[MDEV-10057] Crash with EXPLAIN + WITH + constant query Created: 2016-05-12  Updated: 2016-09-07  Resolved: 2016-09-07

Status: Closed
Project: MariaDB Server
Component/s: Optimizer - CTE
Affects Version/s: 10.2
Fix Version/s: 10.2.2

Type: Bug Priority: Major
Reporter: Alexander Barkov Assignee: Igor Babaev
Resolution: Fixed Votes: 0
Labels: CTE

Issue Links:
Relates
relates to MDEV-10058 Suspicious EXPLAIN output for a deriv... Closed

 Description   

This script

DROP TABLE IF EXISTS t1;
 
CREATE TABLE t1 (a INT);
 
INSERT INTO t1 VALUES (1),(2),(3);
 
SELECT * FROM (WITH a AS (SELECT * FROM t1) SELECT 1) AS t1;
 
EXPLAIN SELECT * FROM (WITH a AS (SELECT * FROM t1) SELECT 1) AS t1;

crashes the served with the following stack trace:

#0  0x0000555555a419a3 in st_select_lex::update_used_tables (this=0x7ffecf4612e0)
 
    at /home/bar/maria-git/server.10.2/sql/sql_lex.cc:4218
 
#1  0x0000555555a8bda7 in JOIN::optimize_inner (this=0x7ffecf4656f0)
 
    at /home/bar/maria-git/server.10.2/sql/sql_select.cc:1162
 
#2  0x0000555555a8b9b4 in JOIN::optimize (this=0x7ffecf4656f0) at /home/bar/maria-git/server.10.2/sql/sql_select.cc:1070
 
#3  0x0000555555a93cbf in mysql_select (thd=0x7ffecf416070, tables=0x7ffecf461ee0, wild_num=0, fields=..., conds=0x0, 
    og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184068, result=0x7ffecf4644d0, 
    unit=0x7ffecf461678, select_lex=0x7ffecf4612e0) at /home/bar/maria-git/server.10.2/sql/sql_select.cc:3524
 
#4  0x0000555555ac7a2b in mysql_explain_union (thd=0x7ffecf416070, unit=0x7ffecf461678, result=0x7ffecf4644d0)
 
    at /home/bar/maria-git/server.10.2/sql/sql_select.cc:24511
 
#5  0x0000555555ac77c7 in select_describe (join=0x7ffecf464b50, need_tmp_table=false, need_order=false, distinct=false, 
    message=0x0) at /home/bar/maria-git/server.10.2/sql/sql_select.cc:24466
 
#6  0x0000555555a935b9 in JOIN::exec_inner (this=0x7ffecf464b50)
 
    at /home/bar/maria-git/server.10.2/sql/sql_select.cc:3314
 
#7  0x0000555555a92c8a in JOIN::exec (this=0x7ffecf464b50) at /home/bar/maria-git/server.10.2/sql/sql_select.cc:3154
 
#8  0x0000555555a93d4f in mysql_select (thd=0x7ffecf416070, tables=0x7ffecf463e00, wild_num=1, fields=..., conds=0x0, 
    og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748612, result=0x7ffecf4644d0, 
    unit=0x7ffecf419ac0, select_lex=0x7ffecf41a1e8) at /home/bar/maria-git/server.10.2/sql/sql_select.cc:3538
 
#9  0x0000555555ac7a2b in mysql_explain_union (thd=0x7ffecf416070, unit=0x7ffecf419ac0, result=0x7ffecf4644d0)
 
    at /home/bar/maria-git/server.10.2/sql/sql_select.cc:24511



 Comments   
Comment by Alexander Barkov [ 2016-05-12 ]

A similar crash happens with this script:

DROP TABLE IF EXISTS t1,t2,t3;
 
CREATE TABLE t1 (a INT);
 
CREATE TABLE t2 (a INT);
 
CREATE TABLE t3 (a INT);
 
INSERT INTO t1 VALUES (1),(2),(3);
 
INSERT INTO t2 VALUES (1),(2),(3);
 
INSERT INTO t3 VALUES (1),(2),(3);
 
EXPLAIN WITH a AS (SELECT * FROM t1) SELECT * FROM (t2 NATURAL JOIN t3);

and with this script:

DROP TABLE IF EXISTS t1,t2,t3;
 
CREATE TABLE t1 (a INT);
 
CREATE TABLE t2 (a INT);
 
CREATE TABLE t3 (a INT);
 
INSERT INTO t1 VALUES (1),(2),(3);
 
INSERT INTO t2 VALUES (1),(2),(3);
 
INSERT INTO t3 VALUES (1),(2),(3);
 
EXPLAIN SELECT * FROM (WITH a AS (SELECT * FROM t1) SELECT * FROM t2 NATURAL JOIN t3) AS d1;

Comment by Sergei Petrunia [ 2016-09-04 ]

Checked all the testcase. Neither crashes on the current 10.2 tree (after the recursive CTEs tree was merged).

Comment by Alexander Barkov [ 2016-09-07 ]

Reopened. Please see here for details:
https://lists.launchpad.net/maria-developers/msg09938.html

Generated at Thu Feb 08 07:39:21 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.