[MDEV-26260] Crash with old DECIMAL and CTE Created: 2021-07-28  Updated: 2023-04-27

Status: Open
Project: MariaDB Server
Component/s: Data types, Optimizer - CTE
Affects Version/s: 10.3, 10.4, 10.5, 10.6
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Alexander Barkov Assignee: Sergei Golubchik
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-24511 null field is created with CREATE..SE... Closed

 Description   

I apply the following patch:

diff --git a/mysql-test/main/type_decimal.test b/mysql-test/main/type_decimal.test
index 71c7c7bcd5b..da70b32e85e 100644
--- a/mysql-test/main/type_decimal.test
+++ b/mysql-test/main/type_decimal.test
@@ -599,6 +599,8 @@ let $MYSQLD_DATADIR= `select @@datadir`;
 --copy_file std_data/old_decimal/t1dec102.MYD $MYSQLD_DATADIR/test/t1dec102.MYD
 --copy_file std_data/old_decimal/t1dec102.MYI $MYSQLD_DATADIR/test/t1dec102.MYI
 
+WITH RECURSIVE tbl AS (   SELECT a FROM t1dec102    UNION SELECT 2 AS col FROM tbl )   SELECT * FROM tbl;
+
 SHOW CREATE TABLE t1dec102;
 SHOW COLUMNS FROM t1dec102;
 SELECT COLUMN_NAME, DATA_TYPE, COLUMN_TYPE FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='t1dec102';

and run:

cd mysql-test
./mtr main.type_decimal

It crashes with the following stack trace:

#0  0x00007ffff76c2625 in raise () from /lib64/libc.so.6
#1  0x00007ffff76ab8d9 in abort () from /lib64/libc.so.6
#2  0x00007ffff76ab7a9 in __assert_fail_base.cold () from /lib64/libc.so.6
#3  0x00007ffff76baa66 in __assert_fail () from /lib64/libc.so.6
#4  0x0000000000967bd9 in Type_handler_olddecimal::make_table_field (this=0x1b8eb90 <type_handler_olddecimal>, name=0x7fffe00167b8, addr=..., attr=..., 
    table=0x7fffe00ab2b8) at /home/bar/maria-git/server.10.3.dec/sql/sql_type.cc:2159
#5  0x00000000009674a9 in Type_handler::make_and_init_table_field (this=0x1b8eb90 <type_handler_olddecimal>, name=0x7fffe00167b8, addr=..., attr=..., 
    table=0x7fffe00ab2b8) at /home/bar/maria-git/server.10.3.dec/sql/sql_type.cc:2037
#6  0x0000000000abdc41 in Item_type_holder::create_tmp_field (this=0x7fffe0016768, group=false, table=0x7fffe00ab2b8)
    at /home/bar/maria-git/server.10.3.dec/sql/item.h:6638
#7  0x00000000007e93b0 in create_tmp_field (thd=0x7fffe0000d90, table=0x7fffe00ab2b8, item=0x7fffe0016768, type=Item::TYPE_HOLDER, copy_func=0x7ffff16e0370, 
    from_field=0x7fffe00ac3b8, default_field=0x7fffe00ac3a8, group=false, modify_item=false, table_cant_handle_bit_fields=false, make_copy_field=false)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_select.cc:17206
#8  0x00000000007eae28 in create_tmp_table (thd=0x7fffe0000d90, param=0x7fffe0016010, fields=..., group=0x0, distinct=true, save_sum_fields=true, 
    select_options=2416196352, rows_limit=18446744073709551615, table_alias=0x1a54f20 <empty_clex_str>, do_not_open=false, keep_row_order=false)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_select.cc:17721
#9  0x000000000086e02b in select_unit::create_result_table (this=0x7fffe0015fd0, thd_arg=0x7fffe0000d90, column_types=0x7fffe0013798, is_union_distinct=true, 
    options=2416196352, alias=0x1a54f20 <empty_clex_str>, bit_fields_as_long=false, create_table=true, keep_row_order=false, hidden=0)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_union.cc:372
#10 0x000000000086e1db in select_union_recursive::create_result_table (this=0x7fffe0015fd0, thd_arg=0x7fffe0000d90, column_types=0x7fffe0013798, 
    is_union_distinct=true, options=2416196352, alias=0x7fffe0014990, bit_fields_as_long=false, create_table=true, keep_row_order=false, hidden=0)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_union.cc:401
#11 0x0000000000870880 in st_select_lex_unit::prepare (this=0x7fffe00130b0, derived_arg=0x7fffe0014948, sel_result=0x7fffe0015ee8, additional_options=0)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_union.cc:1091
#12 0x000000000072e351 in mysql_derived_prepare (thd=0x7fffe0000d90, lex=0x7fffe0004b98, derived=0x7fffe0014948)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_derived.cc:770
#13 0x000000000072cf13 in mysql_handle_single_derived (lex=0x7fffe0004b98, derived=0x7fffe0014948, phases=2)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_derived.cc:199
#14 0x000000000089eb0e in TABLE_LIST::handle_derived (this=0x7fffe0014948, lex=0x7fffe0004b98, phases=2) at /home/bar/maria-git/server.10.3.dec/sql/table.cc:8363
#15 0x00000000007463c2 in LEX::handle_list_of_derived (this=0x7fffe0004b98, table_list=0x7fffe0014948, phases=2)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_lex.h:4004
#16 0x0000000000752594 in st_select_lex::handle_derived (this=0x7fffe0014018, lex=0x7fffe0004b98, phases=2)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_lex.cc:4159
#17 0x000000000089ead4 in TABLE_LIST::handle_derived (this=0x7fffe0015218, lex=0x7fffe0004b98, phases=2) at /home/bar/maria-git/server.10.3.dec/sql/table.cc:8360
#18 0x00000000007463c2 in LEX::handle_list_of_derived (this=0x7fffe0004b98, table_list=0x7fffe0015218, phases=2)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_lex.h:4004
#19 0x0000000000752594 in st_select_lex::handle_derived (this=0x7fffe00053e0, lex=0x7fffe0004b98, phases=2)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_lex.cc:4159
#20 0x00000000007bd3dc in JOIN::prepare (this=0x7fffe0015980, tables_init=0x7fffe0015218, wild_num=1, conds_init=0x0, og_num=0, order_init=0x0, 
    skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7fffe00053e0, unit_arg=0x7fffe0004c58)
    at /home/bar/maria-git/server.10.3.dec/sql/sql_select.cc:1045
#21 0x00000000007c8f3e in mysql_select (thd=0x7fffe0000d90, tables=0x7fffe0015218, wild_num=1, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, 
    proc_param=0x0, select_options=2147756800, result=0x7fffe0015958, unit=0x7fffe0004c58, select_lex=0x7fffe00053e0)

The problem happens when this method:

bool st_select_lex_unit::join_union_type_handlers(THD *thd_arg,
                                                  Type_holder *holders,
                                                  uint count)

is called with count==1. This seems to be possible only with CTE (and is not possible with a simple UNION).

With count>1, e.g. in case of a UNION, it works fine because the following translations:

  • old DATE -> new DATE
  • old VARCHAR -> new VARCHAR
  • old DECIMAL -> new DECIMAL

happen inside Type_handler::aggregate_for_result_traditional().

With count==1 the execition does not go inside Type_handler::aggregate_for_result_traditional(), so the translation does not happen.


Generated at Thu Feb 08 09:43:57 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.