Details
Description
This bug was discovered whilst reducing MDEV-28501. Crashes optimized builds. It looks related to MDEV-23130 (given one of the stacks listed there), however the testcase from that bug does not reproduce against 10.9 whereas this testcase does, and no SP are involved either.
CREATE TABLE t (c INT) ENGINE=InnoDB; |
SELECT * FROM (SELECT 1 FROM t AS a,t) AS b JOIN t AS d NATURAL JOIN t WINDOW e AS (PARTITION BY c AND 1 BETWEEN (SELECT c FROM t GROUP BY c WINDOW f AS (PARTITION BY c)) AND 2); |
Leads to:
10.9.0 0b14dbd45b5a1c02616d611876158d44b92b77bf (Debug) |
Core was generated by `/test/MD030522-mariadb-10.9.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 get_sort_by_table (const_tables=<optimized out>, tables=...,
|
b=<optimized out>, a=0x0) at /test/10.9_dbg/sql/sql_select.cc:25516
|
25516 if (map != table->table->map)
|
[Current thread is 1 (Thread 0x145888051700 (LWP 3001116))]
|
(gdb) bt
|
#0 get_sort_by_table (const_tables=<optimized out>, tables=@0x145844024bf0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14584407a970, last = 0x14584407a970, elements = 1}, <No data fields>}, b=<optimized out>, a=0x0) at /test/10.9_dbg/sql/sql_select.cc:25516
|
#1 make_join_statistics (join=join@entry=0x14584407a3b8, tables_list=@0x145844024bf0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14584407a970, last = 0x14584407a970, elements = 1}, <No data fields>}, keyuse_array=keyuse_array@entry=0x14584407a6d8) at /test/10.9_dbg/sql/sql_select.cc:5643
|
#2 0x00005577ba6f452c in JOIN::optimize_inner (this=this@entry=0x14584407a3b8) at /test/10.9_dbg/sql/sql_select.cc:2495
|
#3 0x00005577ba6f496c in JOIN::optimize (this=this@entry=0x14584407a3b8) at /test/10.9_dbg/sql/sql_select.cc:1837
|
#4 0x00005577ba639462 in st_select_lex::optimize_unflattened_subqueries (this=0x145844013db0, const_only=const_only@entry=true) at /test/10.9_dbg/sql/sql_lex.cc:4916
|
#5 0x00005577ba825f3d in JOIN::optimize_constant_subqueries (this=this@entry=0x145844027188) at /test/10.9_dbg/sql/opt_subselect.cc:5622
|
#6 0x00005577ba6f3490 in JOIN::optimize_inner (this=this@entry=0x145844027188) at /test/10.9_dbg/sql/sql_select.cc:2157
|
#7 0x00005577ba6f496c in JOIN::optimize (this=this@entry=0x145844027188) at /test/10.9_dbg/sql/sql_select.cc:1837
|
#8 0x00005577ba6f4a5f in mysql_select (thd=thd@entry=0x145844000db8, tables=0x145844015f10, fields=@0x145844014050: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x145844014340, last = 0x145844079e20, elements = 2}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x1458440257d0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x145844027160, unit=0x145844004fd8, select_lex=0x145844013db0) at /test/10.9_dbg/sql/sql_select.cc:5022
|
#9 0x00005577ba6f52a8 in handle_select (thd=thd@entry=0x145844000db8, lex=lex@entry=0x145844004f00, result=result@entry=0x145844027160, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.9_dbg/sql/sql_select.cc:570
|
#10 0x00005577ba6616c8 in execute_sqlcom_select (thd=thd@entry=0x145844000db8, all_tables=0x145844015f10) at /test/10.9_dbg/sql/sql_parse.cc:6271
|
#11 0x00005577ba66d935 in mysql_execute_command (thd=thd@entry=0x145844000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.9_dbg/sql/sql_parse.cc:3961
|
#12 0x00005577ba65b67b in mysql_parse (thd=thd@entry=0x145844000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x145888050470) at /test/10.9_dbg/sql/sql_parse.cc:8046
|
#13 0x00005577ba668f79 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x145844000db8, packet=packet@entry=0x14584400b699 "SELECT * FROM (SELECT 1 FROM t AS a,t) AS b JOIN t AS d NATURAL JOIN t WINDOW e AS (PARTITION BY c AND 1 BETWEEN (SELECT c FROM t GROUP BY c WINDOW f AS (PARTITION BY c)) AND 2)", packet_length=packet_length@entry=177, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_class.h:1364
|
#14 0x00005577ba66b686 in do_command (thd=0x145844000db8, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_parse.cc:1408
|
#15 0x00005577ba7c8d02 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5577bcdf1638, put_in_cache=put_in_cache@entry=true) at /test/10.9_dbg/sql/sql_connect.cc:1418
|
#16 0x00005577ba7c920b in handle_one_connection (arg=0x5577bcdf1638) at /test/10.9_dbg/sql/sql_connect.cc:1312
|
#17 0x000014589fb0a609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#18 0x000014589f6f6163 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
Bug confirmed present in:
MariaDB: 10.2.44 (dbg), 10.2.44 (opt), 10.3.35 (dbg), 10.3.35 (opt), 10.4.25 (dbg), 10.4.25 (opt), 10.5.16 (dbg), 10.5.16 (opt), 10.6.8 (dbg), 10.6.8 (opt), 10.7.4 (dbg), 10.7.4 (opt), 10.8.3 (dbg), 10.8.3 (opt), 10.9.0 (dbg), 10.9.0 (opt)
Bug (or feature/syntax) confirmed not present in:
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.37 (dbg), 5.7.37 (opt), 8.0.28 (dbg), 8.0.28 (opt)
Attachments
Issue Links
- duplicates
-
MDEV-28510 SIGSEGV in get_sort_by_table and SIGSEGV in subquery_types_allow_materialization
-
- Closed
-
- is part of
-
MDEV-30052 Crash with a query containing nested WINDOW clauses
-
- Closed
-
- relates to
-
MDEV-28501 SIGSEGV in update_depend_map_for_order on SELECT, UBSAN: runtime error: member access within null pointer of type 'struct JOIN_TAB'
-
- Closed
-
-
MDEV-29935 Server crashes in get_sort_by_table/make_join_statistics after INSERT into a view with ORDER BY
-
- Closed
-
UBSAN faund the cause:
10.9.0 161fd2d29cc2f8390fa3bf7e739c52bc8d5c39df (Optimized, UBASAN)
/test/10.9_opt_san/sql/sql_select.cc:25485:21: runtime error: member access within null pointer of type 'struct TABLE_LIST'
#0 0x55e368dc57de in get_sort_by_table /test/10.9_opt_san/sql/sql_select.cc:25485
#1 0x55e368dc57de in make_join_statistics /test/10.9_opt_san/sql/sql_select.cc:5614
#2 0x55e368dfa27d in JOIN::optimize_inner() /test/10.9_opt_san/sql/sql_select.cc:2466
#3 0x55e368e13bbf in JOIN::optimize() /test/10.9_opt_san/sql/sql_select.cc:1808
#4 0x55e3688fd102 in st_select_lex::optimize_unflattened_subqueries(bool) /test/10.9_opt_san/sql/sql_lex.cc:4916
#5 0x55e3695ba687 in JOIN::optimize_constant_subqueries() /test/10.9_opt_san/sql/opt_subselect.cc:5622
#6 0x55e368df6a47 in JOIN::optimize_inner() /test/10.9_opt_san/sql/sql_select.cc:2128
#7 0x55e368e13bbf in JOIN::optimize() /test/10.9_opt_san/sql/sql_select.cc:1808
#8 0x55e368e2488a in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.9_opt_san/sql/sql_select.cc:4993
#9 0x55e368e28a73 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.9_opt_san/sql/sql_select.cc:543
#10 0x55e368a3fcdf in execute_sqlcom_select /test/10.9_opt_san/sql/sql_parse.cc:6268
#11 0x55e368a7f88b in mysql_execute_command(THD*, bool) /test/10.9_opt_san/sql/sql_parse.cc:3959
#12 0x55e368a0f0a8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.9_opt_san/sql/sql_parse.cc:8043
#13 0x55e368a65439 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.9_opt_san/sql/sql_parse.cc:1910
#14 0x55e368a70c92 in do_command(THD*, bool) /test/10.9_opt_san/sql/sql_parse.cc:1407
#15 0x55e36935bd3d in do_handle_one_connection(CONNECT*, bool) /test/10.9_opt_san/sql/sql_connect.cc:1418
#16 0x55e36935e834 in handle_one_connection /test/10.9_opt_san/sql/sql_connect.cc:1312
#17 0x55e36b45c1f9 in pfs_spawn_thread /test/10.9_opt_san/storage/perfschema/pfs.cc:2201
#18 0x14fdb9120608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477
#19 0x14fdb8395162 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f162)