[MDEV-20224] main.derived crashes with ASAN with error use-after-poison Created: 2019-07-31  Updated: 2020-09-24  Resolved: 2019-08-01

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.5
Fix Version/s: 10.4.8, 10.5.0

Type: Bug Priority: Major
Reporter: Varun Gupta (Inactive) Assignee: Varun Gupta (Inactive)
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-20317 st_select_lex::collect_grouping_field... Closed
relates to MDEV-23804 Server crashes in st_select_lex::coll... Closed

 Description   

When I run the main.derived test on 10.5 with ASAN enabled then the test fails and the stack trace is

Server log from this test:
----------SERVER LOG START-----------
=================================================================
==27857==ERROR: AddressSanitizer: use-after-poison on address 0x62b000174cf8 at pc 0x561e0a9d36ec bp 0x7f110b606820 sp 0x7f110b606810
READ of size 8 at 0x62b000174cf8 thread T8
    #0 0x561e0a9d36eb in st_select_lex::collect_grouping_fields(THD*) /home/varunraiko/MariaDB/maria-dev/sql/sql_lex.cc:7901
    #1 0x561e0a9e2b67 in st_select_lex::pushdown_from_having_into_where(THD*, Item*) /home/varunraiko/MariaDB/maria-dev/sql/sql_lex.cc:10194
    #2 0x561e0aad2cfe in JOIN::optimize_inner() /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:1980
    #3 0x561e0aace910 in JOIN::optimize() /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:1575
    #4 0x561e0aaee72a in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:4598
    #5 0x561e0aac1795 in handle_select(THD*, LEX*, select_result*, unsigned long) /home/varunraiko/MariaDB/maria-dev/sql/sql_select.cc:425
    #6 0x561e0aa38205 in execute_sqlcom_select /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:6319
    #7 0x561e0aa24810 in mysql_execute_command(THD*) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:3882
    #8 0x561e0aa413fd in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:7868
    #9 0x561e0aa172c2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:1826
    #10 0x561e0aa13a62 in do_command(THD*) /home/varunraiko/MariaDB/maria-dev/sql/sql_parse.cc:1359
    #11 0x561e0ae1dfd8 in do_handle_one_connection(CONNECT*, bool) /home/varunraiko/MariaDB/maria-dev/sql/sql_connect.cc:1413
    #12 0x561e0ae1d883 in handle_one_connection /home/varunraiko/MariaDB/maria-dev/sql/sql_connect.cc:1309
    #13 0x561e0ba86b58 in pfs_spawn_thread /home/varunraiko/MariaDB/maria-dev/storage/perfschema/pfs.cc:1862
    #14 0x7f11156506da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #15 0x7f111483688e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

The commit I tested against

commit 46553c250808f0cc21e91f7e13439add2903aea0 (origin/HEAD, origin/10.5, 10.5)
Author: Noel Kuntze <noel@familie-kuntze.de>
Date:   Fri May 31 04:18:24 2019 +0200
 
    Fix compiler warnings GCC8



 Comments   
Comment by Varun Gupta (Inactive) [ 2019-08-01 ]

The test case where this fails

EXPLAIN
SELECT Customer, Success, SUM(OrderSize)
 FROM (SELECT Customer,
 CASE WHEN DeliveryStatus='Success' THEN 'Yes' ELSE 'No' END AS Success,
 OrderSize
 FROM example1463) as subQ
 GROUP BY Success, Customer
 HAVING Success IS NOT NULL;

Inside the function st_select_lex::collect_grouping_fields we try to collect list of group by items that are of type Item_field.
For the above case the item Success is Item_direct_view_ref and the ref is to a Functional Item.
So this Item should not be added to the grouping_fields list

Comment by Varun Gupta (Inactive) [ 2019-08-01 ]

Patch
http://lists.askmonty.org/pipermail/commits/2019-August/013916.html

Comment by Varun Gupta (Inactive) [ 2019-08-01 ]

The illegal cast also happens on 10.4 but somehow ASAN is not able to catch it

Generated at Thu Feb 08 08:57:48 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.