Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-7865

Server crashes in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field on query with impossible condition and OR/AND expressions

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Won't Fix
    • 5.3.13, 5.5
    • N/A
    • Optimizer

    Description

      Stack trace from 5.5 commit 86f46a3da4a6d82cb510dc4c270d46cfd6a8965b

      #2  0x00000000007e7ee9 in handle_fatal_signal (sig=11) at 5.5/sql/signal_handler.cc:262
      #3  <signal handler called>
      #4  0x00000000006a5682 in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field (this=0x7fb6ffbb1980) at 5.5/sql/item_cmpfunc.h:1829
      #5  0x00000000008f5636 in get_full_func_mm_tree (param=0x7fb6ffbb1f90, cond_func=0x7fb6ff169390, field_item=0x7fb6ff288548, value=0x7fb6ff169290, inv=false) at 5.5/sql/opt_range.cc:7396
      #6  0x00000000008f636d in get_mm_tree (param=0x7fb6ffbb1f90, cond=0x7fb6ff169390) at 5.5/sql/opt_range.cc:7584
      #7  0x00000000008f58d1 in get_mm_tree (param=0x7fb6ffbb1f90, cond=0x7fb6ff155950) at 5.5/sql/opt_range.cc:7440
      #8  0x00000000008f5813 in get_mm_tree (param=0x7fb6ffbb1f90, cond=0x7fb6ff155830) at 5.5/sql/opt_range.cc:7430
      #9  0x00000000008ec5eb in SQL_SELECT::test_quick_select (this=0x7fb6ff155a68, thd=0x7fb700150060, keys_to_use=..., prev_tables=4611686018427387910, limit=18446744073709551615, force_quick_range=false, ordered_output=false) at 5.5/sql/opt_range.cc:3101
      #10 0x000000000067b7ff in make_join_select (join=0x7fb6ff169a60, select=0x7fb6ff154bc0, cond=0x7fb6ff169078) at 5.5/sql/sql_select.cc:8986
      #11 0x000000000066683d in JOIN::optimize (this=0x7fb6ff169a60) at 5.5/sql/sql_select.cc:1425
      #12 0x000000000066c45b in mysql_select (thd=0x7fb700150060, rref_pointer_array=0x7fb700153cd0, tables=0x7fb6ff287318, wild_num=1, fields=..., conds=0x7fb6ff169078, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fb6ff169a40, unit=0x7fb700153380, select_lex=0x7fb700153a60) at 5.5/sql/sql_select.cc:3080
      #13 0x0000000000662fbd in handle_select (thd=0x7fb700150060, lex=0x7fb7001532d0, result=0x7fb6ff169a40, setup_tables_done_option=0) at 5.5/sql/sql_select.cc:319
      #14 0x000000000063c1fc in execute_sqlcom_select (thd=0x7fb700150060, all_tables=0x7fb6ff287318) at 5.5/sql/sql_parse.cc:4689
      #15 0x00000000006353de in mysql_execute_command (thd=0x7fb700150060) at 5.5/sql/sql_parse.cc:2234
      #16 0x000000000063ece2 in mysql_parse (thd=0x7fb700150060, rawbuf=0x7fb6ff287078 "SELECT * FROM t1, t2, t3\nWHERE ( b3 = b2 OR 'impossible' = 'expression' ) AND b2 = a1 AND ( b2 > b1 OR i2 <> i1 )", length=113, parser_state=0x7fb6ffbb5620) at 5.5/sql/sql_parse.cc:5909
      #17 0x0000000000632925 in dispatch_command (command=COM_QUERY, thd=0x7fb700150060, packet=0x7fb700209061 "SELECT * FROM t1, t2, t3\nWHERE ( b3 = b2 OR 'impossible' = 'expression' ) AND b2 = a1 AND ( b2 > b1 OR i2 <> i1 )", packet_length=113) at 5.5/sql/sql_parse.cc:1079
      #18 0x0000000000631ab1 in do_command (thd=0x7fb700150060) at 5.5/sql/sql_parse.cc:793
      #19 0x0000000000734122 in do_handle_one_connection (thd_arg=0x7fb700150060) at 5.5/sql/sql_connect.cc:1266
      #20 0x0000000000733be1 in handle_one_connection (arg=0x7fb700150060) at 5.5/sql/sql_connect.cc:1181
      #21 0x0000000000b6c629 in pfs_spawn_thread (arg=0x7fb7001a1760) at 5.5/storage/perfschema/pfs.cc:1015
      #22 0x00007fb706233b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
      #23 0x00007fb7044e970d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

      Test case

      CREATE TABLE t1 (i1 INT, a1 VARCHAR(8), b1 VARCHAR(8), KEY(b1)) ENGINE=MyISAM;
      INSERT INTO t1 VALUES (1,'foo','foo'),(2,'bar','bar');
       
      CREATE TABLE t2 (i2 INT, b2 VARCHAR(8), KEY(b2)) ENGINE=MyISAM;
      INSERT INTO t2 VALUES (1,'qux'),(2,'foo');
       
      CREATE TABLE t3 (b3 VARCHAR(8)) ENGINE=MyISAM;
      INSERT INTO t3 VALUES ('foobar');
       
      SELECT * FROM t1, t2, t3
      WHERE ( b3 = b2 OR 'impossible' = 'expression' ) AND b2 = a1 AND ( b2 > b1 OR i2 <> i1 );

      On some reason, I am not getting the crash on 10.0 and 10.1 (even pretty old 10.0). Either it's just the matter of luck, or something is different there.

      Attachments

        Issue Links

          Activity

            People

              psergei Sergei Petrunia
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.