Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-26446

Crash on st_join_table::save_explain_data

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Critical
    • Resolution: Incomplete
    • 10.4.21, 10.5.12, 10.6.4, 10.4(EOL), 10.5, 10.6
    • N/A
    • Server
    • None

    Description

      Simple SELECT and also just EXPLAIN crash MariaDB server in certain data condition.
      Example crash trace:

      stack_bottom = 0x7f982069adb0 thread_stack 0x49000
      mysys/stacktrace.c:213(my_print_stacktrace)[0x55972f6abc1e]
      sql/signal_handler.cc:224(handle_fatal_signal)[0x55972f088aa7]
      sigaction.c:0(__restore_rt)[0x7f98364b73c0]
      sql/sql_select.cc:26822(st_join_table::save_explain_data(Explain_table_access*, unsigned long long, bool, st_join_table*))[0x55972eecb64f]
      sql/sql_select.cc:27378(JOIN::save_explain_data_intern(Explain_query*, bool, bool, bool, char const*))[0x55972eecd18b]
      sql/sql_select.cc:4256(JOIN::save_explain_data(Explain_query*, bool, bool, bool, bool))[0x55972eecd2f0]
      sql/sql_select.cc:1617(JOIN::build_explain())[0x55972eecd54c]
      sql/sql_select.cc:1674(JOIN::optimize())[0x55972eee2091]
      sql/sql_select.cc:4758(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55972eee2198]
      sql/sql_select.cc:27511(mysql_explain_union(THD*, st_select_lex_unit*, select_result*))[0x55972eee2ff2]
      sql/sql_parse.cc:6256(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55972ed45807]
      sql/sql_parse.cc:4005(mysql_execute_command(THD*))[0x55972ee87fce]
      sql/sql_parse.cc:8100(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55972ee8a35c]
      sql/sql_parse.cc:1951(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55972ee8cd5a]
      sql/sql_parse.cc:1375(do_command(THD*))[0x55972ee8e07f]
      sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x55972ef797e2]
      sql/sql_connect.cc:1318(handle_one_connection)[0x55972ef79ab4]
      perfschema/pfs.cc:2204(pfs_spawn_thread)[0x55972f30087d]
      nptl/pthread_create.c:478(start_thread)[0x7f98364ab609]
      ??:0(clone)[0x7f9836099293]
       
      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0x7f97a4012940): EXPLAIN SELECT COUNT(*) FROM mycrash WHERE (((p = 'foo' AND er != 4) OR er = 4 )) AND ((es >= 4)) limit 1
      

      Consistently reproducible with the example SQL dump attached. Sometimes the EXPLAIN needs to be run 3-4 times before it starts crashing.
      Reproduced on latest 10.4, 10.5 and 10.6 versions with:

      $ dbdeployer deploy single 10.6.4
      $ msb_10_6_4/use test < mycrash_1.sql
      $ msb_10_6_4/use test 
      mysql [localhost:10604] {msandbox} (test) > SELECT COUNT(*) FROM mycrash WHERE (((p = 'foo' AND er != 4) OR er = 4 )) AND ((es >= 4)) limit 1;
      ERROR 2013 (HY000): Lost connection to server during query
      

      Problem similar I guess to MDEV-19720 and MDEV-22160.
      I am very interested if there is any workaround to avoid these crashes.

      Attachments

        1. msandbox.err
          16 kB
          Przemek
        2. mycrash_1.sql
          284 kB
          Przemek

        Issue Links

          Activity

            People

              valerii Valerii Kravchuk
              przemek@mysqlmaniac.com Przemek
              Votes:
              1 Vote for this issue
              Watchers:
              9 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.