[MDEV-20623] Server crashes with segmentation fault in fix_fields_for_tvc Created: 2019-09-18  Updated: 2020-02-11  Resolved: 2020-02-11

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.3.17
Fix Version/s: N/A

Type: Bug Priority: Critical
Reporter: Geoff Montee (Inactive) Assignee: Igor Babaev
Resolution: Incomplete Votes: 1
Labels: need_feedback


 Description   

A user running MariaDB 10.3.17 saw the following crash:

190917  9:59:25 [ERROR] mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
 
To report this bug, see https://mariadb.com/kb/en/reporting-bugs
 
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed, 
something is definitely wrong and this may fail.
 
Server version: 10.3.17-MariaDB-log
key_buffer_size=67108864
read_buffer_size=131072
max_used_connections=1449
max_threads=10002
thread_count=1246
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 22055066 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
 
Thread pointer: 0x7f8d4c0b7de8
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f8b35784d30 thread_stack 0x40000
*** buffer overflow detected ***: /usr/sbin/mysqld terminated
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x7f9d225af677]
/lib64/libc.so.6(+0x1167f2)[0x7f9d225ad7f2]
/lib64/libc.so.6(+0x1185d7)[0x7f9d225af5d7]
/usr/sbin/mysqld(my_addr_resolve+0xda)[0x562f67ea56da]
/usr/sbin/mysqld(my_print_stacktrace+0x1c2)[0x562f67e8ead2]
/usr/sbin/mysqld(handle_fatal_signal+0x30f)[0x562f6792e2af]
/lib64/libpthread.so.0(+0xf680)[0x7f9d241f9680]
/usr/sbin/mysqld(_Z18fix_fields_for_tvcP3THDR18List_iterator_fastI4ListI4ItemEE+0x38)[0x562f67897338]
/usr/sbin/mysqld(_ZN18table_value_constr7prepareEP3THDP13st_select_lexP13select_resultP18st_select_lex_unit+0x94)[0x562f678976f4]
/usr/sbin/mysqld(_ZN18st_select_lex_unit7prepareEP10TABLE_LISTP13select_resultm+0x6e7)[0x562f677ee707]
/usr/sbin/mysqld(_Z21mysql_derived_prepareP3THDP3LEXP10TABLE_LIST+0x263)[0x562f6771b983]
/usr/sbin/mysqld(_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj+0xfc)[0x562f6771c6dc]
/usr/sbin/mysqld(_ZN13st_select_lex14handle_derivedEP3LEXj+0x47)[0x562f67733807]
/usr/sbin/mysqld(_ZN4JOIN7prepareEP10TABLE_LISTjP4ItemjP8st_orderbS5_S3_S5_P13st_select_lexP18st_select_lex_unit+0xc9)[0x562f6779b239]
/usr/sbin/mysqld(_Z12mysql_selectP3THDP10TABLE_LISTjR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x8f2)[0x562f677aae32]
/usr/sbin/mysqld(_Z13handle_selectP3THDP3LEXP13select_resultm+0x1cc)[0x562f677ab16c]
/usr/sbin/mysqld(+0x4bcebc)[0x562f67661ebc]
/usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x33f2)[0x562f67753432]
/usr/sbin/mysqld(_ZN18Prepared_statement7executeEP6Stringb+0x4c6)[0x562f6776b646]
/usr/sbin/mysqld(_ZN18Prepared_statement12execute_loopEP6StringbPhS2_+0xb0)[0x562f6776b820]
/usr/sbin/mysqld(+0x5c7487)[0x562f6776c487]
/usr/sbin/mysqld(_Z19mysqld_stmt_executeP3THDPcj+0x27)[0x562f6776c517]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcjbb+0xf60)[0x562f6775aad0]
/usr/sbin/mysqld(_Z10do_commandP3THD+0x13e)[0x562f6775c74e]
/usr/sbin/mysqld(_Z24do_handle_one_connectionP7CONNECT+0x221)[0x562f6782ff61]
/usr/sbin/mysqld(handle_one_connection+0x3d)[0x562f6783002d]
/lib64/libpthread.so.0(+0x7dd5)[0x7f9d241f1dd5]
/lib64/libc.so.6(clone+0x6d)[0x7f9d22595b3d]



 Comments   
Comment by Igor Babaev [ 2019-11-30 ]

Valerii,
The stack does not help me, I need the query at least

Comment by Igor Babaev [ 2019-12-12 ]

Valerii,
Could you ask them whether they use
1. table value constructor (not as a part of INSERT)e
2. IN predicate with long lists (>= 1000 elements) as the second operand
My guess is that they use 2. If so ask them to turn off the conversion of IN predicates into IN subquery (there is a system variable for this).
I see that they execute a prepared statement. So it might be a bug of the second execution of a query with such conversion (the conversion is performed at the first execution).

Generated at Thu Feb 08 09:00:55 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.