Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-25178

JSON_TABLE: ASAN use-after-poison in my_fill_8bit / Json_table_column::On_response::respond

    XMLWordPrintable

    Details

      Description

      SET NAMES utf8mb4;
      SELECT * FROM JSON_TABLE('{}', '$' COLUMNS(a CHAR(100) PATH '$' DEFAULT "0" ON ERROR)) AS jt;
      

      bb-10.6-mdev17399-hf 8611fb30bc6

      ==2528376==ERROR: AddressSanitizer: use-after-poison on address 0x61900008aa68 at pc 0x7fadafc59f2d bp 0x7fada60d6880 sp 0x7fada60d6028
      WRITE of size 399 at 0x61900008aa68 thread T5
          #0 0x7fadafc59f2c  (/lib/x86_64-linux-gnu/libasan.so.5+0x67f2c)
          #1 0x557a45086d45 in my_fill_8bit /data/src/bb-10.6-mdev17399-hf/strings/ctype-simple.c:1117
          #2 0x557a450d72ff in my_fill_utf8mb3 /data/src/bb-10.6-mdev17399-hf/strings/ctype-utf8.c:5351
          #3 0x557a43a6921e in charset_info_st::fill(char*, unsigned long, int) const /data/src/bb-10.6-mdev17399-hf/include/m_ctype.h:681
          #4 0x557a43a45d91 in Field_string::store(char const*, unsigned long, charset_info_st const*) /data/src/bb-10.6-mdev17399-hf/sql/field.cc:7276
          #5 0x557a438fcbea in Json_table_column::On_response::respond(Json_table_column*, Field*) /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:1040
          #6 0x557a438f6b09 in ha_json_table::fill_column_values(unsigned char*, unsigned char*) /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:408
          #7 0x557a438f5e8f in ha_json_table::rnd_next(unsigned char*) /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:294
          #8 0x557a43ab9037 in handler::ha_rnd_next(unsigned char*) /data/src/bb-10.6-mdev17399-hf/sql/handler.cc:3069
          #9 0x557a43f13fca in rr_sequential(READ_RECORD*) /data/src/bb-10.6-mdev17399-hf/sql/records.cc:519
          #10 0x557a430dc0d1 in READ_RECORD::read_record() /data/src/bb-10.6-mdev17399-hf/sql/records.h:81
          #11 0x557a433eb4f3 in join_init_read_record(st_join_table*) /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:21745
          #12 0x557a433e44d0 in sub_select(JOIN*, st_join_table*, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20767
          #13 0x557a433e287d in do_select /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20317
          #14 0x557a4336ea7e in JOIN::exec_inner() /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4491
          #15 0x557a4336c069 in JOIN::exec() /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4271
          #16 0x557a433704b8 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4747
          #17 0x557a43341845 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:417
          #18 0x557a432ab9e1 in execute_sqlcom_select /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:6230
          #19 0x557a4329acc3 in mysql_execute_command(THD*) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:3926
          #20 0x557a432b6c90 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:8001
          #21 0x557a4328d6c7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1886
          #22 0x557a4328a402 in do_command(THD*, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1397
          #23 0x557a436cbea8 in do_handle_one_connection(CONNECT*, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1410
          #24 0x557a436cb805 in handle_one_connection /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1312
          #25 0x557a443d5f48 in pfs_spawn_thread /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
          #26 0x7fadaf7af608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
          #27 0x7fadaf383292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
       
      0x61900008abe4 is located 0 bytes to the right of 1124-byte region [0x61900008a780,0x61900008abe4)
      allocated by thread T5 here:
          #0 0x7fadafcffbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
          #1 0x557a4500d6a1 in sf_malloc /data/src/bb-10.6-mdev17399-hf/mysys/safemalloc.c:121
          #2 0x557a44fda1e9 in my_malloc /data/src/bb-10.6-mdev17399-hf/mysys/my_malloc.c:90
          #3 0x557a44fb61e9 in alloc_root /data/src/bb-10.6-mdev17399-hf/mysys/my_alloc.c:244
          #4 0x557a4342ae24 in Field::operator new(unsigned long, st_mem_root*) /data/src/bb-10.6-mdev17399-hf/sql/field.h:761
          #5 0x557a43860151 in Type_handler_string::make_table_field_from_def(TABLE_SHARE*, st_mem_root*, st_mysql_const_lex_string const*, Record_addr const&, Bit_addr const&, Column_definition_attributes const*, unsigned int) const /data/src/bb-10.6-mdev17399-hf/sql/sql_type.cc:8250
          #6 0x557a438fb2ae in Create_json_table::add_json_table_fields(THD*, TABLE*, Table_function_json_table*) /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:845
          #7 0x557a438fbb47 in create_table_for_function(THD*, TABLE_LIST*) /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:900
          #8 0x557a431014d0 in open_and_process_table /data/src/bb-10.6-mdev17399-hf/sql/sql_base.cc:3690
          #9 0x557a43104cab in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/bb-10.6-mdev17399-hf/sql/sql_base.cc:4283
          #10 0x557a43109b7f in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/bb-10.6-mdev17399-hf/sql/sql_base.cc:5241
          #11 0x557a43061b9b in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/bb-10.6-mdev17399-hf/sql/sql_base.h:507
          #12 0x557a432aaf60 in execute_sqlcom_select /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:6151
          #13 0x557a4329acc3 in mysql_execute_command(THD*) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:3926
          #14 0x557a432b6c90 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:8001
          #15 0x557a4328d6c7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1886
          #16 0x557a4328a402 in do_command(THD*, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1397
          #17 0x557a436cbea8 in do_handle_one_connection(CONNECT*, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1410
          #18 0x557a436cb805 in handle_one_connection /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1312
          #19 0x557a443d5f48 in pfs_spawn_thread /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
          #20 0x7fadaf7af608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
       
      Thread T5 created by T0 here:
          #0 0x7fadafc2c805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
          #1 0x557a443d0eec in my_thread_create /data/src/bb-10.6-mdev17399-hf/storage/perfschema/my_thread.h:38
          #2 0x557a443d633b in pfs_spawn_thread_v1 /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2252
          #3 0x557a42f7bbd8 in inline_mysql_thread_create /data/src/bb-10.6-mdev17399-hf/include/mysql/psi/mysql_thread.h:1139
          #4 0x557a42f91b73 in create_thread_to_handle_connection(CONNECT*) /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5780
          #5 0x557a42f921f2 in create_new_thread(CONNECT*) /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5839
          #6 0x557a42f9255f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5901
          #7 0x557a42f92f0c in handle_connections_sockets() /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:6023
          #8 0x557a42f91380 in mysqld_main(int, char**) /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5675
          #9 0x557a42f7aefc in main /data/src/bb-10.6-mdev17399-hf/sql/main.cc:25
          #10 0x7fadaf2880b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
       
      SUMMARY: AddressSanitizer: use-after-poison (/lib/x86_64-linux-gnu/libasan.so.5+0x67f2c) 
      Shadow bytes around the buggy address:
        0x0c32800094f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3280009500: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
        0x0c3280009510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3280009520: 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3280009530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      =>0x0c3280009540: 00 00 00 00 00 00 00 00 00 00 00 00 00[f7]00 00
        0x0c3280009550: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c3280009560: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c3280009570: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 04 fa fa fa
        0x0c3280009580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3280009590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==2528376==ABORTING
      210317 18:33:42 [ERROR] mysqld got signal 6 ;
      This could be because you hit a bug. It is also possible that this binary
      or one of the libraries it was linked against is corrupt, improperly built,
      or misconfigured. This error can also be caused by malfunctioning hardware.
       
      To report this bug, see https://mariadb.com/kb/en/reporting-bugs
       
      We will try our best to scrape up some info that will hopefully help
      diagnose the problem, but since we have already crashed, 
      something is definitely wrong and this may fail.
       
      Server version: 10.6.0-MariaDB-debug-log
      key_buffer_size=1048576
      read_buffer_size=131072
      max_used_connections=1
      max_threads=153
      thread_count=1
      It is possible that mysqld could use up to 
      key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63804 K  bytes of memory
      Hope that's ok; if not, decrease some variables in the equation.
       
      Thread pointer: 0x62b000069288
      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong...
      stack_bottom = 0x7fada60d9950 thread_stack 0x5fc00
      ??:0(__interceptor_tcgetattr)[0x7fadafc5ed30]
      mysys/stacktrace.c:212(my_print_stacktrace)[0x557a44febc95]
      sql/signal_handler.cc:212(handle_fatal_signal)[0x557a43a9f67f]
      sigaction.c:0(__restore_rt)[0x7fadaf7bb3c0]
      ??:0(gsignal)[0x7fadaf2a718b]
      ??:0(abort)[0x7fadaf286859]
      ??:0(__sanitizer_set_report_fd)[0x7fadafd1d6a2]
      ??:0(__sanitizer_get_module_and_offset_for_pc)[0x7fadafd2824c]
      ??:0(__sanitizer_ptr_cmp)[0x7fadafd098ec]
      ??:0(__asan_on_error)[0x7fadafd09363]
      ??:0(strlen)[0x7fadafc59f4f]
      strings/ctype-simple.c:1118(my_fill_8bit)[0x557a45086d46]
      strings/ctype-utf8.c:5354(my_fill_utf8mb3)[0x557a450d7300]
      include/m_ctype.h:682(charset_info_st::fill(char*, unsigned long, int) const)[0x557a43a6921f]
      sql/field.cc:7280(Field_string::store(char const*, unsigned long, charset_info_st const*))[0x557a43a45d92]
      sql/json_table.cc:1042(Json_table_column::On_response::respond(Json_table_column*, Field*))[0x557a438fcbeb]
      sql/json_table.cc:408(ha_json_table::fill_column_values(unsigned char*, unsigned char*))[0x557a438f6b0a]
      sql/json_table.cc:294(ha_json_table::rnd_next(unsigned char*))[0x557a438f5e90]
      sql/handler.cc:3069(handler::ha_rnd_next(unsigned char*))[0x557a43ab9038]
      sql/records.cc:519(rr_sequential(READ_RECORD*))[0x557a43f13fcb]
      sql/records.h:81(READ_RECORD::read_record())[0x557a430dc0d2]
      sql/sql_select.cc:21745(join_init_read_record(st_join_table*))[0x557a433eb4f4]
      sql/sql_select.cc:20767(sub_select(JOIN*, st_join_table*, bool))[0x557a433e44d1]
      sql/sql_select.cc:20317(do_select(JOIN*, Procedure*))[0x557a433e287e]
      sql/sql_select.cc:4491(JOIN::exec_inner())[0x557a4336ea7f]
      sql/sql_select.cc:4272(JOIN::exec())[0x557a4336c06a]
      sql/sql_select.cc:4749(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x557a433704b9]
      sql/sql_select.cc:417(handle_select(THD*, LEX*, select_result*, unsigned long))[0x557a43341846]
      sql/sql_parse.cc:6230(execute_sqlcom_select(THD*, TABLE_LIST*))[0x557a432ab9e2]
      sql/sql_parse.cc:3926(mysql_execute_command(THD*))[0x557a4329acc4]
      sql/sql_parse.cc:8001(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x557a432b6c91]
      sql/sql_parse.cc:1888(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x557a4328d6c8]
      sql/sql_parse.cc:1397(do_command(THD*, bool))[0x557a4328a403]
      sql/sql_connect.cc:1410(do_handle_one_connection(CONNECT*, bool))[0x557a436cbea9]
      sql/sql_connect.cc:1314(handle_one_connection)[0x557a436cb806]
      perfschema/pfs.cc:2203(pfs_spawn_thread)[0x557a443d5f49]
      nptl/pthread_create.c:478(start_thread)[0x7fadaf7af609]
      ??:0(clone)[0x7fadaf383293]
       
      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0x62b0000382a8): SELECT * FROM JSON_TABLE('{}', '$' COLUMNS(a CHAR(100) PATH '$' DEFAULT "0" ON ERROR)) AS jt
       
      Connection ID (thread ID): 4
      Status: NOT_KILLED
       
      Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off
       
      The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains
      information that should help you find out what is causing the crash.
      Writing a core file...
      Working directory at /dev/shm/var_auto_NVK3/mysqld.1/data
      Resource Limits:
      Limit                     Soft Limit           Hard Limit           Units     
      Max cpu time              unlimited            unlimited            seconds   
      Max file size             unlimited            unlimited            bytes     
      Max data size             unlimited            unlimited            bytes     
      Max stack size            8388608              unlimited            bytes     
      Max core file size        unlimited            unlimited            bytes     
      Max resident set          unlimited            unlimited            bytes     
      Max processes             385874               385874               processes 
      Max open files            1024                 1024                 files     
      Max locked memory         67108864             67108864             bytes     
      Max address space         unlimited            unlimited            bytes     
      Max file locks            unlimited            unlimited            locks     
      Max pending signals       385874               385874               signals   
      Max msgqueue size         819200               819200               bytes     
      Max nice priority         0                    0                    
      Max realtime priority     0                    0                    
      Max realtime timeout      unlimited            unlimited            us        
      Core pattern: |/usr/share/apport/apport %p %s %c %d %P %E
       
      ----------SERVER LOG END-------------
       
       
       - found 'core' (0/5)
       
      Trying 'dbx' to get a backtrace
       
      Trying 'gdb' to get a backtrace from coredump /mnt-hd8t/src/bb-10.6-mdev17399-hf/mysql-test/var/log/bug.json15/mysqld.1/data/core
      Core generated by '/mnt-hd8t/src/bb-10.6-mdev17399-hf/sql/mariadbd'
      Output from gdb follows. The first stack trace is from the failing thread.
      The following stack traces are from all threads (so the failing one is
      duplicated).
      --------------------------
      [New LWP 2528383]
      [New LWP 2528377]
      [New LWP 2528378]
      [New LWP 2528376]
      [New LWP 2528379]
      [New LWP 2528382]
      [Thread debugging using libthread_db enabled]
      Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
      Core was generated by `/mnt-hd8t/src/bb-10.6-mdev17399-hf/sql/mariadbd --defaults-group-suffix=.1 --de'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      56	../sysdeps/unix/sysv/linux/pthread_kill.c: No such file or directory.
      [Current thread is 1 (Thread 0x7fada60da300 (LWP 2528383))]
      #0  __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      #1  0x0000557a44febe17 in my_write_core (sig=6) at /data/src/bb-10.6-mdev17399-hf/mysys/stacktrace.c:424
      #2  0x0000557a43a9fbbf in handle_fatal_signal (sig=6) at /data/src/bb-10.6-mdev17399-hf/sql/signal_handler.cc:331
      #3  <signal handler called>
      #4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #5  0x00007fadaf286859 in __GI_abort () at abort.c:79
      #6  0x00007fadafd1d6a2 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #7  0x00007fadafd2824c in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #8  0x00007fadafd098ec in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #9  0x00007fadafd09363 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #10 0x00007fadafc59f4f in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #11 0x0000557a45086d46 in my_fill_8bit (cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>, s=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., l=399, fill=32) at /data/src/bb-10.6-mdev17399-hf/strings/ctype-simple.c:1117
      #12 0x0000557a450d7300 in my_fill_utf8mb3 (cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>, str=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., length=399, fill=32) at /data/src/bb-10.6-mdev17399-hf/strings/ctype-utf8.c:5351
      #13 0x0000557a43a6921f in charset_info_st::fill (this=0x557a475084e0 <my_charset_utf8mb4_general_ci>, to=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., len=399, ch=32) at /data/src/bb-10.6-mdev17399-hf/include/m_ctype.h:681
      #14 0x0000557a43a45d92 in Field_string::store (this=0x61900008a828, from=0x62b000039a50 "0", length=1, cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>) at /data/src/bb-10.6-mdev17399-hf/sql/field.cc:7276
      #15 0x0000557a438fcbeb in Json_table_column::On_response::respond (this=0x62b0000399d8, jc=0x62b000039590, f=0x61900008a828) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:1040
      #16 0x0000557a438f6b0a in ha_json_table::fill_column_values (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>..., pos=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:408
      #17 0x0000557a438f5e90 in ha_json_table::rnd_next (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>...) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:294
      #18 0x0000557a43ab9038 in handler::ha_rnd_next (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>...) at /data/src/bb-10.6-mdev17399-hf/sql/handler.cc:3069
      #19 0x0000557a43f13fcb in rr_sequential (info=0x62b00003bfe0) at /data/src/bb-10.6-mdev17399-hf/sql/records.cc:519
      #20 0x0000557a430dc0d2 in READ_RECORD::read_record (this=0x62b00003bfe0) at /data/src/bb-10.6-mdev17399-hf/sql/records.h:81
      #21 0x0000557a433eb4f4 in join_init_read_record (tab=0x62b00003bf18) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:21745
      #22 0x0000557a433e44d1 in sub_select (join=0x62b00003ab28, join_tab=0x62b00003bf18, end_of_records=false) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20767
      #23 0x0000557a433e287e in do_select (join=0x62b00003ab28, procedure=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20317
      #24 0x0000557a4336ea7f in JOIN::exec_inner (this=0x62b00003ab28) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4491
      #25 0x0000557a4336c06a in JOIN::exec (this=0x62b00003ab28) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4271
      #26 0x0000557a433704b9 in mysql_select (thd=0x62b000069288, tables=0x62b000039ae0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x62b00003aaf8, unit=0x62b00006d460, select_lex=0x62b0000383d0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4747
      #27 0x0000557a43341846 in handle_select (thd=0x62b000069288, lex=0x62b00006d398, result=0x62b00003aaf8, setup_tables_done_option=0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:417
      #28 0x0000557a432ab9e2 in execute_sqlcom_select (thd=0x62b000069288, all_tables=0x62b000039ae0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:6230
      #29 0x0000557a4329acc4 in mysql_execute_command (thd=0x62b000069288) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:3926
      #30 0x0000557a432b6c91 in mysql_parse (thd=0x62b000069288, rawbuf=0x62b0000382a8 "SELECT * FROM JSON_TABLE('{}', '$' COLUMNS(a CHAR(100) PATH '$' DEFAULT \"0\" ON ERROR)) AS jt", length=92, parser_state=0x7fada60d87b0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:8001
      #31 0x0000557a4328d6c8 in dispatch_command (command=COM_QUERY, thd=0x62b000069288, packet=0x62900024e289 "", packet_length=92, blocking=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1886
      #32 0x0000557a4328a403 in do_command (thd=0x62b000069288, blocking=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1397
      #33 0x0000557a436cbea9 in do_handle_one_connection (connect=0x61100000ad48, put_in_cache=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1410
      #34 0x0000557a436cb806 in handle_one_connection (arg=0x61100000ac08) at /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1312
      #35 0x0000557a443d5f49 in pfs_spawn_thread (arg=0x616000102a08) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
      #36 0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #37 0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
       
      Thread 6 (Thread 0x7fada6162300 (LWP 2528382)):
      #0  futex_wait_cancelable (private=<optimized out>, expected=0, futex_word=0x557a47590028 <COND_manager+40>) at ../sysdeps/nptl/futex-internal.h:183
      #1  __pthread_cond_wait_common (abstime=0x0, clockid=0, mutex=0x557a4758ff48 <LOCK_manager+40>, cond=0x557a47590000 <COND_manager>) at pthread_cond_wait.c:508
      #2  __pthread_cond_wait (cond=0x557a47590000 <COND_manager>, mutex=0x557a4758ff48 <LOCK_manager+40>) at pthread_cond_wait.c:638
      #3  0x0000557a44ff935b in safe_cond_wait (cond=0x557a47590000 <COND_manager>, mp=0x557a4758ff20 <LOCK_manager>, file=0x557a461e7b80 "/data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c", line=596) at /data/src/bb-10.6-mdev17399-hf/mysys/thr_mutex.c:492
      #4  0x0000557a44fe6a28 in psi_cond_wait (that=0x557a47590000 <COND_manager>, mutex=0x557a4758ff20 <LOCK_manager>, file=0x557a45303060 "/data/src/bb-10.6-mdev17399-hf/sql/sql_manager.cc", line=103) at /data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c:596
      #5  0x0000557a43280798 in inline_mysql_cond_wait (that=0x557a47590000 <COND_manager>, mutex=0x557a4758ff20 <LOCK_manager>, src_file=0x557a45303060 "/data/src/bb-10.6-mdev17399-hf/sql/sql_manager.cc", src_line=103) at /data/src/bb-10.6-mdev17399-hf/include/mysql/psi/mysql_thread.h:1070
      #6  0x0000557a43280e30 in handle_manager (arg=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_manager.cc:103
      #7  0x0000557a443d5f49 in pfs_spawn_thread (arg=0x6160000ee308) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
      #8  0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #9  0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
       
      Thread 5 (Thread 0x7fada621a300 (LWP 2528379)):
      #0  0x00007fadaf2a8322 in __GI___sigtimedwait (set=0x7fada62198f0, info=0x7fada6219720, timeout=0x0) at ../sysdeps/unix/sysv/linux/sigtimedwait.c:29
      #1  0x00007fadafc79111 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #2  0x0000557a42f7b07c in my_sigwait (set=0x7fada62198f0, sig=0x7fada6219860, code=0x7fada6219870) at /data/src/bb-10.6-mdev17399-hf/include/my_pthread.h:195
      #3  0x0000557a42f88367 in signal_hand (arg=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:2995
      #4  0x0000557a443d5f49 in pfs_spawn_thread (arg=0x616000068e08) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
      #5  0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #6  0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
       
      Thread 4 (Thread 0x7fadaf2531c0 (LWP 2528376)):
      #0  0x00007fadaf376aff in __GI___poll (fds=0x602000000df0, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
      #1  0x00007fadafc2e5ba in poll () from /lib/x86_64-linux-gnu/libasan.so.5
      #2  0x0000557a42f92b72 in handle_connections_sockets () at /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5968
      #3  0x0000557a42f91381 in mysqld_main (argc=144, argv=0x61b000001668) at /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5675
      #4  0x0000557a42f7aefd in main (argc=6, argv=0x7ffe76169eb8) at /data/src/bb-10.6-mdev17399-hf/sql/main.cc:25
       
      Thread 3 (Thread 0x7fada6d04700 (LWP 2528378)):
      #0  futex_abstimed_wait_cancelable (private=<optimized out>, abstime=0x7fada6d03c40, clockid=<optimized out>, expected=0, futex_word=0x557a47df70c8 <COND_checkpoint+40>) at ../sysdeps/nptl/futex-internal.h:320
      #1  __pthread_cond_wait_common (abstime=0x7fada6d03c40, clockid=<optimized out>, mutex=0x557a47df6fe8 <LOCK_checkpoint+40>, cond=0x557a47df70a0 <COND_checkpoint>) at pthread_cond_wait.c:520
      #2  __pthread_cond_timedwait (cond=0x557a47df70a0 <COND_checkpoint>, mutex=0x557a47df6fe8 <LOCK_checkpoint+40>, abstime=0x7fada6d03c40) at pthread_cond_wait.c:656
      #3  0x0000557a44ff9c94 in safe_cond_timedwait (cond=0x557a47df70a0 <COND_checkpoint>, mp=0x557a47df6fc0 <LOCK_checkpoint>, abstime=0x7fada6d03c40, file=0x557a461e7b80 "/data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c", line=609) at /data/src/bb-10.6-mdev17399-hf/mysys/thr_mutex.c:546
      #4  0x0000557a44fe6cf9 in psi_cond_timedwait (that=0x557a47df70a0 <COND_checkpoint>, mutex=0x557a47df6fc0 <LOCK_checkpoint>, abstime=0x7fada6d03c40, file=0x557a45a32f40 "/data/src/bb-10.6-mdev17399-hf/storage/maria/ma_servicethread.c", line=115) at /data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c:609
      #5  0x0000557a441e0117 in inline_mysql_cond_timedwait (that=0x557a47df70a0 <COND_checkpoint>, mutex=0x557a47df6fc0 <LOCK_checkpoint>, abstime=0x7fada6d03c40, src_file=0x557a45a32f40 "/data/src/bb-10.6-mdev17399-hf/storage/maria/ma_servicethread.c", src_line=115) at /data/src/bb-10.6-mdev17399-hf/include/mysql/psi/mysql_thread.h:1086
      #6  0x0000557a441e0edc in my_service_thread_sleep (control=0x557a46d76ac0 <checkpoint_control>, sleep_time=29000000000) at /data/src/bb-10.6-mdev17399-hf/storage/maria/ma_servicethread.c:115
      #7  0x0000557a441c305b in ma_checkpoint_background (arg=0x1e) at /data/src/bb-10.6-mdev17399-hf/storage/maria/ma_checkpoint.c:707
      #8  0x0000557a443d5f49 in pfs_spawn_thread (arg=0x616000021108) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
      #9  0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #10 0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
       
      Thread 2 (Thread 0x7fada7c1d700 (LWP 2528377)):
      #0  futex_abstimed_wait_cancelable (private=<optimized out>, abstime=0x7fada7c1cd90, clockid=<optimized out>, expected=0, futex_word=0x557a47ed2728 <COND_timer+40>) at ../sysdeps/nptl/futex-internal.h:320
      #1  __pthread_cond_wait_common (abstime=0x7fada7c1cd90, clockid=<optimized out>, mutex=0x557a47ed2648 <LOCK_timer+40>, cond=0x557a47ed2700 <COND_timer>) at pthread_cond_wait.c:520
      #2  __pthread_cond_timedwait (cond=0x557a47ed2700 <COND_timer>, mutex=0x557a47ed2648 <LOCK_timer+40>, abstime=0x7fada7c1cd90) at pthread_cond_wait.c:656
      #3  0x0000557a44ff9c94 in safe_cond_timedwait (cond=0x557a47ed2700 <COND_timer>, mp=0x557a47ed2620 <LOCK_timer>, abstime=0x7fada7c1cd90, file=0x557a461e7b80 "/data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c", line=609) at /data/src/bb-10.6-mdev17399-hf/mysys/thr_mutex.c:546
      #4  0x0000557a44fe6cf9 in psi_cond_timedwait (that=0x557a47ed2700 <COND_timer>, mutex=0x557a47ed2620 <LOCK_timer>, abstime=0x7fada7c1cd90, file=0x557a461eb4c0 "/data/src/bb-10.6-mdev17399-hf/mysys/thr_timer.c", line=321) at /data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c:609
      #5  0x0000557a44ffc71a in inline_mysql_cond_timedwait (that=0x557a47ed2700 <COND_timer>, mutex=0x557a47ed2620 <LOCK_timer>, abstime=0x7fada7c1cd90, src_file=0x557a461eb4c0 "/data/src/bb-10.6-mdev17399-hf/mysys/thr_timer.c", src_line=321) at /data/src/bb-10.6-mdev17399-hf/include/mysql/psi/mysql_thread.h:1086
      #6  0x0000557a44ffe8fa in timer_handler (arg=0x0) at /data/src/bb-10.6-mdev17399-hf/mysys/thr_timer.c:321
      #7  0x0000557a443d5f49 in pfs_spawn_thread (arg=0x616000004c08) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
      #8  0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #9  0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
       
      Thread 1 (Thread 0x7fada60da300 (LWP 2528383)):
      #0  __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
      #1  0x0000557a44febe17 in my_write_core (sig=6) at /data/src/bb-10.6-mdev17399-hf/mysys/stacktrace.c:424
      #2  0x0000557a43a9fbbf in handle_fatal_signal (sig=6) at /data/src/bb-10.6-mdev17399-hf/sql/signal_handler.cc:331
      #3  <signal handler called>
      #4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #5  0x00007fadaf286859 in __GI_abort () at abort.c:79
      #6  0x00007fadafd1d6a2 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #7  0x00007fadafd2824c in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #8  0x00007fadafd098ec in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #9  0x00007fadafd09363 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #10 0x00007fadafc59f4f in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
      #11 0x0000557a45086d46 in my_fill_8bit (cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>, s=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., l=399, fill=32) at /data/src/bb-10.6-mdev17399-hf/strings/ctype-simple.c:1117
      #12 0x0000557a450d7300 in my_fill_utf8mb3 (cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>, str=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., length=399, fill=32) at /data/src/bb-10.6-mdev17399-hf/strings/ctype-utf8.c:5351
      #13 0x0000557a43a6921f in charset_info_st::fill (this=0x557a475084e0 <my_charset_utf8mb4_general_ci>, to=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., len=399, ch=32) at /data/src/bb-10.6-mdev17399-hf/include/m_ctype.h:681
      #14 0x0000557a43a45d92 in Field_string::store (this=0x61900008a828, from=0x62b000039a50 "0", length=1, cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>) at /data/src/bb-10.6-mdev17399-hf/sql/field.cc:7276
      #15 0x0000557a438fcbeb in Json_table_column::On_response::respond (this=0x62b0000399d8, jc=0x62b000039590, f=0x61900008a828) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:1040
      #16 0x0000557a438f6b0a in ha_json_table::fill_column_values (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>..., pos=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:408
      #17 0x0000557a438f5e90 in ha_json_table::rnd_next (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>...) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:294
      #18 0x0000557a43ab9038 in handler::ha_rnd_next (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>...) at /data/src/bb-10.6-mdev17399-hf/sql/handler.cc:3069
      #19 0x0000557a43f13fcb in rr_sequential (info=0x62b00003bfe0) at /data/src/bb-10.6-mdev17399-hf/sql/records.cc:519
      #20 0x0000557a430dc0d2 in READ_RECORD::read_record (this=0x62b00003bfe0) at /data/src/bb-10.6-mdev17399-hf/sql/records.h:81
      #21 0x0000557a433eb4f4 in join_init_read_record (tab=0x62b00003bf18) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:21745
      #22 0x0000557a433e44d1 in sub_select (join=0x62b00003ab28, join_tab=0x62b00003bf18, end_of_records=false) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20767
      #23 0x0000557a433e287e in do_select (join=0x62b00003ab28, procedure=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20317
      #24 0x0000557a4336ea7f in JOIN::exec_inner (this=0x62b00003ab28) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4491
      #25 0x0000557a4336c06a in JOIN::exec (this=0x62b00003ab28) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4271
      #26 0x0000557a433704b9 in mysql_select (thd=0x62b000069288, tables=0x62b000039ae0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x62b00003aaf8, unit=0x62b00006d460, select_lex=0x62b0000383d0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4747
      #27 0x0000557a43341846 in handle_select (thd=0x62b000069288, lex=0x62b00006d398, result=0x62b00003aaf8, setup_tables_done_option=0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:417
      #28 0x0000557a432ab9e2 in execute_sqlcom_select (thd=0x62b000069288, all_tables=0x62b000039ae0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:6230
      #29 0x0000557a4329acc4 in mysql_execute_command (thd=0x62b000069288) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:3926
      #30 0x0000557a432b6c91 in mysql_parse (thd=0x62b000069288, rawbuf=0x62b0000382a8 "SELECT * FROM JSON_TABLE('{}', '$' COLUMNS(a CHAR(100) PATH '$' DEFAULT \"0\" ON ERROR)) AS jt", length=92, parser_state=0x7fada60d87b0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:8001
      #31 0x0000557a4328d6c8 in dispatch_command (command=COM_QUERY, thd=0x62b000069288, packet=0x62900024e289 "", packet_length=92, blocking=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1886
      #32 0x0000557a4328a403 in do_command (thd=0x62b000069288, blocking=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1397
      #33 0x0000557a436cbea9 in do_handle_one_connection (connect=0x61100000ad48, put_in_cache=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1410
      #34 0x0000557a436cb806 in handle_one_connection (arg=0x61100000ac08) at /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1312
      #35 0x0000557a443d5f49 in pfs_spawn_thread (arg=0x616000102a08) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
      #36 0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #37 0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              holyfoot Alexey Botchkov
              Reporter:
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: