Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-31418

One SQL query crashes the server

Details

    Description

      Hi,

      We're starting to work on a MariaDB 5.5 => 10.11 upgrade. Our current 5.5 server is still in production and I have setup a test VM with 10.11 to test our code. One of our queries crashes the server. The issue has been reproduced on a our VM at first, but also on a fresh docker instance.

      Attached is a file with the tables definitions and the query. It has been reproduced succesfully even with empty tables.

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-31240 Crash with condition pushable into derived and containing outer reference

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            elenst Elena Stepanova added a comment -

            Thanks for the report, reproducible as described.
            The problem was fixed in the scope of MDEV-31240 by the same patch. Releases with the fix should be out very soon.

            #3  <signal handler called>
            		 
            #4  0x0000559f67af99d7 in st_join_table::choose_best_splitting (this=0x62900028b0b8, idx=0, remaining_tables=1, spl_pd_boundary=0x7fb53eb62d00) at /data/src/bb-10.4-release/sql/opt_split.cc:1049
            		 
            #5  0x0000559f6760e8e5 in best_access_path (join=0x62900026a408, s=0x62900028b0b8, remaining_tables=1, join_positions=0x62900028b670, idx=0, disable_jbuf=true, record_count=1, pos=0x62900028b670, loose_scan_pos=0x7fb53eb63140) at /data/src/bb-10.4-release/sql/sql_select.cc:7453
            		 
            #6  0x0000559f6761b9d5 in best_extension_by_limited_search (join=0x62900026a408, remaining_tables=1, idx=0, record_count=1, read_time=0, search_depth=62, prune_level=1, use_cond_selectivity=4) at /data/src/bb-10.4-release/sql/sql_select.cc:9763
            		 
            #7  0x0000559f6761780a in greedy_search (join=0x62900026a408, remaining_tables=1, search_depth=62, prune_level=1, use_cond_selectivity=4) at /data/src/bb-10.4-release/sql/sql_select.cc:8933
            		 
            #8  0x0000559f67615596 in choose_plan (join=0x62900026a408, join_tables=1) at /data/src/bb-10.4-release/sql/sql_select.cc:8495
            		 
            #9  0x0000559f67600bd3 in make_join_statistics (join=0x62900026a408, tables_list=..., keyuse_array=0x62900026a6f8) at /data/src/bb-10.4-release/sql/sql_select.cc:5696
            		 
            #10 0x0000559f675ddd26 in JOIN::optimize_inner (this=0x62900026a408) at /data/src/bb-10.4-release/sql/sql_select.cc:2347
            		 
            #11 0x0000559f675d6cdd in JOIN::optimize (this=0x62900026a408) at /data/src/bb-10.4-release/sql/sql_select.cc:1690
            		 
            #12 0x0000559f674b4e6a in st_select_lex::optimize_unflattened_subqueries (this=0x62b0000a1b90, const_only=false) at /data/src/bb-10.4-release/sql/sql_lex.cc:4236
            		 
            #13 0x0000559f67a10fed in JOIN::optimize_unflattened_subqueries (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/opt_subselect.cc:5601
            		 
            #14 0x0000559f675e40ca in JOIN::optimize_stage2 (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/sql_select.cc:2921
            		 
            #15 0x0000559f675de03f in JOIN::optimize_inner (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/sql_select.cc:2373
            		 
            #16 0x0000559f675d6cdd in JOIN::optimize (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/sql_select.cc:1690
            		 
            #17 0x0000559f675f7d4f in mysql_select (thd=0x62b00009a208, tables=0x6290002645a8, wild_num=0, fields=..., conds=0x6290002675d8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2214857472, result=0x629000268270, unit=0x62b00009e140, select_lex=0x62b0000a1b90) at /data/src/bb-10.4-release/sql/sql_select.cc:4797
            		 
            #18 0x0000559f675c8a9d in handle_select (thd=0x62b00009a208, lex=0x62b00009e080, result=0x629000268270, setup_tables_done_option=0) at /data/src/bb-10.4-release/sql/sql_select.cc:442
            		 
            #19 0x0000559f67538627 in execute_sqlcom_select (thd=0x62b00009a208, all_tables=0x6290002645a8) at /data/src/bb-10.4-release/sql/sql_parse.cc:6463
            		 
            #20 0x0000559f67525b3c in mysql_execute_command (thd=0x62b00009a208) at /data/src/bb-10.4-release/sql/sql_parse.cc:3966
            		 
            #21 0x0000559f675417ff in mysql_parse (thd=0x62b00009a208, rawbuf=0x62b0000a1228 "SET STATEMENT SQL_SELECT_LIMIT=501 FOR SELECT a.utilisateur_id, a.nom, a.prenom, a.nom_utilisateur, a.titre, a.courriel, a.telephone, a.reinitialiser_mot_passe, a.statut, a.type, a.activation_token, a"..., length=989, parser_state=0x7fb53eb668b0, is_com_multi=false, is_next_command=false) at /data/src/bb-10.4-release/sql/sql_parse.cc:7998
            		 
            #22 0x0000559f67517cab in dispatch_command (command=COM_QUERY, thd=0x62b00009a208, packet=0x62900025d209 "SET STATEMENT SQL_SELECT_LIMIT=501 FOR SELECT a.utilisateur_id, a.nom, a.prenom, a.nom_utilisateur, a.titre, a.courriel, a.telephone, a.reinitialiser_mot_passe, a.statut, a.type, a.activation_token, a"..., packet_length=989, is_com_multi=false, is_next_command=false) at /data/src/bb-10.4-release/sql/sql_parse.cc:1857
            		 
            #23 0x0000559f67514824 in do_command (thd=0x62b00009a208) at /data/src/bb-10.4-release/sql/sql_parse.cc:1378
            		 
            #24 0x0000559f67912c60 in do_handle_one_connection (connect=0x608000000e28) at /data/src/bb-10.4-release/sql/sql_connect.cc:1420
            		 
            #25 0x0000559f67912577 in handle_one_connection (arg=0x608000000e28) at /data/src/bb-10.4-release/sql/sql_connect.cc:1324
            		 
            #26 0x00007fb55f5c8fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
            		 
            #27 0x00007fb55f6495bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

            elenst Elena Stepanova added a comment - Thanks for the report, reproducible as described. The problem was fixed in the scope of MDEV-31240 by the same patch. Releases with the fix should be out very soon. #3 <signal handler called> #4 0x0000559f67af99d7 in st_join_table::choose_best_splitting (this=0x62900028b0b8, idx=0, remaining_tables=1, spl_pd_boundary=0x7fb53eb62d00) at /data/src/bb-10.4-release/sql/opt_split.cc:1049 #5 0x0000559f6760e8e5 in best_access_path (join=0x62900026a408, s=0x62900028b0b8, remaining_tables=1, join_positions=0x62900028b670, idx=0, disable_jbuf=true, record_count=1, pos=0x62900028b670, loose_scan_pos=0x7fb53eb63140) at /data/src/bb-10.4-release/sql/sql_select.cc:7453 #6 0x0000559f6761b9d5 in best_extension_by_limited_search (join=0x62900026a408, remaining_tables=1, idx=0, record_count=1, read_time=0, search_depth=62, prune_level=1, use_cond_selectivity=4) at /data/src/bb-10.4-release/sql/sql_select.cc:9763 #7 0x0000559f6761780a in greedy_search (join=0x62900026a408, remaining_tables=1, search_depth=62, prune_level=1, use_cond_selectivity=4) at /data/src/bb-10.4-release/sql/sql_select.cc:8933 #8 0x0000559f67615596 in choose_plan (join=0x62900026a408, join_tables=1) at /data/src/bb-10.4-release/sql/sql_select.cc:8495 #9 0x0000559f67600bd3 in make_join_statistics (join=0x62900026a408, tables_list=..., keyuse_array=0x62900026a6f8) at /data/src/bb-10.4-release/sql/sql_select.cc:5696 #10 0x0000559f675ddd26 in JOIN::optimize_inner (this=0x62900026a408) at /data/src/bb-10.4-release/sql/sql_select.cc:2347 #11 0x0000559f675d6cdd in JOIN::optimize (this=0x62900026a408) at /data/src/bb-10.4-release/sql/sql_select.cc:1690 #12 0x0000559f674b4e6a in st_select_lex::optimize_unflattened_subqueries (this=0x62b0000a1b90, const_only=false) at /data/src/bb-10.4-release/sql/sql_lex.cc:4236 #13 0x0000559f67a10fed in JOIN::optimize_unflattened_subqueries (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/opt_subselect.cc:5601 #14 0x0000559f675e40ca in JOIN::optimize_stage2 (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/sql_select.cc:2921 #15 0x0000559f675de03f in JOIN::optimize_inner (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/sql_select.cc:2373 #16 0x0000559f675d6cdd in JOIN::optimize (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/sql_select.cc:1690 #17 0x0000559f675f7d4f in mysql_select (thd=0x62b00009a208, tables=0x6290002645a8, wild_num=0, fields=..., conds=0x6290002675d8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2214857472, result=0x629000268270, unit=0x62b00009e140, select_lex=0x62b0000a1b90) at /data/src/bb-10.4-release/sql/sql_select.cc:4797 #18 0x0000559f675c8a9d in handle_select (thd=0x62b00009a208, lex=0x62b00009e080, result=0x629000268270, setup_tables_done_option=0) at /data/src/bb-10.4-release/sql/sql_select.cc:442 #19 0x0000559f67538627 in execute_sqlcom_select (thd=0x62b00009a208, all_tables=0x6290002645a8) at /data/src/bb-10.4-release/sql/sql_parse.cc:6463 #20 0x0000559f67525b3c in mysql_execute_command (thd=0x62b00009a208) at /data/src/bb-10.4-release/sql/sql_parse.cc:3966 #21 0x0000559f675417ff in mysql_parse (thd=0x62b00009a208, rawbuf=0x62b0000a1228 "SET STATEMENT SQL_SELECT_LIMIT=501 FOR SELECT a.utilisateur_id, a.nom, a.prenom, a.nom_utilisateur, a.titre, a.courriel, a.telephone, a.reinitialiser_mot_passe, a.statut, a.type, a.activation_token, a"..., length=989, parser_state=0x7fb53eb668b0, is_com_multi=false, is_next_command=false) at /data/src/bb-10.4-release/sql/sql_parse.cc:7998 #22 0x0000559f67517cab in dispatch_command (command=COM_QUERY, thd=0x62b00009a208, packet=0x62900025d209 "SET STATEMENT SQL_SELECT_LIMIT=501 FOR SELECT a.utilisateur_id, a.nom, a.prenom, a.nom_utilisateur, a.titre, a.courriel, a.telephone, a.reinitialiser_mot_passe, a.statut, a.type, a.activation_token, a"..., packet_length=989, is_com_multi=false, is_next_command=false) at /data/src/bb-10.4-release/sql/sql_parse.cc:1857 #23 0x0000559f67514824 in do_command (thd=0x62b00009a208) at /data/src/bb-10.4-release/sql/sql_parse.cc:1378 #24 0x0000559f67912c60 in do_handle_one_connection (connect=0x608000000e28) at /data/src/bb-10.4-release/sql/sql_connect.cc:1420 #25 0x0000559f67912577 in handle_one_connection (arg=0x608000000e28) at /data/src/bb-10.4-release/sql/sql_connect.cc:1324 #26 0x00007fb55f5c8fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 #27 0x00007fb55f6495bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
            ubellavance@attestra.com Ugo Bellavance added a comment -

            Thanks a lot, I'm sorry: I didn't even think about searching if an existing Jira existed.

            We have another query that crashes the server. How to know if it's that bug?

            Stack trace: 

            stack_bottom = 0x7f3e0c0b2bd8 thread_stack 0x40000
            		 
            /usr/sbin/mariadbd(my_print_stacktrace+0x2e)[0x55bf7afbdd6e]
            		 
            /usr/sbin/mariadbd(handle_fatal_signal+0x485)[0x55bf7aab2445]
            		 
            /lib64/libpthread.so.0(+0x12cf0)[0x7f4438d60cf0]
            		 
            /usr/sbin/mariadbd(_ZN13st_join_table21choose_best_splittingEjyPy+0x539)[0x55bf7aa2e909]
            		 
            /usr/sbin/mariadbd(_Z16best_access_pathP4JOINP13st_join_tableyPK8POSITIONjbdPS3_S6_+0x169)[0x55bf7a8b8b39]
            		 
            /usr/sbin/mariadbd(+0x83b4fb)[0x55bf7a8bc4fb]
            		 
            /usr/sbin/mariadbd(+0x83f4cb)[0x55bf7a8c04cb]
            		 
            /usr/sbin/mariadbd(_Z11choose_planP4JOINy+0x306)[0x55bf7a8c1836]
            		 
            /usr/sbin/mariadbd(_ZN4JOIN14optimize_innerEv+0x3846)[0x55bf7a8e75f6]
            		 
            /usr/sbin/mariadbd(_ZN4JOIN8optimizeEv+0xa0)[0x55bf7a8e7be0]
            		 
            /usr/sbin/mariadbd(_ZN13st_select_lex31optimize_unflattened_subqueriesEb+0x10e)[0x55bf7a85213e]
            		 
            /usr/sbin/mariadbd(_ZN4JOIN15optimize_stage2Ev+0x1bd5)[0x55bf7a8e2f85]
            		 
            /usr/sbin/mariadbd(_ZN4JOIN14optimize_innerEv+0x2651)[0x55bf7a8e6401]
            		 
            /usr/sbin/mariadbd(_ZN4JOIN8optimizeEv+0xa0)[0x55bf7a8e7be0]
            		 
            /usr/sbin/mariadbd(+0x7b29b9)[0x55bf7a8339b9]
            		 
            /usr/sbin/mariadbd(_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj+0x99)[0x55bf7a8331e9]
            		 
            /usr/sbin/mariadbd(_ZN4JOIN14optimize_innerEv+0xdac)[0x55bf7a8e4b5c]
            		 
            /usr/sbin/mariadbd(_ZN4JOIN8optimizeEv+0xa0)[0x55bf7a8e7be0]
            		 
            /usr/sbin/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0xce)[0x55bf7a8e7cce]
            		 
            /usr/sbin/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0x14b)[0x55bf7a8e84ab]
            		 
            /usr/sbin/mariadbd(+0x7eef83)[0x55bf7a86ff83]
            		 
            /usr/sbin/mariadbd(_Z21mysql_execute_commandP3THDb+0x1244)[0x55bf7a878408]
            		 
            /usr/sbin/mariadbd(_ZN18Prepared_statement7executeEP6Stringb+0x3df)[0x55bf7a89a0df]
            		 
            /usr/sbin/mariadbd(_ZN18Prepared_statement12execute_loopEP6StringbPhS2_+0x9d)[0x55bf7a89a39d]
            		 
            /usr/sbin/mariadbd(+0x81a295)[0x55bf7a89b295]
            		 
            /usr/sbin/mariadbd(_Z19mysqld_stmt_executeP3THDPcj+0x2b)[0x55bf7a89b43b]
            		 
            /usr/sbin/mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x13ed)[0x55bf7a8752b9]
            		 
            /usr/sbin/mariadbd(_Z10do_commandP3THDb+0x12f)[0x55bf7a876612]
            		 
            /usr/sbin/mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x3f7)[0x55bf7a98add7]
            		 
            /usr/sbin/mariadbd(handle_one_connection+0x5d)[0x55bf7a98b11d]
            		 
            /usr/sbin/mariadbd(+0xc4233d)[0x55bf7acc333d]
            		 
            /lib64/libpthread.so.0(+0x81ca)[0x7f4438d561ca]
            		 
            /lib64/libc.so.6(clone+0x43)[0x7f44380a7e73]

            ubellavance@attestra.com Ugo Bellavance added a comment - Thanks a lot, I'm sorry: I didn't even think about searching if an existing Jira existed. We have another query that crashes the server. How to know if it's that bug? Stack trace: stack_bottom = 0x7f3e0c0b2bd8 thread_stack 0x40000 /usr/sbin/mariadbd(my_print_stacktrace+0x2e)[0x55bf7afbdd6e] /usr/sbin/mariadbd(handle_fatal_signal+0x485)[0x55bf7aab2445] /lib64/libpthread.so.0(+0x12cf0)[0x7f4438d60cf0] /usr/sbin/mariadbd(_ZN13st_join_table21choose_best_splittingEjyPy+0x539)[0x55bf7aa2e909] /usr/sbin/mariadbd(_Z16best_access_pathP4JOINP13st_join_tableyPK8POSITIONjbdPS3_S6_+0x169)[0x55bf7a8b8b39] /usr/sbin/mariadbd(+0x83b4fb)[0x55bf7a8bc4fb] /usr/sbin/mariadbd(+0x83f4cb)[0x55bf7a8c04cb] /usr/sbin/mariadbd(_Z11choose_planP4JOINy+0x306)[0x55bf7a8c1836] /usr/sbin/mariadbd(_ZN4JOIN14optimize_innerEv+0x3846)[0x55bf7a8e75f6] /usr/sbin/mariadbd(_ZN4JOIN8optimizeEv+0xa0)[0x55bf7a8e7be0] /usr/sbin/mariadbd(_ZN13st_select_lex31optimize_unflattened_subqueriesEb+0x10e)[0x55bf7a85213e] /usr/sbin/mariadbd(_ZN4JOIN15optimize_stage2Ev+0x1bd5)[0x55bf7a8e2f85] /usr/sbin/mariadbd(_ZN4JOIN14optimize_innerEv+0x2651)[0x55bf7a8e6401] /usr/sbin/mariadbd(_ZN4JOIN8optimizeEv+0xa0)[0x55bf7a8e7be0] /usr/sbin/mariadbd(+0x7b29b9)[0x55bf7a8339b9] /usr/sbin/mariadbd(_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj+0x99)[0x55bf7a8331e9] /usr/sbin/mariadbd(_ZN4JOIN14optimize_innerEv+0xdac)[0x55bf7a8e4b5c] /usr/sbin/mariadbd(_ZN4JOIN8optimizeEv+0xa0)[0x55bf7a8e7be0] /usr/sbin/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0xce)[0x55bf7a8e7cce] /usr/sbin/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0x14b)[0x55bf7a8e84ab] /usr/sbin/mariadbd(+0x7eef83)[0x55bf7a86ff83] /usr/sbin/mariadbd(_Z21mysql_execute_commandP3THDb+0x1244)[0x55bf7a878408] /usr/sbin/mariadbd(_ZN18Prepared_statement7executeEP6Stringb+0x3df)[0x55bf7a89a0df] /usr/sbin/mariadbd(_ZN18Prepared_statement12execute_loopEP6StringbPhS2_+0x9d)[0x55bf7a89a39d] /usr/sbin/mariadbd(+0x81a295)[0x55bf7a89b295] /usr/sbin/mariadbd(_Z19mysqld_stmt_executeP3THDPcj+0x2b)[0x55bf7a89b43b] /usr/sbin/mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x13ed)[0x55bf7a8752b9] /usr/sbin/mariadbd(_Z10do_commandP3THDb+0x12f)[0x55bf7a876612] /usr/sbin/mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x3f7)[0x55bf7a98add7] /usr/sbin/mariadbd(handle_one_connection+0x5d)[0x55bf7a98b11d] /usr/sbin/mariadbd(+0xc4233d)[0x55bf7acc333d] /lib64/libpthread.so.0(+0x81ca)[0x7f4438d561ca] /lib64/libc.so.6(clone+0x43)[0x7f44380a7e73]
            ubellavance@attestra.com Ugo Bellavance added a comment -

            When I use the workaround optimizer_switch="split_materialized=off", both queries return w/o crashing. Does that mean that the patch would fix the issue for both requests?

            ubellavance@attestra.com Ugo Bellavance added a comment - When I use the workaround optimizer_switch="split_materialized=off", both queries return w/o crashing. Does that mean that the patch would fix the issue for both requests?

            People

              Unassigned Unassigned
              ubellavance@attestra.com Ugo Bellavance
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.