Is the crash reproducible when you re-run the query?
I have been able to reproduce the error on other servers. I stepped thru all available packages at yum.mariadb.org/ above 10.2.8 and the problem persisted.
Testing on 10.1.24 resulted in the query completing without error, so the issues appears to have been introduced somewhere between 10.1.24 and 10.2.8.
Tried changing the optimizer switches: orderby_uses_equalities=off and condition_pushdown_for_derived==off and problem persisted.
10.2.8 is pretty old, but still, we are very interested in this particular failure.
Would you be able to provide a dataset on which the crash is reliably reproducible with this query?
|
table structure |
CREATE TABLE `drop_copy_fill_events` ( |
`id` bigint(20) NOT NULL AUTO_INCREMENT, |
`tstamp` timestamp(6) NOT NULL DEFAULT current_timestamp(6), |
`curr_update_seq` bigint(20) unsigned NOT NULL DEFAULT 0, |
`origin` varchar(50) NOT NULL DEFAULT '', |
`order_id` varchar(64) DEFAULT NULL, |
`order_state` varchar(30) NOT NULL DEFAULT '', |
`event` varchar(30) NOT NULL DEFAULT '', |
`gv_ts` bigint(20) unsigned NOT NULL DEFAULT 0, |
`exchange_ts` bigint(20) unsigned NOT NULL DEFAULT 0, |
`sent_ts` bigint(20) unsigned NOT NULL DEFAULT 0, |
`ts` bigint(20) unsigned NOT NULL DEFAULT 0, |
`exchange_order_id` varchar(50) DEFAULT '', |
`ad_id` varchar(100) DEFAULT '', |
`exchange` varchar(30) NOT NULL DEFAULT '', |
`symbol` varchar(40) DEFAULT '', |
`root_symbol` varchar(30) NOT NULL DEFAULT '', |
`side` varchar(10) NOT NULL DEFAULT '', |
`order_type` varchar(30) NOT NULL DEFAULT '', |
`price` decimal(15,8) NOT NULL DEFAULT 0.00000000, |
`quantity` int(10) unsigned NOT NULL DEFAULT 0, |
`quantity_numerator` int(10) DEFAULT 0, |
`quantity_denominator` int(10) DEFAULT 0, |
`remaining_quantity` int(10) unsigned NOT NULL DEFAULT 0, |
`user_id` varchar(20) NOT NULL DEFAULT '', |
`context` varchar(20) NOT NULL DEFAULT '', |
`ad_text` varchar(100) DEFAULT '', |
`exchange_session` varchar(55) DEFAULT NULL, |
`trader_id` varchar(20) DEFAULT '', |
`fill_id` varchar(100) DEFAULT '', |
`trade_id` varchar(30) DEFAULT NULL, |
`match_id` varchar(20) DEFAULT NULL, |
`total_filled` int(10) unsigned NOT NULL DEFAULT 0, |
`trade_date` date DEFAULT '0000-00-00', |
`leg_type` varchar(30) DEFAULT '', |
`exchange_account` varchar(30) DEFAULT '', |
`account_number` varchar(30) DEFAULT '', |
`liquidity` varchar(20) DEFAULT '', |
`busted` tinyint(4) DEFAULT 0, |
`corrected` tinyint(4) DEFAULT 0, |
`insert_ts` bigint(20) unsigned NOT NULL DEFAULT 0, |
`ts_str` varchar(50) DEFAULT NULL, |
`gv_ts_str` varchar(50) DEFAULT NULL, |
`exchange_ts_str` varchar(50) DEFAULT NULL, |
`sent_ts_str` varchar(50) DEFAULT NULL, |
`value_date` date DEFAULT '0000-00-00', |
`short_sell` tinyint(1) NOT NULL DEFAULT 0, |
PRIMARY KEY (`id`), |
KEY `user_idx` (`user_id`), |
KEY `exchange_ts_idx` (`exchange_ts`), |
KEY `fill_id_str` (`fill_id`), |
KEY `exchange_order_id_idx` (`exchange_order_id`), |
KEY `ts_str_idx` (`ts_str`), |
KEY `tstamp_idx` (`tstamp`), |
KEY `order_id_user_id_idx` (`order_id`,`user_id`) |
) ENGINE=InnoDB
|
|
query |
SELECT
|
CONCAT(exchange_ts_str, '_', symbol) AS trade_key, |
exchange,
|
exchange_ts_str,
|
fill_id,
|
origin,
|
user_id,
|
context,
|
symbol,
|
side,
|
price,
|
quantity,
|
order_id,
|
leg_type,
|
account_number
|
FROM
|
`drop_copy_fill_events`
|
WHERE ts_str LIKE '2018-03%' |
AND CONCAT(exchange_ts_str, '_', symbol) IN |
(SELECT DISTINCT |
CONCAT(exchange_ts_str, '_', symbol) |
FROM |
`drop_copy_fill_events`
|
WHERE ts_str LIKE '2018-03%' |
AND exchange NOT IN ('ICE', 'NYSE_LIFFE_US') |
GROUP BY CONCAT(exchange_ts_str, '_', symbol) |
HAVING COUNT (*) > 1 |
AND COUNT(DISTINCT price) = 1 |
AND COUNT(DISTINCT quantity) = 1 |
AND COUNT(DISTINCT side) = 2 |
AND COUNT(DISTINCT user_id) = 2) |
ORDER BY account_number; |
If I convert it to a cte:
WITH cte AS
(SELECT DISTINCT
CONCAT(exchange_ts_str, '_', symbol) AS symbol
FROM
`drop_copy_fill_events`
WHERE ts_str LIKE '2018-03%'
AND exchange NOT IN ('ICE', 'NYSE_LIFFE_US')
GROUP BY CONCAT(exchange_ts_str, '_', symbol)
HAVING COUNT
> 1
AND COUNT(DISTINCT price) = 1
AND COUNT(DISTINCT quantity) = 1
AND COUNT(DISTINCT side) = 2
AND COUNT(DISTINCT user_id) = 2)
SELECT
CONCAT(f.exchange_ts_str, '_', f.symbol) AS trade_key,
f.exchange,
f.exchange_ts_str,
f.fill_id,
f.origin,
f.user_id,
f.context,
f.symbol,
f.side,
f.price,
f.quantity,
f.order_id,
f.leg_type,
f.account_number
FROM
`drop_copy_fill_events` f, cte
WHERE cte.symbol = CONCAT(f.exchange_ts_str, '_', f.symbol)
AND f.ts_str LIKE '2018-03%'
ORDER BY account_number;
It runs fine. However for backwards compatibility - changing all code is tricky. Not to mention a server crashing over a select query is not viable for production.
Does it actually crash for you on the empty table?
If it does, please also attach or paste your cnf file(s). If it doesn't crash on the empty table, then the question remains – would you be able to provide the data set?
my.cnf for the server:
!include_dir /etc/mysql
|
|
|
#
|
# This started with MariaDB example config file for systems with 4GB of memory
|
# running mostly MariaDB using InnoDB only tables and performing complex
|
# queries with few connections.
|
#
|
|
|
#
|
# The following options will be read by MariaDB client applications.
|
[client]
|
port = 3306
|
socket = /srv/db_trn/run/mysql.sock
|
|
|
|
|
[mysqld]
|
|
|
# generic configuration options
|
port = 3306
|
socket = /srv/db_trn/run/mysql.sock
|
pid-file = /srv/db_trn/run/ch0pxdbpts05.pid
|
|
|
datadir = /srv/dbdata_fast/mysql
|
back_log = 50
|
max_connections = 1500
|
table_open_cache = 1000
|
table_definition_cache = 400
|
skip-external-locking
|
max_allowed_packet = 16M
|
optimizer_switch = default
|
#thread_cache_size = 16
|
#thread_concurrency = 8
|
query_cache_type = 1
|
query_cache_size = 128M
|
query_cache_limit = 16M
|
default_storage_engine = InnoDB
|
table_open_cache = 512
|
userstat = 1
|
plugin-load = auth_pam.so
|
innodb_strict_mode = 0
|
sql_mode = ''
|
|
|
# charset variables
|
init-connect='SET NAMES latin1'
|
character_set_client = latin1
|
character_set_server = latin1
|
skip-character-set-client-handshake
|
|
|
# cg-db-* specific setting
|
max_connect_errors = 50000
|
net_read_timeout = 300
|
|
|
# logging variables
|
slow_query_log = 1
|
long_query_time = 5
|
slow_query_log_file = /srv/db_trn/log/mysql/ch0pxdbpts05-slow.log
|
log-warnings = 2
|
log_error = /srv/db_trn/log/mysql/ch0pxdbpts05-error.log
|
sql-error-log-filename = /srv/db_trn/log/mysql/ch0pxdbpts05_sql_errors.log
|
log_slow_admin_statements = 1
|
|
|
# binlog specific settings
|
binlog_cache_size = 1M
|
log_bin = 1
|
log-bin = /srv/db_trn/log/binlog/ch0pxdbpts05-bin
|
binlog_format = mixed
|
expire_logs_days = 10
|
sync-binlog = 1
|
max_binlog_size = 25M
|
|
|
# session variables
|
read_buffer_size = 2M
|
sort_buffer_size = 2M
|
read_rnd_buffer_size = 8M
|
join_buffer_size = 1M
|
|
|
# tmp variables
|
tmp_table_size = 1G
|
tmpdir = /srv/db_trn/tmp
|
|
|
# Replication related settings
|
server-id = 5
|
#master-host =
|
#master-user =
|
#master-password =
|
#master-port = 3306
|
read_only
|
log_slave_updates = 1
|
#skip-slave-start
|
log-slow-slave-statements
|
relay-log=/srv/db_trn/log/mysql/ch0pxdbpts05-relay-bin
|
|
|
# MyISAM Specific options
|
key_buffer_size = 8G
|
max_heap_table_size = 1G
|
bulk_insert_buffer_size = 32M
|
myisam_sort_buffer_size = 64M
|
myisam_max_sort_file_size = 500M
|
myisam_repair_threads = 4
|
myisam_recover_options = backup
|
|
|
# INNODB Specific options
|
innodb_file_per_table = 1
|
#innodb_additional_mem_pool_size = 30M
|
innodb_buffer_pool_size = 32G
|
innodb_data_file_path = ibdata1:50M:autoextend
|
innodb_data_home_dir = /srv/dbdata_fast/mysql
|
innodb_thread_concurrency = 20
|
innodb_flush_log_at_trx_commit = 2
|
innodb_log_buffer_size = 4M
|
innodb_log_file_size = 512M
|
innodb_log_group_home_dir = /srv/db_trn/log/mysql
|
innodb_max_dirty_pages_pct = 80
|
innodb_flush_method = O_DIRECT
|
innodb_stats_on_metadata = 0
|
innodb_file_format = Barracuda
|
innodb_file_format_check = 1
|
innodb_print_all_deadlocks = 1
|
innodb_open_files = 1000
|
|
|
[mysqldump]
|
quick
|
max_allowed_packet = 16M
|
|
|
[mysql]
|
no-auto-rehash
|
|
|
[myisamchk]
|
key_buffer_size = 512M
|
sort_buffer_size = 512M
|
read_buffer = 8M
|
write_buffer = 8M
|
|
|
[mysqlhotcopy]
|
interactive-timeout
|
|
|
[safe_mysqld]
|
log_error = /srv/db_trn/log/mysql/ch0pxdbpts05-error.log
|
socket = /srv/db_trn/run/mysql.sock
|
pid-file = /srv/db_trn/run/chi0dbcore01.pid
|
sorry about the format of the my.cnf file - Jira sees hash marks meant for comments as a numbered list - I can attach instead if the format is a problem.
I am testing if it crashes on empty table - I can't provide the data itself unfortunately.
It does not crash with no data in the table. I had restored from a backup, so I wouldn't think it is a corruption issue. Seems more memory/buffer related.
It would be extremely helpful if you could narrow down and/or obfuscate the dataset to the point when you can share it (if you so prefer, it can be done in private).
If you can't do that, please paste the output of SHOW INDEX IN drop_copy_fill_events.
Unfortunately - the data is very sentistive, and I can't share it. Output from show index:
| Table | Non_unique | Key_name | Seq_in_index | Column_name | Collation | Cardinality | Sub_part | Packed | Null | Index_type | Comment | Index_comment |
| drop_copy_fill_events | 0 | PRIMARY | 1 | id | A | 14205431 | NULL | NULL | BTREE | |||
| drop_copy_fill_events | 1 | user_idx | 1 | user_id | A | 33582 | NULL | NULL | BTREE | |||
| drop_copy_fill_events | 1 | exchange_ts_idx | 1 | exchange_ts | A | 14205431 | NULL | NULL | BTREE | |||
| drop_copy_fill_events | 1 | fill_id_str | 1 | fill_id | A | 14205431 | NULL | NULL | YES | BTREE | ||
| drop_copy_fill_events | 1 | exchange_order_id_idx | 1 | exchange_order_id | A | 14205431 | NULL | NULL | YES | BTREE | ||
| drop_copy_fill_events | 1 | ts_str_idx | 1 | ts_str | A | 14205431 | NULL | NULL | YES | BTREE | ||
| drop_copy_fill_events | 1 | tstamp_idx | 1 | tstamp | A | 14205431 | NULL | NULL | BTREE | |||
| drop_copy_fill_events | 1 | order_id_user_id_idx | 1 | order_id | A | 14205431 | NULL | NULL | YES | BTREE | ||
| drop_copy_fill_events | 1 | order_id_user_id_idx | 2 | user_id | A | 14205431 | NULL | NULL | BTREE |
We run optimize on the table weekly.
And explain of the query that crashes with data:
| id | select_type | table | type | possible_keys | key | key_len | ref | rows | Extra |
| 1 | PRIMARY | drop_copy_fill_events | ALL | ts_str_idx | NULL | NULL | NULL | 14205472 | Using where; Using filesort |
| 1 | PRIMARY | <subquery2> | eq_ref | distinct_key | distinct_key | 94 | func | 1 | Using where |
| 2 | MATERIALIZED | drop_copy_fill_events | ALL | ts_str_idx | NULL | NULL | NULL | 14205472 | Using where; Using filesort |
Thank you, we will try to reproduce it.
Thanks. I am rolling this server back from 10.2.8 - so it is a show stopper for us. I appreciate the assistance.
|
mariadb-10.2.8 ASAN |
==9883==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6240013b4158 at pc 0x5628600a9a16 bp 0x7fc44624fdc0 sp 0x7fc44624fdb8
|
READ of size 4 at 0x6240013b4158 thread T35
|
#0 0x5628600a9a15 in sf_malloc_usable_size /data/src/10.2-bug/mysys/safemalloc.c:215
|
#1 0x562860078ae0 in my_free /data/src/10.2-bug/mysys/my_malloc.c:215
|
#2 0x56285f1e2564 in Item_subselect::cleanup() /data/src/10.2-bug/sql/item_subselect.cc:158
|
#3 0x56285f1e2b42 in Item_in_subselect::cleanup() /data/src/10.2-bug/sql/item_subselect.cc:195
|
#4 0x56285e9b6097 in Item::delete_self() /data/src/10.2-bug/sql/item.h:1813
|
#5 0x56285e9a0c16 in Query_arena::free_items() /data/src/10.2-bug/sql/sql_class.cc:3533
|
#6 0x56285e99458a in THD::cleanup_after_query() /data/src/10.2-bug/sql/sql_class.cc:2163
|
#7 0x56285ea5f546 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2-bug/sql/sql_parse.cc:7907
|
#8 0x56285ea3ab56 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2-bug/sql/sql_parse.cc:1812
|
#9 0x56285ea37c41 in do_command(THD*) /data/src/10.2-bug/sql/sql_parse.cc:1360
|
#10 0x56285ed6d3ce in do_handle_one_connection(CONNECT*) /data/src/10.2-bug/sql/sql_connect.cc:1354
|
#11 0x56285ed6cde3 in handle_one_connection /data/src/10.2-bug/sql/sql_connect.cc:1260
|
#12 0x7fc6f835e493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
|
#13 0x7fc6f64d693e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
|
--source include/have_innodb.inc
|
SET GLOBAL innodb_stats_persistent= 1; |
DROP TABLE IF EXISTS t1; |
CREATE TABLE t1 ( |
f1 bigint(20) DEFAULT 0, |
f2 varchar(50) DEFAULT '', |
f3 int(10) DEFAULT 0, |
f4 bigint(20) default 0, |
f5 bigint(20) DEFAULT 0, |
f6 varchar(50) DEFAULT '', |
f7 varchar(64) DEFAULT '', |
f8 varchar(30) DEFAULT '', |
f9 varchar(30) DEFAULT '', |
f10 bigint(20) DEFAULT 0, |
f11 bigint(20) DEFAULT 0, |
f12 bigint(20) DEFAULT 0, |
f13 bigint(20) DEFAULT 0, |
f14 varchar(50) DEFAULT '', |
f15 varchar(100) DEFAULT '', |
f16 varchar(30) DEFAULT '', |
f17 varchar(40) DEFAULT '', |
f18 varchar(30) DEFAULT '', |
f19 varchar(10) DEFAULT '', |
f20 varchar(30) DEFAULT '', |
f21 int(10) DEFAULT 0, |
f22 int(10) DEFAULT 0, |
f23 int(10) DEFAULT 0, |
f24 int(10) DEFAULT 0, |
f25 varchar(20) DEFAULT '', |
f26 varchar(20) DEFAULT '', |
f27 varchar(100) DEFAULT '', |
f28 varchar(55) DEFAULT '', |
f29 varchar(20) DEFAULT '', |
f30 varchar(100) DEFAULT '', |
f31 varchar(30) DEFAULT '', |
f32 varchar(20) DEFAULT '', |
f33 int(10) DEFAULT 0, |
f34 int(10) DEFAULT 0, |
f35 varchar(30) DEFAULT '', |
f36 varchar(30) DEFAULT '', |
f37 varchar(30) DEFAULT '', |
f38 varchar(20) DEFAULT '', |
f39 tinyint(4) DEFAULT 0, |
f40 tinyint(4) DEFAULT 0, |
f41 bigint(20) DEFAULT 0, |
f42 varchar(50) DEFAULT '', |
f43 varchar(50) DEFAULT '', |
f44 varchar(50) DEFAULT '', |
f45 int(10) DEFAULT 0, |
f46 tinyint(1) DEFAULT 0 |
) ENGINE=InnoDB ROW_FORMAT=DYNAMIC; |
|
|
INSERT INTO t1 () VALUES (),(),(),(),(),(),(),(),(),(),(),(),(),(),(),(); |
INSERT INTO t1 SELECT * FROM t1; |
INSERT INTO t1 SELECT * FROM t1; |
INSERT INTO t1 SELECT * FROM t1; |
INSERT INTO t1 SELECT * FROM t1; |
|
|
SELECT * FROM t1 WHERE f2 IN (SELECT f2 FROM t1 GROUP BY f2 HAVING COUNT(DISTINCT f3) = 1); |
|
|
# Cleanup
|
DROP TABLE t1; |
|
10.2 ASAN bc2501453c3ab9 |
==22526==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110000515d8 at pc 0x559259e2a69a bp 0x7f6c0d882d60 sp 0x7f6c0d882d58
|
READ of size 4 at 0x6110000515d8 thread T27
|
#0 0x559259e2a699 in sf_malloc_usable_size /data/src/10.2/mysys/safemalloc.c:215
|
#1 0x559259df984e in my_free /data/src/10.2/mysys/my_malloc.c:215
|
#2 0x559258f78052 in Item_subselect::cleanup() /data/src/10.2/sql/item_subselect.cc:158
|
#3 0x559258f78630 in Item_in_subselect::cleanup() /data/src/10.2/sql/item_subselect.cc:195
|
#4 0x559258740881 in Item::delete_self() /data/src/10.2/sql/item.h:1834
|
#5 0x55925872b35e in Query_arena::free_items() /data/src/10.2/sql/sql_class.cc:3563
|
#6 0x55925871e962 in THD::cleanup_after_query() /data/src/10.2/sql/sql_class.cc:2178
|
#7 0x5592587eb1b3 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7935
|
#8 0x5592587c60eb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1815
|
#9 0x5592587c318f in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1369
|
#10 0x559258afea35 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
|
#11 0x559258afe44a in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#12 0x55925950a129 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
|
#13 0x7f6c1e28f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
|
#14 0x7f6c1c67593e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
|
|
|
0x6110000515d8 is located 88 bytes inside of 212-byte region [0x611000051580,0x611000051654)
|
freed by thread T27 here:
|
#0 0x7f6c1e4f9527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
|
#1 0x559259e2af97 in free_memory /data/src/10.2/mysys/safemalloc.c:279
|
#2 0x559259e2a59d in sf_free /data/src/10.2/mysys/safemalloc.c:197
|
#3 0x559259df9884 in my_free /data/src/10.2/mysys/my_malloc.c:217
|
#4 0x559258f78052 in Item_subselect::cleanup() /data/src/10.2/sql/item_subselect.cc:158
|
#5 0x559258f78630 in Item_in_subselect::cleanup() /data/src/10.2/sql/item_subselect.cc:195
|
#6 0x5592588b5111 in st_join_table::cleanup() /data/src/10.2/sql/sql_select.cc:11819
|
#7 0x5592588b788d in JOIN::cleanup(bool) /data/src/10.2/sql/sql_select.cc:12200
|
#8 0x5592588b6f6d in JOIN::join_free() /data/src/10.2/sql/sql_select.cc:12106
|
#9 0x5592588de17f in do_select /data/src/10.2/sql/sql_select.cc:18281
|
#10 0x55925887e15c in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3566
|
#11 0x55925887bdf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3361
|
#12 0x55925887f1d9 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3761
|
#13 0x55925885ed14 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:376
|
#14 0x5592587e28eb in execute_sqlcom_select /data/src/10.2/sql/sql_parse.cc:6468
|
#15 0x5592587cf73a in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:3479
|
#16 0x5592587eaeda in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7914
|
#17 0x5592587c60eb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1815
|
#18 0x5592587c318f in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1369
|
#19 0x559258afea35 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
|
#20 0x559258afe44a in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#21 0x55925950a129 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
|
#22 0x7f6c1e28f493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
|
|
|
previously allocated by thread T27 here:
|
#0 0x7f6c1e4f973f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
|
#1 0x559259e29d0d in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
|
#2 0x559259df8fbc in my_malloc /data/src/10.2/mysys/my_malloc.c:101
|
#3 0x559258d9bbb8 in read_buffpek_from_file /data/src/10.2/sql/filesort.cc:510
|
#4 0x559258d9a178 in filesort(THD*, TABLE*, Filesort*, Filesort_tracker*, JOIN*, unsigned long long) /data/src/10.2/sql/filesort.cc:304
|
#5 0x5592588f55c3 in create_sort_index(THD*, JOIN*, st_join_table*, Filesort*) /data/src/10.2/sql/sql_select.cc:21817
|
#6 0x5592588e686c in st_join_table::sort_table() /data/src/10.2/sql/sql_select.cc:19652
|
#7 0x5592588e5e89 in join_init_read_record(st_join_table*) /data/src/10.2/sql/sql_select.cc:19593
|
#8 0x5592588df6a5 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18688
|
#9 0x5592588ddbb0 in do_select /data/src/10.2/sql/sql_select.cc:18235
|
#10 0x55925887e15c in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3566
|
#11 0x55925887bdf1 in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3361
|
#12 0x559258bcb939 in join_tab_execution_startup(st_join_table*) /data/src/10.2/sql/opt_subselect.cc:5309
|
#13 0x5592588df596 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18679
|
|
|
Thread T27 created by T0 here:
|
#0 0x7f6c1e4c8bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
|
#1 0x55925950a6f1 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1912
|
#2 0x5592585c0cde in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1239
|
#3 0x5592585d5b15 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6436
|
#4 0x5592585d621a in create_new_thread /data/src/10.2/sql/mysqld.cc:6506
|
#5 0x5592585d722b in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6781
|
#6 0x5592585d506a in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6055
|
#7 0x5592585bf07f in main /data/src/10.2/sql/main.cc:25
|
#8 0x7f6c1c5ad2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
|
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.2/mysys/safemalloc.c:215 sf_malloc_usable_size
|
Shadow bytes around the buggy address:
|
0x0c2280002260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2280002270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2280002280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2280002290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c22800022a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
=>0x0c22800022b0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
|
0x0c22800022c0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
|
0x0c22800022d0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
|
0x0c22800022e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c22800022f0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
|
0x0c2280002300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Heap right redzone: fb
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack partial redzone: f4
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Contiguous container OOB:fc
|
ASan internal: fe
|
==22526==ABORTING
|
----------SERVER LOG END-------------
|
Not reproducible on 10.1.
Hi,
Just wondering if there is any update or schedule for a potential fix for this? If it is going to be a while, I will move forward with 10.1. There are features in 10.2 we would really like, so hoping it won't be too long for a fix or work around.
Thanks!
Lori
yes, the plan is to fix it in the next 10.2 release.
the release schedule is at the https://jira.mariadb.org and at the moment it says that 10.2.15 is planned for 2018-05-11
Great - thanks for the update!!