[MDEV-29935] Server crashes in get_sort_by_table/make_join_statistics after INSERT into a view with ORDER BY - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.3(EOL), (14)
10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL), 11.4, 11.5(EOL), 11.6(EOL)
Fix Version/s: 10.5.28, 10.6.21, 10.11.11, 11.4.5, 11.7.2
Component/s: Optimizer
Labels:
None

Description

CREATE TABLE t1 ( pk int) ;

create view v as SELECT * FROM t1 ORDER BY pk;

insert into v select * from v;

10.3 7d96cb4703693cbf7a23308cf
Version: '10.3.37-MariaDB-debug-log' socket: '/home/alice/am/_depot/m-branch/m3-10.3-bld/mysql-test/var/tmp/mysqld.1.sock' port: 16000 Source distribution
221102 14:56:33 [ERROR] mysqld got signal 11 ;

Server version: 10.3.37-MariaDB-debug-log

sql/signal_handler.cc:231(handle_fatal_signal)[0x5592e14cdd1e]
sigaction.c:0(__restore_rt)[0x7f629cfe4420]
sql/sql_select.cc:24221(get_sort_by_table(st_order, st_order, List<TABLE_LIST>&, unsigned long long))[0x5592e0eaacfc]
sql/sql_select.cc:4964(make_join_statistics(JOIN, List<TABLE_LIST>&, st_dynamic_array))[0x5592e0e21385]
sql/sql_select.cc:1992(JOIN::optimize_inner())[0x5592e0e03240]
sql/sql_select.cc:1534(JOIN::optimize())[0x5592e0dfe71b]
sql/sql_select.cc:4360(mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex))[0x5592e0e1bdf5]
sql/sql_select.cc:372(handle_select(THD, LEX, select_result*, unsigned long))[0x5592e0df2139]
sql/sql_parse.cc:4621(mysql_execute_command(THD*))[0x5592e0d55aa9]
sql/sql_parse.cc:7855(mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool))[0x5592e0d6ca88]
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool))[0x5592e0d43a05]
sql/sql_parse.cc:1398(do_command(THD*))[0x5592e0d40524]
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x5592e11164f3]
sql/sql_connect.cc:1309(handle_one_connection)[0x5592e1115dad]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x5592e2748ae7]
nptl/pthread_create.c:478(start_thread)[0x7f629cfd8609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f629cefd133]

Query (0x62b000000290): insert into v select * from v

non-debug:

10.6.9
221102 14:51:37 [ERROR] mysqld got signal 11 ;
Server version: 10.6.9-MariaDB

sql/signal_handler.cc:236(handle_fatal_signal)[0x555ba69f0917]
sigaction.c:0(__restore_rt)[0x7fd2e265b420]
sql/sql_select.cc:25679(JOIN::optimize_inner())[0x555ba682b239]
sql/sql_select.cc:1838(JOIN::optimize())[0x555ba682c375]
sql/sql_select.cc:5027(mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex))[0x555ba682c448]
sql/sql_select.cc:566(handle_select(THD, LEX, select_result*, unsigned long))[0x555ba682cd54]
sql/sql_parse.cc:4711(mysql_execute_command(THD*, bool))[0x555ba67d0229]
sql/sql_parse.cc:8031(mysql_parse(THD, char, unsigned int, Parser_state*))[0x555ba67d112b]
sql/sql_parse.cc:1955(dispatch_command(enum_server_command, THD, char, unsigned int, bool))[0x555ba67d32e7]
sql/sql_parse.cc:1411(do_command(THD*, bool))[0x555ba67d4983]
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x555ba68cac47]
sql/sql_connect.cc:1318(handle_one_connection)[0x555ba68caee4]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x555ba6c5fcdc]
nptl/pthread_create.c:478(start_thread)[0x7fd2e264f609]
??:0(clone)[0x7fd2e223b133]

Query (0x7fd28c012210): insert into v select * from v

Attachments

Issue Links

causes

MDEV-35680 Table number > MAX_TABLES causes overflow of table_map at main.join test

Closed

is caused by

MDEV-26427 MariaDB Server SEGV on INSERT .. SELECT

Closed

is duplicated by

MDEV-32258 MariaDB crash in JOIN optimization

Closed

relates to

MDEV-28510 SIGSEGV in get_sort_by_table and SIGSEGV in subquery_types_allow_materialization

Closed

MDEV-28516 SIGSEGV in get_sort_by_table, UBSAN: runtime error: member access within null pointer of type 'struct TABLE_LIST'

Closed

MDEV-29681 Server crashes when optimizing SQL with ORDER BY

Closed

MDEV-30756 Crash in get_sort_by_table / make_join_statistics / update_depend_map_for_order, various UBSAN pointer issues

Stalled

MDEV-32763 Assertion `fixed' failed at /mariadb-11.3.0/sql/item_strfunc.cc:2391

Confirmed

MDEV-30756 Crash in get_sort_by_table / make_join_statistics / update_depend_map_for_order, various UBSAN pointer issues

Stalled

split to

MDEV-35277 SIGSEGV in get_sort_by_table on SELECT

Stalled

(4 relates to, 1 split to)

Activity

Ascending order - Click to sort in descending order

Alice Sherepa created issue - 2022-11-02 14:03

Alice Sherepa made changes - 2022-11-02 14:03

Field	Original Value	New Value
Assignee		Sergei Petrunia [ psergey ]

Alice Sherepa made changes - 2022-11-02 14:04

Description

{code:sql}
CREATE TABLE t1 ( pk int) ;
create view v as SELECT * FROM t1 ORDER BY pk;

insert into v select * from v;
{code}

{noformat:title=10.3 7d96cb4703693cbf7a23308cf}
Version: '10.3.37-MariaDB-debug-log' socket: '/home/alice/am/_depot/m-branch/m3-10.3-bld/mysql-test/var/tmp/mysqld.1.sock' port: 16000 Source distribution
221102 14:56:33 [ERROR] mysqld got signal 11 ;

Server version: 10.3.37-MariaDB-debug-log

sql/signal_handler.cc:231(handle_fatal_signal)[0x5592e14cdd1e]
sigaction.c:0(__restore_rt)[0x7f629cfe4420]
sql/sql_select.cc:24221(get_sort_by_table(st_order*, st_order*, List<TABLE_LIST>&, unsigned long long))[0x5592e0eaacfc]
sql/sql_select.cc:4964(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x5592e0e21385]
sql/sql_select.cc:1992(JOIN::optimize_inner())[0x5592e0e03240]
sql/sql_select.cc:1534(JOIN::optimize())[0x5592e0dfe71b]
sql/sql_select.cc:4360(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5592e0e1bdf5]
sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x5592e0df2139]
sql/sql_parse.cc:4621(mysql_execute_command(THD*))[0x5592e0d55aa9]
sql/sql_parse.cc:7855(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x5592e0d6ca88]
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5592e0d43a05]
sql/sql_parse.cc:1398(do_command(THD*))[0x5592e0d40524]
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x5592e11164f3]
sql/sql_connect.cc:1309(handle_one_connection)[0x5592e1115dad]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x5592e2748ae7]
nptl/pthread_create.c:478(start_thread)[0x7f629cfd8609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f629cefd133]

Query (0x62b000000290): insert into v select * from v
{noformat}

non-debug:
{noformat:title=10.6.9}
221102 14:51:37 [ERROR] mysqld got signal 11 ;

sql/signal_handler.cc:236(handle_fatal_signal)[0x555ba69f0917]
sigaction.c:0(__restore_rt)[0x7fd2e265b420]
sql/sql_select.cc:25679(JOIN::optimize_inner())[0x555ba682b239]
sql/sql_select.cc:1838(JOIN::optimize())[0x555ba682c375]
sql/sql_select.cc:5027(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x555ba682c448]
sql/sql_select.cc:566(handle_select(THD*, LEX*, select_result*, unsigned long))[0x555ba682cd54]
sql/sql_parse.cc:4711(mysql_execute_command(THD*, bool))[0x555ba67d0229]
sql/sql_parse.cc:8031(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x555ba67d112b]
sql/sql_parse.cc:1955(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x555ba67d32e7]
sql/sql_parse.cc:1411(do_command(THD*, bool))[0x555ba67d4983]
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x555ba68cac47]
sql/sql_connect.cc:1318(handle_one_connection)[0x555ba68caee4]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x555ba6c5fcdc]
nptl/pthread_create.c:478(start_thread)[0x7fd2e264f609]
??:0(clone)[0x7fd2e223b133]

Query (0x7fd28c012210): insert into v select * from v
{noformat}

{code:sql}
CREATE TABLE t1 ( pk int) ;
create view v as SELECT * FROM t1 ORDER BY pk;

insert into v select * from v;
{code}

{noformat:title=10.3 7d96cb4703693cbf7a23308cf}
Version: '10.3.37-MariaDB-debug-log' socket: '/home/alice/am/_depot/m-branch/m3-10.3-bld/mysql-test/var/tmp/mysqld.1.sock' port: 16000 Source distribution
221102 14:56:33 [ERROR] mysqld got signal 11 ;

Server version: 10.3.37-MariaDB-debug-log

sql/signal_handler.cc:231(handle_fatal_signal)[0x5592e14cdd1e]
sigaction.c:0(__restore_rt)[0x7f629cfe4420]
sql/sql_select.cc:24221(get_sort_by_table(st_order*, st_order*, List<TABLE_LIST>&, unsigned long long))[0x5592e0eaacfc]
sql/sql_select.cc:4964(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x5592e0e21385]
sql/sql_select.cc:1992(JOIN::optimize_inner())[0x5592e0e03240]
sql/sql_select.cc:1534(JOIN::optimize())[0x5592e0dfe71b]
sql/sql_select.cc:4360(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5592e0e1bdf5]
sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x5592e0df2139]
sql/sql_parse.cc:4621(mysql_execute_command(THD*))[0x5592e0d55aa9]
sql/sql_parse.cc:7855(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x5592e0d6ca88]
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5592e0d43a05]
sql/sql_parse.cc:1398(do_command(THD*))[0x5592e0d40524]
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x5592e11164f3]
sql/sql_connect.cc:1309(handle_one_connection)[0x5592e1115dad]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x5592e2748ae7]
nptl/pthread_create.c:478(start_thread)[0x7f629cfd8609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f629cefd133]

Query (0x62b000000290): insert into v select * from v
{noformat}

non-debug:
{noformat:title=10.6.9}
221102 14:51:37 [ERROR] mysqld got signal 11 ;
Server version: 10.6.9-MariaDB

sql/signal_handler.cc:236(handle_fatal_signal)[0x555ba69f0917]
sigaction.c:0(__restore_rt)[0x7fd2e265b420]
sql/sql_select.cc:25679(JOIN::optimize_inner())[0x555ba682b239]
sql/sql_select.cc:1838(JOIN::optimize())[0x555ba682c375]
sql/sql_select.cc:5027(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x555ba682c448]
sql/sql_select.cc:566(handle_select(THD*, LEX*, select_result*, unsigned long))[0x555ba682cd54]
sql/sql_parse.cc:4711(mysql_execute_command(THD*, bool))[0x555ba67d0229]
sql/sql_parse.cc:8031(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x555ba67d112b]
sql/sql_parse.cc:1955(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x555ba67d32e7]
sql/sql_parse.cc:1411(do_command(THD*, bool))[0x555ba67d4983]
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x555ba68cac47]
sql/sql_connect.cc:1318(handle_one_connection)[0x555ba68caee4]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x555ba6c5fcdc]
nptl/pthread_create.c:478(start_thread)[0x7fd2e264f609]
??:0(clone)[0x7fd2e223b133]

Query (0x7fd28c012210): insert into v select * from v
{noformat}

Alice Sherepa made changes - 2023-03-01 09:03

Link

This issue relates to ~~MDEV-29681~~ [ ~~MDEV-29681~~ ]

Alice Sherepa made changes - 2023-03-01 09:04

Link

This issue relates to MDEV-30756 [ MDEV-30756 ]

Alice Sherepa made changes - 2023-03-01 09:33

Status

Open [ 1 ]

Confirmed [ 10101 ]

Julien Fritsch made changes - 2023-03-06 08:07

Fix Version/s

10.7 [ 24805 ]

Julien Fritsch made changes - 2023-04-27 13:53

Fix Version/s

10.3 [ 22126 ]

Julien Fritsch made changes - 2023-04-27 14:57

Fix Version/s

10.8 [ 26121 ]

Alice Sherepa made changes - 2023-05-05 08:54

Fix Version/s		10.10 [ 27530 ]
Fix Version/s		10.11 [ 27614 ]

Alice Sherepa made changes - 2023-07-13 12:55

Fix Version/s

11.0 [ 28320 ]

Alice Sherepa made changes - 2023-07-13 12:55

Affects Version/s		10.11 [ 27614 ]
Affects Version/s		11.0 [ 28320 ]

Alice Sherepa made changes - 2023-09-27 14:03

Link

This issue is duplicated by ~~MDEV-32258~~ [ ~~MDEV-32258~~ ]

Julien Fritsch made changes - 2023-11-28 10:22

Fix Version/s

10.9 [ 26905 ]

Julien Fritsch made changes - 2023-11-28 10:31

Fix Version/s

10.10 [ 27530 ]

Alice Sherepa made changes - 2023-12-20 12:30

Fix Version/s		11.1 [ 28549 ]
Fix Version/s		11.2 [ 28603 ]
Fix Version/s		11.3 [ 28565 ]

Julien Fritsch made changes - 2024-05-03 14:30

Fix Version/s	11.0 [ 28320 ]
Fix Version/s	11.3 [ 28565 ]

Roel Van de Paar made changes - 2024-07-01 00:37

Link

This issue relates to ~~MDEV-28516~~ [ ~~MDEV-28516~~ ]

Roel Van de Paar made changes - 2024-07-01 00:37

Link

This issue relates to ~~MDEV-28510~~ [ ~~MDEV-28510~~ ]

Roel Van de Paar made changes - 2024-07-01 00:38

Link

This issue relates to MDEV-32412 [ MDEV-32412 ]

Roel Van de Paar made changes - 2024-07-01 00:38

Link

This issue relates to MDEV-32763 [ MDEV-32763 ]

Roel Van de Paar made changes - 2024-07-01 00:39

Link

This issue relates to MDEV-30756 [ MDEV-30756 ]

Roel Van de Paar made changes - 2024-07-01 00:41

Fix Version/s		11.4 [ 29301 ]
Fix Version/s		11.5 [ 29506 ]
Affects Version/s		11.1 [ 28549 ]
Affects Version/s		11.2 [ 28603 ]
Affects Version/s		11.4 [ 29301 ]
Affects Version/s		11.5 [ 29506 ]
Affects Version/s		11.6 [ 29515 ]

Roel Van de Paar made changes - 2024-07-01 00:43

Component/s

Optimizer [ 10200 ]

Julien Fritsch made changes - 2024-09-10 15:06

Fix Version/s

10.4 [ 22408 ]

Julien Fritsch made changes - 2024-09-10 15:26

Fix Version/s

11.1 [ 28549 ]

Julien Fritsch made changes - 2024-09-10 15:45

Fix Version/s

11.5 [ 29506 ]

Oleg Smirnov made changes - 2024-10-09 11:17

Assignee

Sergei Petrunia [ psergey ]

Oleg Smirnov [ JIRAUSER50405 ]

Oleg Smirnov made changes - 2024-10-09 11:17

Status

Confirmed [ 10101 ]

In Progress [ 3 ]

Oleg Smirnov made changes - 2024-10-09 14:22

Link

This issue relates to MDEV-32412 [ MDEV-32412 ]

Oleg Smirnov made changes - 2024-10-09 14:22

Link

This issue is caused by ~~MDEV-26427~~ [ ~~MDEV-26427~~ ]

Oleg Smirnov added a comment - 2024-10-09 14:25

This issue is caused by ~~MDEV-26427~~:

commit 49e14000eeb245ea27e9207d2f63cb0a28be1ca9

Author: Oleg Smirnov <olernov@gmail.com>

Date:   Sat Jun 18 20:54:39 2022 +0700

    MDEV-26427 MariaDB Server SEGV on INSERT .. SELECT

    1. For INSERT..SELECT statements: don't include table/view the data

       is inserted into in the list of leaf tables

    2. Remove duplicated and dead code related to table_count

Oleg Smirnov added a comment - 2024-10-09 14:25 This issue is caused by MDEV-26427 : commit 49e14000eeb245ea27e9207d2f63cb0a28be1ca9 Author: Oleg Smirnov <olernov@gmail.com> Date: Sat Jun 18 20:54:39 2022 +0700 MDEV-26427 MariaDB Server SEGV on INSERT .. SELECT 1. For INSERT..SELECT statements: don't include table/view the data is inserted into in the list of leaf tables 2. Remove duplicated and dead code related to table_count

Oleg Smirnov added a comment - 2024-10-26 14:18

Roel, would you mind filing this issue as a separate task? It is caused by something different.

sanja, please review the PR or bb-10.5-~~MDEV-29935~~. The branch reverts the previous solution for ~~MDEV-25427~~ and re-implements it more correctly, so there is no need for additional fixes for ~~MDEV-29935~~.

Oleg Smirnov added a comment - 2024-10-26 14:18 Roel , would you mind filing this issue as a separate task? It is caused by something different. sanja , please review the PR or bb-10.5- MDEV-29935 . The branch reverts the previous solution for MDEV-25427 and re-implements it more correctly, so there is no need for additional fixes for MDEV-29935 .

Oleg Smirnov made changes - 2024-10-26 14:18

Assignee	Oleg Smirnov [ JIRAUSER50405 ]	Oleksandr Byelkin [ sanja ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Roel Van de Paar made changes - 2024-10-28 20:36

Link

This issue split to MDEV-35277 [ MDEV-35277 ]

Roel Van de Paar added a comment - 2024-10-28 20:36

oleg.smirnov Ack/done, MDEV-35277 SIGSEGV in get_sort_by_table on SELECT

Roel Van de Paar added a comment - 2024-10-28 20:36 oleg.smirnov Ack/done, MDEV-35277 SIGSEGV in get_sort_by_table on SELECT

Roel Van de Paar made changes - 2024-10-28 20:37

Comment

[ The testcase is in this comment was split to MDEV-35277 - SIGSEGV in get_sort_by_table on SELECT ]

Julien Fritsch made changes - 2024-11-22 17:12

Fix Version/s

11.2(EOL) [ 28603 ]

Oleksandr Byelkin made changes - 2024-12-13 10:35

Comment

[ I see reverting test cases also. why? the issue will be unfixed? ]

Oleksandr Byelkin added a comment - 2024-12-13 13:34

OK to push

Oleksandr Byelkin added a comment - 2024-12-13 13:34 OK to push

Oleksandr Byelkin made changes - 2024-12-13 13:34

Assignee	Oleksandr Byelkin [ sanja ]	Oleg Smirnov [ JIRAUSER50405 ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Oleg Smirnov added a comment - 2024-12-15 09:06

Pushed to 10.5.

Oleg Smirnov added a comment - 2024-12-15 09:06 Pushed to 10.5.

Oleg Smirnov made changes - 2024-12-15 09:06

Fix Version/s		10.5.28 [ 29952 ]
Fix Version/s	10.5 [ 23123 ]
Fix Version/s	10.6 [ 24028 ]
Fix Version/s	10.11 [ 27614 ]
Fix Version/s	11.4 [ 29301 ]
Resolution		Fixed [ 1 ]
Status	Stalled [ 10000 ]	Closed [ 6 ]

JiraAutomate made changes - 2024-12-15 09:06

Fix Version/s		10.6.21 [ 29953 ]
Fix Version/s		10.11.11 [ 29954 ]
Fix Version/s		11.4.5 [ 29956 ]
Fix Version/s		11.7.2 [ 29914 ]

Oleg Smirnov made changes - 2024-12-19 12:13

Link

This issue causes ~~MDEV-35680~~ [ ~~MDEV-35680~~ ]

People

Assignee:: Oleg Smirnov

Reporter:: Alice Sherepa

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Dates

Created:: 2022-11-02 14:03

Updated:: 2024-12-24 08:54

Resolved:: 2024-12-15 09:06

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.