[MDEV-24183] SIGSEGV in base_list_iterator::next on PS execution after changing the derived_merge optimizer_switch Created: 2020-11-10  Updated: 2023-04-27

Status: Open
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.1, 10.2, 10.3, 10.4, 10.5, 10.6
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Dmitry Shulga
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-20761 Server crashes in base_list_iterator:... Open

 Description   

SET SESSION optimizer_switch="derived_merge=OFF";
CREATE TABLE t (c INT PRIMARY KEY) ENGINE=InnoDB;
PREPARE s FROM 'INSERT INTO t SELECT * FROM (SELECT * FROM t) AS a';
SET SESSION optimizer_switch="derived_merge=ON";
EXECUTE s;

Leads to:

10.6.0 5d4599f9750140f92cfdbbe4d292ae1b8dd456f8 (Debug)

Core was generated by `/test/MD211020-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
[Current thread is 1 (Thread 0x1484800fc700 (LWP 3893065))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
#1  0x0000562b8c16c021 in my_write_core (sig=sig@entry=11) at /test/10.6_dbg/mysys/stacktrace.c:424
#2  0x0000562b8b8b3321 in handle_fatal_signal (sig=11) at /test/10.6_dbg/sql/signal_handler.cc:330
#3  <signal handler called>
#4  base_list_iterator::next (this=<synthetic pointer>) at /test/10.6_dbg/sql/sql_list.h:431
#5  List_iterator<Item>::operator++ (this=<synthetic pointer>) at /test/10.6_dbg/sql/sql_list.h:596
#6  TABLE_LIST::change_refs_to_fields (this=this@entry=0x14845002ccf8) at /test/10.6_dbg/sql/table.cc:9348
#7  0x0000562b8b5571f9 in find_dup_table (thd=thd@entry=0x148450000db8, table=table@entry=0x14845002ab30, table_list=table_list@entry=0x14845002bdc0, check_flag=check_flag@entry=0) at /test/10.6_dbg/sql/sql_base.cc:1159
#8  0x0000562b8b5573ce in unique_table (thd=0x148450000db8, table=0x14845002ab30, table_list=0x14845002bdc0, check_flag=check_flag@entry=0) at /test/10.6_dbg/sql/sql_base.cc:1222
#9  0x0000562b8b59fb82 in select_insert::prepare (this=0x148450012ec8, values=<optimized out>, u=<optimized out>) at /test/10.6_dbg/sql/sql_insert.cc:3904
#10 0x0000562b8b658901 in JOIN::prepare (this=this@entry=0x148450012f80, tables_init=tables_init@entry=0x14845002ccf8, conds_init=conds_init@entry=0x0, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x14845002b208, unit_arg=0x148450028f60) at /test/10.6_dbg/sql/my_json_writer.h:367
#11 0x0000562b8b670880 in mysql_select (thd=thd@entry=0x148450000db8, tables=0x14845002ccf8, fields=@0x14845002b358: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14845002b7b8, last = 0x14845002b7b8, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2202244745984, result=0x148450012ec8, unit=0x148450028f60, select_lex=0x14845002b208) at /test/10.6_dbg/sql/sql_select.cc:4637
#12 0x0000562b8b670c72 in handle_select (thd=thd@entry=0x148450000db8, lex=lex@entry=0x148450028e98, result=result@entry=0x148450012ec8, setup_tables_done_option=setup_tables_done_option@entry=1073741824) at /test/10.6_dbg/sql/sql_select.cc:417
#13 0x0000562b8b5f2bf1 in mysql_execute_command (thd=0x148450000db8) at /test/10.6_dbg/sql/sql_parse.cc:4544
#14 0x0000562b8b60a4b4 in Prepared_statement::execute (this=this@entry=0x148450023f48, expanded_query=expanded_query@entry=0x1484800fad30, open_cursor=open_cursor@entry=false) at /test/10.6_dbg/sql/sql_prepare.cc:4736
#15 0x0000562b8b60a801 in Prepared_statement::execute_loop (this=this@entry=0x148450023f48, expanded_query=expanded_query@entry=0x1484800fad30, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/10.6_dbg/sql/sql_prepare.cc:4225
#16 0x0000562b8b60ad39 in mysql_sql_stmt_execute (thd=thd@entry=0x148450000db8) at /test/10.6_dbg/sql/sql_prepare.cc:3336
#17 0x0000562b8b5f0b4a in mysql_execute_command (thd=thd@entry=0x148450000db8) at /test/10.6_dbg/sql/sql_parse.cc:3800
#18 0x0000562b8b5dcfd2 in mysql_parse (thd=thd@entry=0x148450000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1484800fb3d0) at /test/10.6_dbg/sql/sql_parse.cc:7833
#19 0x0000562b8b5eb0c7 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x148450000db8, packet=packet@entry=0x148450008ce9 "EXECUTE s", packet_length=packet_length@entry=9) at /test/10.6_dbg/sql/sql_class.h:1253
#20 0x0000562b8b5ee3d2 in do_command (thd=0x148450000db8) at /test/10.6_dbg/sql/sql_parse.cc:1343
#21 0x0000562b8b748994 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x562b8f20b678, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410
#22 0x0000562b8b74909b in handle_one_connection (arg=arg@entry=0x562b8f20b678) at /test/10.6_dbg/sql/sql_connect.cc:1312
#23 0x0000562b8bbfcabb in pfs_spawn_thread (arg=0x562b8f1331c8) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
#24 0x0000148494eb5609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#25 0x0000148494aa4293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.6.0 5d4599f9750140f92cfdbbe4d292ae1b8dd456f8 (Optimized)

Core was generated by `/test/MD201020-mariadb-10.6.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
[Current thread is 1 (Thread 0x1455ec546700 (LWP 3898211))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
#1  0x0000564adbe92a4f in my_write_core (sig=sig@entry=11) at /test/10.6_opt/mysys/stacktrace.c:424
#2  0x0000564adb8b6130 in handle_fatal_signal (sig=11) at /test/10.6_opt/sql/signal_handler.cc:330
#3  <signal handler called>
#4  base_list_iterator::next (this=<synthetic pointer>) at /test/10.6_opt/sql/sql_list.h:431
#5  List_iterator<Item>::operator++ (this=<synthetic pointer>) at /test/10.6_opt/sql/sql_list.h:596
#6  TABLE_LIST::change_refs_to_fields (this=this@entry=0x14557c027178) at /test/10.6_opt/sql/table.cc:9348
#7  0x0000564adb63c7a3 in find_dup_table (table=0x14557c024fb0, table_list=0x14557c026240, check_flag=check_flag@entry=0, thd=<optimized out>) at /test/10.6_opt/sql/sql_base.cc:1159
#8  0x0000564adb63c8c4 in unique_table (thd=<optimized out>, table=<optimized out>, table_list=<optimized out>, check_flag=check_flag@entry=0) at /test/10.6_opt/sql/sql_base.cc:1222
#9  0x0000564adb66e5f6 in select_insert::prepare (this=0x14557c010bf8, values=<optimized out>, u=<optimized out>) at /test/10.6_opt/sql/sql_insert.cc:3904
#10 0x0000564adb7008b0 in JOIN::prepare (this=0x14557c010cb0, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x14557c025688, unit_arg=0x14557c0233e0) at /test/10.6_opt/sql/sql_select.cc:1445
#11 0x0000564adb7129c9 in mysql_select (thd=0x14557c000c58, tables=0x14557c027178, fields=@0x14557c0257d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14557c025c38, last = 0x14557c025c38, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2202244745984, result=0x14557c010bf8, unit=0x14557c0233e0, select_lex=0x14557c025688) at /test/10.6_opt/sql/sql_select.cc:4637
#12 0x0000564adb712d67 in handle_select (thd=thd@entry=0x14557c000c58, lex=lex@entry=0x14557c023318, result=result@entry=0x14557c010bf8, setup_tables_done_option=setup_tables_done_option@entry=1073741824) at /test/10.6_opt/sql/sql_select.cc:417
#13 0x0000564adb6b11c2 in mysql_execute_command (thd=0x14557c000c58) at /test/10.6_opt/sql/sql_parse.cc:4544
#14 0x0000564adb6c1955 in Prepared_statement::execute (this=0x14557c01e378, expanded_query=<optimized out>, open_cursor=false) at /test/10.6_opt/sql/sql_prepare.cc:4736
#15 0x0000564adb6c1b29 in Prepared_statement::execute_loop (packet=<optimized out>, packet_end=<optimized out>, open_cursor=<optimized out>, expanded_query=0x1455ec544e00, this=0x14557c01e378) at /test/10.6_opt/sql/sql_prepare.cc:4225
#16 Prepared_statement::execute_loop (this=0x14557c01e378, expanded_query=0x1455ec544e00, open_cursor=<optimized out>, packet=<optimized out>, packet_end=<optimized out>) at /test/10.6_opt/sql/sql_prepare.cc:4180
#17 0x0000564adb6c1e33 in mysql_sql_stmt_execute (thd=thd@entry=0x14557c000c58) at /test/10.6_opt/sql/sql_prepare.cc:3336
#18 0x0000564adb6af08e in mysql_execute_command (thd=0x14557c000c58) at /test/10.6_opt/sql/sql_parse.cc:3800
#19 0x0000564adb69d03f in mysql_parse (thd=0x14557c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:7833
#20 0x0000564adb6a8967 in dispatch_command (command=COM_QUERY, thd=0x14557c000c58, packet=0x14557c008009 "EXECUTE s", packet_length=<optimized out>) at /test/10.6_opt/sql/sql_class.h:1253
#21 0x0000564adb6aad42 in do_command (thd=0x14557c000c58) at /test/10.6_opt/sql/sql_parse.cc:1343
#22 0x0000564adb7ae6e1 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x564ade2428c8, put_in_cache=put_in_cache@entry=true) at /test/10.6_opt/sql/sql_connect.cc:1410
#23 0x0000564adb7aeb5d in handle_one_connection (arg=arg@entry=0x564ade2428c8) at /test/10.6_opt/sql/sql_connect.cc:1312
#24 0x0000564adbb34266 in pfs_spawn_thread (arg=0x564ade1bd888) at /test/10.6_opt/storage/perfschema/pfs.cc:2201
#25 0x00001455ede82609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#26 0x00001455eda71293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.1.48 (dbg), 10.1.48 (opt), 10.2.35 (dbg), 10.2.35 (opt), 10.3.26 (dbg), 10.3.26 (opt), 10.4.16 (dbg), 10.4.16 (opt), 10.5.7 (dbg), 10.5.7 (opt), 10.6.0 (dbg), 10.6.0 (opt)

Bug confirmed not present in:
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.50 (dbg), 5.6.50 (opt), 5.7.32 (dbg), 5.7.32 (opt), 8.0.22 (dbg), 8.0.22 (opt)



 Comments   
Comment by Roel Van de Paar [ 2020-11-10 ]

Very different testcase, but stack looks similar to MDEV-20761.

Comment by Sergei Petrunia [ 2021-07-12 ]

Looks like a problem in name resolution. Also, MDEV-20761 is assigned to sanja, so let's assign this one to him also to prevent duplication of effors.

Generated at Thu Feb 08 09:28:03 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.