Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-33511

Crash when executing prepared statement with subqueries

    XMLWordPrintable

Details

    Description

      Consider the following simplified test case:

      create table bug (
      id binary(16) not null,
      c1 int(11),
      c2 varchar(9),
      c3 varchar(6),
      updated_at datetime
      );
       
      prepare `bug_stmt` FROM "select i1_0.c1 from bug i1_0 where i1_0.id in(select (select i3_0.id from bug i3_0 where i3_0.c2=i2_0.c2 and i3_0.c3='123' order by i3_0.updated_at desc limit 1) from bug i2_0 where i2_0.c3='123' group by i2_0.c2)";
       
      execute `bug_stmt`;
      

      We get a crash while running the execute statement

      240221  9:36:45 [ERROR] mysqld got signal 11 ;
      2024-02-21T09:36:45.665298605Z Sorry, we probably made a mistake, and this is a bug.
      2024-02-21T09:36:45.665300783Z 
      2024-02-21T09:36:45.665302492Z Your assistance in bug reporting will enable us to fix this for the next release.
      2024-02-21T09:36:45.665304154Z To report this bug, see https://mariadb.com/kb/en/reporting-bugs
      2024-02-21T09:36:45.665305862Z 
      2024-02-21T09:36:45.665307438Z We will try our best to scrape up some info that will hopefully help
      2024-02-21T09:36:45.665309093Z diagnose the problem, but since we have already crashed, 
      2024-02-21T09:36:45.665310812Z something is definitely wrong and this may fail.
      2024-02-21T09:36:45.665312409Z 
      2024-02-21T09:36:45.665314005Z Server version: 10.6.17-MariaDB-1:10.6.17+maria~ubu2004 source revision: 15c75ad083a55e198ae78324f22970694b72f22b
      2024-02-21T09:36:45.665315790Z key_buffer_size=16384
      2024-02-21T09:36:45.665319428Z read_buffer_size=262144
      2024-02-21T09:36:45.665321182Z max_used_connections=13
      2024-02-21T09:36:45.665322790Z max_threads=153
      2024-02-21T09:36:45.665324396Z thread_count=13
      2024-02-21T09:36:45.665326088Z It is possible that mysqld could use up to 
      2024-02-21T09:36:45.665327678Z key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 52983 K  bytes of memory
      2024-02-21T09:36:45.665329312Z Hope that's ok; if not, decrease some variables in the equation.
      2024-02-21T09:36:45.665330868Z 
      2024-02-21T09:36:45.665332460Z Thread pointer: 0x7f755c000c58
      2024-02-21T09:36:45.665334159Z Attempting backtrace. You can use the following information to find out
      2024-02-21T09:36:45.665335880Z where mysqld died. If you see no messages after this, something went
      2024-02-21T09:36:45.665337571Z terribly wrong...
      2024-02-21T09:36:45.665340121Z stack_bottom = 0x7f75c06f5d18 thread_stack 0x80000
      2024-02-21T09:36:45.667177433Z Printing to addr2line failed
      2024-02-21T09:36:45.667474790Z mariadbd(my_print_stacktrace+0x32)[0x5617eccba9c2]
      2024-02-21T09:36:45.668019437Z mariadbd(handle_fatal_signal+0x475)[0x5617ec769af5]
      2024-02-21T09:36:45.669267901Z /lib/x86_64-linux-gnu/libpthread.so.0(+0x14420)[0x7f75d7961420]
      2024-02-21T09:36:45.671052531Z mariadbd(+0x7f4f49)[0x5617ec548f49]
      2024-02-21T09:36:45.671729842Z mariadbd(_ZN10Item_equal4sortEPFiP4ItemS1_PvES2_+0x95)[0x5617ec7b84a5]
      2024-02-21T09:36:45.672146617Z mariadbd(+0x8125ff)[0x5617ec5665ff]
      2024-02-21T09:36:45.672664416Z mariadbd(_ZN4JOIN15optimize_stage2Ev+0x5bb)[0x5617ec5899bb]
      2024-02-21T09:36:45.673134204Z mariadbd(_ZN4JOIN14optimize_innerEv+0x1bd0)[0x5617ec58dd90]
      2024-02-21T09:36:45.673484384Z mariadbd(_ZN4JOIN8optimizeEv+0xb0)[0x5617ec590110]
      2024-02-21T09:36:45.673874487Z mariadbd(_ZN13st_select_lex31optimize_unflattened_subqueriesEb+0x116)[0x5617ec4fa996]
      2024-02-21T09:36:45.674170878Z mariadbd(_ZN4JOIN15optimize_stage2Ev+0x1e27)[0x5617ec58b227]
      2024-02-21T09:36:45.674578463Z mariadbd(_ZN4JOIN14optimize_innerEv+0x1bd0)[0x5617ec58dd90]
      2024-02-21T09:36:45.674976511Z mariadbd(_ZN4JOIN8optimizeEv+0xb0)[0x5617ec590110]
      2024-02-21T09:36:45.675332970Z mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0xb7)[0x5617ec5901e7]
      2024-02-21T09:36:45.675737164Z mariadbd(_Z13handle_selectP3THDP3LEXP13select_resultm+0x157)[0x5617ec5909f7]
      2024-02-21T09:36:45.676195233Z mariadbd(+0x7c7701)[0x5617ec51b701]
      2024-02-21T09:36:45.676552715Z mariadbd(_Z21mysql_execute_commandP3THDb+0x4781)[0x5617ec52a181]
      2024-02-21T09:36:45.676851058Z mariadbd(_ZN18Prepared_statement7executeEP6Stringb+0x4aa)[0x5617ec53af2a]
      2024-02-21T09:36:45.677160724Z mariadbd(_ZN18Prepared_statement12execute_loopEP6StringbPhS2_+0xa1)[0x5617ec53b151]
      2024-02-21T09:36:45.677485294Z mariadbd(_Z22mysql_sql_stmt_executeP3THD+0x193)[0x5617ec53b483]
      2024-02-21T09:36:45.677791537Z mariadbd(_Z21mysql_execute_commandP3THDb+0x29c6)[0x5617ec5283c6]
      2024-02-21T09:36:45.678088478Z mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x1e7)[0x5617ec515f27]
      2024-02-21T09:36:45.678443229Z mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x1085)[0x5617ec522825]
      2024-02-21T09:36:45.678776055Z mariadbd(_Z10do_commandP3THDb+0x13e)[0x5617ec524b8e]
      2024-02-21T09:36:45.679112037Z mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x3b7)[0x5617ec63dc17]
      2024-02-21T09:36:45.679441540Z mariadbd(handle_one_connection+0x5d)[0x5617ec63df6d]
      2024-02-21T09:36:45.679914125Z mariadbd(+0xc70f76)[0x5617ec9c4f76]
      2024-02-21T09:36:45.681245962Z /lib/x86_64-linux-gnu/libpthread.so.0(+0x8609)[0x7f75d7955609]
      2024-02-21T09:36:45.682451789Z /lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f75d7541353]
      2024-02-21T09:36:45.682461370Z 
      2024-02-21T09:36:45.682464165Z Trying to get some variables.
      2024-02-21T09:36:45.682467292Z Some pointers may be invalid and cause the dump to abort.
      2024-02-21T09:36:45.682502035Z Query (0x7f755c01f1f8): select i1_0.c1 from bug i1_0 where i1_0.id in(select (select i3_0.id from bug i3_0 where i3_0.c2=i2_0.c2 and i3_0.c3='123' order by i3_0.updated_at desc limit 1) from bug i2_0 where i2_0.c3='123' group by i2_0.c2)
      2024-02-21T09:36:45.682506366Z 
      2024-02-21T09:36:45.682508141Z Connection ID (thread ID): 16
      2024-02-21T09:36:45.682522495Z Status: NOT_KILLED
      2024-02-21T09:36:45.682524683Z 
      2024-02-21T09:36:45.682535292Z Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=off,cset_narrowing=off
      2024-02-21T09:36:45.682540932Z 
      2024-02-21T09:36:45.682542770Z The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/ contains
      2024-02-21T09:36:45.682544541Z information that should help you find out what is causing the crash.
      2024-02-21T09:36:45.682557474Z Writing a core file...
      2024-02-21T09:36:45.682563861Z Working directory at /var/lib/mysql
      2024-02-21T09:36:45.682566463Z Resource Limits:
      2024-02-21T09:36:45.682576509Z Limit                     Soft Limit           Hard Limit           Units     
      2024-02-21T09:36:45.682581531Z Max cpu time              unlimited            unlimited            seconds   
      2024-02-21T09:36:45.682583492Z Max file size             unlimited            unlimited            bytes     
      2024-02-21T09:36:45.682585198Z Max data size             unlimited            unlimited            bytes     
      2024-02-21T09:36:45.682586900Z Max stack size            8388608              unlimited            bytes     
      2024-02-21T09:36:45.682588503Z Max core file size        unlimited            unlimited            bytes     
      2024-02-21T09:36:45.682590057Z Max resident set          unlimited            unlimited            bytes     
      2024-02-21T09:36:45.682591630Z Max processes             unlimited            unlimited            processes 
      2024-02-21T09:36:45.682593215Z Max open files            1048576              1048576              files     
      2024-02-21T09:36:45.682594809Z Max locked memory         8388608              8388608              bytes     
      2024-02-21T09:36:45.682596379Z Max address space         unlimited            unlimited            bytes     
      2024-02-21T09:36:45.682597931Z Max file locks            unlimited            unlimited            locks     
      2024-02-21T09:36:45.682599587Z Max pending signals       126461               126461               signals   
      2024-02-21T09:36:45.682601227Z Max msgqueue size         819200               819200               bytes     
      2024-02-21T09:36:45.682602851Z Max nice priority         0                    0                    
      2024-02-21T09:36:45.682604462Z Max realtime priority     0                    0                    
      2024-02-21T09:36:45.682610745Z Max realtime timeout      unlimited            unlimited            us        
      2024-02-21T09:36:45.682615939Z Core pattern: |/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E
      2024-02-21T09:36:45.682618018Z 
      2024-02-21T09:36:45.682620158Z Kernel version: Linux version 6.5.0-18-generic (buildd@lcy02-amd64-070) (x86_64-linux-gnu-gcc-12 (Ubuntu 12.3.0-1ubuntu1~22.04) 12.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #18~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Feb  7 11:40:03 UTC 2
      2024-02-21T09:36:45.682622944Z 
      

      I agree the sql statement is not clean, but crashing seems to be too much

      Maybe related to MDEV-31296 ; but the issue is still there in 10.6.17 and 10.11.7
      Can be reproduced in 11.3.2 too

      Attachments

        Activity

          People

            psergei Sergei Petrunia
            Seb Sébastien Perol
            Votes:
            1 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.