[MDEV-13699] Assertion `!new_field->field_name.str || strlen(new_field->field_name.str) == new_field->field_name.length' failed in create_tmp_table on 2nd execution of PS with semijoin Created: 2017-09-01  Updated: 2018-04-25  Resolved: 2018-04-25

Status: Closed
Project: MariaDB Server
Component/s: Optimizer, Prepared Statements, Views
Affects Version/s: 5.5, 10.0, 10.1, 10.2, 10.3
Fix Version/s: 5.5.61, 10.0.35, 10.1.32, 10.2.15, 10.3.7

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Fixed Votes: 0
Labels: affects-tests


 Description   

10.3 fdc47792354c820aa4a8542d7c00d434424a63fb

 
#7  0x00007fd81b3c5ee2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
 
#8  0x00005575d190dd73 in create_tmp_table (thd=0x7fd804000b00, param=0x7fd8040193e8, fields=..., group=0x0, distinct=true, save_sum_fields=true, select_options=2147752704, rows_limit=18446744073709551615, table_alias=0x5575d24155a9 "sj-materialize", do_not_open=false, keep_row_order=false) at /data/src/10.3/sql/sql_select.cc:16989
 
#9  0x00005575d1a4c3a1 in setup_sj_materialization_part1 (sjm_tab=0x7fd8040195c8) at /data/src/10.3/sql/opt_subselect.cc:3664
 
#10 0x00005575d18fc7c8 in make_outerjoin_info (join=0x7fd8040153f0) at /data/src/10.3/sql/sql_select.cc:9975
 
#11 0x00005575d18e40a0 in JOIN::optimize_stage2 (this=0x7fd8040153f0) at /data/src/10.3/sql/sql_select.cc:1642
 
#12 0x00005575d18e3a1a in JOIN::optimize_inner (this=0x7fd8040153f0) at /data/src/10.3/sql/sql_select.cc:1541
 
#13 0x00005575d18e2306 in JOIN::optimize (this=0x7fd8040153f0) at /data/src/10.3/sql/sql_select.cc:1123
 
#14 0x00005575d1885f8d in st_select_lex::optimize_unflattened_subqueries (this=0x7fd804039758, const_only=false) at /data/src/10.3/sql/sql_lex.cc:3922
 
#15 0x00005575d1a50132 in JOIN::optimize_unflattened_subqueries (this=0x7fd804014dd8) at /data/src/10.3/sql/opt_subselect.cc:5130
 
#16 0x00005575d18e5752 in JOIN::optimize_stage2 (this=0x7fd804014dd8) at /data/src/10.3/sql/sql_select.cc:2052
 
#17 0x00005575d18e3a1a in JOIN::optimize_inner (this=0x7fd804014dd8) at /data/src/10.3/sql/sql_select.cc:1541
 
#18 0x00005575d18e2306 in JOIN::optimize (this=0x7fd804014dd8) at /data/src/10.3/sql/sql_select.cc:1123
 
#19 0x00005575d18eb3b0 in mysql_select (thd=0x7fd804000b00, tables=0x7fd80403a798, wild_num=0, fields=..., conds=0x7fd804042540, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184064, result=0x7fd80403d828, unit=0x7fd804039018, select_lex=0x7fd804039758) at /data/src/10.3/sql/sql_select.cc:3723
 
#20 0x00005575d18df9ce in handle_select (thd=0x7fd804000b00, lex=0x7fd804038f50, result=0x7fd80403d828, setup_tables_done_option=0) at /data/src/10.3/sql/sql_select.cc:378
 
#21 0x00005575d18aae7f in execute_sqlcom_select (thd=0x7fd804000b00, all_tables=0x7fd80403a798) at /data/src/10.3/sql/sql_parse.cc:6476
 
#22 0x00005575d18a16b7 in mysql_execute_command (thd=0x7fd804000b00) at /data/src/10.3/sql/sql_parse.cc:3730
 
#23 0x00005575d18cc151 in Prepared_statement::execute (this=0x7fd804038b00, expanded_query=0x7fd81565b4a0, open_cursor=false) at /data/src/10.3/sql/sql_prepare.cc:4726
 
#24 0x00005575d18ca598 in Prepared_statement::execute_loop (this=0x7fd804038b00, expanded_query=0x7fd81565b4a0, open_cursor=false, packet=0x0, packet_end=0x0) at /data/src/10.3/sql/sql_prepare.cc:4155
 
#25 0x00005575d18c81e4 in mysql_sql_stmt_execute (thd=0x7fd804000b00) at /data/src/10.3/sql/sql_prepare.cc:3262
 
#26 0x00005575d18a16fc in mysql_execute_command (thd=0x7fd804000b00) at /data/src/10.3/sql/sql_parse.cc:3746
 
#27 0x00005575d18ae7e6 in mysql_parse (thd=0x7fd804000b00, rawbuf=0x7fd8040149f8 "EXECUTE stmt", length=12, parser_state=0x7fd81565c610, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7930
 
#28 0x00005575d189c282 in dispatch_command (command=COM_QUERY, thd=0x7fd804000b00, packet=0x7fd804173111 "EXECUTE stmt", packet_length=12, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1819
 
#29 0x00005575d189ace4 in do_command (thd=0x7fd804000b00) at /data/src/10.3/sql/sql_parse.cc:1370
 
#30 0x00005575d19f101a in do_handle_one_connection (connect=0x5575d42ef520) at /data/src/10.3/sql/sql_connect.cc:1418
 
#31 0x00005575d19f0da7 in handle_one_connection (arg=0x5575d42ef520) at /data/src/10.3/sql/sql_connect.cc:1324
 
#32 0x00005575d1e68720 in pfs_spawn_thread (arg=0x5575d438ff20) at /data/src/10.3/storage/perfschema/pfs.cc:1862
 
#33 0x00007fd81d30a494 in start_thread (arg=0x7fd81565d700) at pthread_create.c:333
 
#34 0x00007fd81b48293f in clone () from /lib/x86_64-linux-gnu/libc.so.6


CREATE TABLE t1 (a INT);
 
INSERT INTO t1 VALUES (1),(2);
 
 
 
CREATE TABLE t2 (b INT);
 
INSERT INTO t2 VALUES  (3),(4); 
 
 
CREATE TABLE t3 (c INT);
 
CREATE ALGORITHM=MERGE VIEW v3 AS SELECT * FROM t3;
 
INSERT INTO t3 VALUES (5),(6);
 
 
PREPARE stmt FROM 
  "SELECT * FROM t1
 
  WHERE EXISTS ( 
    SELECT * FROM t2 WHERE t1.a IN ( SELECT c AS fld FROM v3 )
 
  )";
 
EXECUTE stmt;
 
EXECUTE stmt;

Not reproducible on 10.2.
No visible effect on a non-debug build.
No crash without semijoin.
No crash when the base table is used in the query instead of the view.
No crash without AS fld clause.

 Comments   
Comment by Elena Stepanova [ 2018-03-21 ]

Still reproducible and highly annoying in tests

Comment by Oleksandr Byelkin [ 2018-04-11 ]

new field created with correct length but some garbage in string reference...

Comment by Oleksandr Byelkin [ 2018-04-12 ]

setup_sj_materialization_part1 executed twice. On prepare it has correct list to create temporary table, on execution it get list with already freed items

Comment by Oleksandr Byelkin [ 2018-04-12 ]

it was both time execution, but secont time it looks like uses SELECT list to create temporary table which was obsolete because SELECT was not prepared on second execution (replaces with semi-join?)

Comment by Oleksandr Byelkin [ 2018-04-12 ]

So the problem is present, there was no check before

Comment by Oleksandr Byelkin [ 2018-04-12 ]

revision-id: 9591dc2e20fa651b26b8dbc9a0b6d90bb8e6c132 (mariadb-5.5.59-57-g9591dc2e20f)
parent(s): 3eb2a265eac53050089bc5d563e65161717a2983
author: Oleksandr Byelkin
committer: Oleksandr Byelkin
timestamp: 2018-04-12 14:55:43 +0200
message:

MDEV-13699: Assertion `!new_field->field_name.str || strlen(new_field->field_name.str) == new_field->field_name.length' failed in create_tmp_table on 2nd execution of PS with semijoin

The problem was that SJ (semi-join) used secondary list (array) of subquery select list. The items there was prepared once then cleaned up (but not really freed from memory because it was made in statement memory).
Original list was not prepared after first execution because select was removed by conversion to SJ.
The solution is to use original list but prepare it first.

—

Generated at Thu Feb 08 08:07:40 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.