Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-26260

Crash with old DECIMAL and CTE

    XMLWordPrintable

Details

    Description

      I apply the following patch:

      diff --git a/mysql-test/main/type_decimal.test b/mysql-test/main/type_decimal.test
      index 71c7c7bcd5b..da70b32e85e 100644
      --- a/mysql-test/main/type_decimal.test
      +++ b/mysql-test/main/type_decimal.test
      @@ -599,6 +599,8 @@ let $MYSQLD_DATADIR= `select @@datadir`;
       --copy_file std_data/old_decimal/t1dec102.MYD $MYSQLD_DATADIR/test/t1dec102.MYD
       --copy_file std_data/old_decimal/t1dec102.MYI $MYSQLD_DATADIR/test/t1dec102.MYI
       
      +WITH RECURSIVE tbl AS (   SELECT a FROM t1dec102    UNION SELECT 2 AS col FROM tbl )   SELECT * FROM tbl;
      +
       SHOW CREATE TABLE t1dec102;
       SHOW COLUMNS FROM t1dec102;
       SELECT COLUMN_NAME, DATA_TYPE, COLUMN_TYPE FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='t1dec102';
      

      and run:

      cd mysql-test
      ./mtr main.type_decimal
      

      It crashes with the following stack trace:

      #0  0x00007ffff76c2625 in raise () from /lib64/libc.so.6
      #1  0x00007ffff76ab8d9 in abort () from /lib64/libc.so.6
      #2  0x00007ffff76ab7a9 in __assert_fail_base.cold () from /lib64/libc.so.6
      #3  0x00007ffff76baa66 in __assert_fail () from /lib64/libc.so.6
      #4  0x0000000000967bd9 in Type_handler_olddecimal::make_table_field (this=0x1b8eb90 <type_handler_olddecimal>, name=0x7fffe00167b8, addr=..., attr=..., 
          table=0x7fffe00ab2b8) at /home/bar/maria-git/server.10.3.dec/sql/sql_type.cc:2159
      #5  0x00000000009674a9 in Type_handler::make_and_init_table_field (this=0x1b8eb90 <type_handler_olddecimal>, name=0x7fffe00167b8, addr=..., attr=..., 
          table=0x7fffe00ab2b8) at /home/bar/maria-git/server.10.3.dec/sql/sql_type.cc:2037
      #6  0x0000000000abdc41 in Item_type_holder::create_tmp_field (this=0x7fffe0016768, group=false, table=0x7fffe00ab2b8)
          at /home/bar/maria-git/server.10.3.dec/sql/item.h:6638
      #7  0x00000000007e93b0 in create_tmp_field (thd=0x7fffe0000d90, table=0x7fffe00ab2b8, item=0x7fffe0016768, type=Item::TYPE_HOLDER, copy_func=0x7ffff16e0370, 
          from_field=0x7fffe00ac3b8, default_field=0x7fffe00ac3a8, group=false, modify_item=false, table_cant_handle_bit_fields=false, make_copy_field=false)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_select.cc:17206
      #8  0x00000000007eae28 in create_tmp_table (thd=0x7fffe0000d90, param=0x7fffe0016010, fields=..., group=0x0, distinct=true, save_sum_fields=true, 
          select_options=2416196352, rows_limit=18446744073709551615, table_alias=0x1a54f20 <empty_clex_str>, do_not_open=false, keep_row_order=false)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_select.cc:17721
      #9  0x000000000086e02b in select_unit::create_result_table (this=0x7fffe0015fd0, thd_arg=0x7fffe0000d90, column_types=0x7fffe0013798, is_union_distinct=true, 
          options=2416196352, alias=0x1a54f20 <empty_clex_str>, bit_fields_as_long=false, create_table=true, keep_row_order=false, hidden=0)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_union.cc:372
      #10 0x000000000086e1db in select_union_recursive::create_result_table (this=0x7fffe0015fd0, thd_arg=0x7fffe0000d90, column_types=0x7fffe0013798, 
          is_union_distinct=true, options=2416196352, alias=0x7fffe0014990, bit_fields_as_long=false, create_table=true, keep_row_order=false, hidden=0)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_union.cc:401
      #11 0x0000000000870880 in st_select_lex_unit::prepare (this=0x7fffe00130b0, derived_arg=0x7fffe0014948, sel_result=0x7fffe0015ee8, additional_options=0)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_union.cc:1091
      #12 0x000000000072e351 in mysql_derived_prepare (thd=0x7fffe0000d90, lex=0x7fffe0004b98, derived=0x7fffe0014948)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_derived.cc:770
      #13 0x000000000072cf13 in mysql_handle_single_derived (lex=0x7fffe0004b98, derived=0x7fffe0014948, phases=2)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_derived.cc:199
      #14 0x000000000089eb0e in TABLE_LIST::handle_derived (this=0x7fffe0014948, lex=0x7fffe0004b98, phases=2) at /home/bar/maria-git/server.10.3.dec/sql/table.cc:8363
      #15 0x00000000007463c2 in LEX::handle_list_of_derived (this=0x7fffe0004b98, table_list=0x7fffe0014948, phases=2)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_lex.h:4004
      #16 0x0000000000752594 in st_select_lex::handle_derived (this=0x7fffe0014018, lex=0x7fffe0004b98, phases=2)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_lex.cc:4159
      #17 0x000000000089ead4 in TABLE_LIST::handle_derived (this=0x7fffe0015218, lex=0x7fffe0004b98, phases=2) at /home/bar/maria-git/server.10.3.dec/sql/table.cc:8360
      #18 0x00000000007463c2 in LEX::handle_list_of_derived (this=0x7fffe0004b98, table_list=0x7fffe0015218, phases=2)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_lex.h:4004
      #19 0x0000000000752594 in st_select_lex::handle_derived (this=0x7fffe00053e0, lex=0x7fffe0004b98, phases=2)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_lex.cc:4159
      #20 0x00000000007bd3dc in JOIN::prepare (this=0x7fffe0015980, tables_init=0x7fffe0015218, wild_num=1, conds_init=0x0, og_num=0, order_init=0x0, 
          skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7fffe00053e0, unit_arg=0x7fffe0004c58)
          at /home/bar/maria-git/server.10.3.dec/sql/sql_select.cc:1045
      #21 0x00000000007c8f3e in mysql_select (thd=0x7fffe0000d90, tables=0x7fffe0015218, wild_num=1, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, 
          proc_param=0x0, select_options=2147756800, result=0x7fffe0015958, unit=0x7fffe0004c58, select_lex=0x7fffe00053e0)
      

      The problem happens when this method:

      bool st_select_lex_unit::join_union_type_handlers(THD *thd_arg,
                                                        Type_holder *holders,
                                                        uint count)
      

      is called with count==1. This seems to be possible only with CTE (and is not possible with a simple UNION).

      With count>1, e.g. in case of a UNION, it works fine because the following translations:

      • old DATE -> new DATE
      • old VARCHAR -> new VARCHAR
      • old DECIMAL -> new DECIMAL

      happen inside Type_handler::aggregate_for_result_traditional().

      With count==1 the execition does not go inside Type_handler::aggregate_for_result_traditional(), so the translation does not happen.

      Attachments

        Issue Links

          Activity

            People

              serg Sergei Golubchik
              bar Alexander Barkov
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.