Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-24910

Crash with SELECT that uses table value constructor as a subselect

    XMLWordPrintable

    Details

      Description

      The following test case causes a crash of the server in 10.3

      create table t1 (a int) engine=myisam;
      insert into t1 values (3), (7), (1);
      create table t2 (b int) engine=myisam;
      insert into t2 values (1), (2);
       
      select (values ((select * from t1 where a > 10))) from t2; 
       
      drop table t1;
      

      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong...
      stack_bottom = 0x7f8401ffce70 thread_stack 0x49000
      mysys/stacktrace.c:174(my_print_stacktrace)[0x5564f638ad87]
      sql/signal_handler.cc:209(handle_fatal_signal)[0x5564f5b11f67]
      /lib64/libpthread.so.0(+0xf890)[0x7f8409d66890]
      sql/sql_lex.h:1196(st_select_lex::next_select())[0x5564f579f9ee]
      sql/sql_lex.h:1427(st_select_lex_unit::is_unit_op())[0x5564f579fa86]
      sql/sql_select.cc:1044(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x5564f5831668]
      sql/item_subselect.cc:3707(subselect_single_select_engine::prepare(THD*))[0x5564f5bfc15b]
      sql/item_subselect.cc:280(Item_subselect::fix_fields(THD*, Item**))[0x5564f5beedc8]
      sql/item.h:830(Item::fix_fields_if_needed(THD*, Item**))[0x5564f56e56d0]
      sql/item.h:833(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x5564f56e56fd]
      sql/sql_tvc.cc:62(fix_fields_for_tvc(THD*, List_iterator_fast<List<Item> >&))[0x5564f5a16de6]
      sql/sql_tvc.cc:238(table_value_constr::prepare(THD*, st_select_lex*, select_result*, st_select_lex_unit*))[0x5564f5a174d9]
      sql/sql_union.cc:1029(st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long))[0x5564f58ec794]
      sql/sql_derived.cc:771(mysql_derived_prepare(THD*, LEX*, TABLE_LIST*))[0x5564f579d6ee]
      sql/sql_derived.cc:199(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x5564f579c271]
      sql/table.cc:8362(TABLE_LIST::handle_derived(LEX*, unsigned int))[0x5564f591d152]
      sql/sql_lex.h:4004(LEX::handle_list_of_derived(TABLE_LIST*, unsigned int))[0x5564f57b649d]
      sql/sql_lex.cc:4164(st_select_lex::handle_derived(LEX*, unsigned int))[0x5564f57c26aa]
      sql/sql_select.cc:1049(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x5564f58316bb]
      sql/item_subselect.cc:3707(subselect_single_select_engine::prepare(THD*))[0x5564f5bfc15b]
      sql/item_subselect.cc:280(Item_subselect::fix_fields(THD*, Item**))[0x5564f5beedc8]
      sql/item.h:830(Item::fix_fields_if_needed(THD*, Item**))[0x5564f56e56d0]
      sql/item.h:833(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x5564f56e56fd]
      sql/sql_base.cc:7562(setup_fields(THD*, Bounds_checked_array<Item*>, List<Item>&, enum_column_usage, List<Item>*, List<Item>*, bool))[0x5564f575ff8f]
      sql/sql_select.cc:1151(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x5564f5831ce9]
      sql/sql_select.cc:4301(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5564f583d574]
      sql/sql_select.cc:382(handle_select(THD*, LEX*, select_result*, unsigned long))[0x5564f582eb2b]
      sql/sql_parse.cc:6316(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5564f57f5d34]
      sql/sql_parse.cc:3847(mysql_execute_command(THD*))[0x5564f57ec7fc]
      sql/sql_parse.cc:7840(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x5564f57fa073]
      sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5564f57e6b24]
      sql/sql_parse.cc:1399(do_command(THD*))[0x5564f57e5416]
      sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x5564f5961dcc]
      sql/sql_connect.cc:1309(handle_one_connection)[0x5564f5961b3b]
      perfschema/pfs.cc:1871(pfs_spawn_thread)[0x5564f631becd]
      /lib64/libpthread.so.0(+0x80a4)[0x7f8409d5f0a4]
      /lib64/libc.so.6(clone+0x6d)[0x7f8407ec204d]
       
      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0x7f83f0012818): select (values ((select * from t1 where a > 10))) from t2
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              igor Igor Babaev
              Reporter:
              igor Igor Babaev
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: