Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-25013

SIGSEGV in best_extension_by_limited_search | SIGSEGV in restore_prev_nj_state

    XMLWordPrintable

    Details

      Description

      SET join_cache_level=3;
      CREATE TABLE t1 (TEXT1 TEXT,TEXT2 TEXT,TEXT3 TEXT,TEXT4 TEXT,TEXT5 TEXT,TEXT6 TEXT,TEXT7 TEXT,TEXT8 TEXT,TEXT9 TEXT,TEXT10 TEXT,TEXT11 TEXT,TEXT12 TEXT,TEXT13 TEXT,TEXT14 TEXT,TEXT15 TEXT,TEXT16 TEXT,TEXT17 TEXT,TEXT18 TEXT,TEXT19 TEXT,TEXT20 TEXT,TEXT21 TEXT,TEXT22 TEXT,TEXT23 TEXT,TEXT24 TEXT,TEXT25 TEXT,TEXT26 TEXT,TEXT27 TEXT,TEXT28 TEXT,TEXT29 TEXT,TEXT30 TEXT,TEXT31 TEXT,TEXT32 TEXT,TEXT33 TEXT,TEXT34 TEXT,TEXT35 TEXT,TEXT36 TEXT,TEXT37 TEXT,TEXT38 TEXT,TEXT39 TEXT,TEXT40 TEXT,TEXT41 TEXT,TEXT42 TEXT,TEXT43 TEXT,TEXT44 TEXT,TEXT45 TEXT,TEXT46 TEXT,TEXT47 TEXT,TEXT48 TEXT,TEXT49 TEXT,TEXT50 TEXT) ENGINE=InnoDB;
      EXPLAIN SELECT 1 FROM t1 NATURAL JOIN t1 AS t2;
      

      Leads to:

      10.6.0 27d66d644cf2ebe9201e0362f2050036cce2908a (Debug)

      Core was generated by `/test/MD260221-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      [Current thread is 1 (Thread 0x151280136700 (LWP 2415085))]
      (gdb) bt
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      #1  0x0000561d945dcab8 in my_write_core (sig=sig@entry=11) at /test/10.6_dbg/mysys/stacktrace.c:424
      #2  0x0000561d93d71317 in handle_fatal_signal (sig=11) at /test/10.6_dbg/sql/signal_handler.cc:331
      #3  <signal handler called>
      #4  0x0000561d93af3c7b in best_extension_by_limited_search (join=0x15122c010001, join@entry=0x15122c016788, remaining_tables=remaining_tables@entry=2, idx=idx@entry=1, record_count=record_count@entry=1, read_time=1.2, search_depth=search_depth@entry=61, prune_level=prune_level@entry=1, use_cond_selectivity=use_cond_selectivity@entry=4) at /test/10.6_dbg/sql/sql_select.cc:9692
      #5  0x0000561d93af4032 in best_extension_by_limited_search (join=join@entry=0x15122c016788, remaining_tables=remaining_tables@entry=3, idx=idx@entry=0, record_count=record_count@entry=1, read_time=read_time@entry=0, search_depth=search_depth@entry=62, prune_level=prune_level@entry=1, use_cond_selectivity=use_cond_selectivity@entry=4) at /test/10.6_dbg/sql/sql_select.cc:9703
      #6  0x0000561d93af52c9 in greedy_search (use_cond_selectivity=<optimized out>, prune_level=<optimized out>, search_depth=62, remaining_tables=3, join=0x15122c016788) at /test/10.6_dbg/sql/sql_select.cc:8820
      #7  choose_plan (join=join@entry=0x15122c016788, join_tables=<optimized out>) at /test/10.6_dbg/sql/sql_select.cc:8385
      #8  0x0000561d93b25111 in make_join_statistics (join=join@entry=0x15122c016788, tables_list=@0x15122c013e58: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15122c016d00, last = 0x15122c016d10, elements = 2}, <No data fields>}, keyuse_array=keyuse_array@entry=0x15122c016a78) at /test/10.6_dbg/sql/sql_select.cc:5622
      #9  0x0000561d93b2bfeb in JOIN::optimize_inner (this=this@entry=0x15122c016788) at /test/10.6_dbg/sql/sql_select.cc:2256
      #10 0x0000561d93b2c2b6 in JOIN::optimize (this=this@entry=0x15122c016788) at /test/10.6_dbg/sql/sql_select.cc:1628
      #11 0x0000561d93b2cc07 in mysql_select (thd=thd@entry=0x15122c000db8, tables=0x15122c014168, fields=@0x15122c013d68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15122c014120, last = 0x15122c014120, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748612, result=0x15122c016068, unit=0x15122c004f88, select_lex=0x15122c013c18) at /test/10.6_dbg/sql/sql_select.cc:4716
      #12 0x0000561d93b2d227 in mysql_explain_union (thd=thd@entry=0x15122c000db8, unit=unit@entry=0x15122c004f88, result=result@entry=0x15122c016068) at /test/10.6_dbg/sql/sql_select.cc:27263
      #13 0x0000561d93a9f7fc in execute_sqlcom_select (thd=thd@entry=0x15122c000db8, all_tables=0x15122c014168) at /test/10.6_dbg/sql/sql_parse.cc:6143
      #14 0x0000561d93aac791 in mysql_execute_command (thd=thd@entry=0x15122c000db8) at /test/10.6_dbg/sql/sql_parse.cc:3900
      #15 0x0000561d93a98cdc in mysql_parse (thd=thd@entry=0x15122c000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1512801353d0) at /test/10.6_dbg/sql/sql_parse.cc:7972
      #16 0x0000561d93aa6b3b in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x15122c000db8, packet=packet@entry=0x15122c00b319 "", packet_length=packet_length@entry=46, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_class.h:1295
      #17 0x0000561d93aa9fbe in do_command (thd=0x15122c000db8, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_parse.cc:1397
      #18 0x0000561d93c05c2e in do_handle_one_connection (connect=<optimized out>, connect@entry=0x561d967bc1b8, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410
      #19 0x0000561d93c06331 in handle_one_connection (arg=arg@entry=0x561d967bc1b8) at /test/10.6_dbg/sql/sql_connect.cc:1312
      #20 0x0000561d940ba9b9 in pfs_spawn_thread (arg=0x561d966edc98) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
      #21 0x00001512816a7609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #22 0x0000151281296293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.4.19 (dbg), 10.4.19 (opt), 10.5.10 (dbg), 10.5.10 (opt), 10.6.0 (dbg), 10.6.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.38 (dbg), 10.2.38 (opt), 10.3.29 (dbg), 10.3.29 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.29 (dbg), 5.7.30 (dbg), 5.7.33 (dbg), 5.7.33 (opt), 8.0.23 (dbg), 8.0.23 (opt)

      Exactly 38 or more of the text fields are required. Having 37 does not crash anymore.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              psergei Sergei Petrunia
              Reporter:
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated: