[MDEV-13936] Server crashes in Time_and_counter_tracker::incr_loops Created: 2017-09-28  Updated: 2018-09-19  Resolved: 2017-11-14

Status: Closed
Project: MariaDB Server
Component/s: Stored routines, Views
Affects Version/s: 10.1, 10.2
Fix Version/s: 10.1.29, 10.2.11, 10.3.3

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-16618 Executing stored procedure crashes my... Closed
Sprint: 10.2.11

 Description   

CREATE TABLE t1 (i INT);
CREATE VIEW v1 AS SELECT * FROM t1 WHERE RAND() > 0.5;
CREATE FUNCTION f1() RETURNS INT RETURN ( SELECT MAX(i) FROM v1 );
 
--error ER_NON_INSERTABLE_TABLE
REPLACE INTO v1 VALUES (f1());
SET @aux = f1();
 
# Cleanup
DROP FUNCTION f1;
DROP VIEW v1;
DROP TABLE t1;

10.1 e3dee8376885

#3  <signal handler called>
#4  0x00005557badb33f2 in Time_and_counter_tracker::incr_loops (this=0x78) at /data/src/10.1/sql/sql_analyze_stmt.h:97
#5  0x00005557bad76425 in JOIN::exec (this=0x7f1acda67848) at /data/src/10.1/sql/sql_select.cc:2510
#6  0x00005557bb01ea20 in subselect_single_select_engine::exec (this=0x7f1acd9d5600) at /data/src/10.1/sql/item_subselect.cc:3842
#7  0x00005557bb01497f in Item_subselect::exec (this=0x7f1acd9d54f0) at /data/src/10.1/sql/item_subselect.cc:711
#8  0x00005557bb0163df in Item_singlerow_subselect::val_int (this=0x7f1acd9d54f0) at /data/src/10.1/sql/item_subselect.cc:1309
#9  0x00005557baf92cab in Item::save_in_field (this=0x7f1acd9d54f0, field=0x7f1acd847048, no_conversions=false) at /data/src/10.1/sql/item.cc:6070
#10 0x00005557bb0bd586 in sp_eval_expr (thd=0x7f1acf4d5070, result_field=0x7f1acd847048, expr_item_ptr=0x7f1acd9d5670) at /data/src/10.1/sql/sp_head.cc:449
#11 0x00005557bb0c9f17 in sp_rcontext::set_return_value (this=0x7f1acd9e0088, thd=0x7f1acf4d5070, return_value_item=0x7f1acd9d5670) at /data/src/10.1/sql/sp_rcontext.cc:154
#12 0x00005557bb0c4d32 in sp_instr_freturn::exec_core (this=0x7f1acd9d5640, thd=0x7f1acf4d5070, nextp=0x7f1ad88c81f4) at /data/src/10.1/sql/sp_head.cc:3540
#13 0x00005557bb0c38d0 in sp_lex_keeper::reset_lex_and_exec_core (this=0x7f1acd9d5680, thd=0x7f1acf4d5070, nextp=0x7f1ad88c81f4, open_tables=true, instr=0x7f1acd9d5640) at /data/src/10.1/sql/sp_head.cc:2996
#14 0x00005557bb0c4cad in sp_instr_freturn::execute (this=0x7f1acd9d5640, thd=0x7f1acf4d5070, nextp=0x7f1ad88c81f4) at /data/src/10.1/sql/sp_head.cc:3510
#15 0x00005557bb0bf726 in sp_head::execute (this=0x7f1acd9ce088, thd=0x7f1acf4d5070, merge_da_on_success=true) at /data/src/10.1/sql/sp_head.cc:1316
#16 0x00005557bb0c09f4 in sp_head::execute_function (this=0x7f1acd9ce088, thd=0x7f1acf4d5070, argp=0x0, argcount=0, return_value_fld=0x7f1acd847048) at /data/src/10.1/sql/sp_head.cc:1857
#17 0x00005557bafea5b1 in Item_func_sp::execute_impl (this=0x7f1acd843338, thd=0x7f1acf4d5070) at /data/src/10.1/sql/item_func.cc:6712
#18 0x00005557bafea340 in Item_func_sp::execute (this=0x7f1acd843338) at /data/src/10.1/sql/item_func.cc:6645
#19 0x00005557bafed874 in Item_func_sp::val_int (this=0x7f1acd843338) at /data/src/10.1/sql/item_func.h:2130
#20 0x00005557bafe54c1 in Item_func_set_user_var::check (this=0x7f1acd8444d8, use_result_field=false) at /data/src/10.1/sql/item_func.cc:5058
#21 0x00005557bac8836d in set_var_user::check (this=0x7f1acd844938, thd=0x7f1acf4d5070) at /data/src/10.1/sql/set_var.cc:830
#22 0x00005557bac87d21 in sql_set_variables (thd=0x7f1acf4d5070, var_list=0x7f1acf4d9828, free=true) at /data/src/10.1/sql/set_var.cc:689
#23 0x00005557bad3967e in mysql_execute_command (thd=0x7f1acf4d5070) at /data/src/10.1/sql/sql_parse.cc:4323
#24 0x00005557bad429cb in mysql_parse (thd=0x7f1acf4d5070, rawbuf=0x7f1acd843088 "SET @aux = f1()", length=15, parser_state=0x7f1ad88c95e0) at /data/src/10.1/sql/sql_parse.cc:7333
#25 0x00005557bad315d0 in dispatch_command (command=COM_QUERY, thd=0x7f1acf4d5070, packet=0x7f1ad1ff9071 "SET @aux = f1()", packet_length=15) at /data/src/10.1/sql/sql_parse.cc:1484
#26 0x00005557bad3036d in do_command (thd=0x7f1acf4d5070) at /data/src/10.1/sql/sql_parse.cc:1106
#27 0x00005557bae68dd1 in do_handle_one_connection (thd_arg=0x7f1acf4d5070) at /data/src/10.1/sql/sql_connect.cc:1349
#28 0x00005557bae68b35 in handle_one_connection (arg=0x7f1acf4d5070) at /data/src/10.1/sql/sql_connect.cc:1261
#29 0x00005557bb221654 in pfs_spawn_thread (arg=0x7f1ad5c39ef0) at /data/src/10.1/storage/perfschema/pfs.cc:1860
#30 0x00007f1ad8549494 in start_thread (arg=0x7f1ad88cab00) at pthread_create.c:333
#31 0x00007f1ad669493f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Reproducible on debug and release builds of 10.1 and 10.2, including older 10.1 releases.
Not reproducible on 10.0.



 Comments   
Comment by Oleksandr Byelkin [ 2017-11-06 ]

Subquery has no "explain" object attached.

Comment by Oleksandr Byelkin [ 2017-11-06 ]

JOIN::save_explain_data was called, but the object was not created

Comment by Oleksandr Byelkin [ 2017-11-06 ]

again 2 SELECTs with number 3 (or two joins connected to the same select)

Comment by Oleksandr Byelkin [ 2017-11-06 ]

Actually problem of renumbering function's subqueries should be discussed because: 1) it can be used in different statements, which already uses subqueroies, 2) it can be used several times and with other functions

Comment by Oleksandr Byelkin [ 2017-11-06 ]

Actually each function is building in query, so it is OK.
Repeating fix for the procedure fixed the functions.

Comment by Oleksandr Byelkin [ 2017-11-06 ]

github tree bb-10.1-MDEV-13936

Comment by Oleksandr Byelkin [ 2017-11-06 ]

revision-id: 1a66e172f53bf4768cd058cba8a6951c60864f22 (mariadb-10.1.28-34-g1a66e172f53)
parent(s): 51679e5c380e3a140c78a611c28d99bd3a8be2da
author: Oleksandr Byelkin
committer: Oleksandr Byelkin
timestamp: 2017-11-06 15:04:01 +0100
message:

MDEV-13936: Server crashes in Time_and_counter_tracker::incr_loops

Repeat solution for procedures for functions.

Comment by Alexander Barkov [ 2017-11-07 ]

Discussed on IRC.
Perhaps sp_head::execute_trigger() also needs the same change.
Moving this code to sp_head::execute() might be a good idea.

Comment by Oleksandr Byelkin [ 2017-11-13 ]

revision-id: efc18ad7d290a2b767f4f9e3d35905f3d236ecd0 (mariadb-10.1.28-51-gefc18ad7d29)
parent(s): 1fdf11669c1295bb49f50d1aaefec2d93bb24191
author: Oleksandr Byelkin
committer: Oleksandr Byelkin
timestamp: 2017-11-13 14:31:49 +0100
message:

MDEV-13936: Server crashes in Time_and_counter_tracker::incr_loops

Repeat reworked solution of procedures for all posible Sp (functions &
triggers).

Comment by Oleksandr Byelkin [ 2017-11-13 ]

new code forcepushed to bb-10.1-MDEV-13936

Comment by Alexander Barkov [ 2017-11-14 ]

This patch is OK to push, after removing the extra condition:

  • if (err_status || thd->is_error())
    + if (err_status)

Thanks!

revision-id: efc18ad7d290a2b767f4f9e3d35905f3d236ecd0 (mariadb-10.1.28-51-gefc18ad7d29)
parent(s): 1fdf11669c1295bb49f50d1aaefec2d93bb24191
author: Oleksandr Byelkin
committer: Oleksandr Byelkin
timestamp: 2017-11-13 14:31:49 +0100
message:

MDEV-13936: Server crashes in Time_and_counter_tracker::incr_loops

Repeat reworked solution of procedures for all posible Sp (functions &
triggers).

Generated at Thu Feb 08 08:09:34 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.