[MCOL-1083] cannot execute 2 subqueries with blob in select part Created: 2017-12-06  Updated: 2020-08-25  Resolved: 2017-12-22

Status: Closed
Project: MariaDB ColumnStore
Component/s: None
Affects Version/s: 1.1.1, 1.1.2
Fix Version/s: 1.1.3

Type: Bug Priority: Major
Reporter: Richard Stracke Assignee: Daniel Lee (Inactive)
Resolution: Fixed Votes: 1
Labels: None

Sprint: 2017-24, 2017-25

 Description   

To reproduce:

create database b2;
 
use b2;
 
CREATE TABLE `t1` (
  `ID` int(11) DEFAULT NULL
) ENGINE=Columnstore;
 
CREATE TABLE `t2` (
  `ID` int(11) DEFAULT NULL,
  `image` blob DEFAULT NULL
) ENGINE=Columnstore;
 
 select (select id from t2 where id = t1.id) as s1 ,(select image from t2 where id = t1.id ) as s2,
(select image from t2 where id = t1.id ) as s3 from t1; 
 
ERROR 1815 (HY000): Internal error: InetStreamSocket::readToMagic: Remote is closed



 Comments   
Comment by Andrew Hutchings (Inactive) [ 2017-12-06 ]

ExeMgr crashes and it looks like we blow a memory segment somewhere:

Thread 15 "ExeMgr" received signal SIGABRT, Aborted.
[Switching to Thread 0x7f4215ffb700 (LWP 21298)]
0x00007f4223fce428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007f4223fce428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007f4223fd002a in __GI_abort () at abort.c:89
#2  0x00007f42240107ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7f4224129e98 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007f422401937a in malloc_printerr (ar_ptr=<optimised out>, ptr=<optimised out>, str=0x7f4224129ff0 "free(): invalid next size (normal)", action=3) at malloc.c:5006
#4  _int_free (av=<optimised out>, p=<optimised out>, have_lock=0) at malloc.c:3867
#5  0x00007f422401d53c in __GI___libc_free (mem=<optimised out>) at malloc.c:2968
#6  0x00007f422490df15 in operator delete (ptr=<optimised out>) at ../../../../src/libstdc++-v3/libsupc++/del_op.cc:46
#7  0x00007f422499530b in __gnu_cxx::new_allocator<char>::deallocate (this=0x7f4215ffa3f0, __p=<optimised out>)
    at /build/gcc-5-ei9E80/gcc-5-5.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/ext/new_allocator.h:110
#8  std::allocator_traits<std::allocator<char> >::deallocate (__a=..., __n=<optimised out>, __p=<optimised out>)
    at /build/gcc-5-ei9E80/gcc-5-5.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/alloc_traits.h:517
#9  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_destroy (__size=<optimised out>, this=0x7f4215ffa3f0)
    at /build/gcc-5-ei9E80/gcc-5-5.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.h:185
#10 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_dispose (this=0x7f4215ffa3f0)
    at /build/gcc-5-ei9E80/gcc-5-5.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.h:180
#11 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string (this=0x7f4215ffa3f0, __in_chrg=<optimised out>)
    at /build/gcc-5-ei9E80/gcc-5-5.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/bits/basic_string.h:543
#12 std::__cxx11::basic_stringbuf<char, std::char_traits<char>, std::allocator<char> >::~basic_stringbuf (this=0x7f4215ffa3a8, __in_chrg=<optimised out>)
    at /build/gcc-5-ei9E80/gcc-5-5.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/sstream:65
#13 std::__cxx11::basic_ostringstream<char, std::char_traits<char>, std::allocator<char> >::~basic_ostringstream (this=0x7f4215ffa3a0, __in_chrg=<optimised out>, __vtt_parm=<optimised out>)
    at /build/gcc-5-ei9E80/gcc-5-5.4.0/build/x86_64-linux-gnu/libstdc++-v3/include/sstream:577
#14 0x00007f422a7be9f9 in joblist::TupleHashJoinStep::formatMiniStats (this=0x7f421015a0c0, index=1)
    at /home/linuxjedi/Programming/Git/mariadb-columnstore-server/mariadb-columnstore-engine/dbcon/joblist/tuplehashjoin.cpp:1034
#15 0x00007f422a7b91ec in joblist::TupleHashJoinStep::smallRunnerFcn (this=0x7f421015a0c0, index=1)
    at /home/linuxjedi/Programming/Git/mariadb-columnstore-server/mariadb-columnstore-engine/dbcon/joblist/tuplehashjoin.cpp:352
#16 0x00007f422a7c735a in joblist::TupleHashJoinStep::SmallRunner::operator() (this=0x7f42000009e0)
    at /home/linuxjedi/Programming/Git/mariadb-columnstore-server/mariadb-columnstore-engine/dbcon/joblist/tuplehashjoin.h:274
#17 0x00007f422a7cb07c in boost::detail::function::void_function_obj_invoker0<joblist::TupleHashJoinStep::SmallRunner, void>::invoke (function_obj_ptr=...)
    at /usr/include/boost/function/function_template.hpp:159
#18 0x00007f4224e532ff in boost::function0<void>::operator() (this=0x7f42000009d8) at /usr/include/boost/function/function_template.hpp:773
#19 0x00007f4224e50a8b in threadpool::ThreadPool::beginThread (this=0x7f422ab67e60 <joblist::JobStep::jobstepThreadPool>)
    at /home/linuxjedi/Programming/Git/mariadb-columnstore-server/mariadb-columnstore-engine/utils/threadpool/threadpool.cpp:307
#20 0x00007f4224e5241b in threadpool::ThreadPool::beginThreadFunc::operator() (this=0x7f42080191e8)
    at /home/linuxjedi/Programming/Git/mariadb-columnstore-server/mariadb-columnstore-engine/utils/threadpool/threadpool.h:200
#21 0x00007f4224e56a28 in boost::detail::thread_data<threadpool::ThreadPool::beginThreadFunc>::run (this=0x7f4208019030) at /usr/include/boost/thread/detail/thread.hpp:116
#22 0x00007f42266135d5 in boost::(anonymous namespace)::thread_proxy (param=<optimised out>) at libs/thread/src/pthread/thread.cpp:168
#23 0x00007f4225ac96ba in start_thread (arg=0x7f4215ffb700) at pthread_create.c:333
#24 0x00007f42240a03dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Comment by Andrew Hutchings (Inactive) [ 2017-12-06 ]

Using valgrind it was spotted that Row::initToNull() is doing a very bad thing for TEXT/BLOB, overwriting memory it doesn't own. Very surprised we hadn't hit this before.

Comment by Andrew Hutchings (Inactive) [ 2017-12-06 ]

For QA: see description, ExeMgr crashes before fix.

Comment by Daniel Lee (Inactive) [ 2017-12-22 ]

Build verified: 1.1.3

Verified test case in the bug description.

centos6
1um2pm configuration

Generated at Thu Feb 08 02:26:03 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.