Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-27388

SIGSEGV in spider_set_direct_limit_offset on SELECT

Details

    Description

      INSTALL PLUGIN spider SONAME 'ha_spider.so';                                                                            
      CREATE TABLE t0 (a INT,KEY(a)) ENGINE=SPIDER;                                                                           
      CREATE TABLE t1 (a INT,KEY(a)) ENGINE=SPIDER;                                                                           
      INSERT INTO t1 SELECT * FROM t1 ;                                                                                       
      ALTER TABLE t1 CHANGE COLUMN n o CHAR(10);                                                                              
      INSERT INTO t0 VALUES (0);                                                                                              
      SELECT MIN(a) FROM t1;                 
      

      Leads to:

      10.8.0 ccdf5711a8fff0cd610a91fdcf37c8ff1182878c (Optimized)

      Core was generated by `/test/MD121221-mariadb-10.8.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00001518ac4db28b in spider_set_direct_limit_offset (
          spider=spider@entry=0x1517f007d870)
          at /test/10.8_opt/storage/spider/spd_table.cc:9535
      9535	    if (spider->partition_handler_share->owner->
      [Current thread is 1 (Thread 0x1518ac5c1700 (LWP 2638237))]
      (gdb) bt
      #0  0x00001518ac4db28b in spider_set_direct_limit_offset (spider=spider@entry=0x1517f007d870) at /test/10.8_opt/storage/spider/spd_table.cc:9535
      #1  0x00001518ac4f8ecf in ha_spider::check_direct_order_limit (this=0x1517f007d870) at /test/10.8_opt/storage/spider/ha_spider.cc:13105
      #2  ha_spider::check_direct_order_limit (this=0x1517f007d870) at /test/10.8_opt/storage/spider/ha_spider.cc:13089
      #3  0x00001518ac4fe74b in ha_spider::index_read_map_internal (find_flag=HA_READ_AFTER_KEY, keypart_map=1, key=0x1518ac5be930 "\001", buf=0x1517f006ff38 "\377", this=0x1517f007d870) at /test/10.8_opt/storage/spider/ha_spider.cc:1918
      #4  ha_spider::index_read_map_internal (this=0x1517f007d870, buf=0x1517f006ff38 "\377", key=0x1518ac5be930 "\001", keypart_map=1, find_flag=HA_READ_AFTER_KEY) at /test/10.8_opt/storage/spider/ha_spider.cc:1882
      #5  0x0000557bad24ead8 in handler::ha_index_read_map (this=0x1517f007d870, buf=0x1517f006ff38 "\377", key=0x1518ac5be930 "\001", keypart_map=1, find_flag=find_flag@entry=HA_READ_AFTER_KEY) at /test/10.8_opt/sql/handler.cc:3450
      #6  0x0000557bacf303d4 in get_index_min_value (item_field=0x1517f0010db8, prefix_len=<optimized out>, range_fl=<optimized out>, ref=0x1518ac5be8c0, table=0x1517f006fb58) at /test/10.8_opt/sql/opt_sum.cc:154
      #7  opt_sum_query (thd=0x1517f0000c58, tables=@0x1517f0010b50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1517f0012618, last = 0x1517f0012618, elements = 1}, <No data fields>}, all_fields=@0x1517f00123c8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1517f0011010, last = 0x1517f0011010, elements = 1}, <No data fields>}, conds=0x0) at /test/10.8_opt/sql/opt_sum.cc:411
      #8  0x0000557bad0796bd in JOIN::optimize_inner (this=0x1517f0012060) at /test/10.8_opt/sql/sql_select.cc:2364
      #9  0x0000557bad07b803 in JOIN::optimize (this=this@entry=0x1517f0012060) at /test/10.8_opt/sql/sql_select.cc:1809
      #10 0x0000557bad07b8ee in mysql_select (thd=0x1517f0000c58, tables=0x1517f0011070, fields=@0x1517f0010bd8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1517f0011010, last = 0x1517f0011010, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x1517f0012038, unit=0x1517f0004ea0, select_lex=0x1517f0010938) at /test/10.8_opt/sql/sql_select.cc:4979
      #11 0x0000557bad07c0f7 in handle_select (thd=thd@entry=0x1517f0000c58, lex=lex@entry=0x1517f0004dc8, result=result@entry=0x1517f0012038, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.8_opt/sql/sql_select.cc:545
      #12 0x0000557bacffcc01 in execute_sqlcom_select (thd=0x1517f0000c58, all_tables=0x1517f0011070) at /test/10.8_opt/sql/sql_parse.cc:6253
      #13 0x0000557bad00aef2 in mysql_execute_command (thd=0x1517f0000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.8_opt/sql/sql_parse.cc:3944
      #14 0x0000557bacff7986 in mysql_parse (thd=0x1517f0000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.8_opt/sql/sql_parse.cc:8028
      #15 0x0000557bad003b35 in dispatch_command (command=COM_QUERY, thd=0x1517f0000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.8_opt/sql/sql_class.h:1360
      #16 0x0000557bad005d27 in do_command (thd=0x1517f0000c58, blocking=blocking@entry=true) at /test/10.8_opt/sql/sql_parse.cc:1402
      #17 0x0000557bad1242e7 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/10.8_opt/sql/sql_connect.cc:1418
      #18 0x0000557bad12462d in handle_one_connection (arg=arg@entry=0x557bafb61be8) at /test/10.8_opt/sql/sql_connect.cc:1312
      #19 0x0000557bad4925d8 in pfs_spawn_thread (arg=0x557bafb19218) at /test/10.8_opt/storage/perfschema/pfs.cc:2201
      #20 0x00001518cb751609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #21 0x00001518cb33f293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.5.14 (opt), 10.6.6 (opt), 10.7.2 (opt), 10.8.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt), 10.5.14 (dbg), 10.6.6 (dbg), 10.7.2 (dbg), 10.8.0 (dbg)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)

      Attachments

        Issue Links

          Activity

            Roel Roel Van de Paar added a comment - - edited

            Please also try any fixes with

            INSTALL PLUGIN spider SONAME 'ha_spider.so';
            SET SESSION spider_same_server_link=ON;
            CREATE TABLE t (col1 CHAR(1),col2 VARCHAR(1),UNIQUE KEY KEY1 USING HASH (col1,col2)) ENGINE=SPIDER;
            CREATE TEMPORARY TABLE t (c BLOB);
            CREATE TABLE t2 (c INT,c2 INT,c3 BLOB,PRIMARY KEY(c));
            DROP TABLE t;
            SELECT COUNT(TABLE1.colvck) FROM t AS TABLE1 JOIN (SELECT * FROM t) AS TABLE2 ON (1=1) WHERE TABLE1.pk=1;
            ALTER TABLE t CHANGE c c NUMERIC ZEROFILL;
            CREATE TABLE t3 (a INT,b INT,KEY(a));
            INSERT INTO t VALUES (1,0);
            

            Leads to:

            10.8.0 ccdf5711a8fff0cd610a91fdcf37c8ff1182878c (Debug)

            Core was generated by `/test/MD121221-mariadb-10.8.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0  0x000014fc90100ef2 in spider_set_direct_limit_offset (
                spider=spider@entry=0x14fbd40d6760)
                at /test/10.8_dbg/storage/spider/spd_table.cc:9535
            9535	    if (spider->partition_handler_share->owner->
            [Current thread is 1 (Thread 0x14fc9ca87700 (LWP 692285))]
            (gdb) bt
            #0  0x000014fc90100ef2 in spider_set_direct_limit_offset (spider=spider@entry=0x14fbd40d6760) at /test/10.8_dbg/storage/spider/spd_table.cc:9535
            #1  0x000014fc90130e0b in ha_spider::check_direct_order_limit (this=this@entry=0x14fbd40d6760) at /test/10.8_dbg/storage/spider/ha_spider.cc:13105
            #2  0x000014fc9013916e in ha_spider::index_read_map_internal (this=this@entry=0x14fbd40d6760, buf=buf@entry=0x14fbd40d62d8 "\370\061\001\060\223#\001", key=key@entry=0x14fc9ca859cf "", keypart_map=keypart_map@entry=18446744073709551615, find_flag=find_flag@entry=HA_READ_KEY_EXACT) at /test/10.8_dbg/storage/spider/ha_spider.cc:1918
            #3  0x000014fc9013a429 in ha_spider::index_read_map (this=0x14fbd40d6760, buf=0x14fbd40d62d8 "\370\061\001\060\223#\001", key=0x14fc9ca859cf "", keypart_map=18446744073709551615, find_flag=HA_READ_KEY_EXACT) at /test/10.8_dbg/storage/spider/ha_spider.cc:2406
            #4  0x000056458d69d77d in handler::ha_index_read_map (this=0x14fbd40d6760, buf=0x14fbd40d62d8 "\370\061\001\060\223#\001", key=key@entry=0x14fc9ca859cf "", keypart_map=keypart_map@entry=18446744073709551615, find_flag=find_flag@entry=HA_READ_KEY_EXACT) at /test/10.8_dbg/sql/handler.cc:3450
            #5  0x000056458d6a72f0 in handler::check_duplicate_long_entry_key (this=this@entry=0x14fbd40d6760, new_rec=new_rec@entry=0x14fbd40d62d8 "\370\061\001\060\223#\001", key_no=key_no@entry=0) at /test/10.8_dbg/sql/handler.cc:7166
            #6  0x000056458d6a7902 in handler::check_duplicate_long_entries (this=this@entry=0x14fbd40d6760, new_rec=new_rec@entry=0x14fbd40d62d8 "\370\061\001\060\223#\001") at /test/10.8_dbg/sql/handler.cc:7246
            #7  0x000056458d6a857a in handler::ha_write_row (this=0x14fbd40d6760, buf=0x14fbd40d62d8 "\370\061\001\060\223#\001") at /test/10.8_dbg/sql/handler.cc:7508
            #8  0x000056458d34706a in write_record (thd=thd@entry=0x14fbd4000db8, table=table@entry=0x14fbd40d5e88, info=info@entry=0x14fc9ca85ca0, sink=sink@entry=0x0) at /test/10.8_dbg/sql/sql_insert.cc:2156
            #9  0x000056458d352cd9 in mysql_insert (thd=thd@entry=0x14fbd4000db8, table_list=0x14fbd4013eb0, fields=@0x14fbd4006078: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56458e9cdb00 <end_of_list>, last = 0x14fbd4006078, elements = 0}, <No data fields>}, values_list=@0x14fbd40060c0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14fbd4014b48, last = 0x14fbd4014b48, elements = 1}, <No data fields>}, update_fields=@0x14fbd40060a8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56458e9cdb00 <end_of_list>, last = 0x14fbd40060a8, elements = 0}, <No data fields>}, update_values=@0x14fbd4006090: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56458e9cdb00 <end_of_list>, last = 0x14fbd4006090, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.8_dbg/sql/sql_insert.cc:1127
            #10 0x000056458d3993d3 in mysql_execute_command (thd=thd@entry=0x14fbd4000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.8_dbg/sql/sql_parse.cc:4563
            #11 0x000056458d383e0f in mysql_parse (thd=thd@entry=0x14fbd4000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14fc9ca86400) at /test/10.8_dbg/sql/sql_parse.cc:8028
            #12 0x000056458d392aab in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14fbd4000db8, packet=packet@entry=0x14fbd400b879 "INSERT INTO t VALUES (1,0)", packet_length=packet_length@entry=26, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_class.h:1360
            #13 0x000056458d395eea in do_command (thd=0x14fbd4000db8, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_parse.cc:1402
            #14 0x000056458d50f89c in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5645901f1d08, put_in_cache=put_in_cache@entry=true) at /test/10.8_dbg/sql/sql_connect.cc:1418
            #15 0x000056458d50fea1 in handle_one_connection (arg=arg@entry=0x5645901f1d08) at /test/10.8_dbg/sql/sql_connect.cc:1312
            #16 0x000056458d991442 in pfs_spawn_thread (arg=0x564590103908) at /test/10.8_dbg/storage/perfschema/pfs.cc:2201
            #17 0x000014fca81fa609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #18 0x000014fca7de8293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            

            Bug confirmed present in:
            MariaDB: 10.5.14 (dbg), 10.5.14 (opt), 10.6.6 (dbg), 10.6.6 (opt), 10.7.2 (dbg), 10.7.2 (opt), 10.8.0 (dbg), 10.8.0 (opt)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)

            Roel Roel Van de Paar added a comment - - edited Please also try any fixes with INSTALL PLUGIN spider SONAME 'ha_spider.so'; SET SESSION spider_same_server_link=ON; CREATE TABLE t (col1 CHAR(1),col2 VARCHAR(1),UNIQUE KEY KEY1 USING HASH (col1,col2)) ENGINE=SPIDER; CREATE TEMPORARY TABLE t (c BLOB); CREATE TABLE t2 (c INT,c2 INT,c3 BLOB,PRIMARY KEY(c)); DROP TABLE t; SELECT COUNT(TABLE1.colvck) FROM t AS TABLE1 JOIN (SELECT * FROM t) AS TABLE2 ON (1=1) WHERE TABLE1.pk=1; ALTER TABLE t CHANGE c c NUMERIC ZEROFILL; CREATE TABLE t3 (a INT,b INT,KEY(a)); INSERT INTO t VALUES (1,0); Leads to: 10.8.0 ccdf5711a8fff0cd610a91fdcf37c8ff1182878c (Debug) Core was generated by `/test/MD121221-mariadb-10.8.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000014fc90100ef2 in spider_set_direct_limit_offset ( spider=spider@entry=0x14fbd40d6760) at /test/10.8_dbg/storage/spider/spd_table.cc:9535 9535 if (spider->partition_handler_share->owner-> [Current thread is 1 (Thread 0x14fc9ca87700 (LWP 692285))] (gdb) bt #0 0x000014fc90100ef2 in spider_set_direct_limit_offset (spider=spider@entry=0x14fbd40d6760) at /test/10.8_dbg/storage/spider/spd_table.cc:9535 #1 0x000014fc90130e0b in ha_spider::check_direct_order_limit (this=this@entry=0x14fbd40d6760) at /test/10.8_dbg/storage/spider/ha_spider.cc:13105 #2 0x000014fc9013916e in ha_spider::index_read_map_internal (this=this@entry=0x14fbd40d6760, buf=buf@entry=0x14fbd40d62d8 "\370\061\001\060\223#\001", key=key@entry=0x14fc9ca859cf "", keypart_map=keypart_map@entry=18446744073709551615, find_flag=find_flag@entry=HA_READ_KEY_EXACT) at /test/10.8_dbg/storage/spider/ha_spider.cc:1918 #3 0x000014fc9013a429 in ha_spider::index_read_map (this=0x14fbd40d6760, buf=0x14fbd40d62d8 "\370\061\001\060\223#\001", key=0x14fc9ca859cf "", keypart_map=18446744073709551615, find_flag=HA_READ_KEY_EXACT) at /test/10.8_dbg/storage/spider/ha_spider.cc:2406 #4 0x000056458d69d77d in handler::ha_index_read_map (this=0x14fbd40d6760, buf=0x14fbd40d62d8 "\370\061\001\060\223#\001", key=key@entry=0x14fc9ca859cf "", keypart_map=keypart_map@entry=18446744073709551615, find_flag=find_flag@entry=HA_READ_KEY_EXACT) at /test/10.8_dbg/sql/handler.cc:3450 #5 0x000056458d6a72f0 in handler::check_duplicate_long_entry_key (this=this@entry=0x14fbd40d6760, new_rec=new_rec@entry=0x14fbd40d62d8 "\370\061\001\060\223#\001", key_no=key_no@entry=0) at /test/10.8_dbg/sql/handler.cc:7166 #6 0x000056458d6a7902 in handler::check_duplicate_long_entries (this=this@entry=0x14fbd40d6760, new_rec=new_rec@entry=0x14fbd40d62d8 "\370\061\001\060\223#\001") at /test/10.8_dbg/sql/handler.cc:7246 #7 0x000056458d6a857a in handler::ha_write_row (this=0x14fbd40d6760, buf=0x14fbd40d62d8 "\370\061\001\060\223#\001") at /test/10.8_dbg/sql/handler.cc:7508 #8 0x000056458d34706a in write_record (thd=thd@entry=0x14fbd4000db8, table=table@entry=0x14fbd40d5e88, info=info@entry=0x14fc9ca85ca0, sink=sink@entry=0x0) at /test/10.8_dbg/sql/sql_insert.cc:2156 #9 0x000056458d352cd9 in mysql_insert (thd=thd@entry=0x14fbd4000db8, table_list=0x14fbd4013eb0, fields=@0x14fbd4006078: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56458e9cdb00 <end_of_list>, last = 0x14fbd4006078, elements = 0}, <No data fields>}, values_list=@0x14fbd40060c0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14fbd4014b48, last = 0x14fbd4014b48, elements = 1}, <No data fields>}, update_fields=@0x14fbd40060a8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56458e9cdb00 <end_of_list>, last = 0x14fbd40060a8, elements = 0}, <No data fields>}, update_values=@0x14fbd4006090: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56458e9cdb00 <end_of_list>, last = 0x14fbd4006090, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.8_dbg/sql/sql_insert.cc:1127 #10 0x000056458d3993d3 in mysql_execute_command (thd=thd@entry=0x14fbd4000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.8_dbg/sql/sql_parse.cc:4563 #11 0x000056458d383e0f in mysql_parse (thd=thd@entry=0x14fbd4000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14fc9ca86400) at /test/10.8_dbg/sql/sql_parse.cc:8028 #12 0x000056458d392aab in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14fbd4000db8, packet=packet@entry=0x14fbd400b879 "INSERT INTO t VALUES (1,0)", packet_length=packet_length@entry=26, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_class.h:1360 #13 0x000056458d395eea in do_command (thd=0x14fbd4000db8, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_parse.cc:1402 #14 0x000056458d50f89c in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5645901f1d08, put_in_cache=put_in_cache@entry=true) at /test/10.8_dbg/sql/sql_connect.cc:1418 #15 0x000056458d50fea1 in handle_one_connection (arg=arg@entry=0x5645901f1d08) at /test/10.8_dbg/sql/sql_connect.cc:1312 #16 0x000056458d991442 in pfs_spawn_thread (arg=0x564590103908) at /test/10.8_dbg/storage/perfschema/pfs.cc:2201 #17 0x000014fca81fa609 in start_thread (arg=<optimized out>) at pthread_create.c:477 #18 0x000014fca7de8293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Bug confirmed present in: MariaDB: 10.5.14 (dbg), 10.5.14 (opt), 10.6.6 (dbg), 10.6.6 (opt), 10.7.2 (dbg), 10.7.2 (opt), 10.8.0 (dbg), 10.8.0 (opt) Bug (or feature/syntax) confirmed not present in: MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt) MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)
            Roel Roel Van de Paar added a comment - - edited

            Note that the outcome in the secondary testcase is different from the original (debug affected, ha_index_read_map frame difference), but only for debug versions. The original testcase did not seem to affect debug versions.

            Roel Roel Van de Paar added a comment - - edited Note that the outcome in the secondary testcase is different from the original (debug affected, ha_index_read_map frame difference), but only for debug versions. The original testcase did not seem to affect debug versions.

            The bug is fixed by the patch for MDEV-27240.

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - The bug is fixed by the patch for MDEV-27240 .

            I confirmed that the bug is really fixed.

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - I confirmed that the bug is really fixed.

            People

              nayuta-yanagisawa Nayuta Yanagisawa (Inactive)
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.