[MDEV-15509] crash signal 11 at end_sj_materialize Created: 2018-03-08  Updated: 2020-08-25  Resolved: 2018-07-16

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.3
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Richard Stracke Assignee: Sergei Petrunia
Resolution: Cannot Reproduce Votes: 1
Labels: need_feedback
Environment:

Red Hat
MariaDB Enterprise 10.2.13 build 18409 (bb2-compatibility)
+ Build 18904

Attachments: Text File backtrace_full.txt     Text File backtrace_parsed.txt     Text File memorymap.txt    

 Description   

Signal 11 multiples times with

Server version: 10.2.13-MariaDB-log
 
key_buffer_size=67108864
 
read_buffer_size=131072
 
max_used_connections=290
 
max_threads=2002
 
thread_count=544
 
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 4465362 K  bytes of memory
 
Hope that's ok; if not, decrease some variables in the equation.
 
 
 
Thread pointer: 0x563f57d5a008
 
Attempting backtrace. You can use the following information to find out
 
where mysqld died. If you see no messages after this, something went
 
terribly wrong...
 
stack_bottom = 0x7f0ad0c2bd00 thread_stack 0x40000
 
(my_addr_resolve failure: fork)
 
/usr/sbin/mysqld(my_print_stacktrace+0x2e) [0x563e3f6cc3fe]
 
/usr/sbin/mysqld(handle_fatal_signal+0x355) [0x563e3f161fb5]
 
/lib64/libpthread.so.0(+0xf5e0) [0x7f1f70d215e0]
 
/usr/sbin/mysqld(end_sj_materialize(JOIN*, st_join_table*, bool)+0x61) [0x563e3efe2131]
 
/usr/sbin/mysqld(+0x591313) [0x563e3efd2313]
 
/usr/sbin/mysqld(sub_select(JOIN*, st_join_table*, bool)+0x17e) [0x563e3efdacfe]
 
/usr/sbin/mysqld(join_tab_execution_startup(st_join_table*)+0xa1) [0x563e3f0aaf01]
 
/usr/sbin/mysqld(sub_select(JOIN*, st_join_table*, bool)+0x145) [0x563e3efdacc5]
 
/usr/sbin/mysqld(+0x591313) [0x563e3efd2313]
 
/usr/sbin/mysqld(sub_select(JOIN*, st_join_table*, bool)+0x17e) [0x563e3efdacfe]
 
/usr/sbin/mysqld(JOIN::exec_inner()+0xa3f) [0x563e3effa5df]
 
/usr/sbin/mysqld(JOIN::exec()+0x33) [0x563e3effa7f3]
 
/usr/sbin/mysqld(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*)+0x11a) [0x563e3effa94a]
 
/usr/sbin/mysqld(mysql_derived_fill(THD*, LEX*, TABLE_LIST*)+0x15f) [0x563e3ef7923f]
 
/usr/sbin/mysqld(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int)+0xe4) [0x563e3ef78f44]
 
/usr/sbin/mysqld(st_join_table::preread_init()+0x79) [0x563e3efdaad9]
 
/usr/sbin/mysqld(sub_select(JOIN*, st_join_table*, bool)+0x2f8) [0x563e3efdae78]
 
/usr/sbin/mysqld(+0x591313) [0x563e3efd2313]
 
/usr/sbin/mysqld(sub_select(JOIN*, st_join_table*, bool)+0x17e) [0x563e3efdacfe]
 
/usr/sbin/mysqld(+0x591313) [0x563e3efd2313]
 
/usr/sbin/mysqld(sub_select(JOIN*, st_join_table*, bool)+0x17e) [0x563e3efdacfe]
 
/usr/sbin/mysqld(+0x591313) [0x563e3efd2313]
 
/usr/sbin/mysqld(sub_select(JOIN*, st_join_table*, bool)+0x1c4) [0x563e3efdad44]
 
/usr/sbin/mysqld(JOIN_CACHE::generate_full_extensions(unsigned char*)+0x201) [0x563e3f09bb91]
 
/usr/sbin/mysqld(JOIN_CACHE::join_matching_records(bool)+0x264) [0x563e3f09be94]
 
/usr/sbin/mysqld(JOIN_CACHE::join_records(bool)+0xf4) [0x563e3f09b7d4]
 
/usr/sbin/mysqld(sub_select_cache(JOIN*, st_join_table*, bool)+0x5a) [0x563e3efdb10a]
 
/usr/sbin/mysqld(JOIN::exec_inner()+0x903) [0x563e3effa4a3]
 
/usr/sbin/mysqld(JOIN::exec()+0x33) [0x563e3effa7f3]
 
/usr/sbin/mysqld(st_select_lex_unit::exec()+0x2db) [0x563e3f03869b]
 
/usr/sbin/mysqld(mysql_derived_fill(THD*, LEX*, TABLE_LIST*)+0x338) [0x563e3ef79418]
 
/usr/sbin/mysqld(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int)+0xe4) [0x563e3ef78f44]
 
/usr/sbin/mysqld(st_join_table::preread_init()+0x79) [0x563e3efdaad9]
 
/usr/sbin/mysqld(join_init_read_record(st_join_table*)+0x118) [0x563e3efe99a8]
 
/usr/sbin/mysqld(JOIN_CACHE::join_matching_records(bool)+0x96) [0x563e3f09bcc6]
 
/usr/sbin/mysqld(JOIN_CACHE::join_records(bool)+0xf4) [0x563e3f09b7d4]
 
/usr/sbin/mysqld(JOIN_CACHE::join_records(bool)+0x134) [0x563e3f09b814]
 
/usr/sbin/mysqld(sub_select_cache(JOIN*, st_join_table*, bool)+0x5a) [0x563e3efdb10a]
 
/usr/sbin/mysqld(JOIN::exec_inner()+0x903) [0x563e3effa4a3]
 
/usr/sbin/mysqld(JOIN::exec()+0x33) [0x563e3effa7f3]
 
/usr/sbin/mysqld(st_select_lex_unit::exec()+0x2db) [0x563e3f03869b]
 
/usr/sbin/mysqld(mysql_derived_fill(THD*, LEX*, TABLE_LIST*)+0x338) [0x563e3ef79418]
 
/usr/sbin/mysqld(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int)+0xe4) [0x563e3ef78f44]
 
/usr/sbin/mysqld(st_join_table::preread_init()+0x79) [0x563e3efdaad9]
 
/usr/sbin/mysqld(sub_select(JOIN*, st_join_table*, bool)+0x2f8) [0x563e3efdae78]
 
/usr/sbin/mysqld(JOIN::exec_inner()+0xa3f) [0x563e3effa5df]
 
/usr/sbin/mysqld(JOIN::exec()+0x33) [0x563e3effa7f3]
 
/usr/sbin/mysqld(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*)+0x11a) [0x563e3effa94a]
 
/usr/sbin/mysqld(handle_select(THD*, LEX*, select_result*, unsigned long)+0x15e) [0x563e3effb3be]
 
/usr/sbin/mysqld(mysql_execute_command(THD*)+0x78a5) [0x563e3efaafb5]
 
/usr/sbin/mysqld(sp_instr_stmt::exec_core(THD*, unsigned int*)+0x36) [0x563e3ef1ca06]
 
/usr/sbin/mysqld(sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*)+0x99) [0x563e3ef245c9]
 
/usr/sbin/mysqld(sp_instr_stmt::execute(THD*, unsigned int*)+0x205) [0x563e3ef24bc5]
 
/usr/sbin/mysqld(sp_head::execute(THD*, bool)+0x83e) [0x563e3ef2062e]
 
/usr/sbin/mysqld(sp_head::execute_procedure(THD*, List<Item>*)+0x73d) [0x563e3ef2175d]
 
/usr/sbin/mysqld(+0x55bbd9) [0x563e3ef9cbd9]
 
/usr/sbin/mysqld(+0x55d906) [0x563e3ef9e906]
 
/usr/sbin/mysqld(Sql_cmd_call::execute(THD*)+0x90) [0x563e3ef9f100]
 
/usr/sbin/mysqld(mysql_execute_command(THD*)+0x14fb) [0x563e3efa4c0b]
 
/usr/sbin/mysqld(Prepared_statement::execute(String*, bool)+0x4de) [0x563e3efbf1ee]
 
/usr/sbin/mysqld(+0x57e39f) [0x563e3efbf39f]
 
/usr/sbin/mysqld(+0x57f1ff) [0x563e3efc01ff]
 
/usr/sbin/mysqld(mysqld_stmt_execute(THD*, char*, unsigned int)+0x27) [0x563e3efc0287]
 
/usr/sbin/mysqld(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool)+0x14e8) [0x563e3efaef48]
 
/usr/sbin/mysqld(do_command(THD*)+0x149) [0x563e3efb07a9]
 
/usr/sbin/mysqld(do_handle_one_connection(CONNECT*)+0x1aa) [0x563e3f074eba]
 
/usr/sbin/mysqld(handle_one_connection+0x3d) [0x563e3f074fdd]
 
/usr/sbin/mysqld(+0x8c59ed) [0x563e3f3069ed]
 
/lib64/libpthread.so.0(+0x7e25) [0x7f1f70d19e25]
 
/lib64/libc.so.6(clone+0x6d) [0x7f1f6f36c34d]



 Comments   
Comment by Sergei Petrunia [ 2018-03-12 ]

Another thing apparent from the stack trace: the crashing statement is 

 CALL some_stored_proc(...)

which executed the SELECT, which crashed. I don't know whether the fact that it's SP matters or not.

Comment by Sergei Petrunia [ 2018-03-12 ]

Above the stack trace, I see 10.2.13-MariaDB-log , but affects_version is 10.3,

Ok now I also see MariaDB Enterprise 10.2.13 build 18409 (bb2-compatibility). Need to get that binary.

Comment by Sergei Petrunia [ 2018-03-13 ]

So, the crash happens here:

    fill_record(thd, table, table->field, sjm->sjm_table_cols, TRUE, FALSE);

fill_record is a function. The way a crash could happen is that table or sjm are invalid pointers. I have no idea why either could happen.

Comment by Sergei Petrunia [ 2018-03-13 ]

sjm is being used a few lines above (see table=..., {{List_iterator ...}, etc). 

    TABLE *table= sjm->table;
 
 
 
    List_iterator<Item> it(sjm->sjm_table_cols);
 
    Item *item;
 
    while ((item= it++))
 
    {
 
      if (item->is_null())
 
        DBUG_RETURN(NESTED_LOOP_OK);
 
    }
 
    fill_record(thd, table, table->field, sjm->sjm_table_cols, TRUE, FALSE);

So it must be table. The value comes from sjm->table. Could it be that the table was for some reason freed and then used?

Comment by Sergei Petrunia [ 2018-03-14 ]

A tree with a patch for the test binary: https://github.com/MariaDB/server/commits/bb-10.2-compatibility-mdev15509-debug . The test binary is now being built.

Comment by Sergei Petrunia [ 2018-03-15 ]

The tree with

Comment by Sergei Petrunia [ 2018-07-16 ]

Closing as Cannot Reproduce. Feel free to re-open if there is more data that gives a clue about how to reproduce it (error log with the provided test binary and/or a crashing testcase and/or any other detail).

Generated at Thu Feb 08 08:21:51 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.