Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-3903

Exists2In: Server crashes in Item_cond::fix_fields on 2nd execution of a prepared stmt with exists_to_in+materialization+semijoin, EXISTS subquery, STRAIGHT_JOIN

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • None
    • 10.0.2
    • None
    • None

    Description

      #3  <signal handler called>
      #4  0x000000000081458e in Item_cond::fix_fields (this=0x392f628, thd=0x38f6df0, ref=0x3929458) at 10.0-exists2in/sql/item_cmpfunc.cc:4308
      #5  0x0000000000766503 in setup_jtbm_semi_joins (join=0x3928fe8, join_list=0x3926db0, join_where=0x3929458) at 10.0-exists2in/sql/opt_subselect.cc:5230
      #6  0x0000000000645b5a in JOIN::optimize_inner (this=0x3928fe8) at 10.0-exists2in/sql/sql_select.cc:1140
      #7  0x0000000000645414 in JOIN::optimize (this=0x3928fe8) at 10.0-exists2in/sql/sql_select.cc:994
      #8  0x000000000064d0f2 in mysql_select (thd=0x38f6df0, rref_pointer_array=0x3926ed0, tables=0x39278f8, wild_num=0, fields=..., conds=0x392a438, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184066, result=0x37f36a8, unit=0x3926528, select_lex=0x3926c20) at 10.0-exists2in/sql/sql_select.cc:3193
      #9  0x000000000064387e in handle_select (thd=0x38f6df0, lex=0x3926478, result=0x37f36a8, setup_tables_done_option=0) at 10.0-exists2in/sql/sql_select.cc:362
      #10 0x000000000061b13b in execute_sqlcom_select (thd=0x38f6df0, all_tables=0x39278f8) at 10.0-exists2in/sql/sql_parse.cc:4937
      #11 0x00000000006137a8 in mysql_execute_command (thd=0x38f6df0) at 10.0-exists2in/sql/sql_parse.cc:2421
      #12 0x0000000000635b95 in Prepared_statement::execute (this=0x38fefc0, expanded_query=0x7f87e83a7c30, open_cursor=false) at 10.0-exists2in/sql/sql_prepare.cc:3914
      #13 0x0000000000634c2c in Prepared_statement::execute_loop (this=0x38fefc0, expanded_query=0x7f87e83a7c30, open_cursor=false, packet=0x0, packet_end=0x0) at 10.0-exists2in/sql/sql_prepare.cc:3570
      #14 0x0000000000632ce3 in mysql_sql_stmt_execute (thd=0x38f6df0) at 10.0-exists2in/sql/sql_prepare.cc:2732
      #15 0x00000000006137d9 in mysql_execute_command (thd=0x38f6df0) at 10.0-exists2in/sql/sql_parse.cc:2431
      #16 0x000000000061d9f6 in mysql_parse (thd=0x38f6df0, rawbuf=0x391c368 "EXECUTE stmt", length=12, parser_state=0x7f87e83a84e0) at 10.0-exists2in/sql/sql_parse.cc:6056
      #17 0x000000000061099a in dispatch_command (command=COM_QUERY, thd=0x38f6df0, packet=0x3901001 "EXECUTE stmt", packet_length=12) at 10.0-exists2in/sql/sql_parse.cc:1216
      #18 0x000000000060fb93 in do_command (thd=0x38f6df0) at 10.0-exists2in/sql/sql_parse.cc:945
      #19 0x000000000071a57a in do_handle_one_connection (thd_arg=0x38f6df0) at 10.0-exists2in/sql/sql_connect.cc:1254

      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0x3905028): SELECT STRAIGHT_JOIN * FROM t1 WHERE EXISTS ( SELECT * FROM t2 WHERE b = a )
      Connection ID (thread ID): 2
      Status: NOT_KILLED

      branch: 10.0-exists2in
      revision-id: sanja@montyprogram.com-20121129184233-zxp9qe77tfcupomh
      date: 2012-11-29 20:42:33 +0200
      revno: 3486

      Minimal optimizer_switch: materialization=on,semijoin=on,exists_to_in=on
      Full optimizer_switch (default + exists_to_in=on):

      index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on,extended_keys=off,exists_to_in=on

      Test case:

      SET optimizer_switch='materialization=on,semijoin=on,exists_to_in=on';
       
      CREATE TABLE t1 (a INT) ENGINE=MyISAM;
      INSERT INTO t1 VALUES (1),(2);
       
      CREATE TABLE t2 (b INT) ENGINE=MyISAM;
      INSERT INTO t2 VALUES (3),(4);
       
      PREPARE stmt FROM
      'SELECT STRAIGHT_JOIN * FROM t1
      WHERE EXISTS ( SELECT * FROM t2 WHERE b = a )';
       
      EXECUTE stmt;
      EXECUTE stmt;
       

      Attachments

        Issue Links

          Activity

            the problem is that when we create IN subquery unit->item is already assigned and the subquery writes itself there as temporary changing.

            sanja Oleksandr Byelkin added a comment - the problem is that when we create IN subquery unit->item is already assigned and the subquery writes itself there as temporary changing.

            Address which we try to access during the crash (where variable item points) is beginning of memory allocated my mem_root internal allocator (not pointer returned by it).

            sanja Oleksandr Byelkin added a comment - Address which we try to access during the crash (where variable item points) is beginning of memory allocated my mem_root internal allocator (not pointer returned by it).

            People

              sanja Oleksandr Byelkin
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.