[MDEV-25103] Crash at JOIN::reinit - calling stored procedure Created: 2021-03-10  Updated: 2021-09-15  Resolved: 2021-09-15

Status: Closed
Project: MariaDB Server
Component/s: Server
Affects Version/s: 10.4.17, 10.5.9, 10.4, 10.5
Fix Version/s: N/A

Type: Bug Priority: Critical
Reporter: suresh ramagiri Assignee: Igor Babaev
Resolution: Duplicate Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-26108 Crash with query referencing twice CT... Closed

 Description   

One of our customers reported that the execution of stored procedure involving "CONNECT"/"MEMORY" engine tables, table_type=WMI, CTE, JOIN, UNION ALL QUERY, causing MariaDB server running on Windows platform to crash.

I can locally able to reproduce the crash, at 10.4.17 (customer version) and 10.5.9 (latest release).

Repro Steps:
1. Install MariaDB server 10.4.17/10.5.9 at the Window Machine.
2. Install connect plugin.
3. Restore the dump file - proc_monitor_values_prtg_new.sql
4. call the procedure - server_monitoring.query_monitor_values_prtg.
call server_monitoring.query_monitor_values_prtg;

First time execution, will work. 2nd time it will crash the server.

ERROR log:

2021-03-10 15:02:06 5 [Note] CONNECT: Version 1.07.0002 Feb 19 2021 10:36:16
 
210310 15:02:52 [ERROR] mysqld got exception 0xc0000005 ;
 
This could be because you hit a bug. It is also possible that this binary
 
or one of the libraries it was linked against is corrupt, improperly built,
 
or misconfigured. This error can also be caused by malfunctioning hardware.
 
 
 
To report this bug, see https://mariadb.com/kb/en/reporting-bugs
 
 
 
We will try our best to scrape up some info that will hopefully help
 
diagnose the problem, but since we have already crashed, 
something is definitely wrong and this may fail.
 
 
 
Server version: 10.5.9-MariaDB
 
key_buffer_size=134217728
 
read_buffer_size=131072
 
max_used_connections=2
 
max_threads=65537
 
thread_count=2
 
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 136467 K  bytes of memory
 
Hope that's ok; if not, decrease some variables in the equation.
 
 
 
Thread pointer: 0x25c638b9318
 
Attempting backtrace. You can use the following information to find out
 
where mysqld died. If you see no messages after this, something went
 
terribly wrong...
 
server.dll!JOIN::reinit()[sql_select.cc:4067]
 
server.dll!st_select_lex_unit::optimize()[sql_union.cc:2099]
 
server.dll!st_select_lex_unit::exec()[sql_union.cc:2157]
 
server.dll!mysql_union()[sql_union.cc:41]
 
server.dll!handle_select()[sql_select.cc:433]
 
server.dll!execute_sqlcom_select()[sql_parse.cc:6282]
 
server.dll!mysql_execute_command()[sql_parse.cc:3978]
 
server.dll!sp_instr_stmt::exec_core()[sp_head.cc:3770]
 
server.dll!sp_lex_keeper::reset_lex_and_exec_core()[sp_head.cc:3495]
 
server.dll!sp_instr_stmt::execute()[sp_head.cc:3674]
 
server.dll!sp_head::execute()[sp_head.cc:1437]
 
server.dll!sp_head::execute_procedure()[sp_head.cc:2449]
 
server.dll!do_execute_sp()[sql_parse.cc:3088]
 
server.dll!Sql_cmd_call::execute()[sql_parse.cc:3334]
 
server.dll!mysql_execute_command()[sql_parse.cc:6036]
 
server.dll!mysql_parse()[sql_parse.cc:8067]
 
server.dll!dispatch_command()[sql_parse.cc:1892]
 
server.dll!do_command()[sql_parse.cc:1370]
 
server.dll!threadpool_process_request()[threadpool_common.cc:363]
 
server.dll!tp_callback()[threadpool_common.cc:194]
 
ntdll.dll!TpReleaseWait()
 
ntdll.dll!RtlInitializeResource()
 
KERNEL32.DLL!BaseThreadInitThunk()
 
ntdll.dll!RtlUserThreadStart()
 
 
 
Trying to get some variables.
 
Some pointers may be invalid and cause the dump to abort.
 
Query (0x25c982d6480): WITH CheckTableEngines AS (

Thank You,
Suresh

 Comments   
Comment by Alice Sherepa [ 2021-03-10 ] 

create table t1 (tm datetime, id int);
 
insert into t1(id) values (1),(2);  #not important
 
create procedure sp ()
 
WITH cte1 AS (SELECT COUNT(*), @@max_connections  FROM information_schema.processlist), 
    cte AS (
 
       WITH 
       tb1 AS (SELECT MAX(id) id FROM t1), 
       tb2 AS (SELECT tm FROM tb1 JOIN t1 USING (id)), 
       tb3 AS (SELECT tb2.* FROM tb2)
 
    SELECT 1 value, 2 message FROM tb3)
 
SELECT value FROM cte UNION ALL SELECT message FROM cte;
 
 
 
call sp();
 
call sp();

10.4/10.5 crashes (debug/non-debug), 10.3 returns result as expected, but 10.2 returns the error:

'call sp()' failed: 1457: Failed to load routine test.sp. The table mysql.proc is missing, corrupt, or contains bad data (internal code -6)

repeatable with Myisam/Innodb/Memory

10.4

 
210310 13:05:48 [ERROR] mysqld got signal 11 ;
 
 
 
Server version: 10.4.19-MariaDB-debug-log
 
 
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x12730)[0x7f8926a51730]
 
sql/sql_select.cc:4082(JOIN::reinit())[0x55a9ccea757c]
 
sql/sql_union.cc:1449(st_select_lex_unit::optimize())[0x55a9cd089edf]
 
sql/sql_union.cc:1507(st_select_lex_unit::exec())[0x55a9cd08aa64]
 
sql/sql_union.cc:41(mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long))[0x55a9cd07b8f4]
 
sql/sql_select.cc:400(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55a9cce7f289]
 
sql/sql_parse.cc:6444(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55a9ccdf29e4]
 
sql/sql_parse.cc:3963(mysql_execute_command(THD*))[0x55a9ccde06e2]
 
sql/sp_head.cc:3687(sp_instr_stmt::exec_core(THD*, unsigned int*))[0x55a9ccbac150]
 
sql/sp_head.cc:3419(sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*))[0x55a9ccbaa970]
 
sql/sp_head.cc:3593(sp_instr_stmt::execute(THD*, unsigned int*))[0x55a9ccbab8ff]
 
sql/sp_head.cc:1364(sp_head::execute(THD*, bool))[0x55a9ccb9d481]
 
sql/sp_head.cc:2370(sp_head::execute_procedure(THD*, List<Item>*))[0x55a9ccba3418]
 
sql/sql_parse.cc:3052(do_execute_sp(THD*, sp_head*))[0x55a9ccdd9e5f]
 
sql/sql_parse.cc:3294(Sql_cmd_call::execute(THD*))[0x55a9ccddb96b]
 
sql/sql_parse.cc:6187(mysql_execute_command(THD*))[0x55a9ccdf03df]
 
sql/sql_parse.cc:7985(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55a9ccdfbaf7]
 
sql/sql_parse.cc:1858(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55a9ccdd2d43]
 
sql/sql_parse.cc:1373(do_command(THD*))[0x55a9ccdcf7c2]
 
sql/sql_connect.cc:1412(do_handle_one_connection(CONNECT*))[0x55a9cd1b0181]
 
sql/sql_connect.cc:1317(handle_one_connection)[0x55a9cd1afa23]
 
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55a9ce7f4c45]
 
nptl/pthread_create.c:487(start_thread)[0x7f8926a46fa3]
 
x86_64/clone.S:97(clone)[0x7f892604d4cf]
 
 
 
Query (0x625000122190): WITH cte1 AS (SELECT COUNT(*), @@max_connections  FROM information_schema.processlist), 
cte AS (
 
WITH 
tb1 AS (SELECT MAX(id) id FROM t1), 
tb2 AS (SELECT tm FROM tb1 JOIN t1 USING (id)), 
tb3 AS (SELECT tb2.* FROM tb2)
 
SELECT 1 value, 2 message FROM tb3)
 
SELECT value FROM cte UNION ALL SELECT message FROM cte

also with ps:

sql/sql_select.cc:4082(JOIN::reinit())[0x5617672bee84]
 
sql/sql_union.cc:1449(st_select_lex_unit::optimize())[0x5617674a9cef]
 
sql/sql_union.cc:1507(st_select_lex_unit::exec())[0x5617674aa8a8]
 
sql/sql_union.cc:41(mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long))[0x56176749b42a]
 
sql/sql_select.cc:400(handle_select(THD*, LEX*, select_result*, unsigned long))[0x56176729668d]
 
sql/sql_parse.cc:6444(execute_sqlcom_select(THD*, TABLE_LIST*))[0x561767206597]
 
sql/sql_parse.cc:3963(mysql_execute_command(THD*))[0x5617671f429b]
 
sql/sql_prepare.cc:4996(Prepared_statement::execute(String*, bool))[0x561767262d3b]
 
sql/sql_prepare.cc:4465(Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*))[0x56176725e1fb]
 
sql/sql_prepare.cc:3567(mysql_sql_stmt_execute(THD*))[0x56176725810a]
 
sql/sql_parse.cc:3980(mysql_execute_command(THD*))[0x5617671f42e0]
 
sql/sql_parse.cc:7985(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x56176720fa2f]
 
sql/sql_parse.cc:1858(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5617671e660a]
 
sql/sql_parse.cc:1373(do_command(THD*))[0x5617671e30b9]
 
sql/sql_connect.cc:1412(do_handle_one_connection(CONNECT*))[0x5617675d5f88]
 
sql/sql_connect.cc:1317(handle_one_connection)[0x5617675d582c]
 
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x561768c96bfb]
 
nptl/pthread_create.c:478(start_thread)[0x7f9d20f84609]
 
x86_64/clone.S:97(__GI___clone)[0x7f9d20740293]

Comment by Oleksandr Byelkin [ 2021-06-25 ]

It looks like CTE was not cleaned correctly .

Comment by Igor Babaev [ 2021-08-04 ]

Alice!,
I can't reproduce any problems you complained of with the current versions.

Comment by Alice Sherepa [ 2021-08-24 ]

the bug is not reproducible after commit 78735dcaf757cd71c8f0ff3d2 by Igor Babaev "MDEV-26108 Crash with query referencing twice CTE that uses embedded recursive CTE"

igor Could you please take a look at it and close if it is fixed. I'm in doubt because MDEV-26108 mentions recursive CTE, while here we have non-recursive CTE

Generated at Thu Feb 08 09:35:10 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.