Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
12.1
-
None
Description
Running the following script as a test case:
CREATE PROCEDURE proc_overflow()
|
BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN
|
... (20 BEGINs in a string repeated 231 times in total)
|
BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN
|
;
|
leads to:
Thread 1 (Thread 0x7e172e6cd6c0 (LWP 804133)):
|
#0 0x00005cdcb6593cbf in _db_enter_ (_func_=0x0, _file_=0x0, _line_=0, _stack_frame_=0x0) at /src/mariadb2/dbug/dbug.c:1135
|
#1 0x00005cdcb655e97e in my_free (ptr=0x7e171cf989e8) at /src/mariadb2/mysys/my_malloc.c:200
|
#2 0x00005cdcb652977d in delete_dynamic (array=0x7e171cf69510) at /src/mariadb2/mysys/array.c:345
|
#3 0x00005cdcb55e4c12 in Dynamic_array<sp_pcontext*>::~Dynamic_array (this=0x7e171cf69510, __in_chrg=<optimized out>) at /src/mariadb2/sql/sql_array.h:299
|
#4 0x00005cdcb55e257e in sp_pcontext::~sp_pcontext (this=0x7e171cf69370, __in_chrg=<optimized out>) at /src/mariadb2/sql/sp_pcontext.cc:123
|
...
|
#4604 0x00005cdcb55e253d in sp_pcontext::~sp_pcontext (this=0x7e171c0ffc18, __in_chrg=<optimized out>) at /src/mariadb2/sql/sp_pcontext.cc:122
|
#4605 0x00005cdcb55d19ad in sp_head::~sp_head (this=0x7e171c0ff0b0, __in_chrg=<optimized out>) at /src/mariadb2/sql/sp_head.cc:909
|
#4606 0x00005cdcb55d1a4c in sp_head::~sp_head (this=0x7e171c0ff0b0, __in_chrg=<optimized out>) at /src/mariadb2/sql/sp_head.cc:926
|
#4607 0x00005cdcb55cfd23 in sp_head::destroy (sp=0x7e171c0ff0b0) at /src/mariadb2/sql/sp_head.cc:537
|
#4608 0x00005cdcb56b3f28 in lex_end_nops (lex=0x7e171c0052d8) at /src/mariadb2/sql/sql_lex.cc:1385
|
#4609 0x00005cdcb56b3df5 in lex_end (lex=0x7e171c0052d8) at /src/mariadb2/sql/sql_lex.cc:1354
|
#4610 0x00005cdcb56686be in THD::end_statement (this=0x7e171c000dc8) at /src/mariadb2/sql/sql_class.cc:4372
|
#4611 0x00005cdcb5713332 in mysql_parse (thd=0x7e171c000dc8, rawbuf=0x7e171c018370 "CREATE PROCEDURE proc_overflow()\nBEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN\nBEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN"..., length=27632, parser_state=0x7e172e6cc2c0) at /src/mariadb2/sql/sql_parse.cc:7913
|
#4612 0x00005cdcb56fe967 in dispatch_command (command=COM_QUERY, thd=0x7e171c000dc8, packet=0x7e171c253b29 "CREATE PROCEDURE proc_overflow()\nBEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN\nBEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN"..., packet_length=27633, blocking=true) at /src/mariadb2/sql/sql_parse.cc:1877
|
#4613 0x00005cdcb56fd24c in do_command (thd=0x7e171c000dc8, blocking=true) at /src/mariadb2/sql/sql_parse.cc:1416
|
#4614 0x00005cdcb5918a6a in do_handle_one_connection (connect=0x5cdcf08d2f58, put_in_cache=true) at /src/mariadb2/sql/sql_connect.cc:1414
|
#4615 0x00005cdcb59187df in handle_one_connection (arg=0x5cdcf08adf18) at /src/mariadb2/sql/sql_connect.cc:1326
|
#4616 0x00005cdcb5ef944e in pfs_spawn_thread (arg=0x5cdcf0838e08) at /src/mariadb2/storage/perfschema/pfs.cc:2198
|
#4617 0x00007e17398a2ef1 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:448
|
#4618 0x00007e173993445c in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
It seems that the segmentation fault only reproduces in an MTR test case; running the same script in a client does not trigger it (and needs many more nested BEGINs):
(echo "connect t1; CREATE PROCEDURE proc_overflow()"; for i in {1..800}; do echo " BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN BEGIN"; done; echo ";" ) | client/mariadb
|
ERROR 1064 (42000) at line 1: memory exhausted near 'BEGIN BEGIN BEGIN' at line 801
|