Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32304

Pushdown: server crashes at Item_field::used_tables()

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 11.1.2, 11.2.1, 10.4(EOL), 10.5, 10.6, 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL)
    • 10.5.26, 10.6.19, 10.11.9, 11.1.6, 11.2.5, 11.4.3
    • Optimizer
    • None
    • Ubuntu 20.04 x86-64, docker image mariadb:11.1.2

    Description

      PoC:

      SELECT 
      ( WITH x AS 
        ( ( SELECT * 
            FROM ( SELECT 1 x ) x 
            GROUP BY x HAVING x = ( x IS NULL OR x IS NULL ) ) ) ( SELECT 1.000000 FROM x ) ) ;

      docker log:

      mariadbd(my_print_stacktrace+0x32)[0x55edfcfaa7c2]
      		 
      mariadbd(handle_fatal_signal+0x488)[0x55edfca83cf8]
      		 
      /lib/x86_64-linux-gnu/libc.so.6(+0x42520)[0x7f02a678b520]
      		 
      mariadbd(_ZNK10Item_field11used_tablesEv+0xb)[0x55edfcab1d5b]
      		 
      mariadbd(+0xaba703)[0x55edfca98703]
      		 
      mariadbd(_ZN10Item_field35derived_field_transformer_for_whereEP3THDPh+0x1a)[0x55edfca987ea]
      		 
      mariadbd(_ZN9Item_args14transform_argsEP3THDM4ItemFPS2_S1_PhES4_+0xb5)[0x55edfcafae65]
      		 
      mariadbd(_ZN9Item_func9transformEP3THDM4ItemFPS2_S1_PhES4_+0x2d)[0x55edfcafaecd]
      		 
      mariadbd(_ZN9Item_cond12do_transformEP3THDM4ItemFPS2_S1_PhES4_b+0xd6)[0x55edfcaceb36]
      		 
      mariadbd(_ZN9Item_args14transform_argsEP3THDM4ItemFPS2_S1_PhES4_+0xb5)[0x55edfcafae65]
      		 
      mariadbd(_ZN9Item_func9transformEP3THDM4ItemFPS2_S1_PhES4_+0x2d)[0x55edfcafaecd]
      		 
      mariadbd(_Z27transform_condition_or_partP3THDP4ItemMS1_FS2_S0_PhES3_+0x169)[0x55edfc7ca939]
      		 
      mariadbd(_ZN13st_select_lex31pushdown_cond_into_where_clauseEP3THDP4ItemPS3_MS2_FS3_S1_PhES5_+0x135)[0x55edfc7f9155]
      		 
      mariadbd(_Z25pushdown_cond_for_derivedP3THDP4ItemP10TABLE_LIST+0x24f)[0x55edfc7cabef]
      		 
      mariadbd(_ZN4JOIN14optimize_innerEv+0xb06)[0x55edfc88ffc6]
      		 
      mariadbd(_ZN4JOIN8optimizeEv+0xda)[0x55edfc890e2a]
      		 
      mariadbd(+0x7ec60c)[0x55edfc7ca60c]
      		 
      mariadbd(_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj+0x95)[0x55edfc7c9e35]
      		 
      mariadbd(_ZN4JOIN14optimize_innerEv+0xb27)[0x55edfc88ffe7]
      		 
      mariadbd(_ZN4JOIN8optimizeEv+0xda)[0x55edfc890e2a]
      		 
      mariadbd(_ZN13st_select_lex31optimize_unflattened_subqueriesEb+0x115)[0x55edfc7eaa55]
      		 
      mariadbd(_ZN4JOIN28optimize_constant_subqueriesEv+0x35)[0x55edfc989d55]
      		 
      mariadbd(_ZN4JOIN14optimize_innerEv+0x503)[0x55edfc88f9c3]
      		 
      mariadbd(_ZN4JOIN8optimizeEv+0xda)[0x55edfc890e2a]
      		 
      mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0xd1)[0x55edfc890f21]
      		 
      mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0x154)[0x55edfc891774]
      		 
      mariadbd(+0x826f55)[0x55edfc804f55]
      		 
      mariadbd(_Z21mysql_execute_commandP3THDb+0x419e)[0x55edfc813f0e]
      		 
      mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x1e7)[0x55edfc815237]
      		 
      mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x14bd)[0x55edfc817a1d]
      		 
      mariadbd(_Z10do_commandP3THDb+0x138)[0x55edfc819818]
      		 
      mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x3bf)[0x55edfc9413af]
      		 
      mariadbd(handle_one_connection+0x5d)[0x55edfc9416fd]
      		 
      mariadbd(+0xcd1906)[0x55edfccaf906]
      		 
      /lib/x86_64-linux-gnu/libc.so.6(+0x94b43)[0x7f02a67ddb43]
      		 
      /lib/x86_64-linux-gnu/libc.so.6(clone+0x44)[0x7f02a686ebb4]
      		 
       
      		 
      Trying to get some variables.
      		 
      Some pointers may be invalid and cause the dump to abort.
      		 
      Query (0x7f02440130d8): SELECT ( WITH x AS ( ( SELECT * FROM ( SELECT 1 x ) x GROUP BY x HAVING x = ( x IS NULL OR x IS NULL ) ) ) ( SELECT 1.000000 FROM x ) )

      Attachments

        Issue Links

          is part of

          Bug - A problem which impairs or prevents the functions of the product. MDEV-29363 Constant subquery causing a crash in pushdown optimization

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-31007 Assertion `item->type() == Item::FIELD_ITEM || (item->type() == Item::REF_ITEM && ((Item_ref *) item)->ref_type() == Item_ref::VIEW_REF)' failed in find_producing_item

          • Major - Major loss of function.
          • Confirmed

          Activity

            People

              shagalla Galina Shalygina (Inactive)
              fuboat Jingzhou Fu
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.