Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-24658

Assertion `marked_for_read()' failed in Field_long::val_str (and other types) on nested SELECT, ASAN heap-use-after-free in Item_field::print

    XMLWordPrintable

Details

    Description

      There quite a few marked_for_read bugs, but none looks related or identical, and this one requires the optimizer_trace option to be set. This bug does not seem to be a regression as optimizer_trace is not available in 10.3.

      SET SESSION optimizer_trace="enabled=on";
      CREATE TABLE t1 (i INT) ENGINE=InnoDB;
      CREATE TABLE t2 (c INT) ENGINE=MyISAM;
      INSERT INTO t2 VALUES (1);
      SELECT 1 FROM (SELECT 1 IN (SELECT 1 FROM t1 WHERE (SELECT 1 FROM t2 HAVING c)) FROM t2) AS z;
      

      Leads to:

      10.6.0 9118fd360a3da0bba521caf2a35c424968235ac4 (Debug)

      mysqld: /test/10.6_dbg/sql/field.cc:4417: virtual String* Field_long::val_str(String*, String*): Assertion `marked_for_read()' failed.
      

      10.6.0 9118fd360a3da0bba521caf2a35c424968235ac4 (Debug)

      Core was generated by `/test/MD010121-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      [Current thread is 1 (Thread 0x14dea40a3700 (LWP 1993186))]
      (gdb) bt
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      #1  0x0000559e04f4f0d7 in my_write_core (sig=sig@entry=6) at /test/10.6_dbg/mysys/stacktrace.c:424
      #2  0x0000559e046e3ab1 in handle_fatal_signal (sig=6) at /test/10.6_dbg/sql/signal_handler.cc:330
      #3  <signal handler called>
      #4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #5  0x000014dea5e63859 in __GI_abort () at abort.c:79
      #6  0x000014dea5e63729 in __assert_fail_base (fmt=0x14dea5ff9588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x559e052388dc "marked_for_read()", file=0x559e052386c3 "/test/10.6_dbg/sql/field.cc", line=4417, function=<optimized out>) at assert.c:92
      #7  0x000014dea5e74f36 in __GI___assert_fail (assertion=assertion@entry=0x559e052388dc "marked_for_read()", file=file@entry=0x559e052386c3 "/test/10.6_dbg/sql/field.cc", line=line@entry=4417, function=function@entry=0x559e0523b238 "virtual String* Field_long::val_str(String*, String*)") at assert.c:101
      #8  0x0000559e046bd20b in Field_long::val_str (this=0x14de54077218, val_buffer=0x14dea40a0dc0, val_ptr=<optimized out>) at /test/10.6_dbg/sql/field.cc:4417
      #9  0x0000559e04705ab9 in Item_field::val_str (this=0x14de5407b1e8, str=0x14dea40a0dc0) at /test/10.6_dbg/sql/item.cc:3245
      #10 0x0000559e047118c9 in Item::print_value (this=0x14de5407b1e8, str=0x14dea40a1300) at /test/10.6_dbg/sql/item.cc:516
      #11 0x0000559e04711b03 in Item_field::print (this=<optimized out>, str=<optimized out>, query_type=<optimized out>) at /test/10.6_dbg/sql/item.cc:7661
      #12 0x0000559e04711682 in Item::print_parenthesised (this=this@entry=0x14de5407b1e8, str=str@entry=0x14dea40a1300, query_type=query_type@entry=1033, parent_prec=CMP_PRECEDENCE) at /test/10.6_dbg/sql/item.cc:486
      #13 0x0000559e04787579 in Item_func::print_op (this=0x14de54014c38, str=0x14dea40a1300, query_type=1033) at /test/10.6_dbg/sql/item_func.cc:638
      #14 0x0000559e04752d9f in Item_bool_rowready_func2::print (this=<optimized out>, str=<optimized out>, query_type=<optimized out>) at /test/10.6_dbg/sql/item_cmpfunc.h:524
      #15 0x0000559e0449255d in st_select_lex::print (this=0x14de54013e38, thd=thd@entry=0x14de54000db8, str=str@entry=0x14dea40a1300, query_type=query_type@entry=1033) at /test/10.6_dbg/sql/sql_select.cc:27735
      #16 0x0000559e047f1a54 in subselect_single_select_engine::print (this=0x14de54015830, str=0x14dea40a1300, query_type=1033) at /test/10.6_dbg/sql/item_subselect.cc:4495
      #17 0x0000559e047f1fc9 in Item_subselect::print (this=0x14de54015688, str=0x14dea40a1300, query_type=1033) at /test/10.6_dbg/sql/item_subselect.cc:1038
      #18 0x0000559e046406d9 in Json_writer::add_str (this=this@entry=0x14de54070510, item=item@entry=0x14de54015688) at /test/10.6_dbg/sql/opt_trace.cc:697
      #19 0x0000559e04453403 in Json_value_helper::add_str (item=0x14de54015688, this=<synthetic pointer>) at /test/10.6_dbg/sql/my_json_writer.h:454
      #20 Json_writer_object::add (value=0x14de54015688, name=0x559e050c5b1e "original_condition", this=<synthetic pointer>) at /test/10.6_dbg/sql/my_json_writer.h:454
      #21 optimize_cond (join=join@entry=0x14de5407a600, conds=0x14de54015688, join_list=0x14de540133c8, ignore_on_conds=ignore_on_conds@entry=false, cond_value=cond_value@entry=0x14de5407a918, cond_equal=cond_equal@entry=0x14de5407aa40, flags=1) at /test/10.6_dbg/sql/sql_select.cc:17002
      #22 0x0000559e0449e345 in JOIN::optimize_inner (this=this@entry=0x14de5407a600) at /test/10.6_dbg/sql/sql_select.cc:1995
      #23 0x0000559e0449f06c in JOIN::optimize (this=this@entry=0x14de5407a600) at /test/10.6_dbg/sql/sql_select.cc:1627
      #24 0x0000559e043e7517 in st_select_lex::optimize_unflattened_subqueries (this=0x14de540127e0, const_only=const_only@entry=false) at /test/10.6_dbg/sql/sql_lex.cc:4852
      #25 0x0000559e045d84cb in JOIN::optimize_unflattened_subqueries (this=this@entry=0x14de54079b10) at /test/10.6_dbg/sql/opt_subselect.cc:5555
      #26 0x0000559e0449c554 in JOIN::optimize_stage2 (this=this@entry=0x14de54079b10) at /test/10.6_dbg/sql/sql_select.cc:2826
      #27 0x0000559e0449ee3b in JOIN::optimize_inner (this=this@entry=0x14de54079b10) at /test/10.6_dbg/sql/sql_select.cc:2277
      #28 0x0000559e0449f06c in JOIN::optimize (this=this@entry=0x14de54079b10) at /test/10.6_dbg/sql/sql_select.cc:1627
      #29 0x0000559e0449f9ba in mysql_select (thd=thd@entry=0x14de54000db8, tables=0x14de540172c8, fields=@0x14de54012930: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14de54012ce8, last = 0x14de54012ce8, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x14de54018350, unit=0x14de54004f80, select_lex=0x14de540127e0) at /test/10.6_dbg/sql/sql_select.cc:4654
      #30 0x0000559e0449fcd0 in handle_select (thd=thd@entry=0x14de54000db8, lex=lex@entry=0x14de54004eb8, result=result@entry=0x14de54018350, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_dbg/sql/sql_select.cc:417
      #31 0x0000559e0441219d in execute_sqlcom_select (thd=thd@entry=0x14de54000db8, all_tables=0x14de540172c8) at /test/10.6_dbg/sql/sql_parse.cc:6116
      #32 0x0000559e0441ec7c in mysql_execute_command (thd=thd@entry=0x14de54000db8) at /test/10.6_dbg/sql/sql_parse.cc:3820
      #33 0x0000559e0440b072 in mysql_parse (thd=thd@entry=0x14de54000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14dea40a23d0) at /test/10.6_dbg/sql/sql_parse.cc:7881
      #34 0x0000559e044191ec in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14de54000db8, packet=packet@entry=0x14de54008d39 "SELECT 1 FROM (SELECT 1 IN (SELECT 1 FROM t1 WHERE (SELECT 1 FROM t2 HAVING c)) FROM t2) AS z", packet_length=packet_length@entry=93) at /test/10.6_dbg/sql/sql_class.h:1293
      #35 0x0000559e0441c52d in do_command (thd=0x14de54000db8) at /test/10.6_dbg/sql/sql_parse.cc:1348
      #36 0x0000559e045787fc in do_handle_one_connection (connect=<optimized out>, connect@entry=0x559e07d5e9a8, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410
      #37 0x0000559e04578f03 in handle_one_connection (arg=arg@entry=0x559e07d5e9a8) at /test/10.6_dbg/sql/sql_connect.cc:1312
      #38 0x0000559e04a2e88f in pfs_spawn_thread (arg=0x559e07c86898) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
      #39 0x000014dea6371609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #40 0x000014dea5f60293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.4.18 (dbg), 10.5.9 (dbg), 10.6.0 (dbg)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.37 (dbg), 10.2.37 (opt), 10.3.28 (dbg), 10.3.28 (opt), 10.4.18 (opt), 10.5.9 (opt), 10.6.0 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.50 (dbg), 5.6.50 (opt), 5.7.32 (dbg), 5.7.32 (opt), 8.0.22 (dbg), 8.0.22 (opt)

      Attachments

        Issue Links

          Activity

            People

              psergei Sergei Petrunia
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.