[MDEV-12855] Server crashes in in SQL_SELECT::test_quick_select Created: 2017-05-20  Updated: 2017-06-11  Resolved: 2017-06-11

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 5.5, 10.0, 10.1
Fix Version/s: 5.5.57

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Igor Babaev
Resolution: Fixed Votes: 0
Labels: None


 Description   

--source include/have_innodb.inc
 
CREATE TABLE t1 (f1 VARCHAR(8), KEY(f1)) ENGINE=InnoDB;
INSERT INTO t1 VALUES ('foo');
CREATE TABLE t2 (f2 VARCHAR(8)) ENGINE=InnoDB;
INSERT INTO t2 VALUES ('bar'),('qux');
 
SELECT f1 FROM t1 WHERE f1 IN ( SELECT f2 FROM t2 WHERE f2 > 'bar' ) HAVING f1 != 'foo' ORDER BY f1;

5.5 7e9716310261bce124585cbffd85f3402390ec9d

#3  <signal handler called>
#4  0x00000000008b0586 in SQL_SELECT::test_quick_select (this=0x7fda569360f0, thd=0x7fda5caba060, keys_to_use=..., prev_tables=0, limit=18446744073709551615, force_quick_range=true, ordered_output=false) at /data/src/5.5/sql/opt_range.cc:2981
#5  0x000000000065e8b8 in test_if_skip_sort_order (tab=0x7fda569338f8, order=0x7fda5692f4e8, select_limit=1, no_changes=false, map=0x7fda569e54e8) at /data/src/5.5/sql/sql_select.cc:19584
#6  0x000000000065f38c in create_sort_index (thd=0x7fda5caba060, join=0x7fda5692f5f0, order=0x7fda5692f4e8, filesort_limit=18446744073709551615, select_limit=18446744073709551615, is_order_by=false) at /data/src/5.5/sql/sql_select.cc:19903
#7  0x0000000000636103 in JOIN::exec (this=0x7fda5692f5f0) at /data/src/5.5/sql/sql_select.cc:2848
#8  0x0000000000636afa in mysql_select (thd=0x7fda5caba060, rref_pointer_array=0x7fda5cabdcf0, tables=0x7fda56991310, wild_num=0, fields=..., conds=0x7fda56992ec8, og_num=1, order=0x7fda5692f4e8, group=0x0, having=0x7fda5692f268, proc_param=0x0, select_options=2147748608, result=0x7fda5692f5d0, unit=0x7fda5cabd388, select_lex=0x7fda5cabda68) at /data/src/5.5/sql/sql_select.cc:3099
#9  0x000000000062d352 in handle_select (thd=0x7fda5caba060, lex=0x7fda5cabd2d8, result=0x7fda5692f5d0, setup_tables_done_option=0) at /data/src/5.5/sql/sql_select.cc:319
#10 0x00000000006067b3 in execute_sqlcom_select (thd=0x7fda5caba060, all_tables=0x7fda56991310) at /data/src/5.5/sql/sql_parse.cc:4686
#11 0x00000000005ffb26 in mysql_execute_command (thd=0x7fda5caba060) at /data/src/5.5/sql/sql_parse.cc:2234
#12 0x000000000060937e in mysql_parse (thd=0x7fda5caba060, rawbuf=0x7fda56991078 "SELECT f1 FROM t1 WHERE f1 IN ( SELECT f2 FROM t2 WHERE f2 > 'bar' ) HAVING f1 != 'foo' ORDER BY f1", length=99, parser_state=0x7fda67bf0650) at /data/src/5.5/sql/sql_parse.cc:5931
#13 0x00000000005fd0b5 in dispatch_command (command=COM_QUERY, thd=0x7fda5caba060, packet=0x7fda603bf061 "SELECT f1 FROM t1 WHERE f1 IN ( SELECT f2 FROM t2 WHERE f2 > 'bar' ) HAVING f1 != 'foo' ORDER BY f1", packet_length=99) at /data/src/5.5/sql/sql_parse.cc:1079
#14 0x00000000005fc26f in do_command (thd=0x7fda5caba060) at /data/src/5.5/sql/sql_parse.cc:793
#15 0x00000000006fe99b in do_handle_one_connection (thd_arg=0x7fda5caba060) at /data/src/5.5/sql/sql_connect.cc:1268
#16 0x00000000006fe728 in handle_one_connection (arg=0x7fda5caba060) at /data/src/5.5/sql/sql_connect.cc:1184
#17 0x0000000000a0bb79 in pfs_spawn_thread (arg=0x7fda603ba980) at /data/src/5.5/storage/perfschema/pfs.cc:1015
#18 0x00007fda6782d494 in start_thread (arg=0x7fda67bf1700) at pthread_create.c:333
#19 0x00007fda6624393f in clone () from /lib/x86_64-linux-gnu/libc.so.6

10.1 13a350ac29eeb43153c7bca65b73b5dfa9f8ffb5

#3  <signal handler called>
#4  0x00007fa81b0ad782 in TABLE::stat_records (this=0xa5a5a5a5a5a5a5a5) at /data/src/10.1/sql/table.h:1449
#5  0x00007fa81b3887f6 in SQL_SELECT::test_quick_select (this=0x7fa8029b6818, thd=0x7fa80f788070, keys_to_use=..., prev_tables=0, limit=18446744073709551615, force_quick_range=true, ordered_output=false, remove_false_parts_of_where=false) at /data/src/10.1/sql/opt_range.cc:2412
#6  0x00007fa81b09f8ad in test_if_skip_sort_order (tab=0x7fa8029b4088, order=0x7fa802845468, select_limit=1, no_changes=false, map=0x7fa802881d08) at /data/src/10.1/sql/sql_select.cc:21104
#7  0x00007fa81b0a041f in create_sort_index (thd=0x7fa80f788070, join=0x7fa8028455b8, order=0x7fa802845468, filesort_limit=18446744073709551615, select_limit=18446744073709551615, is_order_by=true) at /data/src/10.1/sql/sql_select.cc:21434
#8  0x00007fa81b073255 in JOIN::exec_inner (this=0x7fa8028455b8) at /data/src/10.1/sql/sql_select.cc:3191
#9  0x00007fa81b070717 in JOIN::exec (this=0x7fa8028455b8) at /data/src/10.1/sql/sql_select.cc:2511
#10 0x00007fa81b073c95 in mysql_select (thd=0x7fa80f788070, rref_pointer_array=0x7fa80f78c430, tables=0x7fa802843308, wild_num=0, fields=..., conds=0x7fa802844e98, og_num=1, order=0x7fa802845468, group=0x0, having=0x7fa802845218, proc_param=0x0, select_options=2147748608, result=0x7fa802845598, unit=0x7fa80f78bab8, select_lex=0x7fa80f78c1b8) at /data/src/10.1/sql/sql_select.cc:3445
#11 0x00007fa81b0696ee in handle_select (thd=0x7fa80f788070, lex=0x7fa80f78b9f0, result=0x7fa802845598, setup_tables_done_option=0) at /data/src/10.1/sql/sql_select.cc:384
#12 0x00007fa81b0395f3 in execute_sqlcom_select (thd=0x7fa80f788070, all_tables=0x7fa802843308) at /data/src/10.1/sql/sql_parse.cc:5922
#13 0x00007fa81b02faef in mysql_execute_command (thd=0x7fa80f788070) at /data/src/10.1/sql/sql_parse.cc:2979
#14 0x00007fa81b03cd11 in mysql_parse (thd=0x7fa80f788070, rawbuf=0x7fa802843088 "SELECT f1 FROM t1 WHERE f1 IN ( SELECT f2 FROM t2 WHERE f2 > 'bar' ) HAVING f1 != 'foo' ORDER BY f1", length=99, parser_state=0x7fa81bf395e0) at /data/src/10.1/sql/sql_parse.cc:7339
#15 0x00007fa81b02bcfe in dispatch_command (command=COM_QUERY, thd=0x7fa80f788070, packet=0x7fa80f6b6071 "SELECT f1 FROM t1 WHERE f1 IN ( SELECT f2 FROM t2 WHERE f2 > 'bar' ) HAVING f1 != 'foo' ORDER BY f1", packet_length=99) at /data/src/10.1/sql/sql_parse.cc:1490
#16 0x00007fa81b02aa5d in do_command (thd=0x7fa80f788070) at /data/src/10.1/sql/sql_parse.cc:1109
#17 0x00007fa81b161c0f in do_handle_one_connection (thd_arg=0x7fa80f788070) at /data/src/10.1/sql/sql_connect.cc:1349
#18 0x00007fa81b161973 in handle_one_connection (arg=0x7fa80f788070) at /data/src/10.1/sql/sql_connect.cc:1261
#19 0x00007fa81b517e98 in pfs_spawn_thread (arg=0x7fa80f69ed70) at /data/src/10.1/storage/perfschema/pfs.cc:1860
#20 0x00007fa81a724494 in start_thread (arg=0x7fa81bf3ab00) at pthread_create.c:333
#21 0x00007fa81886f93f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Also reproducible on older versions of 5.5, 10.0. 10.1, debug and release builds.
As of now, this particular test case does not cause a crash on 10.2.



 Comments   
Comment by Igor Babaev [ 2017-06-11 ]

The fix for this bug was pushed into the 5.5 tree.

Generated at Thu Feb 08 08:01:00 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.