Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28833

SIGSEGV in Item_field::used_tables on PREPARED STATEMENT with nested SELECT's

    XMLWordPrintable

    Details

      Description

      CREATE TABLE t (a INT) CHARSET utf8mb4 ENGINE=InnoDB;
      INSERT INTO t VALUES();
      INSERT INTO t VALUES (1),(2),(3),(4),(5),(6),(7),(8);
      PREPARE s1 FROM ' SELECT a FROM t WHERE a in (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))';
      SET max_JOIN_size=9;
      EXECUTE s1;
      SET SESSION sql_big_selects=1;
      EXECUTE s1;
      

      Leads to:

      10.10.0 081a284712bb661349e2e3802077b12211cede3e (Debug)

      Core was generated by `/test/MD310522-mariadb-10.10.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x000055df01a81017 in Item_field::used_tables (this=0x14f0c00744c8)
          at /test/10.10_dbg/sql/item.cc:3504
      [Current thread is 1 (Thread 0x14f1003fa700 (LWP 3134736))]
      (gdb) bt
      #0  0x000055df01a81017 in Item_field::used_tables (this=0x14f0c00744c8) at /test/10.10_dbg/sql/item.cc:3504
      #1  0x000055df0191c405 in optimize_semijoin_nests (join=join@entry=0x14f0c00148b8, all_table_map=all_table_map@entry=1152921504606846975) at /test/10.10_dbg/sql/sql_array.h:63
      #2  0x000055df017e7f6c in make_join_statistics (join=join@entry=0x14f0c00148b8, tables_list=@0x14f0c0073460: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f0c0014e70, last = 0x14f0c0015220, elements = 60}, <No data fields>}, keyuse_array=keyuse_array@entry=0x14f0c0014bd8) at /test/10.10_dbg/sql/sql_select.cc:5928
      #3  0x000055df017ef012 in JOIN::optimize_inner (this=this@entry=0x14f0c00148b8) at /test/10.10_dbg/sql/sql_select.cc:2503
      #4  0x000055df017ef452 in JOIN::optimize (this=this@entry=0x14f0c00148b8) at /test/10.10_dbg/sql/sql_select.cc:1845
      #5  0x000055df01733a24 in st_select_lex::optimize_unflattened_subqueries (this=0x14f0c0070848, const_only=const_only@entry=false) at /test/10.10_dbg/sql/sql_lex.cc:4916
      #6  0x000055df01922669 in JOIN::optimize_unflattened_subqueries (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/opt_subselect.cc:5588
      #7  0x000055df017ecafa in JOIN::optimize_stage2 (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/sql_select.cc:3104
      #8  0x000055df017ef08d in JOIN::optimize_inner (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/sql_select.cc:2529
      #9  0x000055df017ef452 in JOIN::optimize (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/sql_select.cc:1845
      #10 0x000055df017ef545 in mysql_select (thd=thd@entry=0x14f0c0000db8, tables=0x14f0c0070e28, fields=@0x14f0c0070ae8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f0c0070de0, last = 0x14f0c0070de0, elements = 1}, <No data fields>}, conds=0x14f0c0013cd8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2201171004160, result=0x14f0c00d8d40, unit=0x14f0c006de60, select_lex=0x14f0c0070848) at /test/10.10_dbg/sql/sql_select.cc:5030
      #11 0x000055df017efd8e in handle_select (thd=thd@entry=0x14f0c0000db8, lex=lex@entry=0x14f0c006dd88, result=result@entry=0x14f0c00d8d40, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.10_dbg/sql/sql_select.cc:578
      #12 0x000055df0175bb5e in execute_sqlcom_select (thd=thd@entry=0x14f0c0000db8, all_tables=0x14f0c0070e28) at /test/10.10_dbg/sql/sql_parse.cc:6260
      #13 0x000055df01767e70 in mysql_execute_command (thd=0x14f0c0000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true) at /test/10.10_dbg/sql/sql_parse.cc:3944
      #14 0x000055df0179139e in Prepared_statement::execute (this=this@entry=0x14f0c006d908, expanded_query=expanded_query@entry=0x14f1003f8e60, open_cursor=open_cursor@entry=false) at /test/10.10_dbg/sql/sql_prepare.cc:5221
      #15 0x000055df01791737 in Prepared_statement::execute_loop (this=this@entry=0x14f0c006d908, expanded_query=expanded_query@entry=0x14f1003f8e60, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/10.10_dbg/sql/sql_prepare.cc:4644
      #16 0x000055df01791de2 in mysql_sql_stmt_execute (thd=thd@entry=0x14f0c0000db8) at /test/10.10_dbg/sql/sql_prepare.cc:3688
      #17 0x000055df01767ecd in mysql_execute_command (thd=thd@entry=0x14f0c0000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.10_dbg/sql/sql_parse.cc:3960
      #18 0x000055df01755e3a in mysql_parse (thd=thd@entry=0x14f0c0000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14f1003f9470) at /test/10.10_dbg/sql/sql_parse.cc:8036
      #19 0x000055df01763422 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14f0c0000db8, packet=packet@entry=0x14f0c000b6d9 "EXECUTE s1", packet_length=packet_length@entry=10, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_class.h:1364
      #20 0x000055df01765b2c in do_command (thd=0x14f0c0000db8, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_parse.cc:1407
      #21 0x000055df018c53c0 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55df043a6b98, put_in_cache=put_in_cache@entry=true) at /test/10.10_dbg/sql/sql_connect.cc:1418
      #22 0x000055df018c58c9 in handle_one_connection (arg=0x55df043a6b98) at /test/10.10_dbg/sql/sql_connect.cc:1312
      #23 0x000014f1254c3609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #24 0x000014f1250af133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.3.36 (dbg), 10.3.36 (opt), 10.4.26 (dbg), 10.4.26 (opt), 10.5.17 (dbg), 10.5.17 (opt), 10.6.9 (dbg), 10.6.9 (opt), 10.7.5 (dbg), 10.7.5 (opt), 10.8.4 (dbg), 10.8.4 (opt), 10.9.2 (dbg), 10.9.2 (opt), 10.10.0 (dbg), 10.10.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

      SIGSEGV|Item_field::used_tables|optimize_semijoin_nests|make_join_statistics|JOIN::optimize_inner
      

        Attachments

          Activity

            People

            Assignee:
            sanja Oleksandr Byelkin
            Reporter:
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:

                Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.