[MDEV-26412] Server crash in Item_field::fix_outer_field for INSERT SELECT Created: 2021-08-19  Updated: 2022-07-13  Resolved: 2022-04-28

Status: Closed
Project: MariaDB Server
Component/s: Data Manipulation - Insert
Affects Version/s: 10.4, 10.5, 10.6, 10.7, 10.8
Fix Version/s: 10.4.25, 10.5.16, 10.6.8, 10.7.4, 10.8.3

Type: Bug Priority: Major
Reporter: yaoguang Assignee: Igor Babaev
Resolution: Fixed Votes: 0
Labels: crash
Environment:

Linux version 5.13.0-1-MANJARO (builduser@LEGION) (gcc (GCC) 11.1.0, GNU ld (GNU Binutils) 2.36.1) #1 SMP PREEMPT Mon Jun 7 06:16:10 UTC 2021 x86_64


Issue Links:
Duplicate
is duplicated by MDEV-26214 INSERT from SELECT crashes server on ... Closed
Relates
relates to MDEV-29088 Server crash upon CREATE VIEW with un... Closed
relates to MDEV-25346 Server crashes in Item_field::fix_out... Closed
relates to MDEV-28578 Server crashes in Item_field::fix_out... Closed

 Description   

PoC:

CREATE TABLE v0 ( v1 BIGINT ( 67 ) NOT NULL ) ;
 CREATE TABLE v2 ( v4 INT , v3 INT NOT NULL UNIQUE KEY CHECK ( -128 | ( str_to_date ( CHAR ( 33 ) , 'x' ) ) ) ) ;
 DROP FUNCTION IF EXISTS v0 ;
 INSERT INTO v0 SELECT DISTINCT * FROM v0 FULL JOIN v2 ON ( SELECT v0 . v1 ) ;

Crash Log:

Version: '10.7.0-MariaDB'  socket: '/tmp/18.socket'  port: 10018  Source distribution
210816 15:33:24 [ERROR] mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
 
To report this bug, see https://mariadb.com/kb/en/reporting-bugs
 
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed, 
something is definitely wrong and this may fail.
 
Server version: 10.7.0-MariaDB
key_buffer_size=134217728
read_buffer_size=131072
max_used_connections=1
max_threads=153
thread_count=1
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 467956 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
 
Thread pointer: 0x62b0000bd218
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f722a3fd850 thread_stack 0x5fc00
sanitizer_common/sanitizer_common_interceptors.inc:4203(__interceptor_backtrace.part.0)[0x7f7249ca9c3e]
mysys/stacktrace.c:213(my_print_stacktrace)[0x55c05f113747]
sql/signal_handler.cc:222(handle_fatal_signal)[0x55c05e0db120]
sigaction.c:0(__restore_rt)[0x7f7249693870]
sql/item.cc:5561(Item_field::fix_outer_field(THD*, Field**, Item**))[0x55c05e168491]
sql/item.cc:5982(Item_field::fix_fields(THD*, Item**))[0x55c05e16b34c]
sql/item.h:1148(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x55c05d80a2ed]
sql/sql_select.cc:1397(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x55c05dac647c]
sql/item_subselect.cc:3903(subselect_single_select_engine::prepare(THD*))[0x55c05e3cf4f6]
sql/item_subselect.cc:295(Item_subselect::fix_fields(THD*, Item**))[0x55c05e3ccd05]
sql/item.h:1148(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x55c05d810338]
sql/sql_base.cc:8454(setup_conds(THD*, TABLE_LIST*, List<TABLE_LIST>&, Item**))[0x55c05d810d40]
sql/sql_select.cc:833(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x55c05dac6748]
sql/sql_select.cc:4967(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55c05db0dcaa]
sql/sql_select.cc:545(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55c05db0e655]
sql/sql_parse.cc:4718(mysql_execute_command(THD*, bool))[0x55c05d97d9c1]
sql/sql_parse.cc:8047(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55c05d9805a1]
sql/sql_parse.cc:1898(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55c05d98660c]
sql/sql_parse.cc:1406(do_command(THD*, bool))[0x55c05d98b73d]
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x55c05dd46e57]
sql/sql_connect.cc:1312(handle_one_connection)[0x55c05dd4733d]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x55c05e7d7c2c]
pthread_create.c:0(start_thread)[0x7f7249689259]
:0(__GI___clone)[0x7f72492345e3]
 
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x629000087238): INSERT INTO v0 SELECT DISTINCT * FROM v0 FULL JOIN v2 ON ( SELECT v0 . v1 )
 
Connection ID (thread ID): 4
Status: NOT_KILLED



 Comments   
Comment by Alice Sherepa [ 2021-08-27 ]

Thank you!
I repeated the crash on 10.4-10.6, 10.2-10.3 returns error -Unknown column 't1.i' in 'field list'

CREATE TABLE t1 (i int) ;
CREATE TABLE t2 (j int) ;
INSERT INTO t1 SELECT * FROM t1 FULL JOIN t2 ON (SELECT t1.i);

10.4 dc6bc85cd29586631d

Version: '10.4.22-MariaDB-debug-log' 
210827 10:46:46 [ERROR] mysqld got signal 11 ;
 
sql/signal_handler.cc:222(handle_fatal_signal)[0x55dd5eb0bfb3]
sigaction.c:0(__restore_rt)[0x7fcd62ddc3c0]
sql/item.cc:5457(Item_field::fix_outer_field(THD*, Field**, Item**))[0x55dd5eb898fe]
sql/item.cc:5872(Item_field::fix_fields(THD*, Item**))[0x55dd5eb8d319]
sql/item.h:964(Item::fix_fields_if_needed(THD*, Item**))[0x55dd5e06b969]
sql/item.h:968(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x55dd5e06b9a3]
sql/sql_base.cc:7723(setup_fields(THD*, Bounds_checked_array<Item*>, List<Item>&, enum_column_usage, List<Item>*, List<Item>*, bool))[0x55dd5e18f34e]
sql/sql_select.cc:1276(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x55dd5e3b1ea8]
sql/item_subselect.cc:3825(subselect_single_select_engine::prepare(THD*))[0x55dd5ed5a7ae]
sql/item_subselect.cc:289(Item_subselect::fix_fields(THD*, Item**))[0x55dd5ed343ff]
sql/item.h:964(Item::fix_fields_if_needed(THD*, Item**))[0x55dd5e06b969]
sql/item.h:968(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x55dd5e06b9a3]
sql/item.h:973(Item::fix_fields_if_needed_for_bool(THD*, Item**))[0x55dd5e19e141]
sql/sql_base.cc:8341(setup_on_expr(THD*, TABLE_LIST*, bool))[0x55dd5e19423d]
sql/sql_base.cc:8458(setup_conds(THD*, TABLE_LIST*, List<TABLE_LIST>&, Item**))[0x55dd5e194df4]
sql/sql_select.cc:724(setup_without_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<TABLE_LIST>&, List<Item>&, List<Item>&, Item**, st_order*, st_order*, List<Window_spec>&, List<Item_window_func>&, bool*, unsigned int*))[0x55dd5e3aad9a]
sql/sql_select.cc:1281(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x55dd5e3b21f3]
sql/sql_select.cc:4717(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55dd5e3d78cf]
sql/sql_select.cc:436(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55dd5e3a8e9a]
sql/sql_parse.cc:4712(mysql_execute_command(THD*))[0x55dd5e30a499]
sql/sql_parse.cc:7995(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55dd5e3212d7]
sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55dd5e2f7a53]
sql/sql_parse.cc:1373(do_command(THD*))[0x55dd5e2f44d0]
sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x55dd5e6edb39]
sql/sql_connect.cc:1317(handle_one_connection)[0x55dd5e6ed292]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55dd5fdbf74d]
nptl/pthread_create.c:478(start_thread)[0x7fcd62dd0609]
x86_64/clone.S:97(__GI___clone)[0x7fcd629a5293]
 
Query (0x62b0000a1290): INSERT INTO t1 SELECT * FROM t1 FULL JOIN t2 ON (SELECT t1.i)

Comment by Oleksandr Byelkin [ 2022-04-27 ]

OK to push

Comment by Igor Babaev [ 2022-04-28 ]

A fix for this bug was pushed into 10.4

Generated at Thu Feb 08 09:45:07 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.