Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23937

SIGSEGV in looped best_extension_by_limited_search from greedy_search on NATURAL JOIN | SIGSEGV in restore_prev_nj_state

    XMLWordPrintable

Details

    Description

      The following testcase, sporadically (average occurrence about once every 90-400 attempts):

      # Loop 90-3000 times
      		 
      DROP DATABASE test;
      		 
      CREATE DATABASE test;
      		 
      USE test;
      		 
      CREATE TABLE t3 (b VARCHAR (1));
      		 
      CREATE TABLE t2 (c2 INT);
      		 
      SET SESSION join_cache_level=3;
      		 
      INSERT INTO t2 VALUES (14619+0.75);
      		 
      CREATE TEMPORARY TABLE t1 AS SELECT * FROM mysql.user;
      		 
      DELETE IGNORE a2,a3 FROM t2 AS a1 JOIN t AS a2 INNER JOIN t2 AS a3;
      		 
      SELECT * FROM (SELECT * FROM t1 NATURAL JOIN t2) AS a NATURAL LEFT JOIN (SELECT * FROM t1 NATURAL JOIN t3) AS b;

      Leads to:

      10.5.6 2bac9782aa81ad386beaf00eb126ccf2d15031a1 (Optimized)

      		 
      Core was generated by `/test/MD150920-mariadb-10.5.6-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
      		 
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      		 
      [Current thread is 1 (Thread 0x146715e52700 (LWP 3260361))]
      		 
      (gdb) bt
      		 
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      		 
      #1  0x000055acfc476ae7 in my_write_core (sig=sig@entry=11) at /data/10.5_opt/mysys/stacktrace.c:424
      		 
      #2  0x000055acfbe45fda in handle_fatal_signal (sig=11) at /data/10.5_opt/sql/signal_handler.cc:330
      		 
      #3  <signal handler called>
      		 
      #4  best_extension_by_limited_search (join=join@entry=0x1466f1d7cf70, remaining_tables=remaining_tables@entry=2, idx=idx@entry=3, record_count=record_count@entry=7, read_time=12, search_depth=search_depth@entry=59, prune_level=prune_level@entry=1, use_cond_selectivity=use_cond_selectivity@entry=4) at /data/10.5_opt/sql/sql_select.cc:9631
      		 
      #5  0x000055acfbc88046 in best_extension_by_limited_search (join=join@entry=0x1466f1d7cf70, remaining_tables=remaining_tables@entry=10, idx=idx@entry=2, record_count=record_count@entry=7, read_time=3.5999999999999996, search_depth=search_depth@entry=60, prune_level=prune_level@entry=1, use_cond_selectivity=use_cond_selectivity@entry=4) at /data/10.5_opt/sql/sql_select.cc:9633
      		 
      #6  0x000055acfbc88046 in best_extension_by_limited_search (join=join@entry=0x1466f1d7cf70, remaining_tables=remaining_tables@entry=11, idx=idx@entry=1, record_count=record_count@entry=1, read_time=1.2, search_depth=search_depth@entry=61, prune_level=prune_level@entry=1, use_cond_selectivity=use_cond_selectivity@entry=4) at /data/10.5_opt/sql/sql_select.cc:9633
      		 
      #7  0x000055acfbc88046 in best_extension_by_limited_search (join=join@entry=0x1466f1d7cf70, remaining_tables=remaining_tables@entry=15, idx=idx@entry=0, record_count=1, read_time=read_time@entry=0, search_depth=search_depth@entry=62, prune_level=prune_level@entry=1, use_cond_selectivity=4) at /data/10.5_opt/sql/sql_select.cc:9633
      		 
      #8  0x000055acfbc8837a in greedy_search (use_cond_selectivity=<optimized out>, prune_level=<optimized out>, search_depth=62, remaining_tables=15, join=0x1466f1d7cf70) at /data/10.5_opt/sql/sql_select.cc:8750
      		 
      #9  choose_plan (join=join@entry=0x1466f1d7cf70, join_tables=<optimized out>) at /data/10.5_opt/sql/sql_select.cc:8315
      		 
      #10 0x000055acfbca8ec2 in make_join_statistics (keyuse_array=0x1466f1d7d260, tables_list=@0x1466f1c473b0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1466f1d55770, last = 0x1466f1d86f08, elements = 4}, <No data fields>}, join=0x1466f1d7cf70) at /data/10.5_opt/sql/sql_select.cc:5555
      		 
      #11 JOIN::optimize_inner (this=this@entry=0x1466f1d7cf70) at /data/10.5_opt/sql/sql_select.cc:2247
      		 
      #12 0x000055acfbca9533 in JOIN::optimize (this=this@entry=0x1466f1d7cf70) at /data/10.5_opt/sql/sql_select.cc:1623
      		 
      #13 0x000055acfbca9631 in mysql_select (thd=thd@entry=0x1466f1c12018, tables=0x1466f1c49af0, fields=@0x1466f1c472c0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1466f1c47720, last = 0x1466f1d9a820, elements = 49}, <No data fields>}, conds=0x0, og_num=<optimized out>, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x1466f1c4ce38, unit=0x1466f1c15ff0, select_lex=0x1466f1c47170) at /data/10.5_opt/sql/sql_select.cc:4649
      		 
      #14 0x000055acfbcaa041 in handle_select (thd=thd@entry=0x1466f1c12018, lex=lex@entry=0x1466f1c15f28, result=result@entry=0x1466f1c4ce38, setup_tables_done_option=setup_tables_done_option@entry=0) at /data/10.5_opt/sql/sql_select.cc:417
      		 
      #15 0x000055acfbc4f8f1 in execute_sqlcom_select (thd=thd@entry=0x1466f1c12018, all_tables=0x1466f1c49af0) at /data/10.5_opt/sql/sql_parse.cc:6210
      		 
      #16 0x000055acfbc4bfd1 in mysql_execute_command (thd=thd@entry=0x1466f1c12018) at /data/10.5_opt/sql/sql_parse.cc:3932
      		 
      #17 0x000055acfbc52a2c in mysql_parse (thd=0x1466f1c12018, rawbuf=<optimized out>, length=111, parser_state=0x146715e51430, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /data/10.5_opt/sql/sql_parse.cc:7994
      		 
      #18 0x000055acfbc47cc5 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1466f1c12018, packet=packet@entry=0x1466f1c3a019 "SELECT * FROM (SELECT * FROM t1 NATURAL JOIN t2) AS a NATURAL LEFT JOIN (SELECT * FROM t1 NATURAL JOIN t3) AS b", packet_length=packet_length@entry=111, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/10.5_opt/sql/sql_parse.cc:1867
      		 
      #19 0x000055acfbc45fe4 in do_command (thd=0x1466f1c12018) at /data/10.5_opt/sql/sql_parse.cc:1348
      		 
      #20 0x000055acfbd3cba1 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x146712c338f8, put_in_cache=put_in_cache@entry=true) at /data/10.5_opt/sql/sql_connect.cc:1410
      		 
      #21 0x000055acfbd3cf14 in handle_one_connection (arg=arg@entry=0x146712c338f8) at /data/10.5_opt/sql/sql_connect.cc:1312
      		 
      #22 0x000055acfc0b0a4a in pfs_spawn_thread (arg=0x146712c4f018) at /data/10.5_opt/storage/perfschema/pfs.cc:2201
      		 
      #23 0x0000146714dcb6db in start_thread (arg=0x146715e52700) at pthread_create.c:463
      		 
      #24 0x00001467141c9a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

      10.5.6 2bac9782aa81ad386beaf00eb126ccf2d15031a1 (Debug)

      		 
      Core was generated by `/test/MD150920-mariadb-10.5.6-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
      		 
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      		 
      [Current thread is 1 (Thread 0x14b047ab9700 (LWP 3272302))]
      		 
      (gdb) bt
      		 
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      		 
      #1  0x0000557485c8185a in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:424
      		 
      #2  0x00005574854483a9 in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:330
      		 
      #3  <signal handler called>
      		 
      #4  0x00005574852017ff in best_extension_by_limited_search (join=join@entry=0x14b024160fe0, remaining_tables=remaining_tables@entry=2, idx=idx@entry=3, record_count=record_count@entry=7, read_time=12, search_depth=search_depth@entry=59, prune_level=prune_level@entry=1, use_cond_selectivity=use_cond_selectivity@entry=4) at /test/10.5_dbg/sql/sql_select.cc:9631
      		 
      #5  0x000055748520185c in best_extension_by_limited_search (join=join@entry=0x14b024160fe0, remaining_tables=remaining_tables@entry=10, idx=idx@entry=2, record_count=record_count@entry=7, read_time=3.5999999999999996, search_depth=search_depth@entry=60, prune_level=prune_level@entry=1, use_cond_selectivity=use_cond_selectivity@entry=4) at /test/10.5_dbg/sql/sql_select.cc:9633
      		 
      #6  0x000055748520185c in best_extension_by_limited_search (join=join@entry=0x14b024160fe0, remaining_tables=remaining_tables@entry=11, idx=idx@entry=1, record_count=record_count@entry=1, read_time=1.2, search_depth=search_depth@entry=61, prune_level=prune_level@entry=1, use_cond_selectivity=use_cond_selectivity@entry=4) at /test/10.5_dbg/sql/sql_select.cc:9633
      		 
      #7  0x000055748520185c in best_extension_by_limited_search (join=join@entry=0x14b024160fe0, remaining_tables=remaining_tables@entry=15, idx=idx@entry=0, record_count=record_count@entry=1, read_time=read_time@entry=0, search_depth=search_depth@entry=62, prune_level=prune_level@entry=1, use_cond_selectivity=use_cond_selectivity@entry=4) at /test/10.5_dbg/sql/sql_select.cc:9633
      		 
      #8  0x0000557485202cf0 in greedy_search (use_cond_selectivity=<optimized out>, prune_level=<optimized out>, search_depth=62, remaining_tables=15, join=0x14b024160fe0) at /test/10.5_dbg/sql/sql_select.cc:8750
      		 
      #9  choose_plan (join=join@entry=0x14b024160fe0, join_tables=<optimized out>) at /test/10.5_dbg/sql/sql_select.cc:8315
      		 
      #10 0x0000557485213dbd in make_join_statistics (keyuse_array=0x14b0241612d0, tables_list=<optimized out>, join=0x14b024160fe0) at /test/10.5_dbg/sql/sql_select.cc:5555
      		 
      #11 JOIN::optimize_inner (this=this@entry=0x14b024160fe0) at /test/10.5_dbg/sql/sql_select.cc:2247
      		 
      #12 0x00005574852143b3 in JOIN::optimize (this=this@entry=0x14b024160fe0) at /test/10.5_dbg/sql/sql_select.cc:1623
      		 
      #13 0x0000557485214d40 in mysql_select (thd=thd@entry=0x14b024015088, tables=<optimized out>, fields=@0x14b024074330: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14b024074790, last = 0x14b02421e890, elements = 49}, <No data fields>}, conds=0x0, og_num=0, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x14b024079ea8, unit=0x14b024019220, select_lex=0x14b0240741e0) at /test/10.5_dbg/sql/sql_select.cc:4649
      		 
      #14 0x00005574852150bc in handle_select (thd=thd@entry=0x14b024015088, lex=lex@entry=0x14b024019158, result=result@entry=0x14b024079ea8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.5_dbg/sql/sql_select.cc:417
      		 
      #15 0x000055748519c348 in execute_sqlcom_select (thd=thd@entry=0x14b024015088, all_tables=0x14b024076b60) at /test/10.5_dbg/sql/sql_parse.cc:6210
      		 
      #16 0x000055748519541c in mysql_execute_command (thd=thd@entry=0x14b024015088) at /test/10.5_dbg/sql/sql_parse.cc:3932
      		 
      #17 0x00005574851a2324 in mysql_parse (thd=thd@entry=0x14b024015088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14b047ab8350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7994
      		 
      #18 0x000055748518ed54 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14b024015088, packet=packet@entry=0x14b024067089 "SELECT * FROM (SELECT * FROM t1 NATURAL JOIN t2) AS a NATURAL LEFT JOIN (SELECT * FROM t1 NATURAL JOIN t3) AS b", packet_length=packet_length@entry=111, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1867
      		 
      #19 0x000055748518d53e in do_command (thd=0x14b024015088) at /test/10.5_dbg/sql/sql_parse.cc:1348
      		 
      #20 0x00005574852ec893 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x14b0268d4108, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1410
      		 
      #21 0x00005574852ecfb7 in handle_one_connection (arg=arg@entry=0x14b0268d4108) at /test/10.5_dbg/sql/sql_connect.cc:1312
      		 
      #22 0x00005574857575c2 in pfs_spawn_thread (arg=0x14b044846508) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
      		 
      #23 0x000014b046a326db in start_thread (arg=0x14b047ab9700) at pthread_create.c:463
      		 
      #24 0x000014b045e30a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

      Bug confirmed present in:
      MariaDB: 10.4.15 (dbg), 10.4.15 (opt), 10.5.6 (dbg), 10.5.6 (opt), 10.6.0 (dbg), 10.6.0 (opt)

      Bug confirmed not present in:
      MariaDB: 10.1.47 (dbg), 10.1.47 (opt), 10.2.34 (dbg), 10.2.34 (opt), 10.3.25 (dbg), 10.3.25 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.49 (dbg), 5.6.49 (opt), 5.7.31 (dbg), 5.7.31 (opt), 8.0.21 (dbg), 8.0.21 (opt)

      Attachments

        Issue Links

          is blocked by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-17783 AddressSanitizer: stack-buffer-overflow in table_cond_selectivity with optimizer_use_condition_selectivity > 1, join_cache_level >2

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-17783 AddressSanitizer: stack-buffer-overflow in table_cond_selectivity with optimizer_use_condition_selectivity > 1, join_cache_level >2

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-26190 Stack smashing SIGSEGV in optimized builds starting in table_cond_selectivity

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-25013 SIGSEGV in best_extension_by_limited_search | SIGSEGV in restore_prev_nj_state

          • Major - Major loss of function.
          • Closed

          Activity

            People

              psergei Sergei Petrunia
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.