[MDEV-24383] SIGSEGV in heap_info from make_join_statistics on 2nd SP exec Created: 2020-12-09  Updated: 2023-12-15  Resolved: 2023-12-15

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11
Fix Version/s: N/A

Type: Bug Priority: Critical
Reporter: Roel Van de Paar Assignee: Roel Van de Paar
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Duplicate
is duplicated by MDEV-25570 Use of RAND() in procedure crashes se... Closed
Relates
relates to MDEV-23202 Server crashes in maria_status and/or... Confirmed
relates to MDEV-24651 SIGSEGV in maria_scan_init on EXECUTE... Open

 Description    

CREATE PROCEDURE p() SELECT * FROM (SELECT 1 FROM mysql.user) AS a;
 
SET SESSION optimizer_switch="derived_merge=OFF";
 
CALL p();
 
SET SESSION optimizer_switch="derived_merge=ON";
 
CALL p();

Leads to:

10.5.6 2bac9782aa81ad386beaf00eb126ccf2d15031a1 (Optimized)

 
Core was generated by `/test/MD150920-mariadb-10.5.6-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
 
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
 
[Current thread is 1 (Thread 0x145659369700 (LWP 29735))]
 
(gdb) bt
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
 
#1  0x0000564858982ae7 in my_write_core (sig=sig@entry=11) at /data/10.5_opt/mysys/stacktrace.c:424
 
#2  0x0000564858351fda in handle_fatal_signal (sig=11) at /data/10.5_opt/sql/signal_handler.cc:330
 
#3  <signal handler called>
 
#4  heap_info (info=0x0, x=x@entry=0x145659365cd0, flag=flag@entry=18) at /data/10.5_opt/storage/heap/hp_info.c:34
 
#5  0x00005648586628ff in ha_heap::info (this=0x14563588fc30, flag=18) at /data/10.5_opt/storage/heap/ha_heap.cc:377
 
#6  0x00005648581b30be in make_join_statistics (keyuse_array=0x1456359a84b0, tables_list=@0x145635858f80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1456359a8e30, last = 0x1456359a8e30, elements = 1}, <No data fields>}, join=0x1456359a81c0) at /data/10.5_opt/sql/sql_select.cc:4891
 
#7  JOIN::optimize_inner (this=this@entry=0x1456359a81c0) at /data/10.5_opt/sql/sql_select.cc:2247
 
#8  0x00005648581b5533 in JOIN::optimize (this=this@entry=0x1456359a81c0) at /data/10.5_opt/sql/sql_select.cc:1623
 
#9  0x00005648581b5631 in mysql_select (thd=thd@entry=0x145635812018, tables=0x145635854830, fields=@0x145635858e90: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1456358592f0, last = 0x1456358592f0, elements = 1}, <No data fields>}, conds=0x0, og_num=<optimized out>, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147749632, result=0x1456359a8198, unit=0x1456358560f8, select_lex=0x145635858d40) at /data/10.5_opt/sql/sql_select.cc:4649
 
#10 0x00005648581b6041 in handle_select (thd=thd@entry=0x145635812018, lex=lex@entry=0x145635856030, result=result@entry=0x1456359a8198, setup_tables_done_option=setup_tables_done_option@entry=0) at /data/10.5_opt/sql/sql_select.cc:417
 
#11 0x000056485815b8f1 in execute_sqlcom_select (thd=thd@entry=0x145635812018, all_tables=0x145635854830) at /data/10.5_opt/sql/sql_parse.cc:6210
 
#12 0x0000564858157fd1 in mysql_execute_command (thd=0x145635812018) at /data/10.5_opt/sql/sql_parse.cc:3932
 
#13 0x00005648580bb6a5 in sp_instr_stmt::exec_core (this=0x145635859fc0, thd=<optimized out>, nextp=0x1456593672c4) at /data/10.5_opt/sql/sp_head.cc:3765
 
#14 0x00005648580c2ef2 in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x14563585a008, thd=thd@entry=0x145635812018, nextp=nextp@entry=0x1456593672c4, open_tables=open_tables@entry=false, instr=instr@entry=0x145635859fc0) at /data/10.5_opt/sql/sp_head.cc:3492
 
#15 0x00005648580c396e in sp_instr_stmt::execute (this=0x145635859fc0, thd=0x145635812018, nextp=0x1456593672c4) at /data/10.5_opt/sql/sp_head.cc:3671
 
#16 0x00005648580bea97 in sp_head::execute (this=this@entry=0x145635858030, thd=thd@entry=0x145635812018, merge_da_on_success=merge_da_on_success@entry=true) at /data/10.5_opt/sql/sp_head.cc:1435
 
#17 0x00005648580bfe4b in sp_head::execute_procedure (this=0x145635858030, thd=thd@entry=0x145635812018, args=0x145635816eb8) at /data/10.5_opt/sql/sp_head.cc:2446
 
#18 0x00005648581555e5 in do_execute_sp (thd=thd@entry=0x145635812018, sp=sp@entry=0x145635858030) at /data/10.5_opt/sql/sql_parse.cc:3043
 
#19 0x0000564858155c96 in Sql_cmd_call::execute (this=0x1456358470e0, thd=0x145635812018) at /data/10.5_opt/sql/sql_parse.cc:3289
 
#20 0x0000564858157eff in mysql_execute_command (thd=thd@entry=0x145635812018) at /data/10.5_opt/sql/sql_parse.cc:5952
 
#21 0x000056485815ea2c in mysql_parse (thd=0x145635812018, rawbuf=<optimized out>, length=8, parser_state=0x145659368430, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /data/10.5_opt/sql/sql_parse.cc:7994
 
#22 0x0000564858153cc5 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x145635812018, packet=packet@entry=0x14563583a019 "CALL p()", packet_length=packet_length@entry=8, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/10.5_opt/sql/sql_parse.cc:1867
 
#23 0x0000564858151fe4 in do_command (thd=0x145635812018) at /data/10.5_opt/sql/sql_parse.cc:1348
 
#24 0x0000564858248ba1 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1456560338f8, put_in_cache=put_in_cache@entry=true) at /data/10.5_opt/sql/sql_connect.cc:1410
 
#25 0x0000564858248f14 in handle_one_connection (arg=arg@entry=0x1456560338f8) at /data/10.5_opt/sql/sql_connect.cc:1312
 
#26 0x00005648585bca4a in pfs_spawn_thread (arg=0x14565604f018) at /data/10.5_opt/storage/perfschema/pfs.cc:2201
 
#27 0x00001456582e26db in start_thread (arg=0x145659369700) at pthread_create.c:463
 
#28 0x00001456576e0a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.5.6 2bac9782aa81ad386beaf00eb126ccf2d15031a1 (Debug)

 
Core was generated by `/test/MD150920-mariadb-10.5.6-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
 
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
 
[Current thread is 1 (Thread 0x14d5d1718700 (LWP 3961923))]
 
(gdb) bt
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
 
#1  0x0000562ce1fcf85a in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:424
 
#2  0x0000562ce17963a9 in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:330
 
#3  <signal handler called>
 
#4  heap_info (info=0x0, x=x@entry=0x14d5d17149f0, flag=flag@entry=18) at /test/10.5_dbg/storage/heap/hp_info.c:34
 
#5  0x0000562ce1b45104 in ha_heap::info (this=0x14d5ad4964a0, flag=18) at /test/10.5_dbg/storage/heap/ha_heap.cc:377
 
#6  0x0000562ce15f8352 in TABLE_LIST::fetch_number_of_rows (this=this@entry=0x14d5ad48f8a0) at /test/10.5_dbg/sql/table.cc:9288
 
#7  0x0000562ce155fc31 in make_join_statistics (keyuse_array=0x14d5ad5c9520, tables_list=@0x14d5ad489ff0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d5ad5c9ea0, last = 0x14d5ad5c9ea0, elements = 1}, <No data fields>}, join=0x14d5ad5c9230) at /test/10.5_dbg/sql/sql_select.cc:4891
 
#8  JOIN::optimize_inner (this=this@entry=0x14d5ad5c9230) at /test/10.5_dbg/sql/sql_select.cc:2247
 
#9  0x0000562ce15623b3 in JOIN::optimize (this=this@entry=0x14d5ad5c9230) at /test/10.5_dbg/sql/sql_select.cc:1623
 
#10 0x0000562ce1562d40 in mysql_select (thd=thd@entry=0x14d5ad415088, tables=<optimized out>, fields=@0x14d5ad489f00: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d5ad48a360, last = 0x14d5ad48a360, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=2147749632, result=0x14d5ad5c9208, unit=0x14d5ad47d168, select_lex=0x14d5ad489db0) at /test/10.5_dbg/sql/sql_select.cc:4649
 
#11 0x0000562ce15630bc in handle_select (thd=thd@entry=0x14d5ad415088, lex=lex@entry=0x14d5ad47d0a0, result=result@entry=0x14d5ad5c9208, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.5_dbg/sql/sql_select.cc:417
 
#12 0x0000562ce14ea348 in execute_sqlcom_select (thd=thd@entry=0x14d5ad415088, all_tables=0x14d5ad48f8a0) at /test/10.5_dbg/sql/sql_parse.cc:6210
 
#13 0x0000562ce14e341c in mysql_execute_command (thd=0x14d5ad415088) at /test/10.5_dbg/sql/sql_parse.cc:3932
 
#14 0x0000562ce1415dcb in sp_instr_stmt::exec_core (this=0x14d5ad48b030, thd=<optimized out>, nextp=0x14d5d1715f14) at /test/10.5_dbg/sql/sp_head.cc:3765
 
#15 0x0000562ce14219e3 in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x14d5ad48b078, thd=thd@entry=0x14d5ad415088, nextp=nextp@entry=0x14d5d1715f14, open_tables=open_tables@entry=false, instr=instr@entry=0x14d5ad48b030) at /test/10.5_dbg/sql/sp_head.cc:3492
 
#16 0x0000562ce1422589 in sp_instr_stmt::execute (this=0x14d5ad48b030, thd=0x14d5ad415088, nextp=0x14d5d1715f14) at /test/10.5_dbg/sql/sp_head.cc:3671
 
#17 0x0000562ce141b431 in sp_head::execute (this=this@entry=0x14d5ad4890a0, thd=thd@entry=0x14d5ad415088, merge_da_on_success=merge_da_on_success@entry=true) at /test/10.5_dbg/sql/sp_head.cc:1435
 
#18 0x0000562ce141d250 in sp_head::execute_procedure (this=0x14d5ad4890a0, thd=thd@entry=0x14d5ad415088, args=0x14d5ad41a0e8) at /test/10.5_dbg/sql/sp_head.cc:2446
 
#19 0x0000562ce14e0d92 in do_execute_sp (thd=thd@entry=0x14d5ad415088, sp=sp@entry=0x14d5ad4890a0) at /test/10.5_dbg/sql/sql_parse.cc:3043
 
#20 0x0000562ce14e16f6 in Sql_cmd_call::execute (this=0x14d5ad474150, thd=0x14d5ad415088) at /test/10.5_dbg/sql/sql_parse.cc:3289
 
#21 0x0000562ce14e89b0 in mysql_execute_command (thd=thd@entry=0x14d5ad415088) at /test/10.5_dbg/sql/sql_parse.cc:5952
 
#22 0x0000562ce14f0324 in mysql_parse (thd=thd@entry=0x14d5ad415088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14d5d1717350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7994
 
#23 0x0000562ce14dcd54 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14d5ad415088, packet=packet@entry=0x14d5ad467089 "CALL p()", packet_length=packet_length@entry=8, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1867
 
#24 0x0000562ce14db53e in do_command (thd=0x14d5ad415088) at /test/10.5_dbg/sql/sql_parse.cc:1348
 
#25 0x0000562ce163a893 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x14d5b08d4808, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1410
 
#26 0x0000562ce163afb7 in handle_one_connection (arg=arg@entry=0x14d5b08d4808) at /test/10.5_dbg/sql/sql_connect.cc:1312
 
#27 0x0000562ce1aa55c2 in pfs_spawn_thread (arg=0x14d5ce446508) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
 
#28 0x000014d5d06916db in start_thread (arg=0x14d5d1718700) at pthread_create.c:463
 
#29 0x000014d5cfa8fa3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.5.6 (dbg), 10.5.6 (opt), 10.6.0 (dbg), 10.6.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.1.47 (dbg), 10.1.47 (opt), 10.2.34 (dbg), 10.2.34 (opt), 10.3.25 (dbg), 10.3.25 (opt), 10.4.15 (dbg), 10.4.15 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.49 (dbg), 5.6.49 (opt), 5.7.31 (dbg), 5.7.31 (opt), 8.0.21 (dbg), 8.0.21 (opt)

 Comments   
Comment by Roel Van de Paar [ 2020-12-09 ]

Another stack.

CREATE TABLE t (id int PRIMARY KEY) ENGINE=InnoDB;
 
SET @@SESSION.OPTIMIZER_SWITCH="derived_merge=OFF";
 
CREATE TEMPORARY TABLE t2 (c1 VARBINARY(2)) BINARY CHARACTER SET 'latin1' PRIMARY KEY(c1)) ENGINE=MEMORY;
 
SET @cmd:="SELECT * FROM (SELECT * FROM t) AS a";
 
PREPARE stmt FROM @cmd;
 
EXECUTE stmt;
 
SET @@SESSION.OPTIMIZER_SWITCH="derived_merge=ON";
 
EXECUTE stmt;

Leads to:

10.6.0 5d4599f9750140f92cfdbbe4d292ae1b8dd456f8 (Optimized)

 
Core was generated by `/test/MD201020-mariadb-10.6.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
 
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
 
[Current thread is 1 (Thread 0x147cf810c700 (LWP 269715))]
 
(gdb) bt
 
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
 
#1  0x000055b9c7b0aa4f in my_write_core (sig=sig@entry=11) at /test/10.6_opt/mysys/stacktrace.c:424
 
#2  0x000055b9c752e130 in handle_fatal_signal (sig=11) at /test/10.6_opt/sql/signal_handler.cc:330
 
#3  <signal handler called>
 
#4  heap_info (info=0x0, x=x@entry=0x147cf8109ea0, flag=flag@entry=18) at /test/10.6_opt/storage/heap/hp_info.c:34
 
#5  0x000055b9c783d9c1 in ha_heap::info (flag=18, this=0x147cbc0513a0) at /test/10.6_opt/storage/heap/ha_heap.cc:377
 
#6  ha_heap::info (this=0x147cbc0513a0, flag=18) at /test/10.6_opt/storage/heap/ha_heap.cc:370
 
#7  0x000055b9c7387bd6 in make_join_statistics (keyuse_array=0x147cbc0107e0, tables_list=@0x147cbc023058: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x147cbc011160, last = 0x147cbc011160, elements = 1}, <No data fields>}, join=0x147cbc0104f0) at /test/10.6_opt/sql/sql_select.cc:4901
 
#8  JOIN::optimize_inner (this=0x147cbc0104f0) at /test/10.6_opt/sql/sql_select.cc:2247
 
#9  0x000055b9c738a213 in JOIN::optimize (this=this@entry=0x147cbc0104f0) at /test/10.6_opt/sql/sql_select.cc:1623
 
#10 0x000055b9c738a316 in mysql_select (thd=0x147cbc000c58, tables=0x147cbc024908, fields=<optimized out>, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2201171004160, result=0x147cbc025808, unit=0x147cbc0212b0, select_lex=0x147cbc022e18) at /test/10.6_opt/sql/sql_select.cc:4659
 
#11 0x000055b9c738ad67 in handle_select (thd=thd@entry=0x147cbc000c58, lex=lex@entry=0x147cbc0211e8, result=result@entry=0x147cbc025808, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_opt/sql/sql_select.cc:417
 
#12 0x000055b9c731a951 in execute_sqlcom_select (thd=0x147cbc000c58, all_tables=0x147cbc024908) at /test/10.6_opt/sql/sql_parse.cc:6062
 
#13 0x000055b9c7328380 in mysql_execute_command (thd=0x147cbc000c58) at /test/10.6_opt/sql/sql_parse.cc:3784
 
#14 0x000055b9c7339955 in Prepared_statement::execute (this=0x147cbc01c288, expanded_query=<optimized out>, open_cursor=false) at /test/10.6_opt/sql/sql_prepare.cc:4736
 
#15 0x000055b9c7339b29 in Prepared_statement::execute_loop (packet=<optimized out>, packet_end=<optimized out>, open_cursor=<optimized out>, expanded_query=0x147cf810ae00, this=0x147cbc01c288) at /test/10.6_opt/sql/sql_prepare.cc:4225
 
#16 Prepared_statement::execute_loop (this=0x147cbc01c288, expanded_query=0x147cf810ae00, open_cursor=<optimized out>, packet=<optimized out>, packet_end=<optimized out>) at /test/10.6_opt/sql/sql_prepare.cc:4180
 
#17 0x000055b9c7339e33 in mysql_sql_stmt_execute (thd=thd@entry=0x147cbc000c58) at /test/10.6_opt/sql/sql_prepare.cc:3336
 
#18 0x000055b9c732708e in mysql_execute_command (thd=0x147cbc000c58) at /test/10.6_opt/sql/sql_parse.cc:3800
 
#19 0x000055b9c731503f in mysql_parse (thd=0x147cbc000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:7833
 
#20 0x000055b9c7320967 in dispatch_command (command=COM_QUERY, thd=0x147cbc000c58, packet=0x147cbc008009 "EXECUTE stmt", packet_length=<optimized out>) at /test/10.6_opt/sql/sql_class.h:1253
 
#21 0x000055b9c7322d42 in do_command (thd=0x147cbc000c58) at /test/10.6_opt/sql/sql_parse.cc:1343
 
#22 0x000055b9c74266e1 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55b9c9ac1a28, put_in_cache=put_in_cache@entry=true) at /test/10.6_opt/sql/sql_connect.cc:1410
 
#23 0x000055b9c7426b5d in handle_one_connection (arg=arg@entry=0x55b9c9ac1a28) at /test/10.6_opt/sql/sql_connect.cc:1312
 
#24 0x000055b9c77ac266 in pfs_spawn_thread (arg=0x55b9c9a2e9c8) at /test/10.6_opt/storage/perfschema/pfs.cc:2201
 
#25 0x0000147d0e49a609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#26 0x0000147d0e089293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.5.7 (dbg), 10.5.7 (opt), 10.6.0 (dbg), 10.6.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.1.48 (dbg), 10.1.48 (opt), 10.2.35 (dbg), 10.2.35 (opt), 10.3.26 (dbg), 10.3.26 (opt), 10.4.16 (dbg), 10.4.16 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.50 (dbg), 5.6.50 (opt), 5.7.32 (dbg), 5.7.32 (opt), 8.0.22 (dbg), 8.0.22 (opt)

Comment by Roel Van de Paar [ 2020-12-09 ]

sanja Not sure about priority, feel free to adjust as needed.
igor FYI (optimizer switch seems to affect things)

Comment by Roel Van de Paar [ 2021-04-17 ]

Another testcase (not fully optimized yet, for testing any bug fixes against):

CREATE TABLE t (c FLOAT(0,0) ZEROFILL,c2 INT,c3 REAL(0,0) ZEROFILL,KEY(c)) ENGINE=InnoDB;
 
SET SESSION optimizer_switch='derived_merge=OFF';
 
CREATE PROCEDURE p2 (OUT i1 TEXT CHARACTER SET 'latin1' COLLATE 'latin1_bin',OUT i2 INT UNSIGNED) DETERMINISTIC NO SQL SELECT * FROM (SELECT c3 FROM t) AS a1;
 
CALL p2 (@a,@a);
 
DROP TABLE t;
 
SET SESSION optimizer_switch='derived_merge=on';
 
CREATE TABLE t (c INT UNSIGNED ZEROFILL,c2 INT,c3 BLOB,KEY(c)) ENGINE=InnoDB;
 
CALL p2 (@b,@b);

Comment by Alice Sherepa [ 2021-04-30 ]

I checked the initial test case:
5.5-10.2 returns "query 'CALL p()' failed: 1030: Got error 1 "Operation not permitted" from storage engine MEMORY"

10.3-10.5 crahes:

10.3 23e090626a9138f44905a

 
210430  8:17:08 [ERROR] mysqld got signal 11 ;
 
Server version: 10.3.29-MariaDB-debug-log
 
 
 
sql/signal_handler.cc:221(handle_fatal_signal)[0x55e57c0e7109]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7f30ee888730]
 
heap/hp_info.c:34(heap_info)[0x55e57c678d0e]
 
heap/ha_heap.cc:368(ha_heap::info(unsigned int))[0x55e57c669e2e]
 
sql/table.cc:8561(TABLE_LIST::fetch_number_of_rows())[0x55e57bc7a791]
 
sql/sql_select.cc:4557(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x55e57ba1390c]
 
sql/sql_select.cc:1973(JOIN::optimize_inner())[0x55e57b9f9792]
 
sql/sql_select.cc:1515(JOIN::optimize())[0x55e57b9f4b8b]
 
sql/sql_select.cc:4326(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55e57ba11d68]
 
sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55e57b9e8830]
 
sql/sql_parse.cc:6342(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55e57b95453e]
 
sql/sql_parse.cc:3873(mysql_execute_command(THD*))[0x55e57b942547]
 
sql/sp_head.cc:3702(sp_instr_stmt::exec_core(THD*, unsigned int*))[0x55e57b712abe]
 
sql/sp_head.cc:3434(sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*))[0x55e57b7113a6]
 
sql/sp_head.cc:3608(sp_instr_stmt::execute(THD*, unsigned int*))[0x55e57b71228d]
 
sql/sp_head.cc:1377(sp_head::execute(THD*, bool))[0x55e57b70366d]
 
sql/sp_head.cc:2404(sp_head::execute_procedure(THD*, List<Item>*))[0x55e57b709b11]
 
sql/sql_parse.cc:3019(do_execute_sp(THD*, sp_head*))[0x55e57b93bd9d]
 
sql/sql_parse.cc:3259(Sql_cmd_call::execute(THD*))[0x55e57b93d9f9]
 
sql/sql_parse.cc:6078(mysql_execute_command(THD*))[0x55e57b951fdf]
 
sql/sql_parse.cc:7873(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55e57b95e659]
 
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55e57b934d17]
 
sql/sql_parse.cc:1398(do_command(THD*))[0x55e57b931452]
 
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x55e57bd256a7]
 
sql/sql_connect.cc:1309(handle_one_connection)[0x55e57bd24f5f]
 
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55e57d4a2275]
 
nptl/pthread_create.c:487(start_thread)[0x7f30ee87dfa3]
 
x86_64/clone.S:97(clone)[0x7f30ee7ae4cf]
 
 
 
Query (0x62500010e190): SELECT * FROM (SELECT 1 FROM mysql.user) AS a

the second test case fails the same way, error before 10.3, crash on 10.3-10.5.
While the third test case crashes on 10.1-10.5:

10.1 da9081d14f2de7bb655c

 
CREATE TABLE t (c FLOAT(0,0) ZEROFILL,c2 INT,c3 REAL(0,0) ZEROFILL,KEY(c)) ENGINE=InnoDB;
 
SET SESSION optimizer_switch='derived_merge=OFF';
 
CREATE PROCEDURE p2 (OUT i1 TEXT CHARACTER SET 'latin1' COLLATE 'latin1_bin',OUT i2 INT UNSIGNED) DETERMINISTIC NO SQL SELECT * FROM (SELECT c3 FROM t) AS a1;
 
CALL p2 (@a,@a);
 
c3
 
DROP TABLE t;
 
SET SESSION optimizer_switch='derived_merge=on';
 
CREATE TABLE t (c INT UNSIGNED ZEROFILL,c2 INT,c3 BLOB,KEY(c)) ENGINE=InnoDB;
 
CALL p2 (@b,@b);
 
main.1my 'innodb_plugin'                 [ fail ]
 
        Test ended at 2021-04-30 08:27:09
 
 
 
CURRENT_TEST: main.1my
 
mysqltest: At line 9: query 'CALL p2 (@b,@b)' failed: 2013: Lost connection to MySQL server during query
 
 
 
210430  8:27:09 [ERROR] mysqld got signal 11 ;
 
 
 
Server version: 10.1.49-MariaDB-debug
 
 
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7fca631f9730]
 
maria/ma_info.c:43(maria_status)[0x55bf55175388]
 
maria/ha_maria.cc:2498(ha_maria::info(unsigned int))[0x55bf5518c08b]
 
sql/table.cc:7470(TABLE_LIST::fetch_number_of_rows())[0x55bf54e917b7]
 
sql/sql_select.cc:3639(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x55bf54dd68f1]
 
sql/sql_select.cc:1408(JOIN::optimize_inner())[0x55bf54dcec86]
 
sql/sql_select.cc:1063(JOIN::optimize())[0x55bf54dcd991]
 
sql/sql_select.cc:3490(mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55bf54dd61fb]
 
sql/sql_select.cc:377(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55bf54dcba21]
 
sql/sql_parse.cc:5713(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55bf54d9b643]
 
sql/sql_parse.cc:3060(mysql_execute_command(THD*))[0x55bf54d92357]
 
sql/sp_head.cc:3301(sp_instr_stmt::exec_core(THD*, unsigned int*))[0x55bf54cf3790]
 
sql/sp_head.cc:3067(sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*))[0x55bf54cf2e94]
 
sql/sp_head.cc:3217(sp_instr_stmt::execute(THD*, unsigned int*))[0x55bf54cf345c]
 
sql/sp_head.cc:1312(sp_head::execute(THD*, bool))[0x55bf54ceebf7]
 
sql/sp_head.cc:2185(sp_head::execute_procedure(THD*, List<Item>*))[0x55bf54cf0be8]
 
sql/sql_parse.cc:2486(do_execute_sp(THD*, sp_head*))[0x55bf54d909bf]
 
sql/sql_parse.cc:5064(mysql_execute_command(THD*))[0x55bf54d98ff2]
 
sql/sql_parse.cc:7228(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55bf54d9f13e]
 
sql/sql_parse.cc:1494(dispatch_command(enum_server_command, THD*, char*, unsigned int))[0x55bf54d8e2ec]
 
sql/sql_parse.cc:1124(do_command(THD*))[0x55bf54d8d1d8]
 
sql/sql_connect.cc:1331(do_handle_one_connection(THD*))[0x55bf54eca0ef]
 
sql/sql_connect.cc:1243(handle_one_connection)[0x55bf54ec9e2a]
 
perfschema/pfs.cc:1870(pfs_spawn_thread)[0x55bf552e2d64]
 
nptl/pthread_create.c:487(start_thread)[0x7fca631eefa3]
 
x86_64/clone.S:97(clone)[0x7fca628b34cf]
 
 
 
Query (0x7fca4b813088): SELECT * FROM (SELECT c3 FROM t) AS a1

Comment by Alice Sherepa [ 2021-04-30 ]

Test case from MDEV-25570:

CREATE PROCEDURE sp_test()
 
  SELECT x,y FROM (SELECT x, rand() y FROM (SELECT 1 x UNION SELECT 2) sq0) sq1;
 
 
 
CALL sp_test();
 
CALL sp_test();

5.5-10.2 returns 1030: Got error 1 "Operation not permitted" from storage engine MEMORY,
on 10.3-10.5 server crashes, no crash with optimizer_switch="derived_merge=OFF".

10.3 23e090626a9138f44905a5

 
210430  8:39:25 [ERROR] mysqld got signal 11 ;
 
 
 
Server version: 10.3.29-MariaDB-debug-log
 
 
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7f91336b6730]
 
heap/hp_info.c:34(heap_info)[0x55d122253d0e]
 
heap/ha_heap.cc:368(ha_heap::info(unsigned int))[0x55d122244e2e]
 
sql/table.cc:8561(TABLE_LIST::fetch_number_of_rows())[0x55d121855791]
 
sql/sql_select.cc:4557(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x55d1215ee90c]
 
sql/sql_select.cc:1973(JOIN::optimize_inner())[0x55d1215d4792]
 
sql/sql_select.cc:1515(JOIN::optimize())[0x55d1215cfb8b]
 
sql/sql_select.cc:4326(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55d1215ecd68]
 
sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55d1215c3830]
 
sql/sql_parse.cc:6342(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55d12152f53e]
 
sql/sql_parse.cc:3873(mysql_execute_command(THD*))[0x55d12151d547]
 
sql/sp_head.cc:3702(sp_instr_stmt::exec_core(THD*, unsigned int*))[0x55d1212edabe]
 
sql/sp_head.cc:3434(sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*))[0x55d1212ec3a6]
 
sql/sp_head.cc:3608(sp_instr_stmt::execute(THD*, unsigned int*))[0x55d1212ed28d]
 
sql/sp_head.cc:1377(sp_head::execute(THD*, bool))[0x55d1212de66d]
 
sql/sp_head.cc:2404(sp_head::execute_procedure(THD*, List<Item>*))[0x55d1212e4b11]
 
sql/sql_parse.cc:3019(do_execute_sp(THD*, sp_head*))[0x55d121516d9d]
 
sql/sql_parse.cc:3259(Sql_cmd_call::execute(THD*))[0x55d1215189f9]
 
sql/sql_parse.cc:6078(mysql_execute_command(THD*))[0x55d12152cfdf]
 
sql/sql_parse.cc:7873(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55d121539659]
 
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55d12150fd17]
 
sql/sql_parse.cc:1398(do_command(THD*))[0x55d12150c452]
 
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x55d1219006a7]
 
sql/sql_connect.cc:1309(handle_one_connection)[0x55d1218fff5f]
 
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55d12307d275]
 
nptl/pthread_create.c:487(start_thread)[0x7f91336abfa3]
 
x86_64/clone.S:97(clone)[0x7f91335dc4cf]
 
 
 
Query (0x62500010b990): SELECT x,y FROM (SELECT x, rand() y FROM (SELECT 1 x UNION SELECT 2) sq0) sq1

In MariaDB 10.5 there was an error, but after https://github.com/MariaDB/server/commit/eb483c5181 commit - there is a crash. It looks like later smth similar was added in 10.3,10.4 – this is why the bug was first created as a regression in 10.5

Comment by Roel Van de Paar [ 2021-05-01 ]

Confirming the crash/error and version update findings by Alice.

Comment by Alexey Botchkov [ 2021-09-30 ]

https://github.com/MariaDB/server/commit/39efcfbf9d9a69f8e40275f02d87328cf6c082f7

Comment by Sergei Petrunia [ 2022-11-14 ]

SP Cache is not related to query optimizer

Comment by Oleksandr Byelkin [ 2022-12-15 ]

Is it would be better just execute SP with optimizer settings of its compilation?

Comment by Oleksandr Byelkin [ 2022-12-15 ]

Discussion results: 1) the same can be with PS 2) try to fix problem with the temporary table

Comment by Roel Van de Paar [ 2023-12-15 ]

Confirmed no longer reproducible. Closing

Generated at Thu Feb 08 09:29:34 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.