[MDEV-13355] Assertion `using_unique_constraint || group_buff <= param->group_buff + param->group_length' failed in create_tmp_table Created: 2017-07-19  Updated: 2019-12-17  Resolved: 2019-12-12

Status: Closed
Project: MariaDB Server
Component/s: Optimizer - Window functions
Affects Version/s: 10.2
Fix Version/s: N/A

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Sergei Petrunia
Resolution: Cannot Reproduce Votes: 0
Labels: None

Issue Links:
Duplicate
is duplicated by MCOL-1375 Assertion failure when using HAVING w... Closed
Relates
relates to MDEV-12575 Server crash in AGGR_OP::put_record o... Closed
relates to MDEV-16680 [draft] ASAN use-after-poison in JOIN... Open
Sprint: 10.2.10

 Description    

CREATE TABLE t1 (i INT);
 
INSERT INTO t1 VALUES (1),(2);
 
 
 
SELECT * FROM ( 
  SELECT 
    ROW_NUMBER() OVER(), i
 
    FROM t1
 
    WHERE 1=0
 
    GROUP BY i
 
) AS sq
 
;

10.2 bc75c57cfc18be64f167d91c431076f581b0382b

 
mysqld: /data/src/10.2/sql/sql_select.cc:17043: TABLE* create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, ORDER*, bool, bool, ulonglong, ha_rows, const char*, bool, bool): Assertion `using_unique_constraint || group_buff <= param->group_buff + param->group_length' failed.
 
170719 19:47:10 [ERROR] mysqld got signal 6 ;
 
 
 
#7  0x00007feb6f73f312 in __GI___assert_fail (assertion=0x7feb72a6b188 "using_unique_constraint || group_buff <= param->group_buff + param->group_length", file=0x7feb72a69bc8 "/data/src/10.2/sql/sql_select.cc", line=17043, function=0x7feb72a6d700 <create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, char const*, bool, bool)::__PRETTY_FUNCTION__> "TABLE* create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, ORDER*, bool, bool, ulonglong, ha_rows, const char*, bool, bool)") at assert.c:101
 
#8  0x00007feb72062e1c in create_tmp_table (thd=0x7feb58000b00, param=0x7feb58015b90, fields=..., group=0x7feb58013e90, distinct=false, save_sum_fields=false, select_options=2416184064, rows_limit=18446744073709551615, table_alias=0x7feb72a695e4 "", do_not_open=true, keep_row_order=false) at /data/src/10.2/sql/sql_select.cc:17042
 
#9  0x00007feb7203e1f9 in JOIN::create_postjoin_aggr_table (this=0x7feb58014c58, tab=0x7feb580157e0, table_fields=0x7feb58014f78, table_group=0x7feb58013e90, save_sum_fields=false, distinct=false, keep_row_order=false) at /data/src/10.2/sql/sql_select.cc:2835
 
#10 0x00007feb7203c58f in JOIN::make_aggr_tables_info (this=0x7feb58014c58) at /data/src/10.2/sql/sql_select.cc:2405
 
#11 0x00007feb7203b83c in JOIN::optimize_inner (this=0x7feb58014c58) at /data/src/10.2/sql/sql_select.cc:2183
 
#12 0x00007feb72037bb9 in JOIN::optimize (this=0x7feb58014c58) at /data/src/10.2/sql/sql_select.cc:1085
 
#13 0x00007feb71fc8aaa in mysql_derived_optimize (thd=0x7feb58000b00, lex=0x7feb58004520, derived=0x7feb58013f28) at /data/src/10.2/sql/sql_derived.cc:890
 
#14 0x00007feb71fc73ba in mysql_handle_single_derived (lex=0x7feb58004520, derived=0x7feb58013f28, phases=4) at /data/src/10.2/sql/sql_derived.cc:197
 
#15 0x00007feb7203896c in JOIN::optimize_inner (this=0x7feb58014630) at /data/src/10.2/sql/sql_select.cc:1337
 
#16 0x00007feb72037bb9 in JOIN::optimize (this=0x7feb58014630) at /data/src/10.2/sql/sql_select.cc:1085
 
#17 0x00007feb72040b0c in mysql_select (thd=0x7feb58000b00, tables=0x7feb58013f28, wild_num=1, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7feb58014610, unit=0x7feb580045e8, select_lex=0x7feb58004d20) at /data/src/10.2/sql/sql_select.cc:3658
 
#18 0x00007feb720354ea in handle_select (thd=0x7feb58000b00, lex=0x7feb58004520, result=0x7feb58014610, setup_tables_done_option=0) at /data/src/10.2/sql/sql_select.cc:373
 
#19 0x00007feb720013c8 in execute_sqlcom_select (thd=0x7feb58000b00, all_tables=0x7feb58013f28) at /data/src/10.2/sql/sql_parse.cc:6443
 
#20 0x00007feb71ff7407 in mysql_execute_command (thd=0x7feb58000b00) at /data/src/10.2/sql/sql_parse.cc:3458
 
#21 0x00007feb72004d88 in mysql_parse (thd=0x7feb58000b00, rawbuf=0x7feb58012378 "SELECT * FROM ( \nSELECT \nROW_NUMBER() OVER(), i\nFROM t1\nWHERE 1=0\nGROUP BY i\n) AS sq", length=84, parser_state=0x7feb69bee200, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7879
 
#22 0x00007feb71ff2e34 in dispatch_command (command=COM_QUERY, thd=0x7feb58000b00, packet=0x7feb58168011 "SELECT * FROM ( \nSELECT \nROW_NUMBER() OVER(), i\nFROM t1\nWHERE 1=0\nGROUP BY i\n) AS sq\n", packet_length=85, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1817
 
#23 0x00007feb71ff1775 in do_command (thd=0x7feb58000b00) at /data/src/10.2/sql/sql_parse.cc:1362
 
#24 0x00007feb7213d4e7 in do_handle_one_connection (connect=0x7feb74c15760) at /data/src/10.2/sql/sql_connect.cc:1354
 
#25 0x00007feb7213d274 in handle_one_connection (arg=0x7feb74c15760) at /data/src/10.2/sql/sql_connect.cc:1260
 
#26 0x00007feb72484922 in pfs_spawn_thread (arg=0x7feb74cb7f40) at /data/src/10.2/storage/perfschema/pfs.cc:1862
 
#27 0x00007feb71614064 in start_thread (arg=0x7feb69bef700) at pthread_create.c:309
 
#28 0x00007feb6f7f962d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111



 Comments   
Comment by Sergei Petrunia [ 2017-07-21 ]

First variant of the fix: http://lists.askmonty.org/pipermail/commits/2017-July/011314.html

igor, please review.

Comment by Alice Sherepa [ 2018-05-22 ]

variations (to make it searchable):

 10.3 fe3bf136b6cf
 
Thread 1 (Thread 0x7f570dd38700 (LWP 13249)):
 
#0  __pthread_kill (threadid=<optimized out>, signo=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:62
 
#1  0x000055df54587f0f in my_write_core (sig=11) at /home/alice/git/10.3/mysys/stacktrace.c:481
 
#2  0x000055df53d76951 in handle_fatal_signal (sig=11) at /home/alice/git/10.3/sql/signal_handler.cc:305
 
#3  <signal handler called>
 
#4  0x000055df53d99ebf in Item_field::used_tables (this=0x7f56fc18b7c0) at /home/alice/git/10.3/sql/item.cc:3510
 
#5  0x000055df53974b45 in Item::const_item (this=0x7f56fc18b7c0) at /home/alice/git/10.3/sql/item.h:1355
 
#6  0x000055df53aec293 in create_tmp_table (thd=0x7f56fc000a98, param=0x7f56fc182a70, fields=..., group=0x0, distinct=false, save_sum_fields=true, select_options=2147748609, rows_limit=18446744073709551615, table_alias=0x55df54f8e760 <empty_clex_str>, do_not_open=true, keep_row_order=false) at /home/alice/git/10.3/sql/sql_select.cc:17192
 
#7  0x000055df53ac8037 in JOIN::create_postjoin_aggr_table (this=0x7f56fc131890, tab=0x7f56fc18ade0, table_fields=0x7f56fc131c00, table_group=0x0, save_sum_fields=true, distinct=false, keep_row_order=false) at /home/alice/git/10.3/sql/sql_select.cc:3308
 
#8  0x000055df53ac6e63 in JOIN::make_aggr_tables_info (this=0x7f56fc131890) at /home/alice/git/10.3/sql/sql_select.cc:3026
 
#9  0x000055df53ac52a5 in JOIN::optimize_stage2 (this=0x7f56fc131890) at /home/alice/git/10.3/sql/sql_select.cc:2588
 
#10 0x000055df53ac2c41 in JOIN::optimize_inner (this=0x7f56fc131890) at /home/alice/git/10.3/sql/sql_select.cc:1882
 
#11 0x000055df53ac1363 in JOIN::optimize (this=0x7f56fc131890) at /home/alice/git/10.3/sql/sql_select.cc:1437
 
#12 0x000055df53acadd8 in mysql_select (thd=0x7f56fc000a98, tables=0x7f56fc076f40, wild_num=0, fields=..., conds=0x7f56fc0709b0, og_num=1, order=0x0, group=0x7f56fc068670, having=0x7f56fc070e40, proc_param=0x0, select_options=2147748609, result=0x7f56fc128a50, unit=0x7f56fc004918, select_lex=0x7f56fc0050b0) at /home/alice/git/10.3/sql/sql_select.cc:4181
 
#13 0x000055df53abce9a in handle_select (thd=0x7f56fc000a98, lex=0x7f56fc004850, result=0x7f56fc128a50, setup_tables_done_option=0) at /home/alice/git/10.3/sql/sql_select.cc:382
 
#14 0x000055df53a86eca in execute_sqlcom_select (thd=0x7f56fc000a98, all_tables=0x7f56fc076f40) at /home/alice/git/10.3/sql/sql_parse.cc:6545
 
#15 0x000055df53a7d190 in mysql_execute_command (thd=0x7f56fc000a98) at /home/alice/git/10.3/sql/sql_parse.cc:3768
 
#16 0x000055df53a8abac in mysql_parse (thd=0x7f56fc000a98, rawbuf=0x7f56fc017850 "SELECT DISTINCT BIT_XOR((CASE `col_int_nokey` WHEN (MINUTE(`pk`)) THEN (POSITION(`col_int_key` IN 5855)) END)) OVER () AS field1\n,BIT_COUNT((DEFAULT(`col_int_key`))) AS field2\nFROM `CC`\nWHERE @A := 'q"..., length=304, parser_state=0x7f570dd375d0, is_com_multi=false, is_next_command=false) at /home/alice/git/10.3/sql/sql_parse.cc:8019
 
#17 0x000055df53a77b8f in dispatch_command (command=COM_QUERY, thd=0x7f56fc000a98, packet=0x7f56fc00a589 "SELECT DISTINCT BIT_XOR((CASE `col_int_nokey` WHEN (MINUTE(`pk`)) THEN (POSITION(`col_int_key` IN 5855)) END)) OVER () AS field1\n,BIT_COUNT((DEFAULT(`col_int_key`))) AS field2\nFROM `CC`\nWHERE @A := 'q"..., packet_length=304, is_com_multi=false, is_next_command=false) at /home/alice/git/10.3/sql/sql_parse.cc:1846
 
#18 0x000055df53a765ac in do_command (thd=0x7f56fc000a98) at /home/alice/git/10.3/sql/sql_parse.cc:1391
 
#19 0x000055df53be109b in do_handle_one_connection (connect=0x55df55e70338) at /home/alice/git/10.3/sql/sql_connect.cc:1402
 
#20 0x000055df53be0dec in handle_one_connection (arg=0x55df55e70338) at /home/alice/git/10.3/sql/sql_connect.cc:1308
 
#21 0x000055df54509eb0 in pfs_spawn_thread (arg=0x55df55e7ddb8) at /home/alice/git/10.3/storage/perfschema/pfs.cc:1862
 
#22 0x00007f57147d76ba in start_thread (arg=0x7f570dd38700) at pthread_create.c:333
 
#23 0x00007f5713c6c41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109


 10.3 fe3bf136b6cf
 
Thread 1 (Thread 0x7fd2082a8700 (LWP 12437)):
 
#0  __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:62
 
#1  0x000055583f68ef0f in my_write_core (sig=6) at /home/alice/git/10.3/mysys/stacktrace.c:481
 
#2  0x000055583ee7d951 in handle_fatal_signal (sig=6) at /home/alice/git/10.3/sql/signal_handler.cc:305
 
#3  <signal handler called>
 
#4  0x00007fd20d164428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
 
#5  0x00007fd20d16602a in __GI_abort () at abort.c:89
 
#6  0x00007fd20d1a67ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fd20d2bfed8 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
 
#7  0x00007fd20d1af37a in malloc_printerr (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7fd20d2bccaf "free(): invalid pointer", action=3) at malloc.c:5006
 
#8  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3867
 
#9  0x00007fd20d1b353c in __GI___libc_free (mem=<optimized out>) at malloc.c:2968
 
#10 0x000055583f686853 in my_free (ptr=0x7fd1ec18b118) at /home/alice/git/10.3/mysys/my_malloc.c:222
 
#11 0x000055583f677338 in free_root (root=0x7fd2082a64c0, MyFlags=0) at /home/alice/git/10.3/mysys/my_alloc.c:418
 
#12 0x000055583ebf7a92 in free_tmp_table (thd=0x7fd1ec000a98, entry=0x7fd1ec1814d0) at /home/alice/git/10.3/sql/sql_select.cc:18568
 
#13 0x000055583ebe8784 in JOIN::cleanup (this=0x7fd1ec18a220, full=true) at /home/alice/git/10.3/sql/sql_select.cc:12696
 
#14 0x000055583ebd18b3 in JOIN::destroy (this=0x7fd1ec18a220) at /home/alice/git/10.3/sql/sql_select.cc:4022
 
#15 0x000055583ec7b05f in st_select_lex::cleanup (this=0x7fd1ec0050b0) at /home/alice/git/10.3/sql/sql_union.cc:1924
 
#16 0x000055583ebd1efb in mysql_select (thd=0x7fd1ec000a98, tables=0x7fd1ec076f40, wild_num=0, fields=..., conds=0x0, og_num=1, order=0x0, group=0x7fd1ec17fee0, having=0x7fd1ec107150, proc_param=0x0, select_options=551903562497, result=0x7fd1ec17f8a0, unit=0x7fd1ec004918, select_lex=0x7fd1ec0050b0) at /home/alice/git/10.3/sql/sql_select.cc:4207
 
#17 0x000055583ebc3e9a in handle_select (thd=0x7fd1ec000a98, lex=0x7fd1ec004850, result=0x7fd1ec17f8a0, setup_tables_done_option=0) at /home/alice/git/10.3/sql/sql_select.cc:382
 
#18 0x000055583eb8deca in execute_sqlcom_select (thd=0x7fd1ec000a98, all_tables=0x7fd1ec076f40) at /home/alice/git/10.3/sql/sql_parse.cc:6545
 
#19 0x000055583eb84190 in mysql_execute_command (thd=0x7fd1ec000a98) at /home/alice/git/10.3/sql/sql_parse.cc:3768
 
#20 0x000055583eb91bac in mysql_parse (thd=0x7fd1ec000a98, rawbuf=0x7fd1ec017850 "SELECT DISTINCT BIT_XOR((CASE `col_int_nokey` WHEN (MINUTE(`pk`)) THEN (POSITION(`col_int_key` IN 5855)) END)) OVER () AS field1\n,BIT_COUNT((DEFAULT(`col_int_key`))) AS field2\nFROM `CC`\n#WHERE @A := '"..., length=309, parser_state=0x7fd2082a75d0, is_com_multi=false, is_next_command=false) at /home/alice/git/10.3/sql/sql_parse.cc:8019
 
#21 0x000055583eb7eb8f in dispatch_command (command=COM_QUERY, thd=0x7fd1ec000a98, packet=0x7fd1ec00a589 "", packet_length=309, is_com_multi=false, is_next_command=false) at /home/alice/git/10.3/sql/sql_parse.cc:1846
 
#22 0x000055583eb7d5ac in do_command (thd=0x7fd1ec000a98) at /home/alice/git/10.3/sql/sql_parse.cc:1391
 
#23 0x000055583ece809b in do_handle_one_connection (connect=0x5558424cfb48) at /home/alice/git/10.3/sql/sql_connect.cc:1402
 
#24 0x000055583ece7dec in handle_one_connection (arg=0x5558424cfb48) at /home/alice/git/10.3/sql/sql_connect.cc:1308
 
#25 0x000055583f610eb0 in pfs_spawn_thread (arg=0x5558424dcdf8) at /home/alice/git/10.3/storage/perfschema/pfs.cc:1862
 
#26 0x00007fd20dda16ba in start_thread (arg=0x7fd2082a8700) at pthread_create.c:333
 
#27 0x00007fd20d23641d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109
 



sql/signal_handler.cc:168(handle_fatal_signal)[0x55eeb86d6e99]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7f26a2ba7390]
 
sql/item_buff.cc:41(new_Cached_item(THD*, Item*, bool))[0x55eeb8710774]
 
sql/sql_select.cc:23556(alloc_group_fields(JOIN*, st_order*))[0x55eeb84bcdc3]
 
sql/sql_select.cc:23535(make_group_fields(JOIN*, JOIN*))[0x55eeb84bcea0]
 
sql/sql_select.cc:3038(JOIN::make_aggr_tables_info())[0x55eeb84e81af]
 
sql/sql_select.cc:2588(JOIN::optimize_stage2())[0x55eeb84f29d9]
 
sql/sql_select.cc:1882(JOIN::optimize_inner())[0x55eeb84f5baf]
 
sql/sql_select.cc:1437(JOIN::optimize())[0x55eeb84f5ef2]
 
sql/sql_select.cc:4181(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55eeb84f67ca]
 
sql/sql_select.cc:382(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55eeb84f6aa7]
 
sql/sql_parse.cc:6545(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55eeb847cca2]
 
sql/sql_parse.cc:3768(mysql_execute_command(THD*))[0x55eeb8486a89]
 
sql/sql_parse.cc:8019(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55eeb8490c3c]
 
sql/sql_parse.cc:1870(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55eeb849308a]
 
sql/sql_parse.cc:1391(do_command(THD*))[0x55eeb8496118]
 
sql/sql_connect.cc:1402(do_handle_one_connection(CONNECT*))[0x55eeb85a10f1]
 
sql/sql_connect.cc:1310(handle_one_connection)[0x55eeb85a12a3]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7f26a2b9d6ba]
 
x86_64/clone.S:111(clone)[0x7f26a224841d]


stack_bottom = 0x7ff3a574fe78 thread_stack 0x49000
 
/home/alice/br/m3-10.3/bld/sql//mysqld(my_print_stacktrace+0x2b)[0x55a9fbec162a]
 
mysys/stacktrace.c:269(my_print_stacktrace)[0x55a9fb7ba135]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7ff3be2c4390]
 
/home/alice/br/m3-10.3/bld/sql//mysqld(_Z14free_tmp_tableP3THDP5TABLE+0x18)[0x55a9fb5b8f0c]
 
sql/sql_select.cc:18544(free_tmp_table(THD*, TABLE*))[0x55a9fb5b9c79]
 
sql/sql_select.cc:12713(JOIN::cleanup(bool))[0x55a9fb5ba454]
 
sql/sql_lex.h:1158(st_select_lex::first_inner_unit())[0x55a9fb5da571]
 
sql/sql_select.cc:13226(return_zero_rows)[0x55a9fb5db0b5]
 
sql/sql_select.cc:3807(JOIN::exec())[0x55a9fb5d9880]
 
sql/sql_select.cc:4213(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55a9fb5d9b09]
 
sql/sql_select.cc:382(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55a9fb56ab66]
 
sql/sql_parse.cc:4239(mysql_execute_command(THD*))[0x55a9fb573c78]
 
sql/sql_parse.cc:8020(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55a9fb5760c6]
 
sql/sql_parse.cc:1870(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55a9fb579145]
 
sql/sql_parse.cc:1391(do_command(THD*))[0x55a9fb684343]
 
sql/sql_connect.cc:1402(do_handle_one_connection(CONNECT*))[0x55a9fb6844f5]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7ff3be2ba6ba]
 
x86_64/clone.S:111(clone)[0x7ff3bd96541d]

Comment by Alice Sherepa [ 2018-07-04 ] 

Version: '10.3.9-MariaDB-debug-log'  
ASAN:SIGSEGV
 
=================================================================
 
==10097==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x55d5bcac9b5f bp 0x7f56ef081330 sp 0x7f56ef081310 T33)
 
    #0 0x55d5bcac9b5e in Item_sum::set_aggregator(Aggregator::Aggregator_type) /home/alice/git/10.3/sql/item_sum.cc:590
 
    #1 0x55d5bc3204ac in prepare_sum_aggregators /home/alice/git/10.3/sql/sql_select.cc:24143
 
    #2 0x55d5bc2966fd in JOIN::create_postjoin_aggr_table(st_join_table*, List<Item>*, st_order*, bool, bool, bool) /home/alice/git/10.3/sql/sql_select.cc:3377
 
    #3 0x55d5bc29305b in JOIN::make_aggr_tables_info() /home/alice/git/10.3/sql/sql_select.cc:3051
 
    #4 0x55d5bc28e738 in JOIN::optimize_stage2() /home/alice/git/10.3/sql/sql_select.cc:2613
 
    #5 0x55d5bc287b73 in JOIN::optimize_inner() /home/alice/git/10.3/sql/sql_select.cc:1907
 
    #6 0x55d5bc283a73 in JOIN::optimize() /home/alice/git/10.3/sql/sql_select.cc:1448
 
    #7 0x55d5bc29d702 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/alice/git/10.3/sql/sql_select.cc:4206
 
    #8 0x55d5bc279138 in handle_select(THD*, LEX*, select_result*, unsigned long) /home/alice/git/10.3/sql/sql_select.cc:382
 
    #9 0x55d5bc1ef351 in mysql_execute_command(THD*) /home/alice/git/10.3/sql/sql_parse.cc:4236
 
    #10 0x55d5bc207597 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/alice/git/10.3/sql/sql_parse.cc:8073
 
    #11 0x55d5bc1e227e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/alice/git/10.3/sql/sql_parse.cc:1847
 
    #12 0x55d5bc1df416 in do_command(THD*) /home/alice/git/10.3/sql/sql_parse.cc:1392
 
    #13 0x55d5bc52e871 in do_handle_one_connection(CONNECT*) /home/alice/git/10.3/sql/sql_connect.cc:1402
 
    #14 0x55d5bc52e24e in handle_one_connection /home/alice/git/10.3/sql/sql_connect.cc:1308
 
    #15 0x7f571d49f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
    #16 0x7f571c93441c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)


==24433==ERROR: AddressSanitizer: use-after-poison on address 0x62d001dba8cb at pc 0x5633cba782d8 bp 0x7f30f827ed50 sp 0x7f30f827ed40
 
WRITE of size 1 at 0x62d001dba8cb thread T32
 
    #0 0x5633cba782d7 in TABLE::create_key_part_by_field(st_key_part_info*, Field*, unsigned int) /home/alice/git/10.3/sql/table.cc:7046
 
    #1 0x5633cb8a2a46 in create_hj_key_for_table /home/alice/git/10.3/sql/sql_select.cc:9692
 
    #2 0x5633cb8a3120 in create_ref_for_key /home/alice/git/10.3/sql/sql_select.cc:9757
 
    #3 0x5633cb8a1c1a in JOIN::get_best_combination() /home/alice/git/10.3/sql/sql_select.cc:9566
 
    #4 0x5633cb868dcf in JOIN::optimize_stage2() /home/alice/git/10.3/sql/sql_select.cc:1928
 
    #5 0x5633cb868b73 in JOIN::optimize_inner() /home/alice/git/10.3/sql/sql_select.cc:1907
 
    #6 0x5633cb864a73 in JOIN::optimize() /home/alice/git/10.3/sql/sql_select.cc:1448
 
    #7 0x5633cb87e702 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/alice/git/10.3/sql/sql_select.cc:4206
 
    #8 0x5633cb85a138 in handle_select(THD*, LEX*, select_result*, unsigned long) /home/alice/git/10.3/sql/sql_select.cc:382
 
    #9 0x5633cb7dfc89 in execute_sqlcom_select /home/alice/git/10.3/sql/sql_parse.cc:6542
 
    #10 0x5633cb7ce49c in mysql_execute_command(THD*) /home/alice/git/10.3/sql/sql_parse.cc:3765
 
    #11 0x5633cb7e8597 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/alice/git/10.3/sql/sql_parse.cc:8073
 
    #12 0x5633cb7c327e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/alice/git/10.3/sql/sql_parse.cc:1847
 
    #13 0x5633cb7c0416 in do_command(THD*) /home/alice/git/10.3/sql/sql_parse.cc:1392
 
    #14 0x5633cbb0f871 in do_handle_one_connection(CONNECT*) /home/alice/git/10.3/sql/sql_connect.cc:1402
 
    #15 0x5633cbb0f24e in handle_one_connection /home/alice/git/10.3/sql/sql_connect.cc:1308
 
    #16 0x7f31264226b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
    #17 0x7f31258b741c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

Comment by Sergei Petrunia [ 2019-12-12 ]

Not reproducible anymore. The testcase passes (and under ASAN, too).
calc_group_buffer is invoked for the testcase's query:

  Thread 36 "mysqld" hit Breakpoint 1, calc_group_buffer (join=0x62b000002ce8, group=0x0) at /home/psergey/dev-git/10.2/sql/sql_select.cc:23107
 
(gdb) wher
 
  #0  calc_group_buffer (join=0x62b000002ce8, group=0x0) at /home/psergey/dev-git/10.2/sql/sql_select.cc:23107
 
  #1  0x00005555564578ef in JOIN::make_aggr_tables_info (this=0x62b000002ce8) at /home/psergey/dev-git/10.2/sql/sql_select.cc:2781
 
  #2  0x0000555556451990 in JOIN::optimize_inner (this=0x62b000002ce8) at /home/psergey/dev-git/10.2/sql/sql_select.cc:2267
 
  #3  0x0000555556445bc1 in JOIN::optimize (this=0x62b000002ce8) at /home/psergey/dev-git/10.2/sql/sql_select.cc:1113
 
  #4  0x000055555631a130 in mysql_derived_optimize (thd=0x62a0000ae270, lex=0x62a0000b1da8, derived=0x62b000001f80) at /home/psergey/dev-git/10.2/sql/sql_derived.cc:897
 
  #5  0x00005555563157a7 in mysql_handle_single_derived (lex=0x62a0000b1da8, derived=0x62b000001f80, phases=4) at /home/psergey/dev-git/10.2/sql/sql_derived.cc:198
 
  #6  0x0000555556448d98 in JOIN::optimize_inner (this=0x62b0000026b0) at /home/psergey/dev-git/10.2/sql/sql_select.cc:1400
 
  #7  0x0000555556445bc1 in JOIN::optimize (this=0x62b0000026b0) at /home/psergey/dev-git/10.2/sql/sql_select.cc:1113
 
  #8  0x000055555646125a in mysql_select (thd=0x62a0000ae270, tables=0x62b000001f80, wild_num=1, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x62b000002688, unit=0x62a0000b1e70, select_lex=0x62a0000b25b0) at /home/psergey/dev-git/10.2/sql/sql_select.cc:3804
 
  #9  0x000055555643dd1a in handle_select (thd=0x62a0000ae270, lex=0x62a0000b1da8, result=0x62b000002688, setup_tables_done_option=0) at /home/psergey/dev-git/10.2/sql/sql_select.cc:361
 
  #10 0x00005555563b01c2 in execute_sqlcom_select (thd=0x62a0000ae270, all_tables=0x62b000001f80) at /home/psergey/dev-git/10.2/sql/sql_parse.cc:6225
 
  #11 0x000055555639afdc in mysql_execute_command (thd=0x62a0000ae270) at /home/psergey/dev-git/10.2/sql/sql_parse.cc:3532
 
  #12 0x00005555563b9b51 in mysql_parse (thd=0x62a0000ae270, rawbuf=0x62b000000290 "SELECT * FROM ( \nSELECT \nROW_NUMBER() OVER(), i\nFROM t1\nWHERE 1=0\nGROUP BY i\n) AS sq", length=84, parser_state=0x7ffea95f4c20, is_com_multi=false, is_next_command=false) at /home/psergey/dev-git/10.2/sql/sql_parse.cc:7740
 
  #13 0x000055555638ff14 in dispatch_command (command=COM_QUERY, thd=0x62a0000ae270, packet=0x62900005f271 "SELECT * FROM ( \nSELECT \nROW_NUMBER() OVER(), i\nFROM t1\nWHERE 1=0\nGROUP BY i\n) AS sq", packet_length=84, is_com_multi=false, is_next_command=false) at /home/psergey/dev-git/10.2/sql/sql_parse.cc:1830
 
  #14 0x000055555638c5b9 in do_command (thd=0x62a0000ae270) at /home/psergey/dev-git/10.2/sql/sql_parse.cc:1384
 
  #15 0x00005555567335f7 in do_handle_one_connection (connect=0x611000060870) at /home/psergey/dev-git/10.2/sql/sql_connect.cc:1336
 
  #16 0x0000555556732eb4 in handle_one_connection (arg=0x611000060870) at /home/psergey/dev-git/10.2/sql/sql_connect.cc:1241
 
  #17 0x0000555557beadf4 in pfs_spawn_thread (arg=0x61600003fff0) at /home/psergey/dev-git/10.2/storage/perfschema/pfs.cc:1862

Comment by Sergei Petrunia [ 2019-12-12 ]

(Not clear which commit has fixed it, but I don't think it is important)

Generated at Thu Feb 08 08:04:57 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.