Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-29139

Crash when using ANY predicand with redundant subquery in GROUP BY clause

Details

    Description

      The following test case causes an assertion failure in Debug build of the current 10.3 and most probably of all other versions:

      create table t1 (a int);
      insert into t1 values (3), (2);
      create table t2 (b int);
      insert into t2 values (4), (2);
      create table t3 (c int);
      insert into t3 values (7), (1);
       
      select a from t1
        where a >= any (select b from t2 group by (select c from t3 where c = 1));
       
      drop table t1,t2,t3;
      

      The failure happens in item_subselect.cc():

      4  0x00007fde8f9b1187 in raise () from /lib64/libc.so.6
      #5  0x00007fde8f9b2538 in abort () from /lib64/libc.so.6
      #6  0x00007fde8f9aa126 in __assert_fail_base () from /lib64/libc.so.6
      #7  0x00007fde8f9aa1d2 in __assert_fail () from /lib64/libc.so.6
      #8  0x00005618d77c3f94 in Item_subselect::exec (this=0x7fde78017750) at /home/igor/maria-git/10.3/sql/item_subselect.cc:766
      #9  0x00005618d77c6307 in Item_singlerow_subselect::val_str (this=0x7fde78017750, str=0x7fde78113020) at /home/igor/maria-git/10.3/sql/item_subselect.cc:1437
      #10 0x00005618d7710bbe in Item_copy_string::copy (this=0x7fde78112ff0) at /home/igor/maria-git/10.3/sql/item.cc:5281
      #11 0x00005618d7440132 in copy_fields (param=0x7fde7810e008) at /home/igor/maria-git/10.3/sql/sql_select.cc:24580
      #12 0x00005618d743796f in end_send_group (join=0x7fde7810de18, join_tab=0x7fde78112be0, end_of_records=false) at /home/igor/maria-git/10.3/sql/sql_select.cc:21282
      #13 0x00005618d7434687 in evaluate_join_record (join=0x7fde7810de18, join_tab=0x7fde78112850, error=0) at /home/igor/maria-git/10.3/sql/sql_select.cc:20119
      #14 0x00005618d7433ed9 in sub_select (join=0x7fde7810de18, join_tab=0x7fde78112850, end_of_records=false) at /home/igor/maria-git/10.3/sql/sql_select.cc:19892
      #15 0x00005618d7433356 in do_select (join=0x7fde7810de18, procedure=0x0) at /home/igor/maria-git/10.3/sql/sql_sel
      ...
      

      Attachments

        Activity

          You do not dig deeper so this will crash server again:

          diff --git a/mysql-test/main/subselect4.test b/mysql-test/main/subselect4.test
          index a59f4bbcdac..c41fbcfa7b7 100644
          --- a/mysql-test/main/subselect4.test
          +++ b/mysql-test/main/subselect4.test
          @@ -2452,7 +2452,7 @@ insert into t3 values (7), (1);
           
           let $q1=
           select a from t1
          -  where a >= any (select b from t2 group by (select c from t3 where c = 1));
          +  where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1));
           
           eval explain extended $q1;
           eval $q1;
          @@ -2464,7 +2464,7 @@ deallocate prepare stmt;
           
           let $q2=
           select a from t1
          -  where a <= all (select b from t2 group by (select c from t3 where c = 1));
          +  where a <= all (select b from t2 group by 1 + (select c from t3 where c = 1));
           
           eval explain extended $q2;
           eval $q2;
          

          here is result:

          CURRENT_TEST: main.subselect4
          mysqltest: At line 2458: query '$q1' failed: 2013: Lost connection to MySQL server during query
           
          The result from queries just before the failure was:
          < snip >
          DROP TABLE t1;
          # End of 10.2 tests
          #
          # MDEV-29139: Redundannt subquery in GROUP BY clause of ANY/ALL subquery
          #
          create table t1 (a int);
          insert into t1 values (3), (1), (2);
          create table t2 (b int not null);
          insert into t2 values (4), (2);
          create table t3 (c int);
          insert into t3 values (7), (1);
          explain extended select a from t1
          where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1));
          id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
          1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	3	100.00	Using where
          2	SUBQUERY	t2	ALL	NULL	NULL	NULL	NULL	2	100.00	
          Warnings:
          Note	1003	/* select#1 */ select `test`.`t1`.`a` AS `a` from `test`.`t1` where <nop>(<in_optimizer>(`test`.`t1`.`a`,(/* select#2 */ select min(`test`.`t2`.`b`) from `test`.`t2`) <= <cache>(`test`.`t1`.`a`)))
          select a from t1
          where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1));
           
          More results from queries before failure can be found in /home/sanja/maria/git/10.3/mysql-test/var/log/subselect4.log
           
           
          Server [mysqld.1 - pid: 36431, winpid: 36431, exit: 256] failed during test run
          Server log from this test:
          ----------SERVER LOG START-----------
          $ /home/sanja/maria/git/10.3/sql/mysqld --defaults-group-suffix=.1 --defaults-file=/home/sanja/maria/git/10.3/mysql-test/var/my.cnf --log-output=file --loose-sequence --core-file --loose-debug-sync-timeout=300
          2022-07-21 10:12:17 0 [Note] /home/sanja/maria/git/10.3/sql/mysqld (mysqld 10.3.36-MariaDB-debug-log) starting as process 36432 ...
          2022-07-21 10:12:17 0 [Warning] Could not increase number of max_open_files to more than 1024 (request: 32198)
          2022-07-21 10:12:17 0 [Warning] Changed limits: max_open_files: 1024  max_connections: 151 (was 151)  table_cache: 421 (was 2000)
          2022-07-21 10:12:17 0 [Note] Plugin 'partition' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'InnoDB' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_DATAFILES' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_TABLESTATS' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_LOCKS' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_MUTEXES' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMPMEM' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP_PER_INDEX' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_DELETED' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP_RESET' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_LOCK_WAITS' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_TABLESPACES_ENCRYPTION' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_BUFFER_PAGE_LRU' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_FIELDS' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMPMEM_RESET' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'FEEDBACK' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_COLUMNS' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_INDEX_TABLE' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP_PER_INDEX_RESET' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'user_variables' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_INDEX_CACHE' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_FOREIGN_COLS' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_BEING_DELETED' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_BUFFER_POOL_STATS' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_TRX' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_FOREIGN' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_TABLES' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_DEFAULT_STOPWORD' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_CONFIG' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_BUFFER_PAGE' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_TABLESPACES' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_METRICS' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_INDEXES' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_VIRTUAL' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_TABLESPACES_SCRUBBING' is disabled.
          2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_SEMAPHORE_WAITS' is disabled.
          2022-07-21 10:12:17 0 [Warning] /home/sanja/maria/git/10.3/sql/mysqld: unknown option '--loose-pam-debug'
          2022-07-21 10:12:17 0 [Note] Server socket created on IP: '127.0.0.1'.
          2022-07-21 10:12:17 0 [Note] Reading of all Master_info entries succeeded
          2022-07-21 10:12:17 0 [Note] Added new Master_info '' to hash table
          2022-07-21 10:12:17 0 [Note] /home/sanja/maria/git/10.3/sql/mysqld: ready for connections.
          Version: '10.3.36-MariaDB-debug-log'  socket: '/home/sanja/maria/git/10.3/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution
          mysqld: /home/sanja/maria/git/10.3/sql/item_subselect.cc:766: virtual bool Item_subselect::exec(): Assertion `!eliminated' failed.
          220721 10:12:18 [ERROR] mysqld got signal 6 ;
          This could be because you hit a bug. It is also possible that this binary
          or one of the libraries it was linked against is corrupt, improperly built,
          or misconfigured. This error can also be caused by malfunctioning hardware.
           
          To report this bug, see https://mariadb.com/kb/en/reporting-bugs
           
          We will try our best to scrape up some info that will hopefully help
          diagnose the problem, but since we have already crashed, 
          something is definitely wrong and this may fail.
           
          Server version: 10.3.36-MariaDB-debug-log
          key_buffer_size=1048576
          read_buffer_size=131072
          max_used_connections=1
          max_threads=153
          thread_count=1
          It is possible that mysqld could use up to 
          key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63289 K  bytes of memory
          Hope that's ok; if not, decrease some variables in the equation.
           
          Thread pointer: 0x7fa0c0000da0
          Attempting backtrace. You can use the following information to find out
          where mysqld died. If you see no messages after this, something went
          terribly wrong...
          stack_bottom = 0x7fa0dcddcda8 thread_stack 0x49000
          mysys/stacktrace.c:174(my_print_stacktrace)[0x560fb50d5ee5]
          sql/signal_handler.cc:231(handle_fatal_signal)[0x560fb47746dd]
          libc_sigaction.c:0(__restore_rt)[0x7fa0e2cf1520]
          nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7fa0e2d45a7c]
          posix/raise.c:27(__GI_raise)[0x7fa0e2cf1476]
          stdlib/abort.c:81(__GI_abort)[0x7fa0e2cd77f3]
          intl/loadmsgcat.c:1177(_nl_load_domain)[0x7fa0e2cd771b]
          :0(__GI___assert_fail)[0x7fa0e2ce8e96]
          sql/item_subselect.cc:768(Item_subselect::exec())[0x560fb485f780]
          sql/item_subselect.cc:1415(Item_singlerow_subselect::val_int())[0x560fb4861bfb]
          sql/item_func.cc:1213(Item_func_plus::int_op())[0x560fb4808fc6]
          sql/item_func.cc:854(Item_func_hybrid_field_type::val_str_from_int_op(String*))[0x560fb4807891]
          sql/sql_type.cc:3524(Type_handler_int_result::Item_func_hybrid_field_type_val_str(Item_func_hybrid_field_type*, String*) const)[0x560fb464ab83]
          /home/sanja/maria/git/10.3/sql/mysqld(_ZN27Item_func_hybrid_field_type7val_strEP6String+0xbf)[0x560fb440cfeb]
          /home/sanja/maria/git/10.3/sql/mysqld(_ZN16Item_copy_string4copyEv+0x42)[0x560fb47a42ba]
          sql/item_func.h:585(Item_func_hybrid_field_type::val_str(String*))[0x560fb44b5983]
          sql/item.cc:5281(Item_copy_string::copy())[0x560fb44acb1a]
          sql/sql_select.cc:24603(copy_fields(TMP_TABLE_PARAM*))[0x560fb44a9564]
          sql/sql_select.cc:21307(end_send_group(JOIN*, st_join_table*, bool))[0x560fb44a8cf6]
          sql/sql_select.cc:20143(evaluate_join_record(JOIN*, st_join_table*, int))[0x560fb44a8002]
          sql/sql_select.cc:19916(sub_select(JOIN*, st_join_table*, bool))[0x560fb447d0f9]
          sql/sql_select.cc:19454(do_select(JOIN*, Procedure*))[0x560fb447c2f6]
          sql/sql_select.cc:4172(JOIN::exec_inner())[0x560fb486d7cc]
          sql/sql_select.cc:3967(JOIN::exec())[0x560fb485f962]
          sql/item_subselect.cc:791(Item_subselect::exec())[0x560fb4861bfb]
          sql/item_subselect.cc:1415(Item_singlerow_subselect::val_int())[0x560fb47c4375]
          sql/item_cmpfunc.cc:916(Arg_comparator::compare_int_signed())[0x560fb47dac5e]
          sql/item_cmpfunc.h:102(Arg_comparator::compare())[0x560fb47c747f]
          sql/item_cmpfunc.cc:1795(Item_func_le::val_int())[0x560fb47c636c]
          sql/item_cmpfunc.cc:1541(Item_in_optimizer::val_int())[0x560fb47c188a]
          sql/item_cmpfunc.cc:284(Item_func_nop_all::val_int())[0x560fb44a9189]
          sql/sql_select.cc:20011(evaluate_join_record(JOIN*, st_join_table*, int))[0x560fb44a8cf6]
          sql/sql_select.cc:19916(sub_select(JOIN*, st_join_table*, bool))[0x560fb44a8002]
          sql/sql_select.cc:19454(do_select(JOIN*, Procedure*))[0x560fb447d0f9]
          sql/sql_select.cc:4172(JOIN::exec_inner())[0x560fb447c2f6]
          sql/sql_select.cc:3967(JOIN::exec())[0x560fb447d926]
          sql/sql_select.cc:4377(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x560fb446e378]
          sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x560fb4430ce9]
          sql/sql_parse.cc:6339(execute_sqlcom_select(THD*, TABLE_LIST*))[0x560fb4427406]
          sql/sql_parse.cc:3870(mysql_execute_command(THD*))[0x560fb44354e5]
          sql/sql_parse.cc:7870(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x560fb442113a]
          sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x560fb441fa06]
          sql/sql_parse.cc:1398(do_command(THD*))[0x560fb45b1f85]
          sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x560fb45b1ce5]
          sql/sql_connect.cc:1309(handle_one_connection)[0x560fb50056ec]
          nptl/pthread_create.c:442(start_thread)[0x7fa0e2d43b43]
          x86_64/clone3.S:83(__clone3)[0x7fa0e2dd5a00]
           
          Trying to get some variables.
          Some pointers may be invalid and cause the dump to abort.
          Query (0x7fa0c0012ae8): select a from t1
          where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1))
           
          Connection ID (thread ID): 4
          Status: NOT_KILLED
           
          Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on
           
          The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains
          information that should help you find out what is causing the crash.
          Writing a core file...
          Working directory at /dev/shm/var_auto_sr36/mysqld.1/data
          Resource Limits:
          Limit                     Soft Limit           Hard Limit           Units     
          Max cpu time              unlimited            unlimited            seconds   
          Max file size             unlimited            unlimited            bytes     
          Max data size             unlimited            unlimited            bytes     
          Max stack size            8388608              unlimited            bytes     
          Max core file size        unlimited            unlimited            bytes     
          Max resident set          unlimited            unlimited            bytes     
          Max processes             255871               255871               processes 
          Max open files            1024                 1024                 files     
          Max locked memory         8393273344           8393273344           bytes     
          Max address space         unlimited            unlimited            bytes     
          Max file locks            unlimited            unlimited            locks     
          Max pending signals       255871               255871               signals   
          Max msgqueue size         819200               819200               bytes     
          Max nice priority         0                    0                    
          Max realtime priority     0                    0                    
          Max realtime timeout      unlimited            unlimited            us        
          Core pattern: |/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E
           
          Kernel version: Linux version 5.15.0-41-generic (buildd@lcy02-amd64-065) (gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #44-Ubuntu SMP Wed Jun 22 14:20:53 UTC 2022
           
          ----------SERVER LOG END-------------
          

          sanja Oleksandr Byelkin added a comment - You do not dig deeper so this will crash server again: diff --git a/mysql-test/main/subselect4.test b/mysql-test/main/subselect4.test index a59f4bbcdac..c41fbcfa7b7 100644 --- a/mysql-test/main/subselect4.test +++ b/mysql-test/main/subselect4.test @@ -2452,7 +2452,7 @@ insert into t3 values (7), (1); let $q1= select a from t1 - where a >= any (select b from t2 group by (select c from t3 where c = 1)); + where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1)); eval explain extended $q1; eval $q1; @@ -2464,7 +2464,7 @@ deallocate prepare stmt; let $q2= select a from t1 - where a <= all (select b from t2 group by (select c from t3 where c = 1)); + where a <= all (select b from t2 group by 1 + (select c from t3 where c = 1)); eval explain extended $q2; eval $q2; here is result: CURRENT_TEST: main.subselect4 mysqltest: At line 2458: query '$q1' failed: 2013: Lost connection to MySQL server during query   The result from queries just before the failure was: < snip > DROP TABLE t1; # End of 10.2 tests # # MDEV-29139: Redundannt subquery in GROUP BY clause of ANY/ALL subquery # create table t1 (a int); insert into t1 values (3), (1), (2); create table t2 (b int not null); insert into t2 values (4), (2); create table t3 (c int); insert into t3 values (7), (1); explain extended select a from t1 where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1)); id select_type table type possible_keys key key_len ref rows filtered Extra 1 PRIMARY t1 ALL NULL NULL NULL NULL 3 100.00 Using where 2 SUBQUERY t2 ALL NULL NULL NULL NULL 2 100.00 Warnings: Note 1003 /* select#1 */ select `test`.`t1`.`a` AS `a` from `test`.`t1` where <nop>(<in_optimizer>(`test`.`t1`.`a`,(/* select#2 */ select min(`test`.`t2`.`b`) from `test`.`t2`) <= <cache>(`test`.`t1`.`a`))) select a from t1 where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1));   More results from queries before failure can be found in /home/sanja/maria/git/10.3/mysql-test/var/log/subselect4.log     Server [mysqld.1 - pid: 36431, winpid: 36431, exit: 256] failed during test run Server log from this test: ----------SERVER LOG START----------- $ /home/sanja/maria/git/10.3/sql/mysqld --defaults-group-suffix=.1 --defaults-file=/home/sanja/maria/git/10.3/mysql-test/var/my.cnf --log-output=file --loose-sequence --core-file --loose-debug-sync-timeout=300 2022-07-21 10:12:17 0 [Note] /home/sanja/maria/git/10.3/sql/mysqld (mysqld 10.3.36-MariaDB-debug-log) starting as process 36432 ... 2022-07-21 10:12:17 0 [Warning] Could not increase number of max_open_files to more than 1024 (request: 32198) 2022-07-21 10:12:17 0 [Warning] Changed limits: max_open_files: 1024 max_connections: 151 (was 151) table_cache: 421 (was 2000) 2022-07-21 10:12:17 0 [Note] Plugin 'partition' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'InnoDB' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_DATAFILES' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_TABLESTATS' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_LOCKS' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_MUTEXES' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMPMEM' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP_PER_INDEX' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_DELETED' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP_RESET' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_LOCK_WAITS' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_TABLESPACES_ENCRYPTION' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_BUFFER_PAGE_LRU' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_FIELDS' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMPMEM_RESET' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'FEEDBACK' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_COLUMNS' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_INDEX_TABLE' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP_PER_INDEX_RESET' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'user_variables' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_INDEX_CACHE' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_FOREIGN_COLS' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_BEING_DELETED' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_BUFFER_POOL_STATS' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_TRX' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_FOREIGN' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_TABLES' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_DEFAULT_STOPWORD' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_CONFIG' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_BUFFER_PAGE' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_TABLESPACES' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_METRICS' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_INDEXES' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_VIRTUAL' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_TABLESPACES_SCRUBBING' is disabled. 2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_SEMAPHORE_WAITS' is disabled. 2022-07-21 10:12:17 0 [Warning] /home/sanja/maria/git/10.3/sql/mysqld: unknown option '--loose-pam-debug' 2022-07-21 10:12:17 0 [Note] Server socket created on IP: '127.0.0.1'. 2022-07-21 10:12:17 0 [Note] Reading of all Master_info entries succeeded 2022-07-21 10:12:17 0 [Note] Added new Master_info '' to hash table 2022-07-21 10:12:17 0 [Note] /home/sanja/maria/git/10.3/sql/mysqld: ready for connections. Version: '10.3.36-MariaDB-debug-log' socket: '/home/sanja/maria/git/10.3/mysql-test/var/tmp/mysqld.1.sock' port: 16000 Source distribution mysqld: /home/sanja/maria/git/10.3/sql/item_subselect.cc:766: virtual bool Item_subselect::exec(): Assertion `!eliminated' failed. 220721 10:12:18 [ERROR] mysqld got signal 6 ; This could be because you hit a bug. It is also possible that this binary or one of the libraries it was linked against is corrupt, improperly built, or misconfigured. This error can also be caused by malfunctioning hardware.   To report this bug, see https://mariadb.com/kb/en/reporting-bugs   We will try our best to scrape up some info that will hopefully help diagnose the problem, but since we have already crashed, something is definitely wrong and this may fail.   Server version: 10.3.36-MariaDB-debug-log key_buffer_size=1048576 read_buffer_size=131072 max_used_connections=1 max_threads=153 thread_count=1 It is possible that mysqld could use up to key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63289 K bytes of memory Hope that's ok; if not, decrease some variables in the equation.   Thread pointer: 0x7fa0c0000da0 Attempting backtrace. You can use the following information to find out where mysqld died. If you see no messages after this, something went terribly wrong... stack_bottom = 0x7fa0dcddcda8 thread_stack 0x49000 mysys/stacktrace.c:174(my_print_stacktrace)[0x560fb50d5ee5] sql/signal_handler.cc:231(handle_fatal_signal)[0x560fb47746dd] libc_sigaction.c:0(__restore_rt)[0x7fa0e2cf1520] nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7fa0e2d45a7c] posix/raise.c:27(__GI_raise)[0x7fa0e2cf1476] stdlib/abort.c:81(__GI_abort)[0x7fa0e2cd77f3] intl/loadmsgcat.c:1177(_nl_load_domain)[0x7fa0e2cd771b] :0(__GI___assert_fail)[0x7fa0e2ce8e96] sql/item_subselect.cc:768(Item_subselect::exec())[0x560fb485f780] sql/item_subselect.cc:1415(Item_singlerow_subselect::val_int())[0x560fb4861bfb] sql/item_func.cc:1213(Item_func_plus::int_op())[0x560fb4808fc6] sql/item_func.cc:854(Item_func_hybrid_field_type::val_str_from_int_op(String*))[0x560fb4807891] sql/sql_type.cc:3524(Type_handler_int_result::Item_func_hybrid_field_type_val_str(Item_func_hybrid_field_type*, String*) const)[0x560fb464ab83] /home/sanja/maria/git/10.3/sql/mysqld(_ZN27Item_func_hybrid_field_type7val_strEP6String+0xbf)[0x560fb440cfeb] /home/sanja/maria/git/10.3/sql/mysqld(_ZN16Item_copy_string4copyEv+0x42)[0x560fb47a42ba] sql/item_func.h:585(Item_func_hybrid_field_type::val_str(String*))[0x560fb44b5983] sql/item.cc:5281(Item_copy_string::copy())[0x560fb44acb1a] sql/sql_select.cc:24603(copy_fields(TMP_TABLE_PARAM*))[0x560fb44a9564] sql/sql_select.cc:21307(end_send_group(JOIN*, st_join_table*, bool))[0x560fb44a8cf6] sql/sql_select.cc:20143(evaluate_join_record(JOIN*, st_join_table*, int))[0x560fb44a8002] sql/sql_select.cc:19916(sub_select(JOIN*, st_join_table*, bool))[0x560fb447d0f9] sql/sql_select.cc:19454(do_select(JOIN*, Procedure*))[0x560fb447c2f6] sql/sql_select.cc:4172(JOIN::exec_inner())[0x560fb486d7cc] sql/sql_select.cc:3967(JOIN::exec())[0x560fb485f962] sql/item_subselect.cc:791(Item_subselect::exec())[0x560fb4861bfb] sql/item_subselect.cc:1415(Item_singlerow_subselect::val_int())[0x560fb47c4375] sql/item_cmpfunc.cc:916(Arg_comparator::compare_int_signed())[0x560fb47dac5e] sql/item_cmpfunc.h:102(Arg_comparator::compare())[0x560fb47c747f] sql/item_cmpfunc.cc:1795(Item_func_le::val_int())[0x560fb47c636c] sql/item_cmpfunc.cc:1541(Item_in_optimizer::val_int())[0x560fb47c188a] sql/item_cmpfunc.cc:284(Item_func_nop_all::val_int())[0x560fb44a9189] sql/sql_select.cc:20011(evaluate_join_record(JOIN*, st_join_table*, int))[0x560fb44a8cf6] sql/sql_select.cc:19916(sub_select(JOIN*, st_join_table*, bool))[0x560fb44a8002] sql/sql_select.cc:19454(do_select(JOIN*, Procedure*))[0x560fb447d0f9] sql/sql_select.cc:4172(JOIN::exec_inner())[0x560fb447c2f6] sql/sql_select.cc:3967(JOIN::exec())[0x560fb447d926] sql/sql_select.cc:4377(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x560fb446e378] sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x560fb4430ce9] sql/sql_parse.cc:6339(execute_sqlcom_select(THD*, TABLE_LIST*))[0x560fb4427406] sql/sql_parse.cc:3870(mysql_execute_command(THD*))[0x560fb44354e5] sql/sql_parse.cc:7870(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x560fb442113a] sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x560fb441fa06] sql/sql_parse.cc:1398(do_command(THD*))[0x560fb45b1f85] sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x560fb45b1ce5] sql/sql_connect.cc:1309(handle_one_connection)[0x560fb50056ec] nptl/pthread_create.c:442(start_thread)[0x7fa0e2d43b43] x86_64/clone3.S:83(__clone3)[0x7fa0e2dd5a00]   Trying to get some variables. Some pointers may be invalid and cause the dump to abort. Query (0x7fa0c0012ae8): select a from t1 where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1))   Connection ID (thread ID): 4 Status: NOT_KILLED   Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on   The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains information that should help you find out what is causing the crash. Writing a core file... Working directory at /dev/shm/var_auto_sr36/mysqld.1/data Resource Limits: Limit Soft Limit Hard Limit Units Max cpu time unlimited unlimited seconds Max file size unlimited unlimited bytes Max data size unlimited unlimited bytes Max stack size 8388608 unlimited bytes Max core file size unlimited unlimited bytes Max resident set unlimited unlimited bytes Max processes 255871 255871 processes Max open files 1024 1024 files Max locked memory 8393273344 8393273344 bytes Max address space unlimited unlimited bytes Max file locks unlimited unlimited locks Max pending signals 255871 255871 signals Max msgqueue size 819200 819200 bytes Max nice priority 0 0 Max realtime priority 0 0 Max realtime timeout unlimited unlimited us Core pattern: |/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E   Kernel version: Linux version 5.15.0-41-generic (buildd@lcy02-amd64-065) (gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #44-Ubuntu SMP Wed Jun 22 14:20:53 UTC 2022   ----------SERVER LOG END-------------

          Probably it is better make with Item tree walking

          sanja Oleksandr Byelkin added a comment - Probably it is better make with Item tree walking

          the last variant OK to push

          sanja Oleksandr Byelkin added a comment - the last variant OK to push

          A fix for this bug was pushed into 10.3

          igor Igor Babaev (Inactive) added a comment - A fix for this bug was pushed into 10.3

          People

            igor Igor Babaev (Inactive)
            igor Igor Babaev (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.