[MDEV-14743] Server crashes in Item_func_match::init_search Created: 2017-12-21  Updated: 2018-02-06  Resolved: 2018-01-12

Status: Closed
Project: MariaDB Server
Component/s: Full-text Search, Optimizer
Affects Version/s: 5.5, 10.0, 10.1, 10.2
Fix Version/s: 5.5.59, 10.0.34, 10.3.4, 10.1.31, 10.2.13

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Fixed Votes: 0
Labels: None

Sprint: 5.5.59

 Description   

CREATE TABLE t1 (f VARCHAR(8));
INSERT INTO t1 VALUES ('foo'),('bar');
 
SELECT 'foo' IN (  SELECT f FROM t1 GROUP BY MATCH(f) AGAINST ( 'qux' IN BOOLEAN MODE ) );

5.5 20089f5a39fa8

#3  <signal handler called>
#4  0x000000000081cf89 in Item_func_match::init_search (this=0x7f4aaf1495f0, no_order=false) at /data/src/5.5/sql/item_func.cc:6191
#5  0x00000000005b00f0 in init_ftfuncs (thd=0x7f4ab0264060, select_lex=0x7f4aaf148250, no_order=false) at /data/src/5.5/sql/sql_base.cc:9553
#6  0x00000000006320b6 in JOIN::optimize (this=0x7f4aaf1805c8) at /data/src/5.5/sql/sql_select.cc:1669
#7  0x00000000005f5ef1 in st_select_lex::optimize_unflattened_subqueries (this=0x7f4ab0267a68, const_only=true) at /data/src/5.5/sql/sql_lex.cc:3552
#8  0x000000000074326b in JOIN::optimize_constant_subqueries (this=0x7f4aaf180078) at /data/src/5.5/sql/opt_subselect.cc:5165
#9  0x000000000062f9d3 in JOIN::optimize (this=0x7f4aaf180078) at /data/src/5.5/sql/sql_select.cc:1025
#10 0x0000000000636fcf in mysql_select (thd=0x7f4ab0264060, rref_pointer_array=0x7f4ab0267d08, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f4aaf149b18, unit=0x7f4ab0267388, select_lex=0x7f4ab0267a68) at /data/src/5.5/sql/sql_select.cc:3089
#11 0x000000000062d86c in handle_select (thd=0x7f4ab0264060, lex=0x7f4ab02672d8, result=0x7f4aaf149b18, setup_tables_done_option=0) at /data/src/5.5/sql/sql_select.cc:319
#12 0x0000000000606d02 in execute_sqlcom_select (thd=0x7f4ab0264060, all_tables=0x7f4aaf148e10) at /data/src/5.5/sql/sql_parse.cc:4678
#13 0x0000000000600083 in mysql_execute_command (thd=0x7f4ab0264060) at /data/src/5.5/sql/sql_parse.cc:2224
#14 0x00000000006098ce in mysql_parse (thd=0x7f4ab0264060, rawbuf=0x7f4aaf148078 "SELECT 'foo' IN (  SELECT f FROM t1 GROUP BY MATCH(f) AGAINST ( 'qux' IN BOOLEAN MODE ) )", length=89, parser_state=0x7f4ab61a7640) at /data/src/5.5/sql/sql_parse.cc:5923
#15 0x00000000005fd5e3 in dispatch_command (command=COM_QUERY, thd=0x7f4ab0264060, packet=0x7f4ab3f5b061 "SELECT 'foo' IN (  SELECT f FROM t1 GROUP BY MATCH(f) AGAINST ( 'qux' IN BOOLEAN MODE ) )", packet_length=89) at /data/src/5.5/sql/sql_parse.cc:1066
#16 0x00000000005fc7d5 in do_command (thd=0x7f4ab0264060) at /data/src/5.5/sql/sql_parse.cc:793
#17 0x00000000006ff7cf in do_handle_one_connection (thd_arg=0x7f4ab0264060) at /data/src/5.5/sql/sql_connect.cc:1268
#18 0x00000000006ff55c in handle_one_connection (arg=0x7f4ab0264060) at /data/src/5.5/sql/sql_connect.cc:1184
#19 0x0000000000a0d6d9 in pfs_spawn_thread (arg=0x7f4ab0f76fc0) at /data/src/5.5/storage/perfschema/pfs.cc:1015
#20 0x00007f4ab5dda494 in start_thread (arg=0x7f4ab61a8700) at pthread_create.c:333
#21 0x00007f4ab47f093f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Reproducible on MariaDB 5.5-10.2 with (at least) MyISAM and InnoDB.
Could not reproduce on MySQL 5.5-5.7.



 Comments   
Comment by Oleksandr Byelkin [ 2018-01-10 ]

The full text function was not prepared (fix_fields() call).

Comment by Oleksandr Byelkin [ 2018-01-10 ]

First part of the fix:
revision-id: 4b4267288cb2668717cc70537eb7e79cecaff58a (mariadb-5.5.58-24-g4b4267288cb)
parent(s): a408e881cf73d06fc92097fce6ef9584e16edf77
author: Oleksandr Byelkin
committer: Oleksandr Byelkin
timestamp: 2018-01-10 12:22:56 +0100
message:

MDEV-14743: Server crashes in Item_func_match::init_search

Remove non prepared (and so belonging to removed clauses FT functions) from the list.

in later version it will be fixed by building the list during preparation.

github: bb-5.5-MDEV-14743

Generated at Thu Feb 08 08:15:56 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.