[MCOL-5438] Math over widedecimal that includes count() causes SEGV Created: 2023-02-24  Updated: 2023-04-01  Resolved: 2023-04-01

Status: Closed
Project: MariaDB ColumnStore
Component/s: ExeMgr, PrimProc
Affects Version/s: 6.4.6, 22.08.8, 23.02.1
Fix Version/s: 23.02.2

Type: Bug Priority: Major
Reporter: Roman Assignee: Roman
Resolution: Fixed Votes: 0
Labels: beginner-friendly, stability

Issue Links:
PartOf
includes MCOL-5310 Columnstore crashes in malloc() with ... Closed
Relates
relates to MCOL-5310 Columnstore crashes in malloc() with ... Closed
Sprint: 2023-4, 2023-5
Assigned for Review: Denis Khalikov Denis Khalikov
Assigned for Testing: Kirill Perov Kirill Perov

 Description   

Plz see my last comment int MCOL-5310 to get the idea of what happens.
dataconvert::strtoll128 gets count() as a widedecimal column and its precision is 9999. The precision is used as an index in an array of 38 elements thus it is either out-of-bounds access and SEGV is called or a unexpected math result.



 Comments   
Comment by Roman [ 2023-03-02 ]

Here is a call stack for SEGV I had seen in the wild.

#0  0x00007f037515406c in dataconvert::strtoll128 (data=0x401f0f00000156 <error: Cannot access memory at address 0x401f0f00000156>, saturate=@0x7efa208024d0: false, ep=ep@entry=0x7efa208024d8) at ./storage/columnstore/columnstore/utils/dataconvert/./dataconvert.h:1518
1518	./storage/columnstore/columnstore/utils/dataconvert/./dataconvert.h: No such file or directory.
[Current thread is 1 (Thread 0x7efa20803700 (LWP 1723826))]
(gdb) bt
#0  0x00007f037515406c in dataconvert::strtoll128 (data=0x401f0f00000156 <error: Cannot access memory at address 0x401f0f00000156>, saturate=@0x7efa208024d0: false, ep=ep@entry=0x7efa208024d8)
    at ./storage/columnstore/columnstore/utils/dataconvert/./dataconvert.h:1518
#1  0x00007f037515a0cc in dataconvert::number_int_value<__int128> (data=“1”, typeCode=typeCode@entry=datatypes::SystemCatalog::DECIMAL, ct=...,
    pushwarning=pushwarning@entry=@0x7efa2080260f: false, noRoundup=noRoundup@entry=false, intVal=@0x7efa20802610: 1, saturate=0x0) at /usr/include/c++/9/bits/basic_string.h:2300
#2  0x00007f0374fc9c77 in datatypes::SystemCatalog::TypeAttributesStd::decimal128FromString (this=this@entry=0x7efa20802650, value=“1", saturate=saturate@entry=0x0)
    at ./storage/columnstore/columnstore/datatypes/mcs_datatype.cpp:64
#3  0x00007f03754abc45 in rowgroup::RowAggregationUM::doNotNullConstantAggregate (this=0x7efa601537f0, aggData=..., i=2)
    at ./storage/columnstore/columnstore/utils/rowgroup/rowaggregation.cpp:3670
#4  0x00007f037549f0de in rowgroup::RowAggregationUM::fixConstantAggregate (this=0x7efa601537f0) at ./storage/columnstore/columnstore/utils/rowgroup/rowaggregation.cpp:3286
#5  0x00007f03754a983d in rowgroup::RowAggregationUM::finalize (this=0x7efa601537f0) at ./storage/columnstore/columnstore/utils/rowgroup/rowaggregation.cpp:2461
#6  0x00007f0375d3fc37 in joblist::TupleAggregateStep::doThreadedAggregate (this=0x7efa60149400, bs=..., dlp=0x7efa6014bf20)
    at ./builddir/storage/columnstore/columnstore/.boost/boost-lib/include/boost/smart_ptr/shared_ptr.hpp:784
#7  0x00007f0375d404b7 in joblist::TupleAggregateStep::doAggregate (this=0x7efa60149400) at ./storage/columnstore/columnstore/dbcon/joblist/tupleaggregatestep.cpp:5658
#8  0x00007f0374b051cf in boost::function0<void>::operator() (this=0x7efb28002b98) at ./builddir/storage/columnstore/columnstore/.boost/boost-lib/include/boost/function/function_template.hpp:677
#9  threadpool::ThreadPool::beginThread (this=0x55ea39dc00c0 <joblist::JobStep::jobstepThreadPool>) at ./storage/columnstore/columnstore/utils/threadpool/threadpool.cpp:382
#10 0x000055ea39c5942b in thread_proxy ()
#11 0x00007f0374b7a609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#12 0x00007f0374665133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment by Roman [ 2023-03-02 ]

Here is the repro case;

create table cs1(d decimal(38))engine=columnstore;
insert into cs1 values (42);
select count(CASE WHEN 3 IN(42,4) THEN 1 ELSE 0 END) * 100/SUM(1) from cs1;

Comment by Roman [ 2023-03-10 ]

Plz take a look.

Comment by Daniel Lee (Inactive) [ 2023-04-01 ]

Build verified: 23.02.2 (Jenkins RC)

Verified test case. No crash and result match of InnoDB

MariaDB [mytest]> create table cs1(d decimal(38))engine=columnstore;
Query OK, 0 rows affected (0.316 sec)
 
MariaDB [mytest]> insert into cs1 values (42);
Query OK, 1 row affected (0.237 sec)
 
MariaDB [mytest]> select count(CASE WHEN 3 IN(42,4) THEN 1 ELSE 0 END) * 100/SUM(1) from cs1;
+------------------------------------------------------------+
| count(CASE WHEN 3 IN(42,4) THEN 1 ELSE 0 END) * 100/SUM(1) |
+------------------------------------------------------------+
|                                                   100.0000 |
+------------------------------------------------------------+
1 row in set (0.085 sec)

Generated at Thu Feb 08 02:57:53 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.