[MDEV-10824] Crash in CREATE OR REPLACE TABLE t1 AS SELECT spfunc() Created: 2016-09-17  Updated: 2018-07-18  Resolved: 2016-10-26

Status: Closed
Project: MariaDB Server
Component/s: Locking
Affects Version/s: 10.0, 10.1
Fix Version/s: 10.0.28, 10.1.19

Type: Bug Priority: Major
Reporter: Alexander Barkov Assignee: Sergey Vojtovich
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-11129 CREATE OR REPLACE TABLE t1 AS SELECT ... Closed
relates to MDEV-9496 Crash in CREATE OR REPLACE TABLE t1 A... Closed
Sprint: 10.0.28

 Description   

This script crashes the server:

CREATE TABLE IF NOT EXISTS t1 (i INT);
DROP FUNCTION IF EXISTS f1;
DELIMITER $$
CREATE FUNCTION f1() RETURNS VARCHAR(16383)
BEGIN
  RETURN 'test';
END;
$$
DELIMITER ;
CREATE OR REPLACE TABLE t1 AS SELECT f1();

Note, if I replace CREATE OR REPLACE to a DROP followed by CREATE, it works fine:

CREATE TABLE IF NOT EXISTS t1 (i INT);
DROP FUNCTION IF EXISTS f1;
DELIMITER $$
CREATE FUNCTION f1() RETURNS VARCHAR(16383)
BEGIN
  RETURN 'test';
END;
$$
DELIMITER ;
DROP TABLE IF EXISTS t1;
CREATE TABLE t1 AS SELECT f1();



 Comments   
Comment by Elena Stepanova [ 2016-09-19 ]

To get the crash, the table needs to exist before it's re-created. I've added the statement to the test case.
10.2 is also affected, I removed it from the 'affected versions' because that's our current routine.

Stack trace from 10.0 b34d7fba31

#3  <signal handler called>
#4  0x00000000005e5eb8 in wait_while_table_is_used (thd=0x7f281f0ab070, table=0x0, function=HA_EXTRA_NOT_USED) at /data/src/10.0/sql/sql_base.cc:1819
#5  0x00000000006ef000 in mysql_rm_table_no_locks (thd=0x7f281f0ab070, tables=0x7f2821e45bb0, if_exists=false, drop_temporary=false, drop_view=false, dont_log_query=true, dont_free_locks=true) at /data/src/10.0/sql/sql_table.cc:2469
#6  0x00000000006f53db in create_table_impl (thd=0x7f281f0ab070, orig_db=0x7f27f5c22768 "test", orig_table_name=0x7f27f5c22150 "t1", db=0x7f27f5c22768 "test", table_name=0x7f27f5c22150 "t1", path=0x7f2821e46630 "./test/t1", create_info=0x7f2821e47d80, alter_info=0x7f2821e47cf0, create_table_mode=1, is_trans=0x0, key_info=0x7f2821e46858, key_count=0x7f2821e46854, frm=0x7f2821e46840) at /data/src/10.0/sql/sql_table.cc:4762
#7  0x00000000006f5cc0 in mysql_create_table_no_lock (thd=0x7f281f0ab070, db=0x7f27f5c22768 "test", table_name=0x7f27f5c22150 "t1", create_info=0x7f2821e47d80, alter_info=0x7f2821e47cf0, is_trans=0x0, create_table_mode=1) at /data/src/10.0/sql/sql_table.cc:4965
#8  0x000000000063183e in create_table_from_items (thd=0x7f281f0ab070, create_info=0x7f2821e47d80, create_table=0x7f27f5c22188, alter_info=0x7f2821e47cf0, items=0x7f281f0af218, lock=0x7f2821e479c8, hooks=0x7f2821e479a0) at /data/src/10.0/sql/sql_insert.cc:3986
#9  0x0000000000631eb7 in select_create::prepare (this=0x7f27f5c23e50, values=..., u=0x7f281f0aea10) at /data/src/10.0/sql/sql_insert.cc:4158
#10 0x000000000067c564 in JOIN::prepare (this=0x7f27f5d91088, rref_pointer_array=0x7f281f0af378, tables_init=0x0, wild_num=0, conds_init=0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7f281f0af100, unit_arg=0x7f281f0aea10) at /data/src/10.0/sql/sql_select.cc:967
#11 0x00000000006844c8 in mysql_select (thd=0x7f281f0ab070, rref_pointer_array=0x7f281f0af378, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184064, result=0x7f27f5c23e50, unit=0x7f281f0aea10, select_lex=0x7f281f0af100) at /data/src/10.0/sql/sql_select.cc:3286
#12 0x000000000067a93a in handle_select (thd=0x7f281f0ab070, lex=0x7f281f0ae948, result=0x7f27f5c23e50, setup_tables_done_option=0) at /data/src/10.0/sql/sql_select.cc:373
#13 0x0000000000648755 in mysql_execute_command (thd=0x7f281f0ab070) at /data/src/10.0/sql/sql_parse.cc:3015
#14 0x0000000000651e18 in mysql_parse (thd=0x7f281f0ab070, rawbuf=0x7f27f5c22088 "CREATE OR REPLACE TABLE t1 AS SELECT f1()", length=41, parser_state=0x7f2821e486a0) at /data/src/10.0/sql/sql_parse.cc:6576
#15 0x0000000000644918 in dispatch_command (command=COM_QUERY, thd=0x7f281f0ab070, packet=0x7f28075b3071 "CREATE OR REPLACE TABLE t1 AS SELECT f1()", packet_length=41) at /data/src/10.0/sql/sql_parse.cc:1309
#16 0x0000000000643bdb in do_command (thd=0x7f281f0ab070) at /data/src/10.0/sql/sql_parse.cc:999
#17 0x0000000000761efa in do_handle_one_connection (thd_arg=0x7f281f0ab070) at /data/src/10.0/sql/sql_connect.cc:1378
#18 0x0000000000761c6c in handle_one_connection (arg=0x7f281f0ab070) at /data/src/10.0/sql/sql_connect.cc:1293
#19 0x00007f2821aa40a4 in start_thread (arg=0x7f2821e49700) at pthread_create.c:309
#20 0x00007f281fc5c87d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Comment by Sergey Vojtovich [ 2016-10-24 ]

serg, please review fix for this bug.

Comment by Sergey Vojtovich [ 2016-11-01 ]

I'd say "Locking" category is rather a rough choice for this bug. Locking subsystems were generally fine, bug was in DDL code.

Generated at Thu Feb 08 07:45:12 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.