[MDEV-24787] Server crash in Item_ref::field_type / check_group_min_max_predicates Created: 2021-02-04  Updated: 2023-11-09

Status: Confirmed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.2, 10.3, 10.4
Fix Version/s: 10.4

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: not-10.5+


 Description   

--source include/have_innodb.inc
 
CREATE TABLE t1 (id INT, a INT, PRIMARY KEY(id), KEY(a)) ENGINE=InnoDB;
INSERT INTO t1 VALUES (1,10),(2,20);
 
CREATE TABLE t2 (b CHAR(8)) ENGINE=InnoDB;
INSERT INTO t2 VALUES ('10'),('11');
 
SELECT MAX(id), a FROM (SELECT * FROM t1 WHERE a <> 4) AS sq WHERE a IN (SELECT MIN(b) FROM t2) GROUP BY a;
 
# Cleanup
DROP TABLE t1, t2;

10.2 6ede84f4

#3  <signal handler called>
#4  Item_ref::field_type (this=0x7f34f409cc10) at /data/src/10.2/sql/item.h:4492
#5  0x00005645a154ddfd in check_group_min_max_predicates (cond=0x7f34f409cc10, min_max_arg_item=0x7f34f4016d30, image_type=Field::itRAW, has_min_max_arg=0x7f35413a5c84, has_other_arg=0x7f35413a5c85) at /data/src/10.2/sql/opt_range.cc:13058
#6  0x00005645a154dace in check_group_min_max_predicates (cond=0x7f34f4098fa8, min_max_arg_item=0x7f34f4016d30, image_type=Field::itRAW, has_min_max_arg=0x7f35413a5dd8, has_other_arg=0x7f35413a5f30) at /data/src/10.2/sql/opt_range.cc:12996
#7  0x00005645a154d64e in get_best_group_min_max (param=0x7f35413a79c0, tree=0x7f34f40755e0, read_time=1.7976931348623157e+308) at /data/src/10.2/sql/opt_range.cc:12895
#8  0x00005645a1534f91 in SQL_SELECT::test_quick_select (this=0x7f34f409b058, thd=0x7f34f4000d90, keys_to_use=..., prev_tables=0, limit=18446744073709551615, force_quick_range=true, ordered_output=false, remove_false_parts_of_where=false) at /data/src/10.2/sql/opt_range.cc:2567
#9  0x00005645a11d8459 in test_if_skip_sort_order (tab=0x7f34f409a4c8, order=0x7f34f4016060, select_limit=2, no_changes=false, map=0x7f34f409d5b0) at /data/src/10.2/sql/sql_select.cc:21752
#10 0x00005645a11a5080 in JOIN::optimize_inner (this=0x7f34f40161a0) at /data/src/10.2/sql/sql_select.cc:2183
#11 0x00005645a11a146a in JOIN::optimize (this=0x7f34f40161a0) at /data/src/10.2/sql/sql_select.cc:1118
#12 0x00005645a11aa9a8 in mysql_select (thd=0x7f34f4000d90, tables=0x7f34f40141c8, wild_num=0, fields=..., conds=0x7f34f4015d18, og_num=1, order=0x0, group=0x7f34f4016060, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f34f4016180, unit=0x7f34f4004988, select_lex=0x7f34f40050c8) at /data/src/10.2/sql/sql_select.cc:3823
#13 0x00005645a119ebb2 in handle_select (thd=0x7f34f4000d90, lex=0x7f34f40048c8, result=0x7f34f4016180, setup_tables_done_option=0) at /data/src/10.2/sql/sql_select.cc:361
#14 0x00005645a11692bc in execute_sqlcom_select (thd=0x7f34f4000d90, all_tables=0x7f34f40141c8) at /data/src/10.2/sql/sql_parse.cc:6248
#15 0x00005645a115fc6b in mysql_execute_command (thd=0x7f34f4000d90) at /data/src/10.2/sql/sql_parse.cc:3559
#16 0x00005645a116d065 in mysql_parse (thd=0x7f34f4000d90, rawbuf=0x7f34f40126f8 "SELECT MAX(id), a FROM (SELECT * FROM t1 WHERE a <> 4) AS sq WHERE a IN (SELECT MIN(b) FROM t2) GROUP BY a", length=106, parser_state=0x7f35413a95f0, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7763
#17 0x00005645a115b33e in dispatch_command (command=COM_QUERY, thd=0x7f34f4000d90, packet=0x7f34f4008b51 "SELECT MAX(id), a FROM (SELECT * FROM t1 WHERE a <> 4) AS sq WHERE a IN (SELECT MIN(b) FROM t2) GROUP BY a", packet_length=106, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1827
#18 0x00005645a1159e39 in do_command (thd=0x7f34f4000d90) at /data/src/10.2/sql/sql_parse.cc:1381
#19 0x00005645a12b488e in do_handle_one_connection (connect=0x5645a35b33b0) at /data/src/10.2/sql/sql_connect.cc:1336
#20 0x00005645a12b45f3 in handle_one_connection (arg=0x5645a35b33b0) at /data/src/10.2/sql/sql_connect.cc:1241
#21 0x00005645a1adcb82 in pfs_spawn_thread (arg=0x5645a3509580) at /data/src/10.2/storage/perfschema/pfs.cc:1869
#22 0x00007f3547452609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#23 0x00007f354702e293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Reproducible on 10.1-10.5, debug-, release- and ASAN builds alike.
Not reproducible with MyISAM or Aria.



 Comments   
Comment by Elena Stepanova [ 2021-05-23 ]

Same test case, stack trace from 10.4 is a bit different (to avoid duplicate reports):

10.4 67083ca4

==1893911==ERROR: AddressSanitizer: use-after-poison on address 0x6290002b44f8 at pc 0x5638afb1ee19 bp 0x7f517ffe1a00 sp 0x7f517ffe19f0
READ of size 8 at 0x6290002b44f8 thread T27
    #0 0x5638afb1ee18 in Item_args::arguments() const /data/src/10.4/sql/item.h:2693
    #1 0x5638b096c9f2 in check_group_min_max_predicates /data/src/10.4/sql/opt_range.cc:13957
    #2 0x5638b096bbbe in check_group_min_max_predicates /data/src/10.4/sql/opt_range.cc:13871
...

or (different test case)

10.4 8e280f30

#3  <signal handler called>
#4  0x000055aa654efff0 in typeinfo for Item_direct_ref ()
#5  0x000055aa642e1e53 in check_group_min_max_predicates (cond=0x7f58200bdbd0, min_max_arg_item=0x7f5820245800, image_type=Field::itRAW, has_min_max_arg=0x7f58a43f6954, has_other_arg=0x7f58a43f6955) at /home/elenst/src/10.4/sql/opt_range.cc:13933
#6  0x000055aa642e1a58 in check_group_min_max_predicates (cond=0x7f58200163d0, min_max_arg_item=0x7f5820245800, image_type=Field::itRAW, has_min_max_arg=0x7f58a43f6a54, has_other_arg=0x7f58a43f6a55) at /home/elenst/src/10.4/sql/opt_range.cc:13873
...

Generated at Thu Feb 08 09:32:40 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.