Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32394

init_expr_cache_tracker: SEGV at /mariadb-11.3.0/sql/item_subselect.cc:7069

Details

    • Bug
    • Status: Confirmed (View Workflow)
    • Major
    • Resolution: Unresolved
    • 11.3.0, 10.4(EOL), 10.5, 10.6, 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL)
    • 10.5, 10.6, 10.11
    • Optimizer, Server
    • None
    • Ubuntu 20.04

    Description

      Run these queries in release build:

      CREATE TABLE t0 ( c27 TEXT , INDEX i0 ( c27 ( 28 ) ) ) ;
      INSERT INTO t0 VALUES ( 44 ) , ( -111 ) ;
      ALTER TABLE t0 ADD COLUMN c60 INT AFTER c27 ;
      INSERT INTO t0 VALUES ( -9 , 122 ) , ( -119 , -59 ) ;
      SELECT t2 . c41 AS c58 FROM ( SELECT ~ SIGN ( SUBSTRING( c60 , 1 NOT BETWEEN 72 AND 26 IS NOT NULL , EXISTS ( SELECT t1 . c16 NOT IN ( TRIM( LEADING FROM t0 . c60 ) ) = + FLOOR ( c60 ) AS c40 FROM ( SELECT CASE c27 WHEN 'W{uBaX$lwk~r;Y7)1 Aqctw~c"Xk;.u1@=>@~ce
      FslVdC<bzOg&' THEN 114 ELSE -61 END IS TRUE AS c16 FROM t0 ) AS t1 ) ) - ASCII ( c27 ) IS NOT NULL ) AS c41 FROM t0 ) AS t2 JOIN t0 ON t0 . c27 = t0 . c27 IN ( SELECT c60 AS c53 FROM t0 GROUP BY c60 , c60 , c41 WITH ROLLUP ) ;

      Will trigger Segmentation fault.
      GDB info:
      Thread 16 "mariadbd" received signal SIGSEGV, Segmentation fault.
      [Switching to Thread 0x7fffd242e300 (LWP 2659)]
      0x00000000015bd63c in Item_subselect::init_expr_cache_tracker (this=<optimized out>, thd=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:7069
      7069 Explain_node *node= qw->get_node(unit->first_select()->select_number);

      #0 0x00000000015bd63c in Item_subselect::init_expr_cache_tracker (this=<optimized out>, thd=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:7069
      #1 Item_exists_subselect::expr_cache_insert_transformer (this=<optimized out>, tmp_thd=<optimized out>, unused=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1803
      #2 0x000000000145a403 in Item_args::transform_args (this=0x6290000b0490, thd=0x62b00016c218, transformer=<optimized out>, arg=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:473
      #3 Item_func::transform (this=0x6290000b0418, thd=0x62b00016c218, transformer=<optimized out>, argument=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:509
      #4 0x000000000145a403 in Item_args::transform_args (this=0x6290000b07a0, thd=0x62b00016c218, transformer=<optimized out>, arg=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:473
      #5 Item_func::transform (this=0x6290000b0728, thd=0x62b00016c218, transformer=<optimized out>, argument=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:509
      #6 0x000000000145a403 in Item_args::transform_args (this=0x6290000b0868, thd=0x62b00016c218, transformer=<optimized out>, arg=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:473
      #7 Item_func::transform (this=0x6290000b07f0, thd=0x62b00016c218, transformer=<optimized out>, argument=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:509
      #8 0x000000000145a403 in Item_args::transform_args (this=0x6290000b0a68, thd=0x62b00016c218, transformer=<optimized out>, arg=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:473
      #9 Item_func::transform (this=0x6290000b09f0, thd=0x62b00016c218, transformer=<optimized out>, argument=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:509
      #10 0x000000000145a403 in Item_args::transform_args (this=0x6290000b0b20, thd=0x62b00016c218, transformer=<optimized out>, arg=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:473
      #11 Item_func::transform (this=0x6290000b0aa8, thd=0x62b00016c218, transformer=<optimized out>, argument=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:509
      #12 0x000000000136464d in Item_ref::transform (this=0x6290000bb8c0, thd=0x62b00016c218, transformer=&virtual Item::set_type_maybe_null(bool), arg=0x2d <error: Cannot access memory at address 0x2d>) at /home/wx/mariadb-11.3.0/sql/item.cc:8323
      #13 0x0000000000c2cca8 in JOIN::setup_subquery_caches (this=<optimized out>, this@entry=0x6290000b6f50) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4437
      #14 0x0000000000c085fe in JOIN::optimize_stage2 (this=0x6290000b6f50) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:3235
      #15 0x0000000000c13911 in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
      #16 0x0000000000bfc156 in JOIN::optimize (this=this@entry=0x6290000b6f50) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
      #17 0x0000000000be4fdf in mysql_select (thd=<optimized out>, thd@entry=0x62b00016c218, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x6290000b6f20, unit=0x62b0001704a8, select_lex=0x629000091678) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
      #18 0x0000000000be4596 in handle_select (thd=thd@entry=0x62b00016c218, lex=<optimized out>, lex@entry=0x62b0001703c8, result=<optimized out>, result@entry=0x6290000b6f20, setup_tables_done_option=<optimized out>, setup_tables_done_option@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
      #19 0x0000000000b3df18 in execute_sqlcom_select (thd=0x62b00016c218, all_tables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
      #20 0x0000000000b2cd51 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
      #21 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd242ca80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
      #22 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
      #23 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
      #24 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
      #25 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x60800145c2b8) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
      #26 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000006618) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
      #27 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
      #28 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-26047 MariaDB server crash at Item_subselect::init_expr_cache_tracker

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-28614 Server crash in item_subselect.cc:6898 in Item_subselect::init_expr_cache_tracker(THD*)

          • Major - Major loss of function.
          • Stalled

          Activity

            alice Alice Sherepa added a comment -

            Thank you!
            I repeated on 10.4-11.2:

            CREATE TABLE t0 ( a text , b int);
            		 
            INSERT INTO t0 VALUES ('44',NULL),('-111',NULL),('-9',122),('-119',-59);
            		 
             
            		 
            SELECT t2.x  FROM 
            ( SELECT  EXISTS ( SELECT t1.a +b   FROM ( SELECT a FROM t0 ) AS t1 )  AS x  FROM t0 ) AS t2 
            JOIN t0 
            ON t0.a IN ( SELECT b FROM t0 GROUP BY x ) ;


            231012 17:01:57 [ERROR] mysqld got signal 11 ;
            		 
             
            		 
            Server version: 10.4.32-MariaDB-debug-log source revision: 0c7af6a2a19343cb9d4fedbd7165b8f73bc4cf96
            		 
             
            		 
            sql/signal_handler.cc:238(handle_fatal_signal)[0x56399f640f8d]
            		 
            sigaction.c:0(__restore_rt)[0x7fcd31795420]
            		 
            sql/item_subselect.cc:6902(Item_subselect::init_expr_cache_tracker(THD*))[0x56399f8af69e]
            		 
            sql/item_subselect.cc:1681(Item_exists_subselect::expr_cache_insert_transformer(THD*, unsigned char*))[0x56399f880eda]
            		 
            sql/item.cc:602(Item::transform(THD*, Item* (Item::*)(THD*, unsigned char*), unsigned char*))[0x56399f6962e3]
            		 
            sql/item.cc:8181(Item_ref::transform(THD*, Item* (Item::*)(THD*, unsigned char*), unsigned char*))[0x56399f6d5c97]
            		 
            sql/sql_select.cc:4110(JOIN::setup_subquery_caches())[0x56399ef5425b]
            		 
            sql/sql_select.cc:2948(JOIN::optimize_stage2())[0x56399ef4755c]
            		 
            sql/sql_select.cc:2394(JOIN::optimize_inner())[0x56399ef41402]
            		 
            sql/sql_select.cc:1711(JOIN::optimize())[0x56399ef3a10d]
            		 
            sql/sql_select.cc:4812(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x56399ef5b0f7]
            		 
            sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x56399ef2bde0]
            		 
            sql/sql_parse.cc:6475(execute_sqlcom_select(THD*, TABLE_LIST*))[0x56399ee97be4]
            		 
            sql/sql_parse.cc:3978(mysql_execute_command(THD*))[0x56399ee8535b]
            		 
            sql/sql_parse.cc:8012(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x56399eea10bf]
            		 
            sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x56399ee774e5]
            		 
            sql/sql_parse.cc:1378(do_command(THD*))[0x56399ee74010]
            		 
            sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x56399f281deb]
            		 
            sql/sql_connect.cc:1325(handle_one_connection)[0x56399f28168f]
            		 
            perfschema/pfs.cc:1871(pfs_spawn_thread)[0x56399ff2c274]
            		 
            nptl/pthread_create.c:478(start_thread)[0x7fcd31789609]
            		 
             
            		 
            Query (0x62b0000a1290): SELECT t2.x  FROM 
            ( SELECT  EXISTS ( SELECT t1.a +b   FROM ( SELECT a FROM t0 ) AS t1 )  AS x  FROM t0 ) AS t2 
            JOIN t0 
            ON t0.a IN ( SELECT b FROM t0 GROUP BY x )

            alice Alice Sherepa added a comment - Thank you! I repeated on 10.4-11.2: CREATE TABLE t0 ( a text , b int ); INSERT INTO t0 VALUES ( '44' , NULL ),( '-111' , NULL ),( '-9' ,122),( '-119' ,-59);   SELECT t2.x FROM ( SELECT EXISTS ( SELECT t1.a +b FROM ( SELECT a FROM t0 ) AS t1 ) AS x FROM t0 ) AS t2 JOIN t0 ON t0.a IN ( SELECT b FROM t0 GROUP BY x ) ; 231012 17:01:57 [ERROR] mysqld got signal 11 ;   Server version: 10.4.32-MariaDB-debug-log source revision: 0c7af6a2a19343cb9d4fedbd7165b8f73bc4cf96   sql/signal_handler.cc:238(handle_fatal_signal)[0x56399f640f8d] sigaction.c:0(__restore_rt)[0x7fcd31795420] sql/item_subselect.cc:6902(Item_subselect::init_expr_cache_tracker(THD*))[0x56399f8af69e] sql/item_subselect.cc:1681(Item_exists_subselect::expr_cache_insert_transformer(THD*, unsigned char*))[0x56399f880eda] sql/item.cc:602(Item::transform(THD*, Item* (Item::*)(THD*, unsigned char*), unsigned char*))[0x56399f6962e3] sql/item.cc:8181(Item_ref::transform(THD*, Item* (Item::*)(THD*, unsigned char*), unsigned char*))[0x56399f6d5c97] sql/sql_select.cc:4110(JOIN::setup_subquery_caches())[0x56399ef5425b] sql/sql_select.cc:2948(JOIN::optimize_stage2())[0x56399ef4755c] sql/sql_select.cc:2394(JOIN::optimize_inner())[0x56399ef41402] sql/sql_select.cc:1711(JOIN::optimize())[0x56399ef3a10d] sql/sql_select.cc:4812(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x56399ef5b0f7] sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x56399ef2bde0] sql/sql_parse.cc:6475(execute_sqlcom_select(THD*, TABLE_LIST*))[0x56399ee97be4] sql/sql_parse.cc:3978(mysql_execute_command(THD*))[0x56399ee8535b] sql/sql_parse.cc:8012(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x56399eea10bf] sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x56399ee774e5] sql/sql_parse.cc:1378(do_command(THD*))[0x56399ee74010] sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x56399f281deb] sql/sql_connect.cc:1325(handle_one_connection)[0x56399f28168f] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x56399ff2c274] nptl/pthread_create.c:478(start_thread)[0x7fcd31789609]   Query (0x62b0000a1290): SELECT t2.x FROM ( SELECT EXISTS ( SELECT t1.a +b FROM ( SELECT a FROM t0 ) AS t1 ) AS x FROM t0 ) AS t2 JOIN t0 ON t0.a IN ( SELECT b FROM t0 GROUP BY x )

            People

              psergei Sergei Petrunia
              Xin Wen Xin Wen
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.