[MDEV-18335] Assertion `!error || error == 137' failed in subselect_rowid_merge_engine::init Created: 2019-01-22  Updated: 2020-10-06  Resolved: 2020-08-26

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.3, 10.4
Fix Version/s: 10.3.26, 10.4.16, 10.5.7

Type: Bug Priority: Major
Reporter: Alice Sherepa Assignee: Varun Gupta (Inactive)
Resolution: Fixed Votes: 0
Labels: None


 Description    

--source include/have_innodb.inc
 
CREATE TABLE t1 (i1 int,v1 varchar(1),KEY (v1,i1)) engine=innodb;
 
INSERT INTO t1 VALUES (8,'x'),(7,'d'),(1,'r'),(7,'f'),(9,'y'),(null,'u'),(1,'m'),(9,null),(2,'o'),(9,'w'),(2,'m'),(4,'q'),(0,null),(4,'d'),(8,'g'),(null,'x'),(null,'f'),(0,'p'),(null,'j'),(8,'c');
 
 
 
CREATE TABLE t2 (pk int) engine=innodb;
 
 
 
CREATE TABLE t3 (v2 varchar(1)) engine=innodb;
 
INSERT INTO t3 VALUES ('i'),('e'),('p'),('s'),('j'),('z'),('c'),('a'),('q'),('y'),(NULL),('r'),('v'),(NULL),('r');
 
 
 
CREATE TABLE t4 (v2 varchar(1)) engine=innodb;
 
INSERT INTO t4 VALUES ('c'),('c'),('q'),('g'),('e'),('l'),(NULL),('v'),('c'),('u'),('x'),('x'),('x'),('l'),('e'),('s'),('k'),('m'),('x'),('s'),('h'),('u'),('x'),('l'),('p'),('i'),('u'),('i'),('i'),('e'),('h'),('f'),(NULL),('p'),('n'),('h'),('m'),('x'),('d'),('d'),('t'),(NULL),(NULL),('v'),('u'),('p'),('o'),('v'),('m'),('x'),('n'),('b'),(NULL),('r'),('v'),('a'),('u'),(NULL),('b'),('s'),('t'),('b'),('m'),('v'),('n'),('j'),(NULL),(NULL),('h'),('k'),('k'),(NULL),('n'),('e'),('s'),('w'),('y'),('z'),('b'),('f'),('s'),('d'),(NULL),('d'),('n'),('i'),(NULL),('h'),('d'),('c'),('i'),('t'),('g'),('q'),('l'),('n'),('z'),('n'),('r'),('p');
 
 
 
SET SESSION join_cache_level=0;
 
 
 
select 1
 
from t2 join t1 on 
('i','w') not in (select t1.v1,t4.v2 from t4,(t1 join t3 on t3.v2 = t1.v1))
 
limit rows examined 1000 ;
 
 
 
#Cleanup
 
drop table t1,t2,t3,t4;

10.3 d4144c8e010b61a440d42

 
/10.3/sql/item_subselect.cc:6251: bool subselect_rowid_merge_engine::init(MY_BITMAP*, MY_BITMAP*): Assertion `!error || error == 137' failed.
 
190122 12:51:04 [ERROR] mysqld got signal 6 ;
 
 
 
assert/assert.c:92(__assert_fail_base)[0x7f6eae1d3bd7]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x2dc82)[0x7f6eae1d3c82]
 
sql/item_subselect.cc:6252(subselect_rowid_merge_engine::init(st_bitmap*, st_bitmap*))[0x556c222731eb]
 
sql/item_subselect.cc:5544(subselect_hash_sj_engine::exec())[0x556c2226e4ec]
 
sql/item_subselect.cc:727(Item_subselect::exec())[0x556c22245122]
 
sql/item_subselect.cc:907(Item_in_subselect::exec())[0x556c22246327]
 
sql/item_subselect.cc:1757(Item_in_subselect::val_bool())[0x556c2224e6ad]
 
/home/alice/git/10.3/sql/mysqld(+0xd562cc)[0x556c217442cc]
 
sql/item.h:1275(Item::val_bool_result())[0x556c22112900]
 
sql/item_cmpfunc.cc:1602(Item_in_optimizer::val_int())[0x556c2174417c]
 
sql/item.h:1271(Item::val_int_result())[0x556c220e8a1d]
 
sql/item.cc:9872(Item_cache_int::cache_value())[0x556c220faade]
 
sql/item.cc:8698(Item_cache_wrapper::cache())[0x556c220e17a7]
 
sql/item.cc:8862(Item_cache_wrapper::val_bool())[0x556c22102369]
 
sql/item_cmpfunc.cc:224(Item_func_not::val_int())[0x556c21a33c5e]
 
sql/sql_select.cc:3942(JOIN::exec_inner())[0x556c21a326aa]
 
sql/sql_select.cc:3835(JOIN::exec())[0x556c21a35b1c]
 
sql/sql_select.cc:4241(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x556c21a10ec7]
 
sql/sql_select.cc:385(handle_select(THD*, LEX*, select_result*, unsigned long))[0x556c219976a6]
 
sql/sql_parse.cc:6548(execute_sqlcom_select(THD*, TABLE_LIST*))[0x556c21985e01]
 
sql/sql_parse.cc:3769(mysql_execute_command(THD*))[0x556c219a00c1]
 
sql/sql_parse.cc:8092(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x556c2197ab86]
 
sql/sql_parse.cc:1853(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x556c21977d1e]
 
sql/sql_parse.cc:1396(do_command(THD*))[0x556c21ccae63]
 
sql/sql_connect.cc:1402(do_handle_one_connection(CONNECT*))[0x556c21cca840]
 
sql/sql_connect.cc:1309(handle_one_connection)[0x556c22ff2359]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7f6eaee186ba]
 
x86_64/clone.S:111(clone)[0x7f6eae2ad41d]
 
 
 
Query (0x62b000000288): select 1 from t2 join t1 on  ('i','w') not in (select t1.v1,t4.v2 from t4,(t1 join t3 on t3.v2 =

Not reproducible on 10.2.

10.3 non-debug build also fails, but later:

10.3 d4144c8e0

 
*** Error in `/data/bld/10.3-rel/bin/mysqld': free(): invalid next size (normal): 0x00007f1dc80c82f0 ***
 
======= Backtrace: =========
 
/lib/x86_64-linux-gnu/libc.so.6(+0x70bcb)[0x7f1e27ae0bcb]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x76f96)[0x7f1e27ae6f96]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x7778e)[0x7f1e27ae778e]
 
/data/bld/10.3-rel/bin/mysqld(delete_dynamic+0x17)[0x55e8a8403687]
 
/data/bld/10.3-rel/bin/mysqld(_ZN11sp_pcontextD1Ev+0x7b)[0x55e8a7d10bfb]
 
/data/bld/10.3-rel/bin/mysqld(_ZN7sp_headD2Ev+0x55)[0x55e8a7d057f5]
 
/data/bld/10.3-rel/bin/mysqld(_ZN7sp_headD0Ev+0x9)[0x55e8a7d079b9]
 
/data/bld/10.3-rel/bin/mysqld(_ZN19Table_triggers_listD1Ev+0x29)[0x55e8a7e22999]
 
/data/bld/10.3-rel/bin/mysqld(+0x6de355)[0x55e8a7ee3355]
 
/data/bld/10.3-rel/bin/mysqld(_Z8tc_purgeb+0x4d)[0x55e8a7ee4b8d]
 
/data/bld/10.3-rel/bin/mysqld(_Z19close_cached_tablesP3THDP10TABLE_LISTbm+0x7d)[0x55e8a7d37b1d]
 
/data/bld/10.3-rel/bin/mysqld(+0x4d6217)[0x55e8a7cdb217]
 
/data/bld/10.3-rel/bin/mysqld(_Z10unireg_endv+0x2d)[0x55e8a7cdb57d]
 
/data/bld/10.3-rel/bin/mysqld(+0x4da6c9)[0x55e8a7cdf6c9]
 
/data/bld/10.3-rel/bin/mysqld(kill_server_thread+0xe)[0x55e8a7cdf77e]
 
/data/bld/10.3-rel/bin/mysqld(+0x947db4)[0x55e8a814cdb4]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x7494)[0x7f1e29772494]
 
/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f)[0x7f1e27b5893f]
 
======= Memory map: ========
 
55e8a7805000-55e8a89fa000 r-xp 00000000 08:11 37313396                   /data/bld/10.3-rel/bin/mysqld
 
55e8a8bf9000-55e8a8cff000 r--p 011f4000 08:11 37313396                   /data/bld/10.3-rel/bin/mysqld
 
55e8a8cff000-55e8a8dba000 rw-p 012fa000 08:11 37313396                   /data/bld/10.3-rel/bin/mysqld
 
55e8a8dba000-55e8a9656000 rw-p 00000000 00:00 0 
55e8a9c18000-55e8aa109000 rw-p 00000000 00:00 0                          [heap]
 
7f1dc8000000-7f1dc81f1000 rw-p 00000000 00:00 0 
7f1dc81f1000-7f1dcc000000 ---p 00000000 00:00 0 
7f1dcc000000-7f1dcc021000 rw-p 00000000 00:00 0 
7f1dcc021000-7f1dd0000000 ---p 00000000 00:00 0 
7f1dd0000000-7f1dd0021000 rw-p 00000000 00:00 0 
7f1dd0021000-7f1dd4000000 ---p 00000000 00:00 0 
7f1dd4000000-7f1dd4021000 rw-p 00000000 00:00 0 
7f1dd4021000-7f1dd8000000 ---p 00000000 00:00 0 
7f1dd8000000-7f1dd8021000 rw-p 00000000 00:00 0 
7f1dd8021000-7f1ddc000000 ---p 00000000 00:00 0 
7f1ddc000000-7f1ddc021000 rw-p 00000000 00:00 0 
7f1ddc021000-7f1de0000000 ---p 00000000 00:00 0 
7f1de0000000-7f1de0029000 rw-p 00000000 00:00 0 
7f1de0029000-7f1de4000000 ---p 00000000 00:00 0 
7f1de4000000-7f1de4021000 rw-p 00000000 00:00 0 
7f1de4021000-7f1de8000000 ---p 00000000 00:00 0 
7f1de8000000-7f1de8021000 rw-p 00000000 00:00 0 
7f1de8021000-7f1dec000000 ---p 00000000 00:00 0 
7f1df0000000-7f1df0021000 rw-p 00000000 00:00 0 
7f1df0021000-7f1df4000000 ---p 00000000 00:00 0 
7f1df8000000-7f1df8021000 rw-p 00000000 00:00 0 
7f1df8021000-7f1dfc000000 ---p 00000000 00:00 0 
7f1dfcffa000-7f1dfcffb000 ---p 00000000 00:00 0 
7f1dfcffb000-7f1dfd7fb000 rw-p 00000000 00:00 0 
7f1dfd7fb000-7f1dfd7fc000 ---p 00000000 00:00 0 
7f1dfd7fc000-7f1dfdffc000 rw-p 00000000 00:00 0                          [stack:16461]
 
7f1dfdffc000-7f1dfdffd000 ---p 00000000 00:00 0 
7f1dfdffd000-7f1dfe7fd000 rw-p 00000000 00:00 0                          [stack:16460]
 
7f1dfe7fd000-7f1dfe7fe000 ---p 00000000 00:00 0 
7f1dfe7fe000-7f1dfeffe000 rw-p 00000000 00:00 0                          [stack:16459]
 
7f1dff7ff000-7f1dff800000 ---p 00000000 00:00 0 
7f1dff800000-7f1e00000000 rw-p 00000000 00:00 0 
7f1e00000000-7f1e00021000 rw-p 00000000 00:00 0 
7f1e00021000-7f1e04000000 ---p 00000000 00:00 0 
7f1e04000000-7f1e04021000 rw-p 00000000 00:00 0 
7f1e04021000-7f1e08000000 ---p 00000000 00:00 0 
7f1e08000000-7f1e08021000 rw-p 00000000 00:00 0 
7f1e08021000-7f1e0c000000 ---p 00000000 00:00 0 
7f1e0c000000-7f1e0c021000 rw-p 00000000 00:00 0 
7f1e0c021000-7f1e10000000 ---p 00000000 00:00 0 
7f1e107f9000-7f1e107fa000 ---p 00000000 00:00 0 
7f1e107fa000-7f1e10ffa000 rw-p 00000000 00:00 0 
7f1e10ffa000-7f1e10ffb000 ---p 00000000 00:00 0 
7f1e10ffb000-7f1e117fb000 rw-p 00000000 00:00 0 
7f1e117fb000-7f1e117fc000 ---p 00000000 00:00 0 
7f1e117fc000-7f1e11ffc000 rw-p 00000000 00:00 0 
7f1e127fd000-7f1e127fe000 ---p 00000000 00:00 0 
7f1e127fe000-7f1e12ffe000 rw-p 00000000 00:00 0                          [stack:16451]
 
7f1e12ffe000-7f1e12fff000 ---p 00000000 00:00 0 
7f1e12fff000-7f1e137ff000 rw-p 00000000 00:00 0                          [stack:16450]
 
7f1e137ff000-7f1e13800000 ---p 00000000 00:00 0 
7f1e13800000-7f1e14000000 rw-p 00000000 00:00 0                          [stack:16449]
 
7f1e14000000-7f1e14021000 rw-p 00000000 00:00 0 
7f1e14021000-7f1e18000000 ---p 00000000 00:00 0 
7f1e18729000-7f1e1872a000 ---p 00000000 00:00 0 
7f1e1872a000-7f1e18f2a000 rw-p 00000000 00:00 0                          [stack:16454]
 
7f1e18f2a000-7f1e18f2b000 ---p 00000000 00:00 0 
7f1e18f2b000-7f1e1972b000 rw-p 00000000 00:00 0                          [stack:16447]
 
7f1e1972b000-7f1e1972c000 ---p 00000000 00:00 0 
7f1e1972c000-7f1e19f2c000 rw-p 00000000 00:00 0                          [stack:16446]
 
7f1e19f2c000-7f1e19f2d000 ---p 00000000 00:00 0 
7f1e19f2d000-7f1e1a72d000 rw-p 00000000 00:00 0                          [stack:16445]
 
7f1e1a72d000-7f1e1a72e000 ---p 00000000 00:00 0 
7f1e1a72e000-7f1e1af2e000 rw-p 00000000 00:00 0                          [stack:16444]
 
7f1e1af2e000-7f1e1af2f000 ---p 00000000 00:00 0 
7f1e1af2f000-7f1e1b72f000 rw-p 00000000 00:00 0                          [stack:16443]
 
7f1e1b72f000-7f1e1b730000 ---p 00000000 00:00 0 
7f1e1b730000-7f1e1c000000 rw-p 00000000 00:00 0                          [stack:16442]
 
7f1e1c000000-7f1e1c021000 rw-p 00000000 00:00 0 
7f1e1c021000-7f1e20000000 ---p 00000000 00:00 0 
7f1e2036f000-7f1e20574000 rw-p 00000000 00:00 0 
7f1e20574000-7f1e20575000 ---p 00000000 00:00 0 
7f1e20575000-7f1e20d75000 rw-p 00000000 00:00 0                          [stack:16441]
 
7f1e20e4d000-7f1e20e4e000 ---p 00000000 00:00 0 
7f1e20e4e000-7f1e20e97000 rw-p 00000000 00:00 0                          [stack:16478]
 
7f1e20f2b000-7f1e20f2c000 ---p 00000000 00:00 0 
7f1e20f2c000-7f1e20f75000 rw-p 00000000 00:00 0                          [stack:16463]
 
7f1e20f75000-7f1e219a5000 rw-p 00000000 00:00 0 
7f1e219a5000-7f1e21da6000 rw-p 00000000 00:00 0 
7f1e21da6000-7f1e21da7000 ---p 00000000 00:00 0 
7f1e21da7000-7f1e23042000 rw-p 00000000 00:00 0                          [stack:16440]
 
7f1e23042000-7f1e23043000 ---p 00000000 00:00 0 
7f1e23043000-7f1e23843000 rw-p 00000000 00:00 0                          [stack:16439]
 
7f1e2393f000-7f1e27a70000 rw-p 00000000 00:00 0 
7f1e27a70000-7f1e27c05000 r-xp 00000000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
 
7f1e27c05000-7f1e27e04000 ---p 00195000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
 
7f1e27e04000-7f1e27e08000 r--p 00194000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
 
7f1e27e08000-7f1e27e0a000 rw-p 00198000 08:05 3152648                    /lib/x86_64-linux-gnu/libc-2.24.so
 
7f1e27e0a000-7f1e27e0e000 rw-p 00000000 00:00 0 
7f1e27e0e000-7f1e27e24000 r-xp 00000000 08:05 3145732                    /lib/x86_64-linux-gnu/libgcc_s.so.1
 
7f1e27e24000-7f1e28023000 ---p 00016000 08:05 3145732                    /lib/x86_64-linux-gnu/libgcc_s.so.1
 
7f1e28023000-7f1e28024000 rw-p 00015000 08:05 3145732                    /lib/x86_64-linux-gnu/libgcc_s.so.1
 
7f1e28024000-7f1e28127000 r-xp 00000000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
 
7f1e28127000-7f1e28326000 ---p 00103000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
 
7f1e28326000-7f1e28327000 r--p 00102000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
 
7f1e28327000-7f1e28328000 rw-p 00103000 08:05 3152660                    /lib/x86_64-linux-gnu/libm-2.24.so
 
7f1e28328000-7f1e2849a000 r-xp 00000000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
 
7f1e2849a000-7f1e2869a000 ---p 00172000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
 
7f1e2869a000-7f1e286a4000 r--p 00172000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
 
7f1e286a4000-7f1e286a6000 rw-p 0017c000 08:05 1577675                    /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22
 
7f1e286a6000-7f1e286aa000 rw-p 00000000 00:00 0 
7f1e286aa000-7f1e286ad000 r-xp 00000000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
 
7f1e286ad000-7f1e288ac000 ---p 00003000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
 
7f1e288ac000-7f1e288ad000 r--p 00002000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
 
7f1e288ad000-7f1e288ae000 rw-p 00003000 08:05 3152657                    /lib/x86_64-linux-gnu/libdl-2.24.so
 
7f1e288ae000-7f1e28a7b000 r-xp 00000000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
 
7f1e28a7b000-7f1e28c7a000 ---p 001cd000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
 
7f1e28c7a000-7f1e28c97000 r--p 001cc000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
 
7f1e28c97000-7f1e28ca7000 rw-p 001e9000 08:05 1576357                    /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
 
7f1e28ca7000-7f1e28caa000 rw-p 00000000 00:00 0 
7f1e28caa000-7f1e28d01000 r-xp 00000000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
 
7f1e28d01000-7f1e28f01000 ---p 00057000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
 
7f1e28f01000-7f1e28f04000 r--p 00057000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
 
7f1e28f04000-7f1e28f0a000 rw-p 0005a000 08:05 1576361                    /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
 
7f1e28f0a000-7f1e28f0b000 rw-p 00000000 00:00 0 
7f1e28f0b000-7f1e28f13000 r-xp 00000000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
 
7f1e28f13000-7f1e29113000 ---p 00008000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
 
7f1e29113000-7f1e29114000 r--p 00008000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
 
7f1e29114000-7f1e29115000 rw-p 00009000 08:05 3152654                    /lib/x86_64-linux-gnu/libcrypt-2.24.so
 
7f1e29115000-7f1e29143000 rw-p 00000000 00:00 0 
7f1e29143000-7f1e2915d000 r-xp 00000000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
 
7f1e2915d000-7f1e2935c000 ---p 0001a000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
 
7f1e2935c000-7f1e2935d000 r--p 00019000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
 
7f1e2935d000-7f1e2935e000 rw-p 0001a000 08:05 3145828                    /lib/x86_64-linux-gnu/libz.so.1.2.8
 
7f1e2935e000-7f1e29368000 r-xp 00000000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
 
7f1e29368000-7f1e29567000 ---p 0000a000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
 
7f1e29567000-7f1e29568000 r--p 00009000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
 
7f1e29568000-7f1e29569000 rw-p 0000a000 08:05 1586559                    /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
 
7f1e29569000-7f1e2956a000 r-xp 00000000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
 
7f1e2956a000-7f1e29769000 ---p 00001000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
 
7f1e29769000-7f1e2976a000 r--p 00000000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
 
7f1e2976a000-7f1e2976b000 rw-p 00001000 08:05 3152558                    /lib/x86_64-linux-gnu/libaio.so.1.0.1
 
7f1e2976b000-7f1e29783000 r-xp 00000000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
 
7f1e29783000-7f1e29982000 ---p 00018000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
 
7f1e29982000-7f1e29983000 r--p 00017000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
 
7f1e29983000-7f1e29984000 rw-p 00018000 08:05 3152800                    /lib/x86_64-linux-gnu/libpthread-2.24.so
 
7f1e29984000-7f1e29988000 rw-p 00000000 00:00 0 
7f1e29988000-7f1e299ab000 r-xp 00000000 08:05 3145795                    /lib/x86_64-linux-gnu/ld-2.24.so
 
7f1e299af000-7f1e299b5000 rw-s 00000000 08:11 37522030                   /data/bld/10.3-rel/mysql-test/var/mysqld.1/data/tc.log
 
7f1e299b5000-7f1e299ba000 rw-s 00000000 00:0a 92024715                   /[aio] (deleted)
 
7f1e299ba000-7f1e299bf000 rw-s 00000000 00:0a 92024714                   /[aio] (deleted)
 
7f1e299bf000-7f1e29b91000 rw-p 00000000 00:00 0 
7f1e29b91000-7f1e29b93000 rw-s 00000000 00:0a 92024716                   /[aio] (deleted)
 
7f1e29b93000-7f1e29b98000 rw-s 00000000 00:0a 92024713                   /[aio] (deleted)
 
7f1e29b98000-7f1e29b9d000 rw-s 00000000 00:0a 92024712                   /[aio] (deleted)
 
7f1e29b9d000-7f1e29ba2000 rw-s 00000000 00:0a 92024711                   /[aio] (deleted)
 
7f1e29ba2000-7f1e29ba7000 rw-s 00000000 00:0a 92024710                   /[aio] (deleted)
 
7f1e29ba7000-7f1e29ba8000 rw-s 00000000 00:0a 92024709                   /[aio] (deleted)
 
7f1e29ba8000-7f1e29bab000 rw-p 00000000 00:00 0 
7f1e29bab000-7f1e29bac000 r--p 00023000 08:05 3145795                    /lib/x86_64-linux-gnu/ld-2.24.so
 
7f1e29bac000-7f1e29bad000 rw-p 00024000 08:05 3145795                    /lib/x86_64-linux-gnu/ld-2.24.so
 
7f1e29bad000-7f1e29bae000 rw-p 00000000 00:00 0 
7ffdffa61000-7ffdffa84000 rw-p 00000000 00:00 0                          [stack]
 
7ffdffb82000-7ffdffb84000 r-xp 00000000 00:00 0                          [vdso]
 
7ffdffb84000-7ffdffb86000 r--p 00000000 00:00 0                          [vvar]
 
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
 
***Warnings generated in error logs during shutdown after running tests: bug.t2

10.3 non-debug ASAN build produces heap-buffer-overflow:

==16621==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6190001238c0 at pc 0x55eed45c4e2e bp 0x7f79ce5c1a60 sp 0x7f79ce5c1a58
 
WRITE of size 8 at 0x6190001238c0 thread T27
 
    #0 0x55eed45c4e2d in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
 
    #1 0x55eed45c4e2d in subselect_rowid_merge_engine::init(st_bitmap*, st_bitmap*) /data/src/10.3/sql/item_subselect.cc:6264
 
    #2 0x55eed45c78f8 in subselect_hash_sj_engine::exec() /data/src/10.3/sql/item_subselect.cc:5547
 
    #3 0x55eed4598aa3 in Item_subselect::exec() /data/src/10.3/sql/item_subselect.cc:727
 
    #4 0x55eed459c4a1 in Item_in_subselect::val_bool() /data/src/10.3/sql/item_subselect.cc:1757
 
    #5 0x55eed4457f76 in Item_in_optimizer::val_int() /data/src/10.3/sql/item_cmpfunc.cc:1602
 
    #6 0x55eed43be09c in Item_cache_int::cache_value() /data/src/10.3/sql/item.cc:9922
 
    #7 0x55eed4408b22 in Item_cache_wrapper::cache() /data/src/10.3/sql/item.cc:8770
 
    #8 0x55eed4408b22 in Item_cache_wrapper::val_bool() /data/src/10.3/sql/item.cc:8934
 
    #9 0x55eed442a36a in Item_func_not::val_int() /data/src/10.3/sql/item_cmpfunc.cc:224
 
    #10 0x55eed3ed2d71 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:3938
 
    #11 0x55eed3ed4b03 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3829
 
    #12 0x55eed3ed4f02 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4234
 
    #13 0x55eed3ed788b in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:382
 
    #14 0x55eed3b0d6a4 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6547
 
    #15 0x55eed3dc3642 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3769
 
    #16 0x55eed3dcbcb8 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8089
 
    #17 0x55eed3dd2cc7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850
 
    #18 0x55eed3dd4e26 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395
 
    #19 0x55eed407a287 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
 
    #20 0x55eed407a78a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #21 0x55eed4a0cd26 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #22 0x7f79d9d40493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #23 0x7f79d812693e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x6190001238c0 is located 0 bytes to the right of 1088-byte region [0x619000123480,0x6190001238c0)
 
allocated by thread T27 here:
 
    #0 0x7f79d9faa73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x55eed520bbbc in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f79d9f79bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x55eed4a15446 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
 
 
 
SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/include/x86_64-linux-gnu/bits/string3.h:53 memcpy
 
Shadow bytes around the buggy address:
 
  0x0c328001c6c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c328001c6d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c328001c6e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c328001c6f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c328001c700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
=>0x0c328001c710: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
 
  0x0c328001c720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c328001c730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c328001c740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c328001c750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c328001c760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==16621==ABORTING



 Comments   
Comment by Varun Gupta (Inactive) [ 2020-08-17 ]

The issue is not reproducible when LIMIT ROWS EXAMINED is removed.

Comment by Varun Gupta (Inactive) [ 2020-08-18 ]

Well the issue here is when the duplicates are found with hash (for the IN subquery), duplicate records are marked as deleted.

 pos[share->visible]= 0;                                 /* Record deleted */

When their is no LIMIT ROWS EXAMINED in the query then the records that are marked as deleted are skipped by the handler API, but if the query is ABORTED by the user then the deleted records are not skipped and the handler API returns the error HA_ERR_ABORTED_BY_USER.

 do
 
  {
 
    TABLE_IO_WAIT(tracker, m_psi, PSI_TABLE_FETCH_ROW, MAX_KEY, 0,
 
      { result= rnd_next(buf); })
 
    if (result != HA_ERR_RECORD_DELETED)
 
      break;
 
    status_var_increment(table->in_use->status_var.ha_read_rnd_deleted_count);
 
  } while (!table->in_use->check_killed(1));
 
 
 
  if (result == HA_ERR_RECORD_DELETED)
 
    result= HA_ERR_ABORTED_BY_USER;

Comment by Varun Gupta (Inactive) [ 2020-08-18 ]

So a trivial patch to fix this would be to terminated reading rows after HA_ERR_ABORTED_BY_USER is reported

diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
 
index 578f0ded00e..513aad737cd 100644
 
--- a/sql/item_subselect.cc
 
+++ b/sql/item_subselect.cc
 
@@ -6318,6 +6318,9 @@ subselect_rowid_merge_engine::init(MY_BITMAP *non_null_key_parts,
 
   while (TRUE)
 
   {
 
     error= tmp_table->file->ha_rnd_next(tmp_table->record[0]);
 
+
 
+    if (error == HA_ERR_ABORTED_BY_USER)
 
+      break;
 
     /*
 
       This is a temp table that we fully own, there should be no other
 
       cause to stop the iteration than EOF.

Comment by Varun Gupta (Inactive) [ 2020-08-18 ]

This patch fixes the problem but i think there is a bigger issue here. We are trying to read rows even after the query has been aborted (that is LIMIT ROWS EXAMINED has been reached). If we want the entire execution to complete
maybe we should set LIMIT ROWS EXAMINED to max value so the query execution is not aborted and check if the limit rows examined has been reached after the subquery execution is done.

Comment by Varun Gupta (Inactive) [ 2020-08-24 ]

Patch
http://lists.askmonty.org/pipermail/commits/2020-August/014315.html

Comment by Oleksandr Byelkin [ 2020-08-25 ]

The other variant was just fix assert, but IMHO check is good here, because it is in long executing loop.

OK to push.

Generated at Thu Feb 08 08:43:19 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.