Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32395

update_depend_map_for_order: SEGV at /mariadb-11.3.0/sql/sql_select.cc:16583

Details

    Description

      Run these queries in release build:

      CREATE TABLE t0 ( c6 INT , c21 INT ) ;
      INSERT INTO t0 VALUES ( 55 , -95 ) , ( 9 , 90 ) ;
      ALTER TABLE t0 ADD COLUMN c37 INT AFTER c6 ;
      INSERT INTO t0 VALUES ( ) , ( ) ;
      SELECT t0 . c6 AS c42 FROM ( SELECT t0 . c6 = TRIM( TRAILING FROM 96 ) SOUNDS LIKE CONVERT ( t0 . c6 , UNSIGNED ) >> PI ( ) AS c49 FROM t0 ) AS t1 JOIN t0 ON RTRIM ( - RAND ( -66 ) BETWEEN FIND_IN_SET ( 20 , UNHEX ( -80 ) IS NULL OR IF ( 85 , -83 , -113 ) ) AND -125 ) / EXP ( c21 ) = t1 . c49 ORDER BY c42 , ( c42 + ( SELECT c21 AS c61 FROM t0 WHERE t0 . c37 >= -19.601384 = RAND ( ) / TRIM( t0 . c21 FROM 'C@rG3D(#9*17(a.,rV' ) = -106 GROUP BY c21 , c42 HAVING c42 = -73 LIMIT 1 ) ) ;

      Will trigger Segmentation fault.
      GDB info:
      Thread 16 "mariadbd" received signal SIGSEGV, Segmentation fault.
      [Switching to Thread 0x7fffd242e300 (LWP 2691)]
      0x0000000000c24454 in update_depend_map_for_order (join=0x6290000b23e0, order=0x6290000ae168) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:16583
      16583 order->depend_map|=(*tab)->ref.depend_map;
      (gdb) p *tab
      $10 = (JOIN_TAB *) 0x0

      #0 0x0000000000c24454 in update_depend_map_for_order (join=0x6290000b7480, order=0x6290000b46c0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:16583
      #1 remove_const (join=<optimized out>, first_order=<optimized out>, cond=<optimized out>, change_list=<optimized out>, simple_order=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:16696
      #2 0x0000000000c05386 in JOIN::optimize_stage2 (this=0x6290000b7480) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:3104
      #3 0x0000000000c13911 in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
      #4 0x0000000000bfc156 in JOIN::optimize (this=0x6290000b7480) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
      #5 0x0000000000ab5421 in st_select_lex::optimize_unflattened_subqueries (this=<optimized out>, const_only=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
      #6 0x0000000000c0856c in JOIN::optimize_stage2 (this=0x6290000b58b0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:3229
      #7 0x0000000000c13911 in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
      #8 0x0000000000bfc156 in JOIN::optimize (this=this@entry=0x6290000b58b0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
      #9 0x0000000000be4fdf in mysql_select (thd=<optimized out>, thd@entry=0x62b00016c218, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x6290000b5880, unit=0x62b0001704a8, select_lex=0x629000091670) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
      #10 0x0000000000be4596 in handle_select (thd=thd@entry=0x62b00016c218, lex=<optimized out>, lex@entry=0x62b0001703c8, result=<optimized out>, result@entry=0x6290000b5880, setup_tables_done_option=<optimized out>, setup_tables_done_option@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
      #11 0x0000000000b3df18 in execute_sqlcom_select (thd=0x62b00016c218, all_tables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
      #12 0x0000000000b2cd51 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
      #13 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd242ca80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
      #14 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
      #15 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
      #16 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
      #17 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x6080015148b8) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
      #18 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000006618) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
      #19 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
      #20 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

      Attachments

        Issue Links

          Activity

            alice Alice Sherepa added a comment -

            please check MDEV-30756 after the fix - that is probably a duplicate of this one

            alice Alice Sherepa added a comment - please check MDEV-30756 after the fix - that is probably a duplicate of this one
            danblack Daniel Black added a comment - - edited

            I rebased pull request 2873 onto 10.5 (no conflicts), its still on branch bb-10.4-MDEV-32395.

            Buildbot test results

            Test cases from MDEV-32329 included as second commit.

            This doesn't solve the test cases MDEV-30756.

            danblack Daniel Black added a comment - - edited I rebased pull request 2873 onto 10.5 (no conflicts), its still on branch bb-10.4- MDEV-32395 . Buildbot test results Test cases from MDEV-32329 included as second commit. This doesn't solve the test cases MDEV-30756 .
            danblack Daniel Black added a comment - Code introduced by https://github.com/MariaDB/server/commit/ae15f91f227015b3e1ad3f566db9396232cf0a3f

            The patches from jasoncu and danblack looks ok.
            I will add them to 10.5 and also merge them to one patch. I will also do a last check that all test cases related to this bug are added.

            monty Michael Widenius added a comment - The patches from jasoncu and danblack looks ok. I will add them to 10.5 and also merge them to one patch. I will also do a last check that all test cases related to this bug are added.

            Fix pushed to 10.5 tree

            monty Michael Widenius added a comment - Fix pushed to 10.5 tree

            People

              monty Michael Widenius
              Xin Wen Xin Wen
              Votes:
              0 Vote for this issue
              Watchers:
              10 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.