[MDEV-17034] server crashes in Item_sum::set_aggregator Created: 2018-08-22  Updated: 2019-01-08  Resolved: 2019-01-04

Status: Closed
Project: MariaDB Server
Component/s: Optimizer - Window functions
Affects Version/s: 10.2, 10.3
Fix Version/s: 10.3.11, 10.2.19

Type: Bug Priority: Major
Reporter: Alice Sherepa Assignee: Vicențiu Ciorbaru
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-12575 Server crash in AGGR_OP::put_record o... Closed
relates to MDEV-16051 window functions crash Closed

 Description   

create table t1 (`d1` date);
insert into t1 values ('2001-09-09');
 
select distinct var_pop("1"), min(round(`d1`)) over ()
from t1 where @a := 0 group by pi();

10.2 b0ef1b388bff28b93bf
 
#3  <signal handler called>
#4  0x000056545af50834 in Item_sum::set_aggregator (this=0x7f4cb4012660, aggregator=Aggregator::SIMPLE_AGGREGATOR) at /10.2/sql/item_sum.cc:584
#5  0x000056545ac7e2d3 in prepare_sum_aggregators (func_ptr=0x7f4cb40145b8, need_distinct=true) at /10.2/sql/sql_select.cc:23593
#6  0x000056545ac4a153 in JOIN::create_postjoin_aggr_table (this=0x7f4cb4013ae8, tab=0x7f4cb4014b10, table_fields=0x7f4cb4013e20, table_group=0x0, save_sum_fields=true, distinct=false, keep_row_order=false) at /10.2/sql/sql_select.cc:2990
#7  0x000056545ac48d10 in JOIN::make_aggr_tables_info (this=0x7f4cb4013ae8) at /10.2/sql/sql_select.cc:2668
#8  0x000056545ac4734a in JOIN::optimize_inner (this=0x7f4cb4013ae8) at /10.2/sql/sql_select.cc:2254
#9  0x000056545ac433a9 in JOIN::optimize (this=0x7f4cb4013ae8) at /10.2/sql/sql_select.cc:1115
#10 0x000056545ac4c798 in mysql_select (thd=0x7f4cb4000b00, tables=0x7f4cb4012dc0, wild_num=0, fields=..., conds=0x7f4cb4013488, og_num=1, order=0x0, group=0x7f4cb40139a8, having=0x0, proc_param=0x0, select_options=2147748609, result=0x7f4cb4013ac8, unit=0x7f4cb40046f0, select_lex=0x7f4cb4004e28) at /10.2/sql/sql_select.cc:3790
#11 0x000056545ac40b6a in handle_select (thd=0x7f4cb4000b00, lex=0x7f4cb4004628, result=0x7f4cb4013ac8, setup_tables_done_option=0) at /10.2/sql/sql_select.cc:376
#12 0x000056545ac0c2a8 in execute_sqlcom_select (thd=0x7f4cb4000b00, all_tables=0x7f4cb4012dc0) at /10.2/sql/sql_parse.cc:6477
#13 0x000056545ac01fe6 in mysql_execute_command (thd=0x7f4cb4000b00) at /10.2/sql/sql_parse.cc:3484
#14 0x000056545ac100be in mysql_parse (thd=0x7f4cb4000b00, rawbuf=0x7f4cb4012498 "select distinct var_pop(\"1\"), min(round(`d1`)) over ()\nfrom t1 where @a := 0 group by pi()", length=90, parser_state=0x7f4d08124080, is_com_multi=false, is_next_command=false) at /10.2/sql/sql_parse.cc:8009
#15 0x000056545abfd857 in dispatch_command (command=COM_QUERY, thd=0x7f4cb4000b00, packet=0x7f4cb4096341 "select distinct var_pop(\"1\"), min(round(`d1`)) over ()\nfrom t1 where @a := 0 group by pi()", packet_length=90, is_com_multi=false, is_next_command=false) at /10.2/sql/sql_parse.cc:1824
#16 0x000056545abfc1b3 in do_command (thd=0x7f4cb4000b00) at /10.2/sql/sql_parse.cc:1378
#17 0x000056545ad4d577 in do_handle_one_connection (connect=0x56545ea1dc60) at /10.2/sql/sql_connect.cc:1335
#18 0x000056545ad4d2f7 in handle_one_connection (arg=0x56545ea1dc60) at /10.2/sql/sql_connect.cc:1241
#19 0x000056545b57a500 in pfs_spawn_thread (arg=0x56545ea00910) at /10.2/storage/perfschema/pfs.cc:1862
#20 0x00007f4d0f4dd6ba in start_thread (arg=0x7f4d08125700) at pthread_create.c:333
#21 0x00007f4d0e97241d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109



 Comments   
Comment by Alice Sherepa [ 2019-01-04 ]

Fixed by a12b8ac8e9636f commit by Varun Gupta

commit a12b8ac8e9636f8258bcb17a0845b9317d870fd9
Author: Varun Gupta <varunraiko1803@gmail.com>
Date:   Fri Nov 9 19:53:40 2018 +0530
 
    MDEV-12575: Server crash in AGGR_OP::put_record or in JOIN_CACHE::free or Invalid write in JOIN::make_aggr_tables_info
    
    During the optimize state of a query, we come know that the result set
    would atmost contain one row, then for such a query we don't need
    to compute GROUP BY, ORDER BY and DISTINCT.

Generated at Thu Feb 08 08:33:25 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.