Details
-
Bug
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
-
N/A
-
None
Description
MEMBER OF (MDEV-38591) crashes the server when a column computed with MEMBER OF in the first select of a UNION derived table is filtered by the outer WHERE.
Item_func_member_of keeps hidden json_quote_item and json_contains_item helpers that are not in args[]. shallow_copy() copies the pointers, so the original item and the clones made by condition pushdown share the same helpers, and those helpers still point at the original Item_field. Item_func_member_of::walk() descends into the helpers, so cleanup_excluding_const_fields_processor, run on the pushed clone in st_select_lex::pushdown_cond_into_where_clause, reaches the original Item_field and calls Item_field::cleanup() on it (field= 0). st_select_lex::update_used_tables then calls Item_field::used_tables() on the original select-list item and dereferences the NULL field.
Crashes with a JSON or a latin1 VARCHAR container, with MEMBER OF in both selects, and with a view in place of the derived table. Does not crash for a single-select or GROUP BY derived table, or when the same select-list expression is a = 1 instead of MEMBER OF. Also crashes without the fix for MDEV-42083.
CREATE TABLE t1 (a INT, j JSON); |
CREATE TABLE t2 (a INT); |
INSERT INTO t1 VALUES (1,'[1]'),(3,'[1]'); |
INSERT INTO t2 VALUES (2); |
SELECT a FROM (SELECT a, a MEMBER OF (j) m FROM t1 UNION ALL SELECT a, 1 FROM t2) d WHERE m; |
DROP TABLE t1, t2; |
13.2.0-MariaDB-asan-debug-log source revision: bef8c2acb7bfff211e0bc903e99248d91ac37d03
|
 |
#5 <signal handler called>
|
#6 0x00005d0071fbe936 in Item_field::used_tables (this=0x52d0000f1280) at /13.2/sql/item.cc:4020
|
#7 0x00005d0071dee9b9 in Used_tables_and_const_cache::used_tables_and_const_cache_join (this=this@entry=0x52d0000f15b0, item=item@entry=0x52d0000f1280) at /13.2/sql/item.h:6086
|
#8 0x00005d0071deea98 in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (this=this@entry=0x52d0000f15b0, item=0x52d0000f1280) at /13.2/sql/item.h:6092
|
#9 0x00005d0071deead4 in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (this=0x52d0000f15b0, argc=2, argv=0x52d0000f1598) at /13.2/sql/item.h:6103
|
#10 0x00005d0071deeba5 in Item_func::update_used_tables (this=<optimized out>) at /13.2/sql/item_func.h:217
|
#11 0x00005d0072d9ff71 in Item_func_member_of::update_used_tables (this=0x52d0000f1508) at /13.2/sql/item_jsonfunc.cc:7091
|
#12 0x00005d007271e882 in st_select_lex::update_used_tables (this=0x52d0000f0bf0) at /13.2/sql/sql_lex.cc:5792
|
#13 0x00005d0072965144 in JOIN::optimize_inner (this=this@entry=0x52d0000f59b8) at /13.2/sql/sql_select.cc:2308
|
#14 0x00005d0072969fec in JOIN::optimize (this=0x52d0000f59b8) at /13.2/sql/sql_select.cc:2049
|
#15 0x00005d0072ae00ac in st_select_lex_unit::optimize (this=this@entry=0x52d0000f1e70) at /13.2/sql/sql_union.cc:2353
|
#16 0x00005d00726acccc in mysql_derived_optimize (thd=<optimized out>, lex=0x52c0000846d0, derived=0x52d0000f3be8) at /13.2/sql/sql_derived.cc:1060
|
#17 0x00005d00726ab3e9 in mysql_handle_single_derived (lex=0x52c0000846d0, derived=derived@entry=0x52d0000f3be8, phases=phases@entry=4) at /13.2/sql/sql_derived.cc:235
|
#18 0x00005d007296824d in JOIN::optimize_inner (this=this@entry=0x52d0000f4f98) at /13.2/sql/sql_select.cc:2624
|
#19 0x00005d0072969fec in JOIN::optimize (this=this@entry=0x52d0000f4f98) at /13.2/sql/sql_select.cc:2049
|
#20 0x00005d007296a841 in mysql_select (thd=thd@entry=0x52c000080220, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=<optimized out>, having=<optimized out>, proc_param=<optimized out>, select_options=<optimized out>, result=<optimized out>, unit=<optimized out>, select_lex=<optimized out>) at /13.2/sql/sql_select.cc:5366
|
#21 0x00005d007296b194 in handle_select (thd=thd@entry=0x52c000080220, lex=lex@entry=0x52c0000846d0, result=result@entry=0x52d0000f4f60, setup_tables_done_option=setup_tables_done_option@entry=0) at /13.2/sql/sql_select.cc:652
|
#22 0x00005d00727a3662 in execute_sqlcom_select (thd=thd@entry=0x52c000080220, all_tables=<optimized out>) at /13.2/sql/sql_parse.cc:6273
|
#23 0x00005d00727c3831 in mysql_execute_command (thd=thd@entry=0x52c000080220, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /13.2/sql/sql_parse.cc:4044
|
#24 0x00005d00727d0121 in mysql_parse (thd=thd@entry=0x52c000080220, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x71cf663e11b0) at /13.2/sql/sql_parse.cc:8020
|
#25 0x00005d00727d3d00 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x52c000080220, packet=packet@entry=0x529000249221 "SELECT a FROM (SELECT a, a MEMBER OF (j) m FROM t1 UNION ALL SELECT a, 1 FROM t2) d WHERE m", packet_length=packet_length@entry=91, blocking=blocking@entry=true) at /13.2/sql/sql_parse.cc:1903
|
#26 0x00005d00727d84d4 in do_command (thd=thd@entry=0x52c000080220, blocking=blocking@entry=true) at /13.2/sql/sql_parse.cc:1437
|
#27 0x00005d0072c57df1 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x50b000004680, put_in_cache=put_in_cache@entry=true) at /13.2/sql/sql_connect.cc:1529
|
#28 0x00005d0072c581f7 in handle_one_connection (arg=arg@entry=0x50b000004680) at /13.2/sql/sql_connect.cc:1441
|
#29 0x000071cf7325ea42 in asan_thread_start (arg=0x71cf6fb10000) at ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
|
#30 0x000071cf7229cb84 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
|
#31 0x000071cf72329ecc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
JarirBob FYI
Attachments
Issue Links
- relates to
-
MDEV-38591 MEMBER OF json operator
-
- In Testing
-
-
-
- Approved
-