[MDEV-25178] JSON_TABLE: ASAN use-after-poison in my_fill_8bit / Json_table_column::On_response::respond - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: N/A
Fix Version/s: 10.6.0
Component/s: Character Sets, JSON
Labels:
None

Description

SET NAMES utf8mb4;

SELECT * FROM JSON_TABLE('{}', '$' COLUMNS(a CHAR(100) PATH '$' DEFAULT "0" ON ERROR)) AS jt;

bb-10.6-mdev17399-hf 8611fb30bc6
==2528376==ERROR: AddressSanitizer: use-after-poison on address 0x61900008aa68 at pc 0x7fadafc59f2d bp 0x7fada60d6880 sp 0x7fada60d6028
WRITE of size 399 at 0x61900008aa68 thread T5
#0 0x7fadafc59f2c (/lib/x86_64-linux-gnu/libasan.so.5+0x67f2c)
#1 0x557a45086d45 in my_fill_8bit /data/src/bb-10.6-mdev17399-hf/strings/ctype-simple.c:1117
#2 0x557a450d72ff in my_fill_utf8mb3 /data/src/bb-10.6-mdev17399-hf/strings/ctype-utf8.c:5351
#3 0x557a43a6921e in charset_info_st::fill(char*, unsigned long, int) const /data/src/bb-10.6-mdev17399-hf/include/m_ctype.h:681
#4 0x557a43a45d91 in Field_string::store(char const, unsigned long, charset_info_st const) /data/src/bb-10.6-mdev17399-hf/sql/field.cc:7276
#5 0x557a438fcbea in Json_table_column::On_response::respond(Json_table_column, Field) /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:1040
#6 0x557a438f6b09 in ha_json_table::fill_column_values(unsigned char, unsigned char) /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:408
#7 0x557a438f5e8f in ha_json_table::rnd_next(unsigned char*) /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:294
#8 0x557a43ab9037 in handler::ha_rnd_next(unsigned char*) /data/src/bb-10.6-mdev17399-hf/sql/handler.cc:3069
#9 0x557a43f13fca in rr_sequential(READ_RECORD*) /data/src/bb-10.6-mdev17399-hf/sql/records.cc:519
#10 0x557a430dc0d1 in READ_RECORD::read_record() /data/src/bb-10.6-mdev17399-hf/sql/records.h:81
#11 0x557a433eb4f3 in join_init_read_record(st_join_table*) /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:21745
#12 0x557a433e44d0 in sub_select(JOIN, st_join_table, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20767
#13 0x557a433e287d in do_select /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20317
#14 0x557a4336ea7e in JOIN::exec_inner() /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4491
#15 0x557a4336c069 in JOIN::exec() /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4271
#16 0x557a433704b8 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4747
#17 0x557a43341845 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:417
#18 0x557a432ab9e1 in execute_sqlcom_select /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:6230
#19 0x557a4329acc3 in mysql_execute_command(THD*) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:3926
#20 0x557a432b6c90 in mysql_parse(THD, char, unsigned int, Parser_state*) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:8001
#21 0x557a4328d6c7 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1886
#22 0x557a4328a402 in do_command(THD*, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1397
#23 0x557a436cbea8 in do_handle_one_connection(CONNECT*, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1410
#24 0x557a436cb805 in handle_one_connection /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1312
#25 0x557a443d5f48 in pfs_spawn_thread /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
#26 0x7fadaf7af608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
#27 0x7fadaf383292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x61900008abe4 is located 0 bytes to the right of 1124-byte region [0x61900008a780,0x61900008abe4)
allocated by thread T5 here:
#0 0x7fadafcffbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x557a4500d6a1 in sf_malloc /data/src/bb-10.6-mdev17399-hf/mysys/safemalloc.c:121
#2 0x557a44fda1e9 in my_malloc /data/src/bb-10.6-mdev17399-hf/mysys/my_malloc.c:90
#3 0x557a44fb61e9 in alloc_root /data/src/bb-10.6-mdev17399-hf/mysys/my_alloc.c:244
#4 0x557a4342ae24 in Field::operator new(unsigned long, st_mem_root*) /data/src/bb-10.6-mdev17399-hf/sql/field.h:761
#5 0x557a43860151 in Type_handler_string::make_table_field_from_def(TABLE_SHARE, st_mem_root, st_mysql_const_lex_string const, Record_addr const&, Bit_addr const&, Column_definition_attributes const, unsigned int) const /data/src/bb-10.6-mdev17399-hf/sql/sql_type.cc:8250
#6 0x557a438fb2ae in Create_json_table::add_json_table_fields(THD, TABLE, Table_function_json_table*) /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:845
#7 0x557a438fbb47 in create_table_for_function(THD, TABLE_LIST) /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:900
#8 0x557a431014d0 in open_and_process_table /data/src/bb-10.6-mdev17399-hf/sql/sql_base.cc:3690
#9 0x557a43104cab in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/src/bb-10.6-mdev17399-hf/sql/sql_base.cc:4283
#10 0x557a43109b7f in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/src/bb-10.6-mdev17399-hf/sql/sql_base.cc:5241
#11 0x557a43061b9b in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/src/bb-10.6-mdev17399-hf/sql/sql_base.h:507
#12 0x557a432aaf60 in execute_sqlcom_select /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:6151
#13 0x557a4329acc3 in mysql_execute_command(THD*) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:3926
#14 0x557a432b6c90 in mysql_parse(THD, char, unsigned int, Parser_state*) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:8001
#15 0x557a4328d6c7 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1886
#16 0x557a4328a402 in do_command(THD*, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1397
#17 0x557a436cbea8 in do_handle_one_connection(CONNECT*, bool) /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1410
#18 0x557a436cb805 in handle_one_connection /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1312
#19 0x557a443d5f48 in pfs_spawn_thread /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
#20 0x7fadaf7af608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

Thread T5 created by T0 here:
#0 0x7fadafc2c805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x557a443d0eec in my_thread_create /data/src/bb-10.6-mdev17399-hf/storage/perfschema/my_thread.h:38
#2 0x557a443d633b in pfs_spawn_thread_v1 /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2252
#3 0x557a42f7bbd8 in inline_mysql_thread_create /data/src/bb-10.6-mdev17399-hf/include/mysql/psi/mysql_thread.h:1139
#4 0x557a42f91b73 in create_thread_to_handle_connection(CONNECT*) /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5780
#5 0x557a42f921f2 in create_new_thread(CONNECT*) /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5839
#6 0x557a42f9255f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5901
#7 0x557a42f92f0c in handle_connections_sockets() /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:6023
#8 0x557a42f91380 in mysqld_main(int, char**) /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5675
#9 0x557a42f7aefc in main /data/src/bb-10.6-mdev17399-hf/sql/main.cc:25
#10 0x7fadaf2880b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: use-after-poison (/lib/x86_64-linux-gnu/libasan.so.5+0x67f2c)
Shadow bytes around the buggy address:
0x0c32800094f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280009500: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
0x0c3280009510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280009520: 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280009530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3280009540: 00 00 00 00 00 00 00 00 00 00 00 00 00[f7]00 00
0x0c3280009550: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c3280009560: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c3280009570: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 04 fa fa fa
0x0c3280009580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3280009590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==2528376==ABORTING
210317 18:33:42 [ERROR] mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.

Server version: 10.6.0-MariaDB-debug-log
key_buffer_size=1048576
read_buffer_size=131072
max_used_connections=1
max_threads=153
thread_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63804 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x62b000069288
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7fada60d9950 thread_stack 0x5fc00
??:0(__interceptor_tcgetattr)[0x7fadafc5ed30]
mysys/stacktrace.c:212(my_print_stacktrace)[0x557a44febc95]
sql/signal_handler.cc:212(handle_fatal_signal)[0x557a43a9f67f]
sigaction.c:0(__restore_rt)[0x7fadaf7bb3c0]
??:0(gsignal)[0x7fadaf2a718b]
??:0(abort)[0x7fadaf286859]
??:0(__sanitizer_set_report_fd)[0x7fadafd1d6a2]
??:0(__sanitizer_get_module_and_offset_for_pc)[0x7fadafd2824c]
??:0(__sanitizer_ptr_cmp)[0x7fadafd098ec]
??:0(__asan_on_error)[0x7fadafd09363]
??:0(strlen)[0x7fadafc59f4f]
strings/ctype-simple.c:1118(my_fill_8bit)[0x557a45086d46]
strings/ctype-utf8.c:5354(my_fill_utf8mb3)[0x557a450d7300]
include/m_ctype.h:682(charset_info_st::fill(char*, unsigned long, int) const)[0x557a43a6921f]
sql/field.cc:7280(Field_string::store(char const, unsigned long, charset_info_st const))[0x557a43a45d92]
sql/json_table.cc:1042(Json_table_column::On_response::respond(Json_table_column, Field))[0x557a438fcbeb]
sql/json_table.cc:408(ha_json_table::fill_column_values(unsigned char, unsigned char))[0x557a438f6b0a]
sql/json_table.cc:294(ha_json_table::rnd_next(unsigned char*))[0x557a438f5e90]
sql/handler.cc:3069(handler::ha_rnd_next(unsigned char*))[0x557a43ab9038]
sql/records.cc:519(rr_sequential(READ_RECORD*))[0x557a43f13fcb]
sql/records.h:81(READ_RECORD::read_record())[0x557a430dc0d2]
sql/sql_select.cc:21745(join_init_read_record(st_join_table*))[0x557a433eb4f4]
sql/sql_select.cc:20767(sub_select(JOIN, st_join_table, bool))[0x557a433e44d1]
sql/sql_select.cc:20317(do_select(JOIN, Procedure))[0x557a433e287e]
sql/sql_select.cc:4491(JOIN::exec_inner())[0x557a4336ea7f]
sql/sql_select.cc:4272(JOIN::exec())[0x557a4336c06a]
sql/sql_select.cc:4749(mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex))[0x557a433704b9]
sql/sql_select.cc:417(handle_select(THD, LEX, select_result*, unsigned long))[0x557a43341846]
sql/sql_parse.cc:6230(execute_sqlcom_select(THD, TABLE_LIST))[0x557a432ab9e2]
sql/sql_parse.cc:3926(mysql_execute_command(THD*))[0x557a4329acc4]
sql/sql_parse.cc:8001(mysql_parse(THD, char, unsigned int, Parser_state*))[0x557a432b6c91]
sql/sql_parse.cc:1888(dispatch_command(enum_server_command, THD, char, unsigned int, bool))[0x557a4328d6c8]
sql/sql_parse.cc:1397(do_command(THD*, bool))[0x557a4328a403]
sql/sql_connect.cc:1410(do_handle_one_connection(CONNECT*, bool))[0x557a436cbea9]
sql/sql_connect.cc:1314(handle_one_connection)[0x557a436cb806]
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x557a443d5f49]
nptl/pthread_create.c:478(start_thread)[0x7fadaf7af609]
??:0(clone)[0x7fadaf383293]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x62b0000382a8): SELECT * FROM JSON_TABLE('{}', '$' COLUMNS(a CHAR(100) PATH '$' DEFAULT "0" ON ERROR)) AS jt

Connection ID (thread ID): 4
Status: NOT_KILLED

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off

The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains
information that should help you find out what is causing the crash.
Writing a core file...
Working directory at /dev/shm/var_auto_NVK3/mysqld.1/data
Resource Limits:
Limit Soft Limit Hard Limit Units
Max cpu time unlimited unlimited seconds
Max file size unlimited unlimited bytes
Max data size unlimited unlimited bytes
Max stack size 8388608 unlimited bytes
Max core file size unlimited unlimited bytes
Max resident set unlimited unlimited bytes
Max processes 385874 385874 processes
Max open files 1024 1024 files
Max locked memory 67108864 67108864 bytes
Max address space unlimited unlimited bytes
Max file locks unlimited unlimited locks
Max pending signals 385874 385874 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 0 0
Max realtime priority 0 0
Max realtime timeout unlimited unlimited us
Core pattern: \|/usr/share/apport/apport %p %s %c %d %P %E

----------SERVER LOG END-------------


- found 'core' (0/5)

Trying 'dbx' to get a backtrace

Trying 'gdb' to get a backtrace from coredump /mnt-hd8t/src/bb-10.6-mdev17399-hf/mysql-test/var/log/bug.json15/mysqld.1/data/core
Core generated by '/mnt-hd8t/src/bb-10.6-mdev17399-hf/sql/mariadbd'
Output from gdb follows. The first stack trace is from the failing thread.
The following stack traces are from all threads (so the failing one is
duplicated).
--------------------------
[New LWP 2528383]
[New LWP 2528377]
[New LWP 2528378]
[New LWP 2528376]
[New LWP 2528379]
[New LWP 2528382]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/mnt-hd8t/src/bb-10.6-mdev17399-hf/sql/mariadbd --defaults-group-suffix=.1 --de'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
56 ../sysdeps/unix/sysv/linux/pthread_kill.c: No such file or directory.
[Current thread is 1 (Thread 0x7fada60da300 (LWP 2528383))]
#0 __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
#1 0x0000557a44febe17 in my_write_core (sig=6) at /data/src/bb-10.6-mdev17399-hf/mysys/stacktrace.c:424
#2 0x0000557a43a9fbbf in handle_fatal_signal (sig=6) at /data/src/bb-10.6-mdev17399-hf/sql/signal_handler.cc:331
#3 <signal handler called>
#4 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#5 0x00007fadaf286859 in __GI_abort () at abort.c:79
#6 0x00007fadafd1d6a2 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#7 0x00007fadafd2824c in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#8 0x00007fadafd098ec in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#9 0x00007fadafd09363 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#10 0x00007fadafc59f4f in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#11 0x0000557a45086d46 in my_fill_8bit (cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>, s=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., l=399, fill=32) at /data/src/bb-10.6-mdev17399-hf/strings/ctype-simple.c:1117
#12 0x0000557a450d7300 in my_fill_utf8mb3 (cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>, str=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., length=399, fill=32) at /data/src/bb-10.6-mdev17399-hf/strings/ctype-utf8.c:5351
#13 0x0000557a43a6921f in charset_info_st::fill (this=0x557a475084e0 <my_charset_utf8mb4_general_ci>, to=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., len=399, ch=32) at /data/src/bb-10.6-mdev17399-hf/include/m_ctype.h:681
#14 0x0000557a43a45d92 in Field_string::store (this=0x61900008a828, from=0x62b000039a50 "0", length=1, cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>) at /data/src/bb-10.6-mdev17399-hf/sql/field.cc:7276
#15 0x0000557a438fcbeb in Json_table_column::On_response::respond (this=0x62b0000399d8, jc=0x62b000039590, f=0x61900008a828) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:1040
#16 0x0000557a438f6b0a in ha_json_table::fill_column_values (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>..., pos=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:408
#17 0x0000557a438f5e90 in ha_json_table::rnd_next (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>...) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:294
#18 0x0000557a43ab9038 in handler::ha_rnd_next (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>...) at /data/src/bb-10.6-mdev17399-hf/sql/handler.cc:3069
#19 0x0000557a43f13fcb in rr_sequential (info=0x62b00003bfe0) at /data/src/bb-10.6-mdev17399-hf/sql/records.cc:519
#20 0x0000557a430dc0d2 in READ_RECORD::read_record (this=0x62b00003bfe0) at /data/src/bb-10.6-mdev17399-hf/sql/records.h:81
#21 0x0000557a433eb4f4 in join_init_read_record (tab=0x62b00003bf18) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:21745
#22 0x0000557a433e44d1 in sub_select (join=0x62b00003ab28, join_tab=0x62b00003bf18, end_of_records=false) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20767
#23 0x0000557a433e287e in do_select (join=0x62b00003ab28, procedure=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20317
#24 0x0000557a4336ea7f in JOIN::exec_inner (this=0x62b00003ab28) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4491
#25 0x0000557a4336c06a in JOIN::exec (this=0x62b00003ab28) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4271
#26 0x0000557a433704b9 in mysql_select (thd=0x62b000069288, tables=0x62b000039ae0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x62b00003aaf8, unit=0x62b00006d460, select_lex=0x62b0000383d0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4747
#27 0x0000557a43341846 in handle_select (thd=0x62b000069288, lex=0x62b00006d398, result=0x62b00003aaf8, setup_tables_done_option=0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:417
#28 0x0000557a432ab9e2 in execute_sqlcom_select (thd=0x62b000069288, all_tables=0x62b000039ae0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:6230
#29 0x0000557a4329acc4 in mysql_execute_command (thd=0x62b000069288) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:3926
#30 0x0000557a432b6c91 in mysql_parse (thd=0x62b000069288, rawbuf=0x62b0000382a8 "SELECT * FROM JSON_TABLE('{}', '$' COLUMNS(a CHAR(100) PATH '$' DEFAULT \"0\" ON ERROR)) AS jt", length=92, parser_state=0x7fada60d87b0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:8001
#31 0x0000557a4328d6c8 in dispatch_command (command=COM_QUERY, thd=0x62b000069288, packet=0x62900024e289 "", packet_length=92, blocking=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1886
#32 0x0000557a4328a403 in do_command (thd=0x62b000069288, blocking=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1397
#33 0x0000557a436cbea9 in do_handle_one_connection (connect=0x61100000ad48, put_in_cache=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1410
#34 0x0000557a436cb806 in handle_one_connection (arg=0x61100000ac08) at /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1312
#35 0x0000557a443d5f49 in pfs_spawn_thread (arg=0x616000102a08) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
#36 0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#37 0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 6 (Thread 0x7fada6162300 (LWP 2528382)):
#0 futex_wait_cancelable (private=<optimized out>, expected=0, futex_word=0x557a47590028 <COND_manager+40>) at ../sysdeps/nptl/futex-internal.h:183
#1 __pthread_cond_wait_common (abstime=0x0, clockid=0, mutex=0x557a4758ff48 <LOCK_manager+40>, cond=0x557a47590000 <COND_manager>) at pthread_cond_wait.c:508
#2 __pthread_cond_wait (cond=0x557a47590000 <COND_manager>, mutex=0x557a4758ff48 <LOCK_manager+40>) at pthread_cond_wait.c:638
#3 0x0000557a44ff935b in safe_cond_wait (cond=0x557a47590000 <COND_manager>, mp=0x557a4758ff20 <LOCK_manager>, file=0x557a461e7b80 "/data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c", line=596) at /data/src/bb-10.6-mdev17399-hf/mysys/thr_mutex.c:492
#4 0x0000557a44fe6a28 in psi_cond_wait (that=0x557a47590000 <COND_manager>, mutex=0x557a4758ff20 <LOCK_manager>, file=0x557a45303060 "/data/src/bb-10.6-mdev17399-hf/sql/sql_manager.cc", line=103) at /data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c:596
#5 0x0000557a43280798 in inline_mysql_cond_wait (that=0x557a47590000 <COND_manager>, mutex=0x557a4758ff20 <LOCK_manager>, src_file=0x557a45303060 "/data/src/bb-10.6-mdev17399-hf/sql/sql_manager.cc", src_line=103) at /data/src/bb-10.6-mdev17399-hf/include/mysql/psi/mysql_thread.h:1070
#6 0x0000557a43280e30 in handle_manager (arg=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_manager.cc:103
#7 0x0000557a443d5f49 in pfs_spawn_thread (arg=0x6160000ee308) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
#8 0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#9 0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 5 (Thread 0x7fada621a300 (LWP 2528379)):
#0 0x00007fadaf2a8322 in __GI___sigtimedwait (set=0x7fada62198f0, info=0x7fada6219720, timeout=0x0) at ../sysdeps/unix/sysv/linux/sigtimedwait.c:29
#1 0x00007fadafc79111 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#2 0x0000557a42f7b07c in my_sigwait (set=0x7fada62198f0, sig=0x7fada6219860, code=0x7fada6219870) at /data/src/bb-10.6-mdev17399-hf/include/my_pthread.h:195
#3 0x0000557a42f88367 in signal_hand (arg=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:2995
#4 0x0000557a443d5f49 in pfs_spawn_thread (arg=0x616000068e08) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
#5 0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#6 0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 4 (Thread 0x7fadaf2531c0 (LWP 2528376)):
#0 0x00007fadaf376aff in __GI___poll (fds=0x602000000df0, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1 0x00007fadafc2e5ba in poll () from /lib/x86_64-linux-gnu/libasan.so.5
#2 0x0000557a42f92b72 in handle_connections_sockets () at /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5968
#3 0x0000557a42f91381 in mysqld_main (argc=144, argv=0x61b000001668) at /data/src/bb-10.6-mdev17399-hf/sql/mysqld.cc:5675
#4 0x0000557a42f7aefd in main (argc=6, argv=0x7ffe76169eb8) at /data/src/bb-10.6-mdev17399-hf/sql/main.cc:25

Thread 3 (Thread 0x7fada6d04700 (LWP 2528378)):
#0 futex_abstimed_wait_cancelable (private=<optimized out>, abstime=0x7fada6d03c40, clockid=<optimized out>, expected=0, futex_word=0x557a47df70c8 <COND_checkpoint+40>) at ../sysdeps/nptl/futex-internal.h:320
#1 __pthread_cond_wait_common (abstime=0x7fada6d03c40, clockid=<optimized out>, mutex=0x557a47df6fe8 <LOCK_checkpoint+40>, cond=0x557a47df70a0 <COND_checkpoint>) at pthread_cond_wait.c:520
#2 __pthread_cond_timedwait (cond=0x557a47df70a0 <COND_checkpoint>, mutex=0x557a47df6fe8 <LOCK_checkpoint+40>, abstime=0x7fada6d03c40) at pthread_cond_wait.c:656
#3 0x0000557a44ff9c94 in safe_cond_timedwait (cond=0x557a47df70a0 <COND_checkpoint>, mp=0x557a47df6fc0 <LOCK_checkpoint>, abstime=0x7fada6d03c40, file=0x557a461e7b80 "/data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c", line=609) at /data/src/bb-10.6-mdev17399-hf/mysys/thr_mutex.c:546
#4 0x0000557a44fe6cf9 in psi_cond_timedwait (that=0x557a47df70a0 <COND_checkpoint>, mutex=0x557a47df6fc0 <LOCK_checkpoint>, abstime=0x7fada6d03c40, file=0x557a45a32f40 "/data/src/bb-10.6-mdev17399-hf/storage/maria/ma_servicethread.c", line=115) at /data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c:609
#5 0x0000557a441e0117 in inline_mysql_cond_timedwait (that=0x557a47df70a0 <COND_checkpoint>, mutex=0x557a47df6fc0 <LOCK_checkpoint>, abstime=0x7fada6d03c40, src_file=0x557a45a32f40 "/data/src/bb-10.6-mdev17399-hf/storage/maria/ma_servicethread.c", src_line=115) at /data/src/bb-10.6-mdev17399-hf/include/mysql/psi/mysql_thread.h:1086
#6 0x0000557a441e0edc in my_service_thread_sleep (control=0x557a46d76ac0 <checkpoint_control>, sleep_time=29000000000) at /data/src/bb-10.6-mdev17399-hf/storage/maria/ma_servicethread.c:115
#7 0x0000557a441c305b in ma_checkpoint_background (arg=0x1e) at /data/src/bb-10.6-mdev17399-hf/storage/maria/ma_checkpoint.c:707
#8 0x0000557a443d5f49 in pfs_spawn_thread (arg=0x616000021108) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
#9 0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#10 0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 2 (Thread 0x7fada7c1d700 (LWP 2528377)):
#0 futex_abstimed_wait_cancelable (private=<optimized out>, abstime=0x7fada7c1cd90, clockid=<optimized out>, expected=0, futex_word=0x557a47ed2728 <COND_timer+40>) at ../sysdeps/nptl/futex-internal.h:320
#1 __pthread_cond_wait_common (abstime=0x7fada7c1cd90, clockid=<optimized out>, mutex=0x557a47ed2648 <LOCK_timer+40>, cond=0x557a47ed2700 <COND_timer>) at pthread_cond_wait.c:520
#2 __pthread_cond_timedwait (cond=0x557a47ed2700 <COND_timer>, mutex=0x557a47ed2648 <LOCK_timer+40>, abstime=0x7fada7c1cd90) at pthread_cond_wait.c:656
#3 0x0000557a44ff9c94 in safe_cond_timedwait (cond=0x557a47ed2700 <COND_timer>, mp=0x557a47ed2620 <LOCK_timer>, abstime=0x7fada7c1cd90, file=0x557a461e7b80 "/data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c", line=609) at /data/src/bb-10.6-mdev17399-hf/mysys/thr_mutex.c:546
#4 0x0000557a44fe6cf9 in psi_cond_timedwait (that=0x557a47ed2700 <COND_timer>, mutex=0x557a47ed2620 <LOCK_timer>, abstime=0x7fada7c1cd90, file=0x557a461eb4c0 "/data/src/bb-10.6-mdev17399-hf/mysys/thr_timer.c", line=321) at /data/src/bb-10.6-mdev17399-hf/mysys/my_thr_init.c:609
#5 0x0000557a44ffc71a in inline_mysql_cond_timedwait (that=0x557a47ed2700 <COND_timer>, mutex=0x557a47ed2620 <LOCK_timer>, abstime=0x7fada7c1cd90, src_file=0x557a461eb4c0 "/data/src/bb-10.6-mdev17399-hf/mysys/thr_timer.c", src_line=321) at /data/src/bb-10.6-mdev17399-hf/include/mysql/psi/mysql_thread.h:1086
#6 0x0000557a44ffe8fa in timer_handler (arg=0x0) at /data/src/bb-10.6-mdev17399-hf/mysys/thr_timer.c:321
#7 0x0000557a443d5f49 in pfs_spawn_thread (arg=0x616000004c08) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
#8 0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#9 0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 1 (Thread 0x7fada60da300 (LWP 2528383)):
#0 __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
#1 0x0000557a44febe17 in my_write_core (sig=6) at /data/src/bb-10.6-mdev17399-hf/mysys/stacktrace.c:424
#2 0x0000557a43a9fbbf in handle_fatal_signal (sig=6) at /data/src/bb-10.6-mdev17399-hf/sql/signal_handler.cc:331
#3 <signal handler called>
#4 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#5 0x00007fadaf286859 in __GI_abort () at abort.c:79
#6 0x00007fadafd1d6a2 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#7 0x00007fadafd2824c in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#8 0x00007fadafd098ec in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#9 0x00007fadafd09363 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#10 0x00007fadafc59f4f in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
#11 0x0000557a45086d46 in my_fill_8bit (cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>, s=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., l=399, fill=32) at /data/src/bb-10.6-mdev17399-hf/strings/ctype-simple.c:1117
#12 0x0000557a450d7300 in my_fill_utf8mb3 (cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>, str=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., length=399, fill=32) at /data/src/bb-10.6-mdev17399-hf/strings/ctype-utf8.c:5351
#13 0x0000557a43a6921f in charset_info_st::fill (this=0x557a475084e0 <my_charset_utf8mb4_general_ci>, to=0x61900008a91a ' ' <repeats 99 times>, '\276' <repeats 101 times>..., len=399, ch=32) at /data/src/bb-10.6-mdev17399-hf/include/m_ctype.h:681
#14 0x0000557a43a45d92 in Field_string::store (this=0x61900008a828, from=0x62b000039a50 "0", length=1, cs=0x557a475084e0 <my_charset_utf8mb4_general_ci>) at /data/src/bb-10.6-mdev17399-hf/sql/field.cc:7276
#15 0x0000557a438fcbeb in Json_table_column::On_response::respond (this=0x62b0000399d8, jc=0x62b000039590, f=0x61900008a828) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:1040
#16 0x0000557a438f6b0a in ha_json_table::fill_column_values (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>..., pos=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:408
#17 0x0000557a438f5e90 in ha_json_table::rnd_next (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>...) at /data/src/bb-10.6-mdev17399-hf/sql/json_table.cc:294
#18 0x0000557a43ab9038 in handler::ha_rnd_next (this=0x61b00003c728, buf=0x61900008a918 "\375\060", ' ' <repeats 99 times>, '\276' <repeats 99 times>...) at /data/src/bb-10.6-mdev17399-hf/sql/handler.cc:3069
#19 0x0000557a43f13fcb in rr_sequential (info=0x62b00003bfe0) at /data/src/bb-10.6-mdev17399-hf/sql/records.cc:519
#20 0x0000557a430dc0d2 in READ_RECORD::read_record (this=0x62b00003bfe0) at /data/src/bb-10.6-mdev17399-hf/sql/records.h:81
#21 0x0000557a433eb4f4 in join_init_read_record (tab=0x62b00003bf18) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:21745
#22 0x0000557a433e44d1 in sub_select (join=0x62b00003ab28, join_tab=0x62b00003bf18, end_of_records=false) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20767
#23 0x0000557a433e287e in do_select (join=0x62b00003ab28, procedure=0x0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:20317
#24 0x0000557a4336ea7f in JOIN::exec_inner (this=0x62b00003ab28) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4491
#25 0x0000557a4336c06a in JOIN::exec (this=0x62b00003ab28) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4271
#26 0x0000557a433704b9 in mysql_select (thd=0x62b000069288, tables=0x62b000039ae0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x62b00003aaf8, unit=0x62b00006d460, select_lex=0x62b0000383d0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:4747
#27 0x0000557a43341846 in handle_select (thd=0x62b000069288, lex=0x62b00006d398, result=0x62b00003aaf8, setup_tables_done_option=0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_select.cc:417
#28 0x0000557a432ab9e2 in execute_sqlcom_select (thd=0x62b000069288, all_tables=0x62b000039ae0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:6230
#29 0x0000557a4329acc4 in mysql_execute_command (thd=0x62b000069288) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:3926
#30 0x0000557a432b6c91 in mysql_parse (thd=0x62b000069288, rawbuf=0x62b0000382a8 "SELECT * FROM JSON_TABLE('{}', '$' COLUMNS(a CHAR(100) PATH '$' DEFAULT \"0\" ON ERROR)) AS jt", length=92, parser_state=0x7fada60d87b0) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:8001
#31 0x0000557a4328d6c8 in dispatch_command (command=COM_QUERY, thd=0x62b000069288, packet=0x62900024e289 "", packet_length=92, blocking=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1886
#32 0x0000557a4328a403 in do_command (thd=0x62b000069288, blocking=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_parse.cc:1397
#33 0x0000557a436cbea9 in do_handle_one_connection (connect=0x61100000ad48, put_in_cache=true) at /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1410
#34 0x0000557a436cb806 in handle_one_connection (arg=0x61100000ac08) at /data/src/bb-10.6-mdev17399-hf/sql/sql_connect.cc:1312
#35 0x0000557a443d5f49 in pfs_spawn_thread (arg=0x616000102a08) at /data/src/bb-10.6-mdev17399-hf/storage/perfschema/pfs.cc:2201
#36 0x00007fadaf7af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#37 0x00007fadaf383293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Attachments

Issue Links

relates to

MDEV-17399 Add support for JSON_TABLE

Closed

Activity

People

Assignee:: Alexey Botchkov

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2021-03-17 16:36

Updated:: 2021-04-21 06:21

Resolved:: 2021-03-22 12:32

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.