The bug and test case look very similar to MDEV-3404, except that the problem from MDEV-3404 was fixed some time ago, and the test case provided there does not cause valgrind errors any longer.
==29679== Thread 5:
|
==29679== Invalid read of size 1
|
==29679== at 0x619C5B: subselect_engine::calc_const_tables(List<TABLE_LIST>&) (item_subselect.cc:3609)
|
==29679== by 0x619CD4: subselect_single_select_engine::upper_select_const_tables() (item_subselect.cc:3618)
|
==29679== by 0x611B19: Item_subselect::update_used_tables() (item_subselect.cc:801)
|
==29679== by 0x5AFB0F: Item_func::update_used_tables() (item_func.cc:424)
|
==29679== by 0x712097: JOIN::exec() (sql_select.cc:2532)
|
==29679== by 0x713964: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2985)
|
==29679== by 0x70A31E: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:286)
|
==29679== by 0x69583E: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5157)
|
==29679== by 0x68C5FD: mysql_execute_command(THD*) (sql_parse.cc:2290)
|
==29679== by 0x698296: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6158)
|
==29679== by 0x689DA3: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1228)
|
==29679== by 0x6890B7: do_command(THD*) (sql_parse.cc:923)
|
==29679== by 0x685B12: handle_one_connection (sql_connect.cc:1231)
|
==29679== by 0x548BEFB: start_thread (pthread_create.c:304)
|
==29679== by 0x5F18F4C: clone (clone.S:112)
|
==29679== Address 0xf7d48a7 is 2,103 bytes inside a block of size 4,120 free'd
|
==29679== at 0x4C282E0: free (vg_replace_malloc.c:366)
|
==29679== by 0xBAE901: my_no_flags_free (my_malloc.c:78)
|
==29679== by 0xBB0323: free_root (my_alloc.c:366)
|
==29679== by 0x731F8E: free_tmp_table(THD*, st_table*) (sql_select.cc:15218)
|
==29679== by 0x61B812: subselect_hash_sj_engine::cleanup() (item_subselect.cc:4440)
|
==29679== by 0x610127: Item_subselect::cleanup() (item_subselect.cc:130)
|
==29679== by 0x610302: Item_in_subselect::cleanup() (item_subselect.cc:167)
|
==29679== by 0x725781: st_join_table::cleanup() (sql_select.cc:10102)
|
==29679== by 0x7261F1: JOIN::cleanup(bool) (sql_select.cc:10408)
|
==29679== by 0x725EEE: JOIN::join_free() (sql_select.cc:10328)
|
==29679== by 0x7117F6: JOIN::exec() (sql_select.cc:2402)
|
==29679== by 0x713964: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2985)
|
==29679== by 0x70A31E: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:286)
|
==29679== by 0x69583E: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5157)
|
==29679== by 0x68C5FD: mysql_execute_command(THD*) (sql_parse.cc:2290)
|
==29679== by 0x698296: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6158)
|
revision-id: timour@askmonty.org-20130117140805-4kyoq7azx4v2irhq
|
revno: 3615
|
branch-nick: 5.3
|
Also reproducible on 5.5 revno 3640 and 10.0-base revno 3472.
Minimal optimizer_switch: semijoin=on,materialization=on
Full optimizer_switch (default):
index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on,extended_keys=off
|
EXPLAIN (with the minimal optimizer_switch):
id select_type table type possible_keys key key_len ref rows filtered Extra
|
1 PRIMARY <subquery2> const distinct_key distinct_key 8 const,const 1 100.00 Using temporary; Using filesort
|
1 PRIMARY t1 ALL NULL NULL NULL NULL 2 100.00 Using join buffer (flat, BNL join)
|
3 SUBQUERY t1 ALL NULL NULL NULL NULL 2 100.00
|
2 MATERIALIZED t2 ALL NULL NULL NULL NULL 2 100.00
|
Warnings:
|
Note 1003 select `test`.`t1`.`c` AS `c`,sum(distinct `test`.`t1`.`b`) AS `sm` from <materialize> (select min(`test`.`t2`.`a`),max(`test`.`t2`.`a`) from `test`.`t2`) join `test`.`t1` where ((`<subquery2>`.`MAX(a)` = 108) and (`<subquery2>`.`MIN(a)` = 5)) group by `test`.`t1`.`b` having (`test`.`t1`.`c` <> (select max(`test`.`t1`.`c`) from `test`.`t1`)) order by sum(distinct `test`.`t1`.`b`)
|
Test case:
SET optimizer_switch = 'semijoin=on,materialization=on';
|
|
CREATE TABLE t1 (b INT, c VARCHAR(1)) ENGINE=MyISAM;
|
INSERT INTO t1 VALUES (7,'v'),(0,'s');
|
|
CREATE TABLE t2 (a INT) ENGINE=MyISAM;
|
INSERT INTO t2 VALUES (0),(8);
|
|
SELECT c, SUM( DISTINCT b ) AS sm FROM t1
|
WHERE ( 5, 108 ) IN ( SELECT MIN(a), MAX(a) FROM t2 )
|
GROUP BY b
|
HAVING c <> ( SELECT MAX( c ) FROM t1 )
|
ORDER BY sm;
|
- relates to
-
MDEV-3404
LP:1002630 - Valgrind warnings 'Invalid read' in subselect_engine::calc_const_tables with SELECT and IN subqueries, GROUP BY, HAVING, materialization+semijoin
-
-
Closed
{"report":{"fcp":1014.5999999046326,"ttfb":254.09999990463257,"pageVisibility":"visible","entityId":22702,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":0.5,"journeyId":"3280b431-2a89-45d5-ab28-9973a773625f","navigationType":0,"readyForUser":1107,"redirectCount":0,"resourceLoadedEnd":1261.6999998092651,"resourceLoadedStart":259.5,"resourceTiming":[{"duration":267.39999985694885,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":259.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":259.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":526.8999998569489,"responseStart":0,"secureConnectionStart":0},{"duration":267.2999999523163,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2cib/820016/12ta74/494e4c556ecbb29f90a3d3b4f09cb99c/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true&whisper-enabled=true","startTime":259.7999999523163,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":259.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":527.0999999046326,"responseStart":0,"secureConnectionStart":0},{"duration":276.2999999523163,"initiatorType":"script","name":"https://jira.mariadb.org/s/0917945aaa57108d00c5076fea35e069-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":260,"connectEnd":260,"connectStart":260,"domainLookupEnd":260,"domainLookupStart":260,"fetchStart":260,"redirectEnd":0,"redirectStart":0,"requestStart":260,"responseEnd":536.2999999523163,"responseStart":536.2999999523163,"secureConnectionStart":260},{"duration":361.09999990463257,"initiatorType":"script","name":"https://jira.mariadb.org/s/2d8175ec2fa4c816e8023260bd8c1786-CDN/lu2cib/820016/12ta74/494e4c556ecbb29f90a3d3b4f09cb99c/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true&whisper-enabled=true","startTime":260.09999990463257,"connectEnd":260.09999990463257,"connectStart":260.09999990463257,"domainLookupEnd":260.09999990463257,"domainLookupStart":260.09999990463257,"fetchStart":260.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":260.09999990463257,"responseEnd":621.1999998092651,"responseStart":621.1999998092651,"secureConnectionStart":260.09999990463257},{"duration":364.90000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/a9324d6758d385eb45c462685ad88f1d-CDN/lu2cib/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":260.39999985694885,"connectEnd":260.39999985694885,"connectStart":260.39999985694885,"domainLookupEnd":260.39999985694885,"domainLookupStart":260.39999985694885,"fetchStart":260.39999985694885,"redirectEnd":0,"redirectStart":0,"requestStart":260.39999985694885,"responseEnd":625.2999999523163,"responseStart":625.1999998092651,"secureConnectionStart":260.39999985694885},{"duration":365.19999980926514,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":260.5,"connectEnd":260.5,"connectStart":260.5,"domainLookupEnd":260.5,"domainLookupStart":260.5,"fetchStart":260.5,"redirectEnd":0,"redirectStart":0,"requestStart":260.5,"responseEnd":625.6999998092651,"responseStart":625.6999998092651,"secureConnectionStart":260.5},{"duration":365.40000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":260.69999980926514,"connectEnd":260.69999980926514,"connectStart":260.69999980926514,"domainLookupEnd":260.69999980926514,"domainLookupStart":260.69999980926514,"fetchStart":260.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":260.69999980926514,"responseEnd":626.0999999046326,"responseStart":626.0999999046326,"secureConnectionStart":260.69999980926514},{"duration":422,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2cib/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":260.7999999523163,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":260.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":682.7999999523163,"responseStart":0,"secureConnectionStart":0},{"duration":365.5,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":261.09999990463257,"connectEnd":261.09999990463257,"connectStart":261.09999990463257,"domainLookupEnd":261.09999990463257,"domainLookupStart":261.09999990463257,"fetchStart":261.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":261.09999990463257,"responseEnd":626.5999999046326,"responseStart":626.5999999046326,"secureConnectionStart":261.09999990463257},{"duration":421.7000000476837,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":261.2999999523163,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":261.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":683,"responseStart":0,"secureConnectionStart":0},{"duration":365.7000000476837,"initiatorType":"script","name":"https://jira.mariadb.org/s/5d5e8fe91fbc506585e83ea3b62ccc4b-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":261.39999985694885,"connectEnd":261.39999985694885,"connectStart":261.39999985694885,"domainLookupEnd":261.39999985694885,"domainLookupStart":261.39999985694885,"fetchStart":261.39999985694885,"redirectEnd":0,"redirectStart":0,"requestStart":261.39999985694885,"responseEnd":627.0999999046326,"responseStart":627.0999999046326,"secureConnectionStart":261.39999985694885},{"duration":517.7000000476837,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":267.89999985694885,"connectEnd":267.89999985694885,"connectStart":267.89999985694885,"domainLookupEnd":267.89999985694885,"domainLookupStart":267.89999985694885,"fetchStart":267.89999985694885,"redirectEnd":0,"redirectStart":0,"requestStart":267.89999985694885,"responseEnd":785.5999999046326,"responseStart":785.5999999046326,"secureConnectionStart":267.89999985694885},{"duration":961.3999998569489,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":268,"connectEnd":268,"connectStart":268,"domainLookupEnd":268,"domainLookupStart":268,"fetchStart":268,"redirectEnd":0,"redirectStart":0,"requestStart":268,"responseEnd":1229.3999998569489,"responseStart":1229.3999998569489,"secureConnectionStart":268},{"duration":91.5,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":695,"connectEnd":695,"connectStart":695,"domainLookupEnd":695,"domainLookupStart":695,"fetchStart":695,"redirectEnd":0,"redirectStart":0,"requestStart":695,"responseEnd":786.5,"responseStart":786.5,"secureConnectionStart":695},{"duration":297.09999990463257,"initiatorType":"link","name":"https://jira.mariadb.org/s/d5715adaadd168a9002b108b2b039b50-CDN/lu2cib/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/css/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true&whisper-enabled=true","startTime":964.5999999046326,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":964.5999999046326,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1261.6999998092651,"responseStart":0,"secureConnectionStart":0},{"duration":280.10000014305115,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/e65b778d185daf5aee24936755b43da6/_/download/contextbatch/js/browser-metrics-plugin.contrib,-_super,-project.issue.navigator,-jira.view.issue,-atl.general/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true&whisper-enabled=true","startTime":965.6999998092651,"connectEnd":965.6999998092651,"connectStart":965.6999998092651,"domainLookupEnd":965.6999998092651,"domainLookupStart":965.6999998092651,"fetchStart":965.6999998092651,"redirectEnd":0,"redirectStart":0,"requestStart":965.6999998092651,"responseEnd":1245.7999999523163,"responseStart":1245.7999999523163,"secureConnectionStart":965.6999998092651},{"duration":285.59999990463257,"initiatorType":"script","name":"https://jira.mariadb.org/s/097ae97cb8fbec7d6ea4bbb1f26955b9-CDN/lu2cib/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/js/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true&whisper-enabled=true","startTime":966.0999999046326,"connectEnd":966.0999999046326,"connectStart":966.0999999046326,"domainLookupEnd":966.0999999046326,"domainLookupStart":966.0999999046326,"fetchStart":966.0999999046326,"redirectEnd":0,"redirectStart":0,"requestStart":966.0999999046326,"responseEnd":1251.6999998092651,"responseStart":1251.6999998092651,"secureConnectionStart":966.0999999046326},{"duration":259.59999990463257,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":1006.7999999523163,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1006.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1266.3999998569489,"responseStart":0,"secureConnectionStart":0}],"fetchStart":1,"domainLookupStart":31,"domainLookupEnd":40,"connectStart":40,"connectEnd":65,"secureConnectionStart":51,"requestStart":66,"responseStart":255,"responseEnd":268,"domLoading":258,"domInteractive":1294,"domContentLoadedEventStart":1294,"domContentLoadedEventEnd":1338,"domComplete":1738,"loadEventStart":1738,"loadEventEnd":1738,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":1269.5999999046326},{"name":"bigPipe.sidebar-id.end","time":1270.5},{"name":"bigPipe.activity-panel-pipe-id.start","time":1270.6999998092651},{"name":"bigPipe.activity-panel-pipe-id.end","time":1271.5},{"name":"activityTabFullyLoaded","time":1352.0999999046326}],"measures":[],"correlationId":"3745d6006c50f8","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":99,"dbReadsTimeInMs":12,"dbConnsTimeInMs":21,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}
In
MDEV-3404, the problem was that update_used_tables() referred to the first table in the join order, which filesort() has replaced with temptable with sorted data, and then that temptable was freed before calc_const_tables() was called.Here, the problem is similar - again we refer to a temptable that has already been freed. However, the temptable is of a different kind - this time it is SJ-Materialization temptable.
SJ-Materialization temptable is freed before the update_tmp_tables() is done for the HAVING clause. This is the cause for error.