[MDEV-31112] vcol circular references lead to stack overflow - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Affects Version/s: 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL)
Fix Version/s: 10.5.23, 10.6.16, 10.10.7, 10.11.6, 11.0.4, 11.1.3
Component/s: Data Definition - Alter Table, Partitioning, Virtual Columns
Labels:
None

Description

Server hangs or crashes in Item::walk / Item_field::check_valid_arguments_processor upon ALTER with circular virtual columns

Note: This is another case when the server log contains nothing at all after the crash, not even an attempt to write a crash report, no 'Killed', nothing.

--source include/have_partition.inc

CREATE TABLE t (a INT, c INT AS (a));

ALTER TABLE t ALTER COLUMN c DROP DEFAULT;

ALTER TABLE t MODIFY COLUMN a INT AS (c) STORED;

ALTER TABLE t PARTITION BY HASH(c);

# Cleanup

DROP TABLE t;

10.3 2743a510

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x000055d860a18f04 in Item::walk (this=0x0, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1702

Thread 1 (Thread 0x7fe92df012c0 (LWP 3948203)):

#0  0x000055d860a18f04 in Item::walk (this=0x0, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1702

#1  0x000055d861469c94 in Item_field::check_valid_arguments_processor (this=0x61d0001a2ca8, bool_arg=0x0) at /src/sql/item.cc:6460

#2  0x000055d860a19097 in Item::walk (this=0x61d0001a2ca8, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1704

#3  0x000055d861469d23 in Item_field::check_valid_arguments_processor (this=0x61d0001a2df8, bool_arg=0x0) at /src/sql/item.cc:6461

...

...

#2953 0x000055d861469d23 in Item_field::check_valid_arguments_processor (this=0x61d0001a3238, bool_arg=0x0) at /src/sql/item.cc:6461

#2954 0x000055d860a19097 in Item::walk (this=0x61d0001a3238, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1704

#2955 0x000055d86184e738 in fix_fields_part_func (thd=0x62a000060208, func_expr=0x61d0001a3238, table=0x7fe92defacc0, is_sub_part=false, is_create_table_ind=true) at /src/sql/sql_partition.cc:901

#2956 0x000055d8618555bb in fix_partition_func (thd=0x62a000060208, table=0x7fe92defacc0, is_create_table_ind=true) at /src/sql/sql_partition.cc:1998

#2957 0x000055d860f85d5e in open_table_from_share (thd=0x62a000060208, share=0x7fe92defa000, alias=0x55d863599740 <empty_clex_str>, db_stat=0, prgflag=1, ha_open_flags=0, outparam=0x7fe92defacc0, is_create_table=true, partitions_to_open=0x0) at /src/sql/table.cc:3614

#2958 0x000055d860ed23aa in create_table_impl (thd=0x62a000060208, orig_db=0x7fe92defc7e0, orig_table_name=0x7fe92defc7f0, db=0x7fe92defc810, table_name=0x7fe92defc840, path=0x7fe92defd03e "./test/#sql-3c3ea4_4", options=..., create_info=0x7fe92defd4f0, alter_info=0x7fe92defd3f0, create_table_mode=-2, is_trans=0x0, key_info=0x7fe92defbb20, key_count=0x7fe92defbab0, frm=0x7fe92defbbc0) at /src/sql/sql_table.cc:5164

#2959 0x000055d860ef453d in mysql_alter_table (thd=0x62a000060208, new_db=0x62a000064918, new_name=0x62a000064d30, create_info=0x7fe92defd4f0, table_list=0x62b000000348, alter_info=0x7fe92defd3f0, order_num=0, order=0x0, ignore=false) at /src/sql/sql_table.cc:10037

#2960 0x000055d86105e96e in Sql_cmd_alter_table::execute (this=0x62b000000d58, thd=0x62a000060208) at /src/sql/sql_alter.cc:512

#2961 0x000055d860caa153 in mysql_execute_command (thd=0x62a000060208) at /src/sql/sql_parse.cc:6076

#2962 0x000055d860cb5f84 in mysql_parse (thd=0x62a000060208, rawbuf=0x62b000000228 "ALTER TABLE t PARTITION BY HASH(c)", length=34, parser_state=0x7fe92deff8f0, is_com_multi=false, is_next_command=false) at /src/sql/sql_parse.cc:7855

#2963 0x000055d860c8d614 in dispatch_command (command=COM_QUERY, thd=0x62a000060208, packet=0x6290000eb209 "ALTER TABLE t PARTITION BY HASH(c)", packet_length=34, is_com_multi=false, is_next_command=false) at /src/sql/sql_parse.cc:1852

#2964 0x000055d860c8a1cc in do_command (thd=0x62a000060208) at /src/sql/sql_parse.cc:1398

#2965 0x000055d86104e258 in do_handle_one_connection (connect=0x608000000ca8) at /src/sql/sql_connect.cc:1404

#2966 0x000055d86104db54 in handle_one_connection (arg=0x608000000ca8) at /src/sql/sql_connect.cc:1309

#2967 0x000055d8625ff62b in pfs_spawn_thread (arg=0x615000004908) at /src/storage/perfschema/pfs.cc:1869

#2968 0x00007fe938ca7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#2969 0x00007fe938d285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Release builds instead hang on the last ALTER.

Reproducible with at least MyISAM, InnoDB, Aria, on all existing versions, all the way back to first GAs.

Attachments

Issue Links

relates to

MDEV-18114 Foreign Key Constraint actions don't affect Virtual Column

Closed

Activity

Ascending order - Click to sort in descending order

Elena Stepanova created issue - 2023-04-22 16:40

Elena Stepanova made changes - 2023-04-22 16:42

Field	Original Value	New Value
Description	Note: This is another case when the server log contains nothing at all after the crash, not even an attempt to write a crash report, no 'Killed', nothing. {code:sql} --source include/have_partition.inc CREATE TABLE t (a INT, c INT AS (a)); ALTER TABLE t ALTER COLUMN c DROP DEFAULT; ALTER TABLE t MODIFY COLUMN a INT AS (c) STORED; ALTER TABLE t PARTITION BY HASH(c); # Cleanup DROP TABLE t; {code} {noformat:title=10.3 2743a510} Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000055d860a18f04 in Item::walk (this=0x0, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1702 {noformat} {noformat} Thread 1 (Thread 0x7fe92df012c0 (LWP 3948203)): #0 0x000055d860a18f04 in Item::walk (this=0x0, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1702 #1 0x000055d861469c94 in Item_field::check_valid_arguments_processor (this=0x61d0001a2ca8, bool_arg=0x0) at /src/sql/item.cc:6460 #2 0x000055d860a19097 in Item::walk (this=0x61d0001a2ca8, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1704 #3 0x000055d861469d23 in Item_field::check_valid_arguments_processor (this=0x61d0001a2df8, bool_arg=0x0) at /src/sql/item.cc:6461 ... ... #2953 0x000055d861469d23 in Item_field::check_valid_arguments_processor (this=0x61d0001a3238, bool_arg=0x0) at /src/sql/item.cc:6461 #2954 0x000055d860a19097 in Item::walk (this=0x61d0001a3238, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1704 #2955 0x000055d86184e738 in fix_fields_part_func (thd=0x62a000060208, func_expr=0x61d0001a3238, table=0x7fe92defacc0, is_sub_part=false, is_create_table_ind=true) at /src/sql/sql_partition.cc:901 #2956 0x000055d8618555bb in fix_partition_func (thd=0x62a000060208, table=0x7fe92defacc0, is_create_table_ind=true) at /src/sql/sql_partition.cc:1998 #2957 0x000055d860f85d5e in open_table_from_share (thd=0x62a000060208, share=0x7fe92defa000, alias=0x55d863599740 <empty_clex_str>, db_stat=0, prgflag=1, ha_open_flags=0, outparam=0x7fe92defacc0, is_create_table=true, partitions_to_open=0x0) at /src/sql/table.cc:3614 #2958 0x000055d860ed23aa in create_table_impl (thd=0x62a000060208, orig_db=0x7fe92defc7e0, orig_table_name=0x7fe92defc7f0, db=0x7fe92defc810, table_name=0x7fe92defc840, path=0x7fe92defd03e "./test/#sql-3c3ea4_4", options=..., create_info=0x7fe92defd4f0, alter_info=0x7fe92defd3f0, create_table_mode=-2, is_trans=0x0, key_info=0x7fe92defbb20, key_count=0x7fe92defbab0, frm=0x7fe92defbbc0) at /src/sql/sql_table.cc:5164 #2959 0x000055d860ef453d in mysql_alter_table (thd=0x62a000060208, new_db=0x62a000064918, new_name=0x62a000064d30, create_info=0x7fe92defd4f0, table_list=0x62b000000348, alter_info=0x7fe92defd3f0, order_num=0, order=0x0, ignore=false) at /src/sql/sql_table.cc:10037 #2960 0x000055d86105e96e in Sql_cmd_alter_table::execute (this=0x62b000000d58, thd=0x62a000060208) at /src/sql/sql_alter.cc:512 #2961 0x000055d860caa153 in mysql_execute_command (thd=0x62a000060208) at /src/sql/sql_parse.cc:6076 #2962 0x000055d860cb5f84 in mysql_parse (thd=0x62a000060208, rawbuf=0x62b000000228 "ALTER TABLE t PARTITION BY HASH(c)", length=34, parser_state=0x7fe92deff8f0, is_com_multi=false, is_next_command=false) at /src/sql/sql_parse.cc:7855 #2963 0x000055d860c8d614 in dispatch_command (command=COM_QUERY, thd=0x62a000060208, packet=0x6290000eb209 "ALTER TABLE t PARTITION BY HASH(c)", packet_length=34, is_com_multi=false, is_next_command=false) at /src/sql/sql_parse.cc:1852 #2964 0x000055d860c8a1cc in do_command (thd=0x62a000060208) at /src/sql/sql_parse.cc:1398 #2965 0x000055d86104e258 in do_handle_one_connection (connect=0x608000000ca8) at /src/sql/sql_connect.cc:1404 #2966 0x000055d86104db54 in handle_one_connection (arg=0x608000000ca8) at /src/sql/sql_connect.cc:1309 #2967 0x000055d8625ff62b in pfs_spawn_thread (arg=0x615000004908) at /src/storage/perfschema/pfs.cc:1869 #2968 0x00007fe938ca7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 #2969 0x00007fe938d285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 {noformat} Reproducible with at least MyISAM, InnoDB, Aria, on all existing versions, all the way back to first GAs.	Note: This is another case when the server log contains nothing at all after the crash, not even an attempt to write a crash report, no 'Killed', nothing. {code:sql} --source include/have_partition.inc CREATE TABLE t (a INT, c INT AS (a)); ALTER TABLE t ALTER COLUMN c DROP DEFAULT; ALTER TABLE t MODIFY COLUMN a INT AS (c) STORED; ALTER TABLE t PARTITION BY HASH(c); # Cleanup DROP TABLE t; {code} {noformat:title=10.3 2743a510} Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000055d860a18f04 in Item::walk (this=0x0, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1702 {noformat} {noformat} Thread 1 (Thread 0x7fe92df012c0 (LWP 3948203)): #0 0x000055d860a18f04 in Item::walk (this=0x0, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1702 #1 0x000055d861469c94 in Item_field::check_valid_arguments_processor (this=0x61d0001a2ca8, bool_arg=0x0) at /src/sql/item.cc:6460 #2 0x000055d860a19097 in Item::walk (this=0x61d0001a2ca8, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1704 #3 0x000055d861469d23 in Item_field::check_valid_arguments_processor (this=0x61d0001a2df8, bool_arg=0x0) at /src/sql/item.cc:6461 ... ... #2953 0x000055d861469d23 in Item_field::check_valid_arguments_processor (this=0x61d0001a3238, bool_arg=0x0) at /src/sql/item.cc:6461 #2954 0x000055d860a19097 in Item::walk (this=0x61d0001a3238, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1704 #2955 0x000055d86184e738 in fix_fields_part_func (thd=0x62a000060208, func_expr=0x61d0001a3238, table=0x7fe92defacc0, is_sub_part=false, is_create_table_ind=true) at /src/sql/sql_partition.cc:901 #2956 0x000055d8618555bb in fix_partition_func (thd=0x62a000060208, table=0x7fe92defacc0, is_create_table_ind=true) at /src/sql/sql_partition.cc:1998 #2957 0x000055d860f85d5e in open_table_from_share (thd=0x62a000060208, share=0x7fe92defa000, alias=0x55d863599740 <empty_clex_str>, db_stat=0, prgflag=1, ha_open_flags=0, outparam=0x7fe92defacc0, is_create_table=true, partitions_to_open=0x0) at /src/sql/table.cc:3614 #2958 0x000055d860ed23aa in create_table_impl (thd=0x62a000060208, orig_db=0x7fe92defc7e0, orig_table_name=0x7fe92defc7f0, db=0x7fe92defc810, table_name=0x7fe92defc840, path=0x7fe92defd03e "./test/#sql-3c3ea4_4", options=..., create_info=0x7fe92defd4f0, alter_info=0x7fe92defd3f0, create_table_mode=-2, is_trans=0x0, key_info=0x7fe92defbb20, key_count=0x7fe92defbab0, frm=0x7fe92defbbc0) at /src/sql/sql_table.cc:5164 #2959 0x000055d860ef453d in mysql_alter_table (thd=0x62a000060208, new_db=0x62a000064918, new_name=0x62a000064d30, create_info=0x7fe92defd4f0, table_list=0x62b000000348, alter_info=0x7fe92defd3f0, order_num=0, order=0x0, ignore=false) at /src/sql/sql_table.cc:10037 #2960 0x000055d86105e96e in Sql_cmd_alter_table::execute (this=0x62b000000d58, thd=0x62a000060208) at /src/sql/sql_alter.cc:512 #2961 0x000055d860caa153 in mysql_execute_command (thd=0x62a000060208) at /src/sql/sql_parse.cc:6076 #2962 0x000055d860cb5f84 in mysql_parse (thd=0x62a000060208, rawbuf=0x62b000000228 "ALTER TABLE t PARTITION BY HASH(c)", length=34, parser_state=0x7fe92deff8f0, is_com_multi=false, is_next_command=false) at /src/sql/sql_parse.cc:7855 #2963 0x000055d860c8d614 in dispatch_command (command=COM_QUERY, thd=0x62a000060208, packet=0x6290000eb209 "ALTER TABLE t PARTITION BY HASH(c)", packet_length=34, is_com_multi=false, is_next_command=false) at /src/sql/sql_parse.cc:1852 #2964 0x000055d860c8a1cc in do_command (thd=0x62a000060208) at /src/sql/sql_parse.cc:1398 #2965 0x000055d86104e258 in do_handle_one_connection (connect=0x608000000ca8) at /src/sql/sql_connect.cc:1404 #2966 0x000055d86104db54 in handle_one_connection (arg=0x608000000ca8) at /src/sql/sql_connect.cc:1309 #2967 0x000055d8625ff62b in pfs_spawn_thread (arg=0x615000004908) at /src/storage/perfschema/pfs.cc:1869 #2968 0x00007fe938ca7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 #2969 0x00007fe938d285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 {noformat} Release builds instead hang on the last ALTER. Reproducible with at least MyISAM, InnoDB, Aria, on all existing versions, all the way back to first GAs.

Elena Stepanova made changes - 2023-04-22 16:42

Summary

Server crashes in Item::walk / Item_field::check_valid_arguments_processor upon ALTER with circular virtual columns

Server hangs or crashes in Item::walk / Item_field::check_valid_arguments_processor upon ALTER with circular virtual columns

Nikita Malyavin made changes - 2023-04-24 18:02

Labels

vital

Julien Fritsch made changes - 2023-04-27 14:48

Fix Version/s

10.8 [ 26121 ]

Aleksey Midenkov made changes - 2023-09-13 13:56

Assignee

Nikita Malyavin [ nikitamalyavin ]

Aleksey Midenkov [ midenok ]

Aleksey Midenkov made changes - 2023-09-13 13:56

Status

Open [ 1 ]

In Progress [ 3 ]

Aleksey Midenkov made changes - 2023-09-13 13:58

Priority

Major [ 3 ]

Critical [ 2 ]

Aleksey Midenkov made changes - 2023-09-14 09:57

Description

*Note:* This is another case when the server log contains nothing at all after the crash, not even an attempt to write a crash report, no 'Killed', nothing.

{code:sql}
--source include/have_partition.inc

CREATE TABLE t (a INT, c INT AS (a));
ALTER TABLE t ALTER COLUMN c DROP DEFAULT;
ALTER TABLE t MODIFY COLUMN a INT AS (c) STORED;

ALTER TABLE t PARTITION BY HASH(c);

# Cleanup
DROP TABLE t;
{code}

{noformat:title=10.3 2743a510}
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000055d860a18f04 in Item::walk (this=0x0, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1702
{noformat}
{noformat}
Thread 1 (Thread 0x7fe92df012c0 (LWP 3948203)):
#0 0x000055d860a18f04 in Item::walk (this=0x0, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1702
#1 0x000055d861469c94 in Item_field::check_valid_arguments_processor (this=0x61d0001a2ca8, bool_arg=0x0) at /src/sql/item.cc:6460
#2 0x000055d860a19097 in Item::walk (this=0x61d0001a2ca8, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1704
#3 0x000055d861469d23 in Item_field::check_valid_arguments_processor (this=0x61d0001a2df8, bool_arg=0x0) at /src/sql/item.cc:6461
...
...
#2953 0x000055d861469d23 in Item_field::check_valid_arguments_processor (this=0x61d0001a3238, bool_arg=0x0) at /src/sql/item.cc:6461
#2954 0x000055d860a19097 in Item::walk (this=0x61d0001a3238, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1704
#2955 0x000055d86184e738 in fix_fields_part_func (thd=0x62a000060208, func_expr=0x61d0001a3238, table=0x7fe92defacc0, is_sub_part=false, is_create_table_ind=true) at /src/sql/sql_partition.cc:901
#2956 0x000055d8618555bb in fix_partition_func (thd=0x62a000060208, table=0x7fe92defacc0, is_create_table_ind=true) at /src/sql/sql_partition.cc:1998
#2957 0x000055d860f85d5e in open_table_from_share (thd=0x62a000060208, share=0x7fe92defa000, alias=0x55d863599740 <empty_clex_str>, db_stat=0, prgflag=1, ha_open_flags=0, outparam=0x7fe92defacc0, is_create_table=true, partitions_to_open=0x0) at /src/sql/table.cc:3614
#2958 0x000055d860ed23aa in create_table_impl (thd=0x62a000060208, orig_db=0x7fe92defc7e0, orig_table_name=0x7fe92defc7f0, db=0x7fe92defc810, table_name=0x7fe92defc840, path=0x7fe92defd03e "./test/#sql-3c3ea4_4", options=..., create_info=0x7fe92defd4f0, alter_info=0x7fe92defd3f0, create_table_mode=-2, is_trans=0x0, key_info=0x7fe92defbb20, key_count=0x7fe92defbab0, frm=0x7fe92defbbc0) at /src/sql/sql_table.cc:5164
#2959 0x000055d860ef453d in mysql_alter_table (thd=0x62a000060208, new_db=0x62a000064918, new_name=0x62a000064d30, create_info=0x7fe92defd4f0, table_list=0x62b000000348, alter_info=0x7fe92defd3f0, order_num=0, order=0x0, ignore=false) at /src/sql/sql_table.cc:10037
#2960 0x000055d86105e96e in Sql_cmd_alter_table::execute (this=0x62b000000d58, thd=0x62a000060208) at /src/sql/sql_alter.cc:512
#2961 0x000055d860caa153 in mysql_execute_command (thd=0x62a000060208) at /src/sql/sql_parse.cc:6076
#2962 0x000055d860cb5f84 in mysql_parse (thd=0x62a000060208, rawbuf=0x62b000000228 "ALTER TABLE t PARTITION BY HASH(c)", length=34, parser_state=0x7fe92deff8f0, is_com_multi=false, is_next_command=false) at /src/sql/sql_parse.cc:7855
#2963 0x000055d860c8d614 in dispatch_command (command=COM_QUERY, thd=0x62a000060208, packet=0x6290000eb209 "ALTER TABLE t PARTITION BY HASH(c)", packet_length=34, is_com_multi=false, is_next_command=false) at /src/sql/sql_parse.cc:1852
#2964 0x000055d860c8a1cc in do_command (thd=0x62a000060208) at /src/sql/sql_parse.cc:1398
#2965 0x000055d86104e258 in do_handle_one_connection (connect=0x608000000ca8) at /src/sql/sql_connect.cc:1404
#2966 0x000055d86104db54 in handle_one_connection (arg=0x608000000ca8) at /src/sql/sql_connect.cc:1309
#2967 0x000055d8625ff62b in pfs_spawn_thread (arg=0x615000004908) at /src/storage/perfschema/pfs.cc:1869
#2968 0x00007fe938ca7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#2969 0x00007fe938d285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
{noformat}

Release builds instead hang on the last ALTER.

Reproducible with at least MyISAM, InnoDB, Aria, on all existing versions, all the way back to first GAs.

h3. Server hangs or crashes in Item::walk / Item_field::check_valid_arguments_processor upon ALTER with circular virtual columns
*Note:* This is another case when the server log contains nothing at all after the crash, not even an attempt to write a crash report, no 'Killed', nothing.

{code:sql}
--source include/have_partition.inc

CREATE TABLE t (a INT, c INT AS (a));
ALTER TABLE t ALTER COLUMN c DROP DEFAULT;
ALTER TABLE t MODIFY COLUMN a INT AS (c) STORED;

ALTER TABLE t PARTITION BY HASH(c);

# Cleanup
DROP TABLE t;
{code}

{noformat:title=10.3 2743a510}
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000055d860a18f04 in Item::walk (this=0x0, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1702
{noformat}
{noformat}
Thread 1 (Thread 0x7fe92df012c0 (LWP 3948203)):
#0 0x000055d860a18f04 in Item::walk (this=0x0, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1702
#1 0x000055d861469c94 in Item_field::check_valid_arguments_processor (this=0x61d0001a2ca8, bool_arg=0x0) at /src/sql/item.cc:6460
#2 0x000055d860a19097 in Item::walk (this=0x61d0001a2ca8, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1704
#3 0x000055d861469d23 in Item_field::check_valid_arguments_processor (this=0x61d0001a2df8, bool_arg=0x0) at /src/sql/item.cc:6461
...
...
#2953 0x000055d861469d23 in Item_field::check_valid_arguments_processor (this=0x61d0001a3238, bool_arg=0x0) at /src/sql/item.cc:6461
#2954 0x000055d860a19097 in Item::walk (this=0x61d0001a3238, processor=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, walk_subquery=false, arg=0x0) at /src/sql/item.h:1704
#2955 0x000055d86184e738 in fix_fields_part_func (thd=0x62a000060208, func_expr=0x61d0001a3238, table=0x7fe92defacc0, is_sub_part=false, is_create_table_ind=true) at /src/sql/sql_partition.cc:901
#2956 0x000055d8618555bb in fix_partition_func (thd=0x62a000060208, table=0x7fe92defacc0, is_create_table_ind=true) at /src/sql/sql_partition.cc:1998
#2957 0x000055d860f85d5e in open_table_from_share (thd=0x62a000060208, share=0x7fe92defa000, alias=0x55d863599740 <empty_clex_str>, db_stat=0, prgflag=1, ha_open_flags=0, outparam=0x7fe92defacc0, is_create_table=true, partitions_to_open=0x0) at /src/sql/table.cc:3614
#2958 0x000055d860ed23aa in create_table_impl (thd=0x62a000060208, orig_db=0x7fe92defc7e0, orig_table_name=0x7fe92defc7f0, db=0x7fe92defc810, table_name=0x7fe92defc840, path=0x7fe92defd03e "./test/#sql-3c3ea4_4", options=..., create_info=0x7fe92defd4f0, alter_info=0x7fe92defd3f0, create_table_mode=-2, is_trans=0x0, key_info=0x7fe92defbb20, key_count=0x7fe92defbab0, frm=0x7fe92defbbc0) at /src/sql/sql_table.cc:5164
#2959 0x000055d860ef453d in mysql_alter_table (thd=0x62a000060208, new_db=0x62a000064918, new_name=0x62a000064d30, create_info=0x7fe92defd4f0, table_list=0x62b000000348, alter_info=0x7fe92defd3f0, order_num=0, order=0x0, ignore=false) at /src/sql/sql_table.cc:10037
#2960 0x000055d86105e96e in Sql_cmd_alter_table::execute (this=0x62b000000d58, thd=0x62a000060208) at /src/sql/sql_alter.cc:512
#2961 0x000055d860caa153 in mysql_execute_command (thd=0x62a000060208) at /src/sql/sql_parse.cc:6076
#2962 0x000055d860cb5f84 in mysql_parse (thd=0x62a000060208, rawbuf=0x62b000000228 "ALTER TABLE t PARTITION BY HASH(c)", length=34, parser_state=0x7fe92deff8f0, is_com_multi=false, is_next_command=false) at /src/sql/sql_parse.cc:7855
#2963 0x000055d860c8d614 in dispatch_command (command=COM_QUERY, thd=0x62a000060208, packet=0x6290000eb209 "ALTER TABLE t PARTITION BY HASH(c)", packet_length=34, is_com_multi=false, is_next_command=false) at /src/sql/sql_parse.cc:1852
#2964 0x000055d860c8a1cc in do_command (thd=0x62a000060208) at /src/sql/sql_parse.cc:1398
#2965 0x000055d86104e258 in do_handle_one_connection (connect=0x608000000ca8) at /src/sql/sql_connect.cc:1404
#2966 0x000055d86104db54 in handle_one_connection (arg=0x608000000ca8) at /src/sql/sql_connect.cc:1309
#2967 0x000055d8625ff62b in pfs_spawn_thread (arg=0x615000004908) at /src/storage/perfschema/pfs.cc:1869
#2968 0x00007fe938ca7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#2969 0x00007fe938d285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
{noformat}

Release builds instead hang on the last ALTER.

Reproducible with at least MyISAM, InnoDB, Aria, on all existing versions, all the way back to first GAs.

Aleksey Midenkov made changes - 2023-09-14 09:59

Summary

Server hangs or crashes in Item::walk / Item_field::check_valid_arguments_processor upon ALTER with circular virtual columns

vcol circular references lead to stack overflow

Aleksey Midenkov added a comment - 2023-09-14 14:40

Please review bb-10.4-midenok

Aleksey Midenkov added a comment - 2023-09-14 14:40 Please review bb-10.4-midenok

Aleksey Midenkov made changes - 2023-09-14 14:40

Assignee	Aleksey Midenkov [ midenok ]	Nikita Malyavin [ nikitamalyavin ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Sergei Golubchik made changes - 2023-10-17 10:29

Assignee

Nikita Malyavin [ nikitamalyavin ]

Sergei Golubchik [ serg ]

Sergei Golubchik added a comment - 2023-10-21 14:35 - edited

~~This is already fixed in 10.5 (in ~~MDEV-18114~~)~~
No, sorry, it's not. The test case from the commit is fixed in 10.5, the original test case from the bug report is not fixed.

Besides, we can never add new error messages in 10.4.

Sergei Golubchik added a comment - 2023-10-21 14:35 - edited This is already fixed in 10.5 (in MDEV-18114 ) No, sorry, it's not. The test case from the commit is fixed in 10.5, the original test case from the bug report is not fixed. Besides, we can never add new error messages in 10.4.

Sergei Golubchik made changes - 2023-10-21 14:35

Assignee	Sergei Golubchik [ serg ]	Aleksey Midenkov [ midenok ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Sergei Golubchik made changes - 2023-10-21 14:36

Fix Version/s		10.5.22 [ 29011 ]
Fix Version/s	10.4 [ 22408 ]
Fix Version/s	10.5 [ 23123 ]
Fix Version/s	10.6 [ 24028 ]
Fix Version/s	10.9 [ 26905 ]
Fix Version/s	10.10 [ 27530 ]
Fix Version/s	10.11 [ 27614 ]
Fix Version/s	11.0 [ 28320 ]
Assignee	Aleksey Midenkov [ midenok ]	Sergei Golubchik [ serg ]
Resolution		Duplicate [ 3 ]
Status	Stalled [ 10000 ]	Closed [ 6 ]

Sergei Golubchik made changes - 2023-10-21 14:37

Link

This issue is part of ~~MDEV-18114~~ [ ~~MDEV-18114~~ ]

Sergei Golubchik made changes - 2023-10-21 14:37

Fix Version/s		10.11.5 [ 29019 ]
Fix Version/s		10.10.6 [ 29017 ]
Fix Version/s		10.9.8 [ 29015 ]
Fix Version/s		10.6.15 [ 29013 ]

Sergei Golubchik made changes - 2023-10-21 14:38

Resolution	Duplicate [ 3 ]
Status	Closed [ 6 ]	Stalled [ 10000 ]

Sergei Golubchik made changes - 2023-10-21 14:40

Fix Version/s		10.5 [ 23123 ]
Fix Version/s		10.6 [ 24028 ]
Fix Version/s		10.10 [ 27530 ]
Fix Version/s		10.11 [ 27614 ]
Fix Version/s	10.5.22 [ 29011 ]
Fix Version/s	10.6.15 [ 29013 ]
Fix Version/s	10.9.8 [ 29015 ]
Fix Version/s	10.10.6 [ 29017 ]
Fix Version/s	10.11.5 [ 29019 ]

Sergei Golubchik made changes - 2023-10-21 14:40

Labels

vital

Sergei Golubchik made changes - 2023-10-21 14:41

Link

This issue relates to ~~MDEV-18114~~ [ ~~MDEV-18114~~ ]

Sergei Golubchik made changes - 2023-10-21 14:41

Link

This issue is part of ~~MDEV-18114~~ [ ~~MDEV-18114~~ ]

Sergei Golubchik added a comment - 2023-10-21 15:13 - edited

The crash in the original test case is caused by the flowed logic in Item_field::check_field_expression_processor. The comment there says "We don't have to check fields that are marked as NO_DEFAULT_VALUE as the upper level will ensure that all these will be given a value." It is only true for non-generated fields. So the fix is simply

--- a/sql/item.cc

+++ b/sql/item.cc

@@ -938,7 +938,7 @@ bool Item_field::register_field_in_write_map(void *arg)

 bool Item_field::check_field_expression_processor(void *arg)

   Field *org_field= (Field*) arg;

-  if (field->flags & NO_DEFAULT_VALUE_FLAG)

+  if (field->flags & NO_DEFAULT_VALUE_FLAG && !field->vcol_info)

     return 0;

   if ((field->default_value && field->default_value->flags) || field->vcol_info)

Sergei Golubchik added a comment - 2023-10-21 15:13 - edited The crash in the original test case is caused by the flowed logic in Item_field::check_field_expression_processor . The comment there says "We don't have to check fields that are marked as NO_DEFAULT_VALUE as the upper level will ensure that all these will be given a value." It is only true for non-generated fields. So the fix is simply --- a/sql/item.cc +++ b/sql/item.cc @@ -938,7 +938,7 @@ bool Item_field::register_field_in_write_map(void *arg) bool Item_field::check_field_expression_processor(void *arg) { Field *org_field= (Field*) arg; - if (field->flags & NO_DEFAULT_VALUE_FLAG) + if (field->flags & NO_DEFAULT_VALUE_FLAG && !field->vcol_info) return 0; if ((field->default_value && field->default_value->flags) || field->vcol_info) {

Sergei Golubchik made changes - 2023-10-21 15:14

Status

Stalled [ 10000 ]

In Testing [ 10301 ]

Sergei Golubchik made changes - 2023-10-23 17:34

Fix Version/s		10.5.23 [ 29012 ]
Fix Version/s		10.6.16 [ 29014 ]
Fix Version/s		10.10.7 [ 29018 ]
Fix Version/s		10.11.6 [ 29020 ]
Fix Version/s		11.0.4 [ 29021 ]
Fix Version/s		11.1.3 [ 29023 ]
Fix Version/s	10.5 [ 23123 ]
Fix Version/s	10.6 [ 24028 ]
Fix Version/s	10.10 [ 27530 ]
Fix Version/s	10.11 [ 27614 ]
Resolution		Fixed [ 1 ]
Status	In Testing [ 10301 ]	Closed [ 6 ]

People

Assignee:: Sergei Golubchik

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2023-04-22 16:40

Updated:: 2023-10-23 17:34

Resolved:: 2023-10-23 17:34

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Server hangs or crashes in Item::walk / Item_field::check_valid_arguments_processor upon ALTER with circular virtual columns

Attachments

Issue Links

Activity

People

Dates

Git Integration