[MDEV-30933] UBSAN: load of value X, which is not a valid value for type 'bool' (11.0) or 'sj_strategy_enum' (10.3) on [EXPLAIN] SELECT - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.3, 11.0
Fix Version/s: 11.0
Component/s: Optimizer, Partitioning
Labels:
- UBSAN
- not-10.10
- not-10.4
- not-10.5
- not-10.6
- not-10.7
- not-10.8
- not-10.9
- regression-10.11

Description

This bug affects only 11.0 (likely new regression) and 10.3 with a similar but not identical UBSAN error between the versions.

CREATE TABLE t (c INT,INDEX (c)) ENGINE=InnoDB PARTITION BY LIST (c) (PARTITION p VALUES IN (1,2));

EXPLAIN SELECT * FROM t WHERE (t.c) IN (SELECT c FROM t);

Leads to:

11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)

/test/11.0_dbg_san/sql/sql_select.h:968:7: runtime error: load of value 63, which is not a valid value for type 'bool'

/test/11.0_dbg_san/sql/sql_select.h:968:7: runtime error: load of value 158, which is not a valid value for type 'bool'

11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)
#0 0x55874b65b446 in POSITION::operator=(POSITION const&) /test/11.0_dbg_san/sql/sql_select.h:968
#1 0x55874b5f46da in optimize_wo_join_buffering(JOIN, unsigned int, unsigned int, unsigned long long, bool, unsigned int, double, double*) /test/11.0_dbg_san/sql/sql_select.cc:19260
#2 0x55874be58f26 in LooseScan_picker::check_qep(JOIN, unsigned int, unsigned long long, st_join_table const, double, double, unsigned long long, sj_strategy_enum, POSITION*) /test/11.0_dbg_san/sql/opt_subselect.cc:3384
#3 0x55874bea2f64 in optimize_semi_joins(JOIN, unsigned long long, unsigned int, double, double, POSITION) /test/11.0_dbg_san/sql/opt_subselect.cc:2977
#4 0x55874b5d2e45 in best_extension_by_limited_search /test/11.0_dbg_san/sql/sql_select.cc:11167
#5 0x55874b5d03b6 in best_extension_by_limited_search /test/11.0_dbg_san/sql/sql_select.cc:11334
#6 0x55874b5daffc in greedy_search /test/11.0_dbg_san/sql/sql_select.cc:10080
#7 0x55874b5daffc in choose_plan(JOIN, unsigned long long, TABLE_LIST) /test/11.0_dbg_san/sql/sql_select.cc:9601
#8 0x55874b5efc01 in make_join_statistics /test/11.0_dbg_san/sql/sql_select.cc:6080
#9 0x55874b6203a7 in JOIN::optimize_inner() /test/11.0_dbg_san/sql/sql_select.cc:2572
#10 0x55874b6222c5 in JOIN::optimize() /test/11.0_dbg_san/sql/sql_select.cc:1900
#11 0x55874b622a4e in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/11.0_dbg_san/sql/sql_select.cc:5139
#12 0x55874b628672 in mysql_explain_union(THD, st_select_lex_unit, select_result*) /test/11.0_dbg_san/sql/sql_select.cc:29838
#13 0x55874b1a4cbb in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6205
#14 0x55874b207cce in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
#15 0x55874b2375e6 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
#16 0x55874b24737a in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
#17 0x55874b25517f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
#18 0x55874bc19459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
#19 0x55874bc1a974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
#20 0x151ccccb6b42 in start_thread nptl/pthread_create.c:442
#21 0x151cccd489ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

10.3.39 4c4939bbf619d7e516131c0b3e5691b1c2d2ff8f (Debug, UBASAN)
/test/10.3_dbg_san/sql/sql_select.h:901:16: runtime error: load of value 24976, which is not a valid value for type 'sj_strategy_enum'
#0 0x55d2b36d7759 in st_position::operator=(st_position const&) /test/10.3_dbg_san/sql/sql_select.h:901
#1 0x55d2b36d7759 in optimize_wo_join_buffering(JOIN, unsigned int, unsigned int, unsigned long long, bool, unsigned int, double, double*) /test/10.3_dbg_san/sql/sql_select.cc:16355
#2 0x55d2b3cea0e7 in LooseScan_picker::check_qep(JOIN, unsigned int, unsigned long long, st_join_table const, double, double, unsigned long long, sj_strategy_enum, st_position*) /test/10.3_dbg_san/sql/opt_subselect.cc:3153
#3 0x55d2b3d0cd87 in optimize_semi_joins(JOIN, unsigned long long, unsigned int, double, double, st_position) /test/10.3_dbg_san/sql/opt_subselect.cc:2799
#4 0x55d2b36b4e6e in best_extension_by_limited_search /test/10.3_dbg_san/sql/sql_select.cc:9036
#5 0x55d2b36b57f5 in best_extension_by_limited_search /test/10.3_dbg_san/sql/sql_select.cc:9097
#6 0x55d2b36b9596 in greedy_search /test/10.3_dbg_san/sql/sql_select.cc:8203
#7 0x55d2b36b9a31 in choose_plan(JOIN*, unsigned long long) /test/10.3_dbg_san/sql/sql_select.cc:7779
#8 0x55d2b37c1c0e in make_join_statistics /test/10.3_dbg_san/sql/sql_select.cc:5240
#9 0x55d2b37c1c0e in JOIN::optimize_inner() /test/10.3_dbg_san/sql/sql_select.cc:2000
#10 0x55d2b37c2d23 in JOIN::optimize() /test/10.3_dbg_san/sql/sql_select.cc:1542
#11 0x55d2b37d2335 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.3_dbg_san/sql/sql_select.cc:4379
#12 0x55d2b37d3581 in handle_select(THD, LEX, select_result*, unsigned long) /test/10.3_dbg_san/sql/sql_select.cc:372
#13 0x55d2b352f059 in execute_sqlcom_select /test/10.3_dbg_san/sql/sql_parse.cc:6340
#14 0x55d2b356b386 in mysql_execute_command(THD*) /test/10.3_dbg_san/sql/sql_parse.cc:3871
#15 0x55d2b358dc95 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.3_dbg_san/sql/sql_parse.cc:7855
#16 0x55d2b3596970 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.3_dbg_san/sql/sql_parse.cc:1852
#17 0x55d2b359f9b7 in do_command(THD*) /test/10.3_dbg_san/sql/sql_parse.cc:1398
#18 0x55d2b3b9fcef in do_handle_one_connection(CONNECT*) /test/10.3_dbg_san/sql/sql_connect.cc:1404
#19 0x55d2b3ba033c in handle_one_connection /test/10.3_dbg_san/sql/sql_connect.cc:1309
#20 0x14ae4011cb42 in start_thread nptl/pthread_create.c:442
#21 0x14ae401ae9ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

/test/10.3_dbg_san/sql/sql_select.h:725:7: runtime error: load of value 168, which is not a valid value for type 'bool'
#0 0x55d2b36d77aa in Duplicate_weedout_picker::operator=(Duplicate_weedout_picker const&) /test/10.3_dbg_san/sql/sql_select.h:725
#1 0x55d2b36d77aa in st_position::operator=(st_position const&) /test/10.3_dbg_san/sql/sql_select.h:901
#2 0x55d2b36d77aa in optimize_wo_join_buffering(JOIN, unsigned int, unsigned int, unsigned long long, bool, unsigned int, double, double*) /test/10.3_dbg_san/sql/sql_select.cc:16355
#3 0x55d2b3cea0e7 in LooseScan_picker::check_qep(JOIN, unsigned int, unsigned long long, st_join_table const, double, double, unsigned long long, sj_strategy_enum, st_position*) /test/10.3_dbg_san/sql/opt_subselect.cc:3153
#4 0x55d2b3d0cd87 in optimize_semi_joins(JOIN, unsigned long long, unsigned int, double, double, st_position) /test/10.3_dbg_san/sql/opt_subselect.cc:2799
#5 0x55d2b36b4e6e in best_extension_by_limited_search /test/10.3_dbg_san/sql/sql_select.cc:9036
#6 0x55d2b36b57f5 in best_extension_by_limited_search /test/10.3_dbg_san/sql/sql_select.cc:9097
#7 0x55d2b36b9596 in greedy_search /test/10.3_dbg_san/sql/sql_select.cc:8203
#8 0x55d2b36b9a31 in choose_plan(JOIN*, unsigned long long) /test/10.3_dbg_san/sql/sql_select.cc:7779
#9 0x55d2b37c1c0e in make_join_statistics /test/10.3_dbg_san/sql/sql_select.cc:5240
#10 0x55d2b37c1c0e in JOIN::optimize_inner() /test/10.3_dbg_san/sql/sql_select.cc:2000
#11 0x55d2b37c2d23 in JOIN::optimize() /test/10.3_dbg_san/sql/sql_select.cc:1542
#12 0x55d2b37d2335 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.3_dbg_san/sql/sql_select.cc:4379
#13 0x55d2b37d3581 in handle_select(THD, LEX, select_result*, unsigned long) /test/10.3_dbg_san/sql/sql_select.cc:372
#14 0x55d2b352f059 in execute_sqlcom_select /test/10.3_dbg_san/sql/sql_parse.cc:6340
#15 0x55d2b356b386 in mysql_execute_command(THD*) /test/10.3_dbg_san/sql/sql_parse.cc:3871
#16 0x55d2b358dc95 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.3_dbg_san/sql/sql_parse.cc:7855
#17 0x55d2b3596970 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.3_dbg_san/sql/sql_parse.cc:1852
#18 0x55d2b359f9b7 in do_command(THD*) /test/10.3_dbg_san/sql/sql_parse.cc:1398
#19 0x55d2b3b9fcef in do_handle_one_connection(CONNECT*) /test/10.3_dbg_san/sql/sql_connect.cc:1404
#20 0x55d2b3ba033c in handle_one_connection /test/10.3_dbg_san/sql/sql_connect.cc:1309
#21 0x14ae4011cb42 in start_thread nptl/pthread_create.c:442
#22 0x14ae401ae9ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

/test/10.3_dbg_san/sql/sql_select.h:761:7: runtime error: load of value 8, which is not a valid value for type 'bool'
#0 0x55d2b36d77e7 in Firstmatch_picker::operator=(Firstmatch_picker const&) /test/10.3_dbg_san/sql/sql_select.h:761
#1 0x55d2b36d77e7 in st_position::operator=(st_position const&) /test/10.3_dbg_san/sql/sql_select.h:901
#2 0x55d2b36d77e7 in optimize_wo_join_buffering(JOIN, unsigned int, unsigned int, unsigned long long, bool, unsigned int, double, double*) /test/10.3_dbg_san/sql/sql_select.cc:16355
#3 0x55d2b3cea0e7 in LooseScan_picker::check_qep(JOIN, unsigned int, unsigned long long, st_join_table const, double, double, unsigned long long, sj_strategy_enum, st_position*) /test/10.3_dbg_san/sql/opt_subselect.cc:3153
#4 0x55d2b3d0cd87 in optimize_semi_joins(JOIN, unsigned long long, unsigned int, double, double, st_position) /test/10.3_dbg_san/sql/opt_subselect.cc:2799
#5 0x55d2b36b4e6e in best_extension_by_limited_search /test/10.3_dbg_san/sql/sql_select.cc:9036
#6 0x55d2b36b57f5 in best_extension_by_limited_search /test/10.3_dbg_san/sql/sql_select.cc:9097
#7 0x55d2b36b9596 in greedy_search /test/10.3_dbg_san/sql/sql_select.cc:8203
#8 0x55d2b36b9a31 in choose_plan(JOIN*, unsigned long long) /test/10.3_dbg_san/sql/sql_select.cc:7779
#9 0x55d2b37c1c0e in make_join_statistics /test/10.3_dbg_san/sql/sql_select.cc:5240
#10 0x55d2b37c1c0e in JOIN::optimize_inner() /test/10.3_dbg_san/sql/sql_select.cc:2000
#11 0x55d2b37c2d23 in JOIN::optimize() /test/10.3_dbg_san/sql/sql_select.cc:1542
#12 0x55d2b37d2335 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.3_dbg_san/sql/sql_select.cc:4379
#13 0x55d2b37d3581 in handle_select(THD, LEX, select_result*, unsigned long) /test/10.3_dbg_san/sql/sql_select.cc:372
#14 0x55d2b352f059 in execute_sqlcom_select /test/10.3_dbg_san/sql/sql_parse.cc:6340
#15 0x55d2b356b386 in mysql_execute_command(THD*) /test/10.3_dbg_san/sql/sql_parse.cc:3871
#16 0x55d2b358dc95 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.3_dbg_san/sql/sql_parse.cc:7855
#17 0x55d2b3596970 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.3_dbg_san/sql/sql_parse.cc:1852
#18 0x55d2b359f9b7 in do_command(THD*) /test/10.3_dbg_san/sql/sql_parse.cc:1398
#19 0x55d2b3b9fcef in do_handle_one_connection(CONNECT*) /test/10.3_dbg_san/sql/sql_connect.cc:1404
#20 0x55d2b3ba033c in handle_one_connection /test/10.3_dbg_san/sql/sql_connect.cc:1309
#21 0x14ae4011cb42 in start_thread nptl/pthread_create.c:442
#22 0x14ae401ae9ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

/test/10.3_dbg_san/sql/sql_select.h:806:7: runtime error: load of value 176, which is not a valid value for type 'bool'
#0 0x55d2b36d782e in LooseScan_picker::operator=(LooseScan_picker const&) /test/10.3_dbg_san/sql/sql_select.h:806
#1 0x55d2b36d782e in st_position::operator=(st_position const&) /test/10.3_dbg_san/sql/sql_select.h:901
#2 0x55d2b36d782e in optimize_wo_join_buffering(JOIN, unsigned int, unsigned int, unsigned long long, bool, unsigned int, double, double*) /test/10.3_dbg_san/sql/sql_select.cc:16355
#3 0x55d2b3cea0e7 in LooseScan_picker::check_qep(JOIN, unsigned int, unsigned long long, st_join_table const, double, double, unsigned long long, sj_strategy_enum, st_position*) /test/10.3_dbg_san/sql/opt_subselect.cc:3153
#4 0x55d2b3d0cd87 in optimize_semi_joins(JOIN, unsigned long long, unsigned int, double, double, st_position) /test/10.3_dbg_san/sql/opt_subselect.cc:2799
#5 0x55d2b36b4e6e in best_extension_by_limited_search /test/10.3_dbg_san/sql/sql_select.cc:9036
#6 0x55d2b36b57f5 in best_extension_by_limited_search /test/10.3_dbg_san/sql/sql_select.cc:9097
#7 0x55d2b36b9596 in greedy_search /test/10.3_dbg_san/sql/sql_select.cc:8203
#8 0x55d2b36b9a31 in choose_plan(JOIN*, unsigned long long) /test/10.3_dbg_san/sql/sql_select.cc:7779
#9 0x55d2b37c1c0e in make_join_statistics /test/10.3_dbg_san/sql/sql_select.cc:5240
#10 0x55d2b37c1c0e in JOIN::optimize_inner() /test/10.3_dbg_san/sql/sql_select.cc:2000
#11 0x55d2b37c2d23 in JOIN::optimize() /test/10.3_dbg_san/sql/sql_select.cc:1542
#12 0x55d2b37d2335 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.3_dbg_san/sql/sql_select.cc:4379
#13 0x55d2b37d3581 in handle_select(THD, LEX, select_result*, unsigned long) /test/10.3_dbg_san/sql/sql_select.cc:372
#14 0x55d2b352f059 in execute_sqlcom_select /test/10.3_dbg_san/sql/sql_parse.cc:6340
#15 0x55d2b356b386 in mysql_execute_command(THD*) /test/10.3_dbg_san/sql/sql_parse.cc:3871
#16 0x55d2b358dc95 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.3_dbg_san/sql/sql_parse.cc:7855
#17 0x55d2b3596970 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.3_dbg_san/sql/sql_parse.cc:1852
#18 0x55d2b359f9b7 in do_command(THD*) /test/10.3_dbg_san/sql/sql_parse.cc:1398
#19 0x55d2b3b9fcef in do_handle_one_connection(CONNECT*) /test/10.3_dbg_san/sql/sql_connect.cc:1404
#20 0x55d2b3ba033c in handle_one_connection /test/10.3_dbg_san/sql/sql_connect.cc:1309
#21 0x14ae4011cb42 in start_thread nptl/pthread_create.c:442
#22 0x14ae401ae9ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

/test/10.3_dbg_san/sql/sql_select.h:861:7: runtime error: load of value 80, which is not a valid value for type 'bool'
#0 0x55d2b36d784d in Sj_materialization_picker::operator=(Sj_materialization_picker const&) /test/10.3_dbg_san/sql/sql_select.h:861
#1 0x55d2b36d784d in st_position::operator=(st_position const&) /test/10.3_dbg_san/sql/sql_select.h:901
#2 0x55d2b36d784d in optimize_wo_join_buffering(JOIN, unsigned int, unsigned int, unsigned long long, bool, unsigned int, double, double*) /test/10.3_dbg_san/sql/sql_select.cc:16355
#3 0x55d2b3cea0e7 in LooseScan_picker::check_qep(JOIN, unsigned int, unsigned long long, st_join_table const, double, double, unsigned long long, sj_strategy_enum, st_position*) /test/10.3_dbg_san/sql/opt_subselect.cc:3153
#4 0x55d2b3d0cd87 in optimize_semi_joins(JOIN, unsigned long long, unsigned int, double, double, st_position) /test/10.3_dbg_san/sql/opt_subselect.cc:2799
#5 0x55d2b36b4e6e in best_extension_by_limited_search /test/10.3_dbg_san/sql/sql_select.cc:9036
#6 0x55d2b36b57f5 in best_extension_by_limited_search /test/10.3_dbg_san/sql/sql_select.cc:9097
#7 0x55d2b36b9596 in greedy_search /test/10.3_dbg_san/sql/sql_select.cc:8203
#8 0x55d2b36b9a31 in choose_plan(JOIN*, unsigned long long) /test/10.3_dbg_san/sql/sql_select.cc:7779
#9 0x55d2b37c1c0e in make_join_statistics /test/10.3_dbg_san/sql/sql_select.cc:5240
#10 0x55d2b37c1c0e in JOIN::optimize_inner() /test/10.3_dbg_san/sql/sql_select.cc:2000
#11 0x55d2b37c2d23 in JOIN::optimize() /test/10.3_dbg_san/sql/sql_select.cc:1542
#12 0x55d2b37d2335 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /test/10.3_dbg_san/sql/sql_select.cc:4379
#13 0x55d2b37d3581 in handle_select(THD, LEX, select_result*, unsigned long) /test/10.3_dbg_san/sql/sql_select.cc:372
#14 0x55d2b352f059 in execute_sqlcom_select /test/10.3_dbg_san/sql/sql_parse.cc:6340
#15 0x55d2b356b386 in mysql_execute_command(THD*) /test/10.3_dbg_san/sql/sql_parse.cc:3871
#16 0x55d2b358dc95 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.3_dbg_san/sql/sql_parse.cc:7855
#17 0x55d2b3596970 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.3_dbg_san/sql/sql_parse.cc:1852
#18 0x55d2b359f9b7 in do_command(THD*) /test/10.3_dbg_san/sql/sql_parse.cc:1398
#19 0x55d2b3b9fcef in do_handle_one_connection(CONNECT*) /test/10.3_dbg_san/sql/sql_connect.cc:1404
#20 0x55d2b3ba033c in handle_one_connection /test/10.3_dbg_san/sql/sql_connect.cc:1309
#21 0x14ae4011cb42 in start_thread nptl/pthread_create.c:442
#22 0x14ae401ae9ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

Setup:

Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1

Bug confirmed present in:
MariaDB: 10.3.39 (dbg), 10.3.39 (opt), 11.0.2 (dbg), 11.0.2 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt)

Attachments

Activity

People

Assignee:: Sergei Petrunia

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2023-03-27 07:05

Updated:: 2023-04-27 14:32

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.