Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-35277

SIGSEGV in get_sort_by_table on SELECT

Details

    • Bug
    • Status: Stalled (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.5, 10.6, 10.11, 11.2(EOL), 11.4, 11.6(EOL), 11.7(EOL)
    • 10.5, 10.6, 10.11, 11.4
    • Optimizer
    • None

    Description

      CREATE TABLE t (a INT KEY,b INT) COMMENT='' ENGINE=InnoDB;
      		 
      SELECT 1 FROM t WHERE 1 IN (SELECT 1 FROM t WHERE 1=(EXISTS (SELECT a FROM (SELECT 1) s GROUP BY 1=ANY (SELECT 1 FROM t HAVING a) HAVING 1)));

      Leads to:

      CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug)

      		 
      Core was generated by `/test/MD141024-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  get_sort_by_table (const_tables=1, tables=..., b=<optimized out>, a=0x0)at /test/11.2_dbg/sql/sql_select.cc:28792
      		 
       
      		 
      [Current thread is 1 (LWP 3093068)]
      		 
      (gdb) bt
      		 
      #0  get_sort_by_table (const_tables=1, tables=@0x10bae4015470: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x10bae4072568, last = 0x10bae4072568, elements = 1}, <No data fields>}, b=<optimized out>, a=0x0) at /test/11.2_dbg/sql/sql_select.cc:28792
      		 
      #1  make_join_statistics (join=join@entry=0x10bae40717d8, tables_list=@0x10bae4015470: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x10bae4072568, last = 0x10bae4072568, elements = 1}, <No data fields>}, keyuse_array=keyuse_array@entry=0x10bae4071b40)at /test/11.2_dbg/sql/sql_select.cc:6041
      		 
      #2  0x000059c9233998f9 in JOIN::optimize_inner (this=this@entry=0x10bae40717d8)at /test/11.2_dbg/sql/sql_select.cc:2699
      		 
      #3  0x000059c923399eae in JOIN::optimize (this=this@entry=0x10bae40717d8)at /test/11.2_dbg/sql/sql_select.cc:2003
      		 
      #4  0x000059c9232d7412 in st_select_lex::optimize_unflattened_subqueries (this=0x10bae40137c8, const_only=const_only@entry=false)at /test/11.2_dbg/sql/sql_lex.cc:5005
      		 
      #5  0x000059c9234dff27 in JOIN::optimize_unflattened_subqueries (this=this@entry=0x10bae4027218) at /test/11.2_dbg/sql/opt_subselect.cc:5873
      		 
      #6  0x000059c9233973f7 in JOIN::optimize_stage2 (this=this@entry=0x10bae4027218) at /test/11.2_dbg/sql/sql_select.cc:3318
      		 
      #7  0x000059c923399956 in JOIN::optimize_inner (this=this@entry=0x10bae4027218)at /test/11.2_dbg/sql/sql_select.cc:2725
      		 
      #8  0x000059c923399eae in JOIN::optimize (this=this@entry=0x10bae4027218)at /test/11.2_dbg/sql/sql_select.cc:2003
      		 
      #9  0x000059c923399fce in mysql_select (thd=thd@entry=0x10bae4000d58, tables=0x10bae4013d68, fields=@0x10bae4013a80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x10bae4013d18, last = 0x10bae4013d18, elements = 1}, <No data fields>}, conds=0x10bae40265d0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x10bae40271f0, unit=0x10bae40052b0, select_lex=0x10bae40137c8)at /test/11.2_dbg/sql/sql_select.cc:5344
      		 
      #10 0x000059c92339a858 in handle_select (thd=thd@entry=0x10bae4000d58, lex=lex@entry=0x10bae40051d0, result=result@entry=0x10bae40271f0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/11.2_dbg/sql/sql_select.cc:642
      		 
      #11 0x000059c9232f8751 in execute_sqlcom_select (thd=thd@entry=0x10bae4000d58, all_tables=0x10bae4013d68) at /test/11.2_dbg/sql/sql_parse.cc:6177
      		 
      #12 0x000059c9233045bc in mysql_execute_command (thd=thd@entry=0x10bae4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:3984
      		 
      #13 0x000059c92330b2ce in mysql_parse (thd=thd@entry=0x10bae4000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x10bb2a74c2a0)at /test/11.2_dbg/sql/sql_parse.cc:7938
      		 
      #14 0x000059c92330d786 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x10bae4000d58, packet=packet@entry=0x10bae400b319 "SELECT 1 FROM t WHERE 1 IN (SELECT 1 FROM t WHERE 1=(EXISTS (SELECT a FROM (SELECT 1) s GROUP BY 1=ANY (SELECT 1 FROM t HAVING a) HAVING 1)))", packet_length=packet_length@entry=141, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_class.h:248
      		 
      #15 0x000059c92330f9c2 in do_command (thd=0x10bae4000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407
      		 
      #16 0x000059c92347cfe7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x59c92659b3f8, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439
      		 
      #17 0x000059c92347d2ef in handle_one_connection (arg=arg@entry=0x59c92659b3f8)at /test/11.2_dbg/sql/sql_connect.cc:1341
      		 
      #18 0x000059c9238c4f14 in pfs_spawn_thread (arg=0x59c9264ee228)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201
      		 
      #19 0x000010bb3349ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      		 
      #20 0x000010bb33529c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

      Bug confirmed present in:
      MariaDB: 10.5.27 (dbg), 10.5.27 (opt), 10.6.20 (dbg), 10.6.20 (opt), 10.11.10 (dbg), 10.11.10 (opt), 11.2.6 (dbg), 11.2.6 (opt), 11.4.4 (dbg), 11.4.4 (opt), 11.6.2 (dbg), 11.6.2 (opt), 11.7.0 (dbg), 11.7.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.44 (dbg), 5.7.44 (opt), 8.0.36 (dbg), 8.0.36 (opt), 9.1.0 (dbg), 9.1.0 (opt)

      Attachments

        Issue Links

          split from

          Bug - A problem which impairs or prevents the functions of the product. MDEV-29935 Server crashes in get_sort_by_table/make_join_statistics after INSERT into a view with ORDER BY

          • Major - Major loss of function.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            oleg.smirnov Oleg Smirnov added a comment - - edited

            Simplified test case:

            CREATE TABLE t (a INT);
            		 
             
            		 
            SELECT a FROM t WHERE a IN (
            		 
              SELECT a FROM t WHERE EXISTS (
            		 
                  SELECT a FROM (SELECT 1) s 
                  GROUP BY 1 IN (SELECT 1 FROM t HAVING a > 0)
            		 
                )
            		 
            );

            Problematic call of `get_sort_by_table()` happens during `optimize_unflatted_subqueries()` for "select t.a AS a from t semi join (t) where <in_optimizer>(1,exists(subquery#3))".
            ORDER* b->item is "<in_optimizer>(1,<exists>(subquery#5))" here, and its used_tables() == 2 here. However, `tables` list in the function contains only 1 table, so used_tables() == 2 is invalid in this context and leads to SIGSEGV.

            oleg.smirnov Oleg Smirnov added a comment - - edited Simplified test case: CREATE TABLE t (a INT );   SELECT a FROM t WHERE a IN ( SELECT a FROM t WHERE EXISTS ( SELECT a FROM ( SELECT 1) s GROUP BY 1 IN ( SELECT 1 FROM t HAVING a > 0) ) ); Problematic call of `get_sort_by_table()` happens during `optimize_unflatted_subqueries()` for "select t.a AS a from t semi join (t) where <in_optimizer>(1,exists(subquery#3))". ORDER* b->item is "<in_optimizer>(1,<exists>(subquery#5))" here, and its used_tables() == 2 here. However, `tables` list in the function contains only 1 table, so used_tables() == 2 is invalid in this context and leads to SIGSEGV.
            oleg.smirnov Oleg Smirnov added a comment -

            Let's adjust the `map` value with the debugger in `get_sort_by_table` to make the query finish successfully and see how column names are resolved.

            EXPLAIN EXTENDED SELECT a FROM t AS t1 WHERE a IN (
            		 
              SELECT a FROM t AS t2 WHERE EXISTS (
            		 
                SELECT a FROM (SELECT 1) t3 
                GROUP BY 1 IN (SELECT 1 FROM t AS t4 HAVING a > 0)
            		 
              )
            		 
            );
            		 
            id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
            		 
            1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	2	100.00	
            1	PRIMARY	<subquery2>	eq_ref	distinct_key	distinct_key	4	func	1	100.00	
            2	MATERIALIZED	t2	ALL	NULL	NULL	NULL	NULL	2	100.00	Using where
            		 
            3	DEPENDENT SUBQUERY	<derived4>	system	NULL	NULL	NULL	NULL	1	100.00	
            5	DEPENDENT SUBQUERY	t4	ALL	NULL	NULL	NULL	NULL	2	100.00	
            4	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	NULL	No tables used
            		 
             
            		 
            Warnings:
            		 
            Note    1276    Field or reference 'test.t2.a' of SELECT #3 was resolved in SELECT #2
            		 
            Note    1276    Field or reference 'a' of SELECT #5 was resolved in SELECT #3
            		 
            Note    1003    /* select#1 */ select `test`.`t1`.`a` AS `a` from `test`.`t` `t1` semi join (`test`.`t` `t2`) where <in_optimizer>(1,<expr_cache><`test`.`t2`.`a`>(exists(/* select#3 */ select `test`.`t2`.`a` from dual group by <in_optimizer>(1,<exists>(/* select#5 */ select 1 from `test`.`t` `t4` having `test`.`t2`.`a` > 0 and <cache>(1 = <ref_null_helper>(1)))) limit 1)))

            Looking at 

            `group by <in_optimizer>(1,<exists>(/* select#5 */ select 1 from `test`.`t` `t4` having `test`.`t2`.`a` > 0 ...`

            we can see at least two tables participating: `t4` and `t2`, so `used_tables() == 2` observed above looks incorrect, because that means only one set bit and one table . Maybe OUTER_REF_TABLE_BIT should be set here.

            oleg.smirnov Oleg Smirnov added a comment - Let's adjust the `map` value with the debugger in `get_sort_by_table` to make the query finish successfully and see how column names are resolved. EXPLAIN EXTENDED SELECT a FROM t AS t1 WHERE a IN ( SELECT a FROM t AS t2 WHERE EXISTS ( SELECT a FROM ( SELECT 1) t3 GROUP BY 1 IN ( SELECT 1 FROM t AS t4 HAVING a > 0) ) ); id select_type table type possible_keys key key_len ref rows filtered Extra 1 PRIMARY t1 ALL NULL NULL NULL NULL 2 100.00 1 PRIMARY <subquery2> eq_ref distinct_key distinct_key 4 func 1 100.00 2 MATERIALIZED t2 ALL NULL NULL NULL NULL 2 100.00 Using where 3 DEPENDENT SUBQUERY <derived4> system NULL NULL NULL NULL 1 100.00 5 DEPENDENT SUBQUERY t4 ALL NULL NULL NULL NULL 2 100.00 4 DERIVED NULL NULL NULL NULL NULL NULL NULL NULL No tables used   Warnings: Note 1276 Field or reference 'test.t2.a' of SELECT #3 was resolved in SELECT #2 Note 1276 Field or reference 'a' of SELECT #5 was resolved in SELECT #3 Note 1003 /* select#1 */ select `test`.`t1`.`a` AS `a` from `test`.`t` `t1` semi join (`test`.`t` `t2`) where <in_optimizer>(1,<expr_cache><`test`.`t2`.`a`>(exists( /* select#3 */ select `test`.`t2`.`a` from dual group by <in_optimizer>(1,<exists>( /* select#5 */ select 1 from `test`.`t` `t4` having `test`.`t2`.`a` > 0 and <cache>(1 = <ref_null_helper>(1)))) limit 1))) Looking at `group by <in_optimizer>(1,<exists>(/* select#5 */ select 1 from `test`.`t` `t4` having `test`.`t2`.`a` > 0 ...` we can see at least two tables participating: `t4` and `t2`, so `used_tables() == 2` observed above looks incorrect, because that means only one set bit and one table . Maybe OUTER_REF_TABLE_BIT should be set here.
            oleg.smirnov Oleg Smirnov added a comment -

            One more observation: disabling semijoin makes the query finish successfully:

            set optimizer_switch='semijoin=off';
            		 
            EXPLAIN EXTENDED SELECT a FROM t AS t1 WHERE a IN (
            		 
              SELECT a FROM t AS t2 WHERE EXISTS (
            		 
               SELECT a FROM (SELECT 1) t3 
                 GROUP BY 1 IN (SELECT 1 FROM t AS t4 HAVING a > 0)
            		 
              )
            		 
            );
            		 
            id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
            		 
            1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	2	100.00	Using where
            		 
            2	MATERIALIZED	t2	ALL	NULL	NULL	NULL	NULL	2	100.00	Using where
            		 
            3	DEPENDENT SUBQUERY	<derived4>	system	NULL	NULL	NULL	NULL	1	100.00	
            5	DEPENDENT SUBQUERY	t4	ALL	NULL	NULL	NULL	NULL	2	100.00	
            4	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	NULL	No tables used
            		 
            Warnings:
            		 
            Note	1276	Field or reference 'test.t2.a' of SELECT #3 was resolved in SELECT #2
            		 
            Note	1276	Field or reference 'a' of SELECT #5 was resolved in SELECT #3
            		 
            Note	1003	/* select#1 */ select `test`.`t1`.`a` AS `a` from `test`.`t` `t1` where <expr_cache><`test`.`t1`.`a`>(<in_optimizer>(`test`.`t1`.`a`,`test`.`t1`.`a` in ( <materialize> (/* select#2 */ select `test`.`t2`.`a` from `test`.`t` `t2` where <in_optimizer>(1,<expr_cache><`test`.`t2`.`a`>(exists(/* select#3 */ select `test`.`t2`.`a` from dual group by <in_optimizer>(1,<exists>(/* select#5 */ select 1 from `test`.`t` `t4` having `test`.`t2`.`a` > 0 and <cache>(1 = <ref_null_helper>(1)))) limit 1))) ), <primary_index_lookup>(`test`.`t1`.`a` in <temporary table> on distinct_key where `test`.`t1`.`a` = `<subquery2>`.`a`))))

            oleg.smirnov Oleg Smirnov added a comment - One more observation: disabling semijoin makes the query finish successfully: set optimizer_switch= 'semijoin=off' ; EXPLAIN EXTENDED SELECT a FROM t AS t1 WHERE a IN ( SELECT a FROM t AS t2 WHERE EXISTS ( SELECT a FROM ( SELECT 1) t3 GROUP BY 1 IN ( SELECT 1 FROM t AS t4 HAVING a > 0) ) ); id select_type table type possible_keys key key_len ref rows filtered Extra 1 PRIMARY t1 ALL NULL NULL NULL NULL 2 100.00 Using where 2 MATERIALIZED t2 ALL NULL NULL NULL NULL 2 100.00 Using where 3 DEPENDENT SUBQUERY <derived4> system NULL NULL NULL NULL 1 100.00 5 DEPENDENT SUBQUERY t4 ALL NULL NULL NULL NULL 2 100.00 4 DERIVED NULL NULL NULL NULL NULL NULL NULL NULL No tables used Warnings: Note 1276 Field or reference 'test.t2.a' of SELECT #3 was resolved in SELECT #2 Note 1276 Field or reference 'a' of SELECT #5 was resolved in SELECT #3 Note 1003 /* select#1 */ select `test`.`t1`.`a` AS `a` from `test`.`t` `t1` where <expr_cache><`test`.`t1`.`a`>(<in_optimizer>(`test`.`t1`.`a`,`test`.`t1`.`a` in ( <materialize> ( /* select#2 */ select `test`.`t2`.`a` from `test`.`t` `t2` where <in_optimizer>(1,<expr_cache><`test`.`t2`.`a`>(exists( /* select#3 */ select `test`.`t2`.`a` from dual group by <in_optimizer>(1,<exists>( /* select#5 */ select 1 from `test`.`t` `t4` having `test`.`t2`.`a` > 0 and <cache>(1 = <ref_null_helper>(1)))) limit 1))) ), <primary_index_lookup>(`test`.`t1`.`a` in < temporary table > on distinct_key where `test`.`t1`.`a` = `<subquery2>`.`a`))))
            oleg.smirnov Oleg Smirnov added a comment -

            igor, would you mind taking this task over? It has something to do with `used_tables()` and `OUTER_REF_TABLE_BIT`

            oleg.smirnov Oleg Smirnov added a comment - igor , would you mind taking this task over? It has something to do with `used_tables()` and `OUTER_REF_TABLE_BIT`

            People

              Johnston Rex Johnston
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.