Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-7865

Server crashes in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field on query with impossible condition and OR/AND expressions

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Won't Fix
    • 5.3.13, 5.5(EOL)
    • N/A
    • Optimizer

    Description

      Stack trace from 5.5 commit 86f46a3da4a6d82cb510dc4c270d46cfd6a8965b

      #2  0x00000000007e7ee9 in handle_fatal_signal (sig=11) at 5.5/sql/signal_handler.cc:262
      #3  <signal handler called>
      #4  0x00000000006a5682 in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field (this=0x7fb6ffbb1980) at 5.5/sql/item_cmpfunc.h:1829
      #5  0x00000000008f5636 in get_full_func_mm_tree (param=0x7fb6ffbb1f90, cond_func=0x7fb6ff169390, field_item=0x7fb6ff288548, value=0x7fb6ff169290, inv=false) at 5.5/sql/opt_range.cc:7396
      #6  0x00000000008f636d in get_mm_tree (param=0x7fb6ffbb1f90, cond=0x7fb6ff169390) at 5.5/sql/opt_range.cc:7584
      #7  0x00000000008f58d1 in get_mm_tree (param=0x7fb6ffbb1f90, cond=0x7fb6ff155950) at 5.5/sql/opt_range.cc:7440
      #8  0x00000000008f5813 in get_mm_tree (param=0x7fb6ffbb1f90, cond=0x7fb6ff155830) at 5.5/sql/opt_range.cc:7430
      #9  0x00000000008ec5eb in SQL_SELECT::test_quick_select (this=0x7fb6ff155a68, thd=0x7fb700150060, keys_to_use=..., prev_tables=4611686018427387910, limit=18446744073709551615, force_quick_range=false, ordered_output=false) at 5.5/sql/opt_range.cc:3101
      #10 0x000000000067b7ff in make_join_select (join=0x7fb6ff169a60, select=0x7fb6ff154bc0, cond=0x7fb6ff169078) at 5.5/sql/sql_select.cc:8986
      #11 0x000000000066683d in JOIN::optimize (this=0x7fb6ff169a60) at 5.5/sql/sql_select.cc:1425
      #12 0x000000000066c45b in mysql_select (thd=0x7fb700150060, rref_pointer_array=0x7fb700153cd0, tables=0x7fb6ff287318, wild_num=1, fields=..., conds=0x7fb6ff169078, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fb6ff169a40, unit=0x7fb700153380, select_lex=0x7fb700153a60) at 5.5/sql/sql_select.cc:3080
      #13 0x0000000000662fbd in handle_select (thd=0x7fb700150060, lex=0x7fb7001532d0, result=0x7fb6ff169a40, setup_tables_done_option=0) at 5.5/sql/sql_select.cc:319
      #14 0x000000000063c1fc in execute_sqlcom_select (thd=0x7fb700150060, all_tables=0x7fb6ff287318) at 5.5/sql/sql_parse.cc:4689
      #15 0x00000000006353de in mysql_execute_command (thd=0x7fb700150060) at 5.5/sql/sql_parse.cc:2234
      #16 0x000000000063ece2 in mysql_parse (thd=0x7fb700150060, rawbuf=0x7fb6ff287078 "SELECT * FROM t1, t2, t3\nWHERE ( b3 = b2 OR 'impossible' = 'expression' ) AND b2 = a1 AND ( b2 > b1 OR i2 <> i1 )", length=113, parser_state=0x7fb6ffbb5620) at 5.5/sql/sql_parse.cc:5909
      #17 0x0000000000632925 in dispatch_command (command=COM_QUERY, thd=0x7fb700150060, packet=0x7fb700209061 "SELECT * FROM t1, t2, t3\nWHERE ( b3 = b2 OR 'impossible' = 'expression' ) AND b2 = a1 AND ( b2 > b1 OR i2 <> i1 )", packet_length=113) at 5.5/sql/sql_parse.cc:1079
      #18 0x0000000000631ab1 in do_command (thd=0x7fb700150060) at 5.5/sql/sql_parse.cc:793
      #19 0x0000000000734122 in do_handle_one_connection (thd_arg=0x7fb700150060) at 5.5/sql/sql_connect.cc:1266
      #20 0x0000000000733be1 in handle_one_connection (arg=0x7fb700150060) at 5.5/sql/sql_connect.cc:1181
      #21 0x0000000000b6c629 in pfs_spawn_thread (arg=0x7fb7001a1760) at 5.5/storage/perfschema/pfs.cc:1015
      #22 0x00007fb706233b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
      #23 0x00007fb7044e970d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

      Test case

      CREATE TABLE t1 (i1 INT, a1 VARCHAR(8), b1 VARCHAR(8), KEY(b1)) ENGINE=MyISAM;
      INSERT INTO t1 VALUES (1,'foo','foo'),(2,'bar','bar');
       
      CREATE TABLE t2 (i2 INT, b2 VARCHAR(8), KEY(b2)) ENGINE=MyISAM;
      INSERT INTO t2 VALUES (1,'qux'),(2,'foo');
       
      CREATE TABLE t3 (b3 VARCHAR(8)) ENGINE=MyISAM;
      INSERT INTO t3 VALUES ('foobar');
       
      SELECT * FROM t1, t2, t3
      WHERE ( b3 = b2 OR 'impossible' = 'expression' ) AND b2 = a1 AND ( b2 > b1 OR i2 <> i1 );

      On some reason, I am not getting the crash on 10.0 and 10.1 (even pretty old 10.0). Either it's just the matter of luck, or something is different there.

      Attachments

        Issue Links

          Activity

            psergei Sergei Petrunia added a comment - https://lists.launchpad.net/maria-developers/msg10971.html

            See also the followup message in that email thread. further investigation is necessary in order to conclude whether the patch is ok.

            psergei Sergei Petrunia added a comment - See also the followup message in that email thread. further investigation is necessary in order to conclude whether the patch is ok.
            varun Varun Gupta (Inactive) added a comment - - edited

            The condition we have is
            ( b3 = b2 OR 'impossible' = 'expression' ) AND b2 = a1 AND ( b2 > b1 OR i2 <> i1 )

            Now we create multiple_equalities(ME) in the optimize_cond function

            For the first call we will build multiple_equality(b2,a1)
            For the next call we take into account the condition ( b3 = b2 OR 'impossible' = 'expression')

            • then we find if we have a multiple_equality at the upper level and check if it contains any of the fields of the current equality.
            • First predicate would be b3=b2 and we will find ME(b2,a1) at upper level and create a new equality was ME(b2,a1,b3)
            • The second predicate 'impossible' = 'expression' will be evaluated to false and will be removed, leaving only one equality at the current level, so we will try to merge it to the upper level
            • After merging at the upper level we will have ME(b2,a1,b3)

            The issue here is that b3 is an Item_field object and it points to the multiple equality created earlier() and not to the merged multiple equality().
            For such a case I think it would be good to adjust this and point it to the new multiple equalities.

            varun Varun Gupta (Inactive) added a comment - - edited The condition we have is ( b3 = b2 OR 'impossible' = 'expression' ) AND b2 = a1 AND ( b2 > b1 OR i2 <> i1 ) Now we create multiple_equalities(ME) in the optimize_cond function For the first call we will build multiple_equality(b2,a1) For the next call we take into account the condition ( b3 = b2 OR 'impossible' = 'expression') then we find if we have a multiple_equality at the upper level and check if it contains any of the fields of the current equality. First predicate would be b3=b2 and we will find ME(b2,a1) at upper level and create a new equality was ME(b2,a1,b3) The second predicate 'impossible' = 'expression' will be evaluated to false and will be removed, leaving only one equality at the current level, so we will try to merge it to the upper level After merging at the upper level we will have ME(b2,a1,b3) The issue here is that b3 is an Item_field object and it points to the multiple equality created earlier( ) and not to the merged multiple equality( ). For such a case I think it would be good to adjust this and point it to the new multiple equalities.
            varun Varun Gupta (Inactive) added a comment - Patch http://lists.askmonty.org/pipermail/commits/2018-July/012721.html

            People

              psergei Sergei Petrunia
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.