Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-24935

Server crashes in Field_iterator_natural_join::next or Field_iterator_table_ref::set_field_iterator upon 2nd execution of SP

    XMLWordPrintable

Details

    Description

      CREATE TABLE t1 (a INT);
      insert into t1 VALUES (1),(2);
       
      CREATE TABLE t2 (b INT, c INT);
      insert into t2 VALUES (1,10),(2,20);
       
      CREATE TABLE t3 (d INT);
      INSERT INTO t3 VALUES (1),(2);
       
      CREATE PROCEDURE sp() SELECT * FROM t1 JOIN t2 JOIN t3 USING (x); 
       
      --error ER_BAD_FIELD_ERROR
      CALL sp;
      --error ER_BAD_FIELD_ERROR
      CALL sp;
       
      # Cleanup
      DROP PROCEDURE sp;
      DROP TABLE t1, t2, t3;
      

      10.2 5ecaf52d

      #3  <signal handler called>
      #4  0x000055ed2eb66d9a in Field_iterator_natural_join::next (this=0x7f340c7d6a60) at /data/src/10.2/sql/table.cc:6015
      #5  0x000055ed2eb67a12 in Field_iterator_table_ref::next (this=0x7f340c7d6a10) at /data/src/10.2/sql/table.cc:6085
      #6  0x000055ed2e77f919 in mark_common_columns (thd=0x62a000060270, table_ref_1=0x62500009e020, table_ref_2=0x6250000ce7d8, using_fields=0x6250000ef4e0, found_using_fields=0x7f340c7d6ce0) at /data/src/10.2/sql/sql_base.cc:6528
      #7  0x000055ed2e780ed2 in store_top_level_join_columns (thd=0x62a000060270, table_ref=0x62500009d990, left_neighbor=0x0, right_neighbor=0x0) at /data/src/10.2/sql/sql_base.cc:6974
      #8  0x000055ed2e78194c in setup_natural_join_row_types (thd=0x62a000060270, from_clause=0x6250000cdb30, context=0x6250000cd9e0) at /data/src/10.2/sql/sql_base.cc:7096
      #9  0x000055ed2e784f91 in setup_tables (thd=0x62a000060270, context=0x6250000cd9e0, from_clause=0x6250000cdb30, tables=0x6250000ee778, leaves=..., select_insert=false, full_table_list=false) at /data/src/10.2/sql/sql_base.cc:7514
      #10 0x000055ed2e78530c in setup_tables_and_check_access (thd=0x62a000060270, context=0x6250000cd9e0, from_clause=0x6250000cdb30, tables=0x6250000ee778, leaves=..., select_insert=false, want_access_first=1, want_access=1, full_table_list=false) at /data/src/10.2/sql/sql_base.cc:7553
      #11 0x000055ed2e92edb6 in JOIN::prepare (this=0x6250000f0368, tables_init=0x6250000ee778, wild_num=1, conds_init=0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x6250000cd990, unit_arg=0x6250000cd250) at /data/src/10.2/sql/sql_select.cc:728
      #12 0x000055ed2e94f049 in mysql_select (thd=0x62a000060270, tables=0x6250000ee778, wild_num=1, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147749632, result=0x6250000f0340, unit=0x6250000cd250, select_lex=0x6250000cd990) at /data/src/10.2/sql/sql_select.cc:3815
      #13 0x000055ed2e92bd02 in handle_select (thd=0x62a000060270, lex=0x6250000cd190, result=0x6250000f0340, setup_tables_done_option=0) at /data/src/10.2/sql/sql_select.cc:361
      #14 0x000055ed2e8a2bed in execute_sqlcom_select (thd=0x62a000060270, all_tables=0x6250000ee778) at /data/src/10.2/sql/sql_parse.cc:6248
      #15 0x000055ed2e88fb92 in mysql_execute_command (thd=0x62a000060270) at /data/src/10.2/sql/sql_parse.cc:3559
      #16 0x000055ed2e6de09a in sp_instr_stmt::exec_core (this=0x6250000ef5d0, thd=0x62a000060270, nextp=0x7f340c7d9210) at /data/src/10.2/sql/sp_head.cc:3332
      #17 0x000055ed2e6dcbc7 in sp_lex_keeper::reset_lex_and_exec_core (this=0x6250000ef610, thd=0x62a000060270, nextp=0x7f340c7d9210, open_tables=false, instr=0x6250000ef5d0) at /data/src/10.2/sql/sp_head.cc:3095
      #18 0x000055ed2e6dd90e in sp_instr_stmt::execute (this=0x6250000ef5d0, thd=0x62a000060270, nextp=0x7f340c7d9210) at /data/src/10.2/sql/sp_head.cc:3248
      #19 0x000055ed2e6d1c6e in sp_head::execute (this=0x6250000ed990, thd=0x62a000060270, merge_da_on_success=true) at /data/src/10.2/sql/sp_head.cc:1326
      #20 0x000055ed2e6d6439 in sp_head::execute_procedure (this=0x6250000ed990, thd=0x62a000060270, args=0x62a000064bb0) at /data/src/10.2/sql/sp_head.cc:2202
      #21 0x000055ed2e88bb55 in do_execute_sp (thd=0x62a000060270, sp=0x6250000ed990) at /data/src/10.2/sql/sql_parse.cc:2981
      #22 0x000055ed2e89dc85 in mysql_execute_command (thd=0x62a000060270) at /data/src/10.2/sql/sql_parse.cc:5599
      #23 0x000055ed2e8ac16a in mysql_parse (thd=0x62a000060270, rawbuf=0x62b000000290 "CALL sp", length=7, parser_state=0x7f340c7dac90, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7763
      #24 0x000055ed2e8851af in dispatch_command (command=COM_QUERY, thd=0x62a000060270, packet=0x6290000eb271 "CALL sp", packet_length=7, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1827
      #25 0x000055ed2e881f6e in do_command (thd=0x62a000060270) at /data/src/10.2/sql/sql_parse.cc:1381
      #26 0x000055ed2ec0a925 in do_handle_one_connection (connect=0x611000005470) at /data/src/10.2/sql/sql_connect.cc:1336
      #27 0x000055ed2ec0a1e8 in handle_one_connection (arg=0x611000005470) at /data/src/10.2/sql/sql_connect.cc:1241
      #28 0x000055ed2ffa6aac in pfs_spawn_thread (arg=0x616000009ff0) at /data/src/10.2/storage/perfschema/pfs.cc:1869
      #29 0x00007f3417538609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #30 0x00007f3417112293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Reproducible on all of 5.5-10.6, with at least MyISAM, InnoDB, Aria.
      A non-debug build didn't crash on my machine, but since it's a SIGSEGV, probably it's just the matter of luck.

      There was a very similar bug MDEV-16957, closed as fixed. Apparently it only partially fixed the problem.

      Attachments

        Issue Links

          Activity

            People

              shulga Dmitry Shulga
              elenst Elena Stepanova
              Votes:
              1 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.