[MDEV-20290] Server crash in st_select_lex::cleanup or Assertion `sl->join == 0' failed in reinit_stmt_before_use Created: 2019-08-08  Updated: 2020-10-08  Resolved: 2020-10-08

Status: Closed
Project: MariaDB Server
Component/s: Server, Stored routines
Affects Version/s: 10.4, 10.5
Fix Version/s: 10.4.13, 10.5.4

Type: Bug Priority: Critical
Reporter: Alice Sherepa Assignee: Oleksandr Byelkin
Resolution: Duplicate Votes: 2
Labels: None

Issue Links:
Duplicate
is duplicated by MDEV-21315 Server 10.4 sporadically crashes when... Closed
is duplicated by MDEV-23056 server crash on select with where cla... Closed
is duplicated by MDEV-23094 Multiple calls to a Stored Procedure ... Closed
Relates
relates to MDEV-20284 Some pointers may be invalid and caus... Closed
relates to MDEV-20803 IF NOT EXISTS AND NOT EXISTS crash DB... Closed
relates to MDEV-20858 Function crash server Closed
relates to MDEV-21199 Segfault Closed

 Description    

CREATE TABLE t1 (a VARCHAR(20) NULL, c VARCHAR(20) NULL);
 
 
 
DELIMITER $$;
 
CREATE TRIGGER t1_BEFORE_INSERT BEFORE INSERT ON t1 FOR EACH ROW
 
BEGIN
 
    IF NEW.a in (select a from t1) OR NEW.a in (select c from t1 )
 
    THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = 'a or c';
 
END IF;
 
END$$
 
DELIMITER ;$$
 
 
 
INSERT INTO t1 VALUES ('Francia', 'Croazia');
 
INSERT INTO t1 VALUES ('Germania', 'Albania');
 
drop trigger t1_BEFORE_INSERT;
 
drop table t1;

10.4 13f36fffeaecf316435fc497b0

 
 
 
#3  <signal handler called>
 
#4  0x00007f3ad5a58428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
 
#5  0x00007f3ad5a5a02a in __GI_abort () at abort.c:89
 
#6  0x00007f3ad5a50bd7 in __assert_fail_base (fmt=<optimized out>, assertion=assertion@entry=0x55f50f088d56 "sl->join == 0", file=file@entry=0x55f50f088688 "/10.4/sql/sql_prepare.cc", line=line@entry=2998, function=function@entry=0x55f50f089aa0 <reinit_stmt_before_use(THD*, LEX*)::__PRETTY_FUNCTION__> "void reinit_stmt_before_use(THD*, LEX*)") at assert.c:92
 
#7  0x00007f3ad5a50c82 in __GI___assert_fail (assertion=0x55f50f088d56 "sl->join == 0", file=0x55f50f088688 "/10.4/sql/sql_prepare.cc", line=2998, function=0x55f50f089aa0 <reinit_stmt_before_use(THD*, LEX*)::__PRETTY_FUNCTION__> "void reinit_stmt_before_use(THD*, LEX*)") at assert.c:101
 
#8  0x000055f50e499a2f in reinit_stmt_before_use (thd=0x7f3a7c000b00, lex=0x7f3a7c14c7c8) at /10.4/sql/sql_prepare.cc:2998
 
#9  0x000055f50e38b021 in sp_lex_keeper::reset_lex_and_exec_core (this=0x7f3a7c150768, thd=0x7f3a7c000b00, nextp=0x7f3ac9fa3734, open_tables=true, instr=0x7f3a7c150710) at /10.4/sql/sp_head.cc:3308
 
#10 0x000055f50e38cf0d in sp_instr_jump_if_not::execute (this=0x7f3a7c150710, thd=0x7f3a7c000b00, nextp=0x7f3ac9fa3734) at /10.4/sql/sp_head.cc:3926
 
#11 0x000055f50e3855fe in sp_head::execute (this=0x7f3a7c13eff8, thd=0x7f3a7c000b00, merge_da_on_success=false) at /10.4/sql/sp_head.cc:1346
 
#12 0x000055f50e386703 in sp_head::execute_trigger (this=0x7f3a7c13eff8, thd=0x7f3a7c000b00, db_name=0x7f3a7c040a88, table_name=0x7f3a7c040a98, grant_info=0x7f3a7c13ea70) at /10.4/sql/sp_head.cc:1755
 
#13 0x000055f50e56a2c4 in Table_triggers_list::process_triggers (this=0x7f3a7c13eb98, thd=0x7f3a7c000b00, event=TRG_EVENT_INSERT, time_type=TRG_ACTION_BEFORE, old_row_is_record1=true) at /10.4/sql/sql_trigger.cc:2202
 
#14 0x000055f50e3e2916 in fill_record_n_invoke_before_triggers (thd=0x7f3a7c000b00, table=0x7f3a7c139480, ptr=0x7f3a7c00bd90, values=..., ignore_errors=false, event=TRG_EVENT_INSERT) at /10.4/sql/sql_base.cc:8826
 
#15 0x000055f50e428cc5 in mysql_insert (thd=0x7f3a7c000b00, table_list=0x7f3a7c013230, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false) at /10.4/sql/sql_insert.cc:1018
 
#16 0x000055f50e473e58 in mysql_execute_command (thd=0x7f3a7c000b00) at /10.4/sql/sql_parse.cc:4528
 
#17 0x000055f50e47fd4a in mysql_parse (thd=0x7f3a7c000b00, rawbuf=0x7f3a7c013128 "INSERT INTO t1 VALUES ('Germania', 'Albania')", length=45, parser_state=0x7f3ac9fa4ff0, is_com_multi=false, is_next_command=false) at /10.4/sql/sql_parse.cc:7908
 
#18 0x000055f50e46bfb8 in dispatch_command (command=COM_QUERY, thd=0x7f3a7c000b00, packet=0x7f3a7c19de41 "INSERT INTO t1 VALUES ('Germania', 'Albania')", packet_length=45, is_com_multi=false, is_next_command=false) at /10.4/sql/sql_parse.cc:1843
 
#19 0x000055f50e46a6d2 in do_command (thd=0x7f3a7c000b00) at /10.4/sql/sql_parse.cc:1360
 
#20 0x000055f50e5e5076 in do_handle_one_connection (connect=0x55f511a5a040) at /10.4/sql/sql_connect.cc:1404
 
#21 0x000055f50e5e4d9f in handle_one_connection (arg=0x55f511a5a040) at /10.4/sql/sql_connect.cc:1306
 
#22 0x000055f50ef10cdf in pfs_spawn_thread (arg=0x55f5119d87d0) at /10.4/storage/perfschema/pfs.cc:1862
 
#23 0x00007f3ad68996ba in start_thread (arg=0x7f3ac9fa6700) at pthread_create.c:333
 
#24 0x00007f3ad5b2a41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109



 Comments   
Comment by Elena Stepanova [ 2019-10-12 ]

Non-debug build doesn't crash with the provided test case, but see MDEV-20803 for the release variation.

However, even a non-debug build with ASAN fails with the test case provided in the description:

10.3 9afbb106 non-debug -DWITH_ASAN=YES

 
==5812==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500017c970 at pc 0x560859d9f96d bp 0x7f24a5412030 sp 0x7f24a5412028
 
READ of size 8 at 0x62500017c970 thread T5
 
    #0 0x560859d9f96c in JOIN::destroy() /data/src/10.4/sql/sql_select.cc:4407
 
    #1 0x560859ebcac2 in st_select_lex::cleanup() /data/src/10.4/sql/sql_union.cc:2058
 
    #2 0x56085a46c830 in subselect_single_select_engine::prepare(THD*) /data/src/10.4/sql/item_subselect.cc:3711
 
    #3 0x56085a46b1fc in Item_subselect::fix_fields(THD*, Item**) /data/src/10.4/sql/item_subselect.cc:283
 
    #4 0x56085a46bf79 in Item_in_subselect::fix_fields(THD*, Item**) /data/src/10.4/sql/item_subselect.cc:3382
 
    #5 0x56085a3174c0 in Item::fix_fields_if_needed(THD*, Item**) /data/src/10.4/sql/item.h:956
 
    #6 0x56085a3174c0 in Item_in_optimizer::fix_fields(THD*, Item**) /data/src/10.4/sql/item_cmpfunc.cc:1372
 
    #7 0x56085a30e2fc in Item::fix_fields_if_needed(THD*, Item**) /data/src/10.4/sql/item.h:956
 
    #8 0x56085a30e2fc in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /data/src/10.4/sql/item.h:960
 
    #9 0x56085a30e2fc in Item::fix_fields_if_needed_for_bool(THD*, Item**) /data/src/10.4/sql/item.h:964
 
    #10 0x56085a30e2fc in Item_cond::fix_fields(THD*, Item**) /data/src/10.4/sql/item_cmpfunc.cc:4845
 
    #11 0x560859b4b7bd in Item::fix_fields_if_needed(THD*, Item**) /data/src/10.4/sql/item.h:956
 
    #12 0x560859b4b7bd in THD::sp_fix_func_item(Item**) /data/src/10.4/sql/sp_head.cc:356
 
    #13 0x560859b4b83c in THD::sp_prepare_func_item(Item**, unsigned int) /data/src/10.4/sql/sp_head.cc:342
 
    #14 0x560859b4b8bc in sp_instr_jump_if_not::exec_core(THD*, unsigned int*) /data/src/10.4/sql/sp_head.cc:3956
 
    #15 0x560859b5c912 in sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*) /data/src/10.4/sql/sp_head.cc:3398
 
    #16 0x560859b509ff in sp_head::execute(THD*, bool) /data/src/10.4/sql/sp_head.cc:1346
 
    #17 0x560859b528c5 in sp_head::execute_trigger(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, st_grant_info*) /data/src/10.4/sql/sp_head.cc:1818
 
    #18 0x560859ea7bbc in Table_triggers_list::process_triggers(THD*, trg_event_type, trg_action_time_type, bool) /data/src/10.4/sql/sql_trigger.cc:2214
 
    #19 0x560859be3b13 in fill_record_n_invoke_before_triggers(THD*, TABLE*, Field**, List<Item>&, bool, trg_event_type) /data/src/10.4/sql/sql_base.cc:8804
 
    #20 0x560859c65b92 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.4/sql/sql_insert.cc:1018
 
    #21 0x560859cf666d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4524
 
    #22 0x560859d06678 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7912
 
    #23 0x560859d0bf14 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1841
 
    #24 0x560859d0fe17 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1359
 
    #25 0x560859f7dbd7 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
 
    #26 0x560859f7ddfa in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
 
    #27 0x56085af7f4a3 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
 
    #28 0x7f24afa6c4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
 
    #29 0x7f24adfb3d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
 
 
 
0x62500017c970 is located 2160 bytes inside of 8160-byte region [0x62500017c100,0x62500017e0e0)
 
freed by thread T5 here:
 
    #0 0x7f24afd43a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
 
    #1 0x56085b0258f4 in free_root /data/src/10.4/mysys/my_alloc.c:420
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7f24afd43d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
 
    #1 0x56085b03751c in my_malloc /data/src/10.4/mysys/my_malloc.c:101
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f24afcb2f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
 
    #1 0x56085af87722 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.4/sql/sql_select.cc:4407 in JOIN::destroy()
 
Shadow bytes around the buggy address:
 
  0x0c4a800278d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4a800278e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4a800278f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4a80027900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4a80027910: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c4a80027920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
 
  0x0c4a80027930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4a80027940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4a80027950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4a80027960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c4a80027970: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
==5812==ABORTING

Comment by Elena Stepanova [ 2019-10-28 ]

See also MDEV-20858 with yet another test case from real life.

I'm raising the priority since external reports keep coming.

Comment by Oleksandr Byelkin [ 2019-12-02 ]

there is no call of JOIN::destroy because there is no call of st_select_lex::cleanup

Comment by Alice Sherepa [ 2020-06-30 ]

After fixing it, please check also MDEV-23056 to be fixed

Comment by Oleksandr Byelkin [ 2020-10-08 ]

Duplicate of MDEV-23094

Generated at Thu Feb 08 08:58:19 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.