having_into_where(THD*, Item*) /home/varunraiko/MariaDB/maria-dev/sql/sql_lex.cc:10194
                #2 0x561e0aad2cfe in JOIN::optimize_inner() /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:1980
                #3 0x561e0aace910 in JOIN::optimize() /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:1575
                #4 0x561e0aaee72a in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:4598
                #5 0x561e0aac1795 in handle_select(THD*, LEX*, select_result*, unsigned long) /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:425
                #6 0x561e0aa38205 in execute_sqlcom_select /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:6319
                #7 0x561e0aa24810 in mysql_execute_command(THD*) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:3882
                #8 0x561e0aa413fd in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:7868
                #9 0x561e0aa172c2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:1826
                #10 0x561e0aa13a62 in do_command(THD*) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:1359
                #11 0x561e0ae1dfd8 in do_handle_one_connection(CONNECT*, bool) /home/varunraiko/MariaDB/maria-dev/sql/sql_connect.cc:1413
                #12 0x561e0ae1d883 in handle_one_connection /home/varunraiko/MariaDB/maria-dev/sql/sql_connect.cc:1309
                #13 0x561e0ba86b58 in pfs_spawn_thread /home/varunraiko/MariaDB/maria-dev/storage/perfschema/pfs.cc:1862
                #14 0x7f11156506da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
                #15 0x7f111483688e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

            {noformat}

            The commit I tested against

            {noformat}
            commit 46553c250808f0cc21e91f7e13439add2903aea0 (origin/HEAD, origin/10.5, 10.5)
            Author: Noel Kuntze <noel@familie-kuntze.de>
            Date: Fri May 31 04:18:24 2019 +0200

                Fix compiler warnings GCC8
            {noformat}

            varun Varun Gupta (Inactive) added a comment - - edited

            The test case where this fails

            EXPLAIN
            SELECT Customer, Success, SUM(OrderSize)
             FROM (SELECT Customer,
             CASE WHEN DeliveryStatus='Success' THEN 'Yes' ELSE 'No' END AS Success,
             OrderSize
             FROM example1463) as subQ
             GROUP BY Success, Customer
             HAVING Success IS NOT NULL;
            

            Inside the function st_select_lex::collect_grouping_fields we try to collect list of group by items that are of type Item_field.
            For the above case the item Success is Item_direct_view_ref and the ref is to a Functional Item.
            So this Item should not be added to the grouping_fields list

            varun Varun Gupta (Inactive) added a comment - - edited The test case where this fails EXPLAIN SELECT Customer, Success, SUM(OrderSize) FROM (SELECT Customer, CASE WHEN DeliveryStatus='Success' THEN 'Yes' ELSE 'No' END AS Success, OrderSize FROM example1463) as subQ GROUP BY Success, Customer HAVING Success IS NOT NULL; Inside the function st_select_lex::collect_grouping_fields we try to collect list of group by items that are of type Item_field. For the above case the item Success is Item_direct_view_ref and the ref is to a Functional Item. So this Item should not be added to the grouping_fields list
            varun Varun Gupta (Inactive) added a comment - Patch http://lists.askmonty.org/pipermail/commits/2019-August/013916.html

            The illegal cast also happens on 10.4 but somehow ASAN is not able to catch it

            varun Varun Gupta (Inactive) added a comment - The illegal cast also happens on 10.4 but somehow ASAN is not able to catch it
            varun Varun Gupta (Inactive) made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            varun Varun Gupta (Inactive) made changes -
            Assignee Varun Gupta [ varun ] Igor Babaev [ igor ]
            Status In Progress [ 3 ] In Review [ 10002 ]
            varun Varun Gupta (Inactive) made changes -
            Fix Version/s 10.5.0 [ 23709 ]
            Fix Version/s 10.4.8 [ 23721 ]
            Fix Version/s 10.5 [ 23123 ]
            Assignee Igor Babaev [ igor ] Varun Gupta [ varun ]
            Resolution Fixed [ 1 ]
            Status In Review [ 10002 ] Closed [ 6 ]
            varun Varun Gupta (Inactive) made changes -
            alice Alice Sherepa made changes -
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 98620 ] MariaDB v4 [ 156555 ]

            People

              varun Varun Gupta (Inactive)
              varun Varun Gupta (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.