Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-4250

Server crashes on a query with AND and OR conditions

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 5.5.30, 5.3.13
    • Component/s: None
    • Labels:
      None

      Description

      The following query makes the server crash with a long corrupted stack trace:

      SELECT * FROM mysql.time_zone 
      WHERE ( NOT (Use_leap_seconds <= Use_leap_seconds AND Time_zone_id != 1) 
              AND Time_zone_id = Time_zone_id 
           OR Time_zone_id <> Time_zone_id ) 
        AND Use_leap_seconds <> 'N'
      ;

      Reproducible on maria/5.5 tree starting from revision 3671 (merge 5.3=>5.5), however 5.3 does not crash with the same query.

      Stack trace (from a debug build, same picture on two different machines, note 2400+ frames):

      Thread 1 (Thread 0x7f194ae44700 (LWP 30028)):
      #0  __pthread_kill (threadid=<optimized out>, signo=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/pthread_kill.c:63
      #1  0x0000000000ccf314 in my_write_core (sig=11) at 5.5/mysys/stacktrace.c:457
      #2  0x00000000007c5bc8 in handle_fatal_signal (sig=11) at 5.5/sql/signal_handler.cc:262
      #3  <signal handler called>
      #4  0x00007f194004ada8 in ?? ()
      #5  0xa5a5a5a5a5a5a5a5 in ?? ()
      ...
      #2402 0x00007f1940048fd0 in ?? ()
      #2403 0x0000000000000800 in ?? ()
      #2404 0x0000000000ca006e in init_dynamic_array2 (array=0xff000000ff, element_size=255, init_buffer=0xff000000ff, init_alloc=255, alloc_increment=255) at 5.5/mysys/array.c:65
      Backtrace stopped: previous frame inner to this frame (corrupt stack?)

      revision-id: holyfoot@askmonty.org-20130305214525-2lgv24a11bmeu6iq
      revno: 3682
      branch-nick: 5.5

      Reproducible with the default optimizer_switch as well as with all OFF values.
      EXPLAIN also crashes.

        Attachments

          Activity

            People

            • Assignee:
              igor Igor Babaev
              Reporter:
              elenst Elena Stepanova
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: