Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-27315

SIGSEGV in next_breadth_first_tab when setting tmp_disk_table_size to zero

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Cannot Reproduce
    • 10.3, 10.4, 10.5, 10.6, 10.7, 10.8
    • N/A
    • OTHER

    Description

      XA START 'a';
      XA END 'a';
      SET SESSION tmp_disk_table_size=0;
      SELECT * FROM information_schema.tables t JOIN information_schema.COLUMNS c ON t.table_schema=c.table_schema WHERE c.table_schema=(SELECT COUNT(*) FROM information_schema.COLUMNS GROUP BY column_type) GROUP BY t.table_name;
      

      Leads to:

      10.8.0 c9fcea14e9e1f34a97451706eac51276c85bbea7 (Debug)

      Core was generated by `/test/MD181221-mariadb-10.8.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x000056506ea7b299 in next_breadth_first_tab (
          first_top_tab=0x152e2c06ff40, n_top_tabs_count=2, 
          tab=tab@entry=0x152e2c0706a0) at /test/10.8_dbg/sql/sql_select.cc:10355
      10355	  n_top_tabs_count += tab->join->aggr_tables;
      [Current thread is 1 (Thread 0x152e701ad700 (LWP 1762831))]
      (gdb) bt
      #0  0x000056506ea7b299 in next_breadth_first_tab (first_top_tab=0x152e2c06ff40, n_top_tabs_count=2, tab=tab@entry=0x152e2c0706a0) at /test/10.8_dbg/sql/sql_select.cc:10355
      #1  0x000056506eac1d37 in JOIN::cleanup (this=this@entry=0x152e2c028b20, full=full@entry=true) at /test/10.8_dbg/sql/sql_select.h:1724
      #2  0x000056506eac221f in JOIN::destroy (this=0x152e2c028b20) at /test/10.8_dbg/sql/sql_select.cc:4764
      #3  0x000056506eb3e002 in st_select_lex::cleanup (this=this@entry=0x152e2c013fe8) at /test/10.8_dbg/sql/sql_union.cc:2788
      #4  0x000056506eacce24 in mysql_select (thd=thd@entry=0x152e2c000db8, tables=0x152e2c0145e8, fields=@0x152e2c014288: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152e2c014578, last = 0x152e2c04b070, elements = 45}, <No data fields>}, conds=0x152e2c017aa8, og_num=1, order=0x0, group=0x152e2c017ce8, having=0x0, proc_param=0x0, select_options=2685668096, result=0x152e2c028af8, unit=0x152e2c0051c0, select_lex=0x152e2c013fe8) at /test/10.8_dbg/sql/sql_select.cc:5012
      #5  0x000056506eaccfa2 in handle_select (thd=thd@entry=0x152e2c000db8, lex=lex@entry=0x152e2c0050e8, result=result@entry=0x152e2c028af8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.8_dbg/sql/sql_select.cc:545
      #6  0x000056506ea2ca82 in execute_sqlcom_select (thd=thd@entry=0x152e2c000db8, all_tables=0x152e2c0145e8) at /test/10.8_dbg/sql/sql_parse.cc:6253
      #7  0x000056506ea39942 in mysql_execute_command (thd=thd@entry=0x152e2c000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.8_dbg/sql/sql_parse.cc:3944
      #8  0x000056506ea25c74 in mysql_parse (thd=thd@entry=0x152e2c000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152e701ac400) at /test/10.8_dbg/sql/sql_parse.cc:8028
      #9  0x000056506ea348f9 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152e2c000db8, packet=packet@entry=0x152e2c00b879 "SELECT * FROM information_schema.tables t JOIN information_schema.COLUMNs c ON t.table_schema=c.table_schema WHERE c.table_schema=(SELECT COUNT(*) FROM information_schema.COLUMNs GROUP BY column_type)"..., packet_length=packet_length@entry=222, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_class.h:1360
      #10 0x000056506ea37d3b in do_command (thd=0x152e2c000db8, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_parse.cc:1402
      #11 0x000056506ebb1272 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x565071517ee8, put_in_cache=put_in_cache@entry=true) at /test/10.8_dbg/sql/sql_connect.cc:1418
      #12 0x000056506ebb1877 in handle_one_connection (arg=arg@entry=0x565071517ee8) at /test/10.8_dbg/sql/sql_connect.cc:1312
      #13 0x000056506f033ea8 in pfs_spawn_thread (arg=0x56507142b808) at /test/10.8_dbg/storage/perfschema/pfs.cc:2201
      #14 0x0000152e85138609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #15 0x0000152e84d27293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.3.33 (dbg), 10.4.23 (dbg), 10.5.14 (dbg), 10.6.6 (dbg), 10.7.1 (dbg), 10.7.2 (dbg), 10.8.0 (dbg)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (opt), 10.4.23 (opt), 10.5.14 (opt), 10.6.6 (opt), 10.7.2 (opt), 10.8.0 (opt)

      Attachments

        Activity

          People

            sanja Oleksandr Byelkin
            ramesh Ramesh Sivaraman
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.