[MDEV-24256] SIGSEGV in SQL_SELECT::cleanup Created: 2020-11-20  Updated: 2023-12-05

Status: Stalled
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.5, 10.6
Fix Version/s: 10.5

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Igor Babaev
Resolution: Unresolved Votes: 0
Labels: not-10.1, not-10.2, not-10.3, not-10.4, regression


 Description    

SET SQL_MODE='';    # Not always required it seems
 
SET SESSION optimizer_switch="not_null_range_scan=ON";
 
CREATE TEMPORARY TABLE t (a INT, b INT, PRIMARY KEY(a), INDEX (b)) ENGINE=MyISAM;
 
INSERT INTO t (a,b) VALUES (0,0),(1,1),(2,'a');
 
SET @a=0.0;
 
SELECT a,b FROM t AS d WHERE a=(SELECT a FROM t WHERE b=@a) AND b='a';

Leads to:

10.6.0 5d4599f9750140f92cfdbbe4d292ae1b8dd456f8(Optimized)

 
Core was generated by `/test/MD201020-mariadb-10.6.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
 
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
 
[Current thread is 1 (Thread 0x14f9dcbfc700 (LWP 3609934))]
 
(gdb) bt
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
 
#1  0x000055a4016cda4f in my_write_core (sig=sig@entry=11) at /test/10.6_opt/mysys/stacktrace.c:424
 
#2  0x000055a4010f1130 in handle_fatal_signal (sig=11) at /test/10.6_opt/sql/signal_handler.cc:330
 
#3  <signal handler called>
 
#4  0x000055a401229d6b in SQL_SELECT::cleanup (this=0x14f97c023430) at /test/10.6_opt/sql/opt_range.cc:1232
 
#5  0x000055a401229dbd in SQL_SELECT::~SQL_SELECT (this=<optimized out>, __in_chrg=<optimized out>) at /test/10.6_opt/sql/opt_range.cc:1246
 
#6  0x000055a400f19f56 in JOIN::make_range_rowid_filters (this=0x14f97c014058) at /test/10.6_opt/sql/sql_select.cc:1723
 
#7  JOIN::make_range_rowid_filters (this=0x14f97c014058) at /test/10.6_opt/sql/sql_select.cc:1652
 
#8  0x000055a400f47311 in JOIN::optimize_stage2 (this=0x14f97c014058) at /test/10.6_opt/sql/sql_select.cc:2297
 
#9  0x000055a400f4b14a in JOIN::optimize_inner (this=0x14f97c014058) at /test/10.6_opt/sql/sql_select.cc:2273
 
#10 0x000055a400f4d213 in JOIN::optimize (this=this@entry=0x14f97c014058) at /test/10.6_opt/sql/sql_select.cc:1623
 
#11 0x000055a400f4d316 in mysql_select (thd=0x14f97c000c58, tables=0x14f97c010bf8, fields=<optimized out>, conds=0x14f97c013608, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x14f97c014030, unit=0x14f97c004c20, select_lex=0x14f97c010490) at /test/10.6_opt/sql/sql_select.cc:4659
 
#12 0x000055a400f4dd67 in handle_select (thd=thd@entry=0x14f97c000c58, lex=lex@entry=0x14f97c004b58, result=result@entry=0x14f97c014030, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_opt/sql/sql_select.cc:417
 
#13 0x000055a400edd951 in execute_sqlcom_select (thd=0x14f97c000c58, all_tables=0x14f97c010bf8) at /test/10.6_opt/sql/sql_parse.cc:6062
 
#14 0x000055a400eeb380 in mysql_execute_command (thd=0x14f97c000c58) at /test/10.6_opt/sql/sql_parse.cc:3784
 
#15 0x000055a400ed803f in mysql_parse (thd=0x14f97c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:7833
 
#16 0x000055a400ee3967 in dispatch_command (command=COM_QUERY, thd=0x14f97c000c58, packet=0x14f97c008009 "SELECT a,b FROM t AS d WHERE a=(SELECT a FROM t WHERE b=@a) AND b='a'", packet_length=<optimized out>) at /test/10.6_opt/sql/sql_class.h:1253
 
#17 0x000055a400ee5d42 in do_command (thd=0x14f97c000c58) at /test/10.6_opt/sql/sql_parse.cc:1343
 
#18 0x000055a400fe96e1 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55a4036e5438, put_in_cache=put_in_cache@entry=true) at /test/10.6_opt/sql/sql_connect.cc:1410
 
#19 0x000055a400fe9b5d in handle_one_connection (arg=arg@entry=0x55a4036e5438) at /test/10.6_opt/sql/sql_connect.cc:1312
 
#20 0x000055a40136f266 in pfs_spawn_thread (arg=0x55a403698918) at /test/10.6_opt/storage/perfschema/pfs.cc:2201
 
#21 0x000014f9e6539609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#22 0x000014f9e6128293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.6.0 5d4599f9750140f92cfdbbe4d292ae1b8dd456f8 (Debug)

 
Core was generated by `/test/MD211020-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
 
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
 
[Current thread is 1 (Thread 0x1487900d1700 (LWP 3624881))]
 
(gdb) bt
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
 
#1  0x0000562995f8f021 in my_write_core (sig=sig@entry=11) at /test/10.6_dbg/mysys/stacktrace.c:424
 
#2  0x00005629956d6321 in handle_fatal_signal (sig=11) at /test/10.6_dbg/sql/signal_handler.cc:330
 
#3  <signal handler called>
 
#4  0x000056299588bd41 in SQL_SELECT::cleanup (this=0x14874802cd80) at /test/10.6_dbg/sql/opt_range.cc:1232
 
#5  0x000056299588bd8f in SQL_SELECT::~SQL_SELECT (this=<optimized out>, __in_chrg=<optimized out>) at /test/10.6_dbg/sql/opt_range.cc:1246
 
#6  0x0000562995453d11 in JOIN::make_range_rowid_filters (this=this@entry=0x148748016328) at /test/10.6_dbg/sql/sql_select.cc:1723
 
#7  0x000056299548eb79 in JOIN::optimize_stage2 (this=this@entry=0x148748016328) at /test/10.6_dbg/sql/sql_select.cc:2297
 
#8  0x0000562995492d2b in JOIN::optimize_inner (this=this@entry=0x148748016328) at /test/10.6_dbg/sql/sql_select.cc:2273
 
#9  0x0000562995492f5d in JOIN::optimize (this=this@entry=0x148748016328) at /test/10.6_dbg/sql/sql_select.cc:1623
 
#10 0x00005629954938f5 in mysql_select (thd=thd@entry=0x148748000db8, tables=0x148748012ec8, fields=@0x1487480128b0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x148748012d18, last = 0x148748012e70, elements = 2}, <No data fields>}, conds=0x1487480158d8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x148748016300, unit=0x148748004f40, select_lex=0x148748012760) at /test/10.6_dbg/sql/sql_select.cc:4659
 
#11 0x0000562995493c72 in handle_select (thd=thd@entry=0x148748000db8, lex=lex@entry=0x148748004e78, result=result@entry=0x148748016300, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_dbg/sql/sql_select.cc:417
 
#12 0x000056299540738e in execute_sqlcom_select (thd=thd@entry=0x148748000db8, all_tables=0x148748012ec8) at /test/10.6_dbg/sql/sql_parse.cc:6062
 
#13 0x0000562995413aea in mysql_execute_command (thd=thd@entry=0x148748000db8) at /test/10.6_dbg/sql/sql_parse.cc:3784
 
#14 0x00005629953fffd2 in mysql_parse (thd=thd@entry=0x148748000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1487900d03d0) at /test/10.6_dbg/sql/sql_parse.cc:7833
 
#15 0x000056299540e0c7 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x148748000db8, packet=packet@entry=0x148748008ce9 "SELECT a,b FROM t AS d WHERE a=(SELECT a FROM t WHERE b=@a) AND b='a'", packet_length=packet_length@entry=69) at /test/10.6_dbg/sql/sql_class.h:1253
 
#16 0x00005629954113d2 in do_command (thd=0x148748000db8) at /test/10.6_dbg/sql/sql_parse.cc:1343
 
#17 0x000056299556b994 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5629988fe518, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410
 
#18 0x000056299556c09b in handle_one_connection (arg=arg@entry=0x5629988fe518) at /test/10.6_dbg/sql/sql_connect.cc:1312
 
#19 0x0000562995a1fabb in pfs_spawn_thread (arg=0x562998833688) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
 
#20 0x000014879ac49609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#21 0x000014879a838293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.5.7 (dbg), 10.5.7 (opt), 10.6.0 (dbg), 10.6.0 (opt)

Bug confirmed not present in:
MariaDB: 10.1.48 (dbg), 10.1.48 (opt), 10.2.35 (dbg), 10.2.35 (opt), 10.3.26 (dbg), 10.3.26 (opt), 10.4.16 (dbg), 10.4.16 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.50 (dbg), 5.6.50 (opt), 5.7.32 (dbg), 5.7.32 (opt), 8.0.22 (dbg), 8.0.22 (opt)

 Comments   
Comment by Roel Van de Paar [ 2020-11-20 ]

Unique ID's so far

SIGSEGV|SQL_SELECT::cleanup|SQL_SELECT::~SQL_SELECT|JOIN::make_range_rowid_filters|JOIN::make_range_rowid_filters
 
SIGSEGV|SQL_SELECT::cleanup|SQL_SELECT::~SQL_SELECT|JOIN::make_range_rowid_filters|JOIN::optimize_stage2

Comment by Roel Van de Paar [ 2020-11-20 ]

10.2.35 (Optimized)

 
10.2.35>SET SESSION optimizer_switch="not_null_range_scan=ON";
 
ERROR 1231 (42000): Variable 'optimizer_switch' can't be set to the value of 'not_null_range_scan=ON'
 
...
 
10.2.35>SELECT a,b FROM t AS d WHERE a=(SELECT a FROM t WHERE b=@a) AND b='a';
 
ERROR 1242 (21000): Subquery returns more than 1 row

Potentially this bug could affect 10.2 with different SQL?

Comment by Roel Van de Paar [ 2020-11-20 ]

Not a supported version anymore, but adding as the output is interesting:

10.1.48 (Optimized)

 
10.1.48>SET SESSION optimizer_switch="not_null_range_scan=ON";
 
ERROR 1231 (42000): Variable 'optimizer_switch' can't be set to the value of 'not_null_range_scan=ON'
 
...
 
10.1.48>SELECT a,b FROM t AS d WHERE a=(SELECT a FROM t WHERE b=@a) AND b='a';
 
ERROR 1137 (HY000): Can't reopen table: 'd'

Comment by Roel Van de Paar [ 2020-11-20 ]

Making small changes to the testcase results in the same error on 10.5 as seen on 10.2: ERROR 1242 (21000): Subquery returns more than 1 row

Comment by Julien Fritsch [ 2023-12-05 ]

Automated message:
----------------------------
Since this issue has not been updated since 6 weeks, it's time to move it back to Stalled.

Comment by JiraAutomate [ 2023-12-05 ]

Automated message:
----------------------------
Since this issue has not been updated since 6 weeks, it's time to move it back to Stalled.

Generated at Thu Feb 08 09:28:36 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.