[MDEV-26926] 【BUG】【view】debug 版本视图做 insert into ... on duplicate key update操作导致mysqld coredump掉 Created: 2021-10-28  Updated: 2023-10-04  Resolved: 2023-10-04

Status: Closed
Project: MariaDB Server
Component/s: Views
Affects Version/s: 10.4.6, 10.6.4, 10.2, 10.3, 10.4, 10.5, 10.6
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: niezhibiao Assignee: Oleksandr Byelkin
Resolution: Cannot Reproduce Votes: 0
Labels: view
Environment:

ubuntu 16.04.4 LTS


Attachments: PNG File 1.png    
Issue Links:
Relates
relates to MDEV-28917 SIGSEGV in resolve_ref_in_select_and_... Confirmed

 Description   

【重现步骤】
1、创建表 t1
CREATE TABLE `t1` (
`id` int(10) unsigned NOT NULL,
`r` float NOT NULL,
PRIMARY KEY (`id`)
) DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
2、创建视图v1,v2
create view v1 as select id, if(r=r,1,2) as d from t1;
create view v2 as
select id,
d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d as p
from v1;
3、执行插入语句
insert into t1 (id, r)
select id,p from v2
on duplicate key update r=p;

【预期结果】
插入成功

【实际结果】
mysqld coredump

【备注】
1、这个问题是在 10.4.6 debug版发现的,随后我又去官网下载了最新的稳定版 10.6.4,发现仍然存在该问题。希望您能尽快修复 bug,同时也麻烦解决后能通知下我。
2、该问题源于原生用例mysql-test/main/view.test,难道你们没有用 debug 版运行过自己的用例吗?对于这一点我心存疑惑。



 Comments   
Comment by Daniel Black [ 2021-10-28 ]

Using latest 10.6 as of now, this might be fixed already.

10.6-relwithdebuginfo-d8c6c53a0658ea8315252997f65d796b13182387

MariaDB [(none)]> use test;
Database changed
MariaDB [test]> CREATE TABLE `t1` (
    -> `id` int(10) unsigned NOT NULL,
    -> `r` float NOT NULL,
    -> PRIMARY KEY (`id`)
    -> ) DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
Query OK, 0 rows affected (0.002 sec)
 
MariaDB [test]> create view v1 as select id, if(r=r,1,2) as d from t1;
Query OK, 0 rows affected (0.001 sec)
 
MariaDB [test]> create view v2 as
    -> select id,
    -> d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d+d as p
    -> from v1;
Query OK, 0 rows affected (0.001 sec)
 
MariaDB [test]> insert into t1 (id, r)
    -> select id,p from v2
    -> on duplicate key update r=p;
Query OK, 0 rows affected (0.003 sec)
Records: 0  Duplicates: 0  Warnings: 0

Comment by Daniel Black [ 2021-10-28 ]

Confirmed on debug build:

Core was generated by `sql/mysqld --no-defaults --skip-networking --datadir=/tmp/build-mariadb-server-'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007f867da825bf in poll () from /lib64/libc.so.6
[Current thread is 1 (Thread 0x7f867d6eb900 (LWP 187838))]
(gdb) thread apply all bt full
 
Thread 9 (Thread 0x7f867c076640 (LWP 188418)):
#0  0x00007f867d9ca2a2 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007f867d9b3950 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00007f867d9b3789 in __assert_fail_base.cold () from /lib64/libc.so.6
No symbol table info available.
#3  0x00007f867d9c2a16 in __assert_fail () from /lib64/libc.so.6
No symbol table info available.
#4  0x0000000000844d2d in Bounds_checked_array<Item*>::operator[] (this=0x7f867c072408, n=55) at /home/dan/repos/mariadb-server-10.6/sql/sql_array.h:65
No locals.
#5  0x0000000000977ad6 in change_refs_to_tmp_fields (thd=0x7f864c002688, ref_pointer_array={m_array = 0x7f864c08b100, m_size = 36}, res_selected_fields=@0x7f864c08ac98: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x227f048 <end_of_list>, last = 0x7f864c08ac98, elements = 0}, <No data fields>}, res_all_fields=@0x7f864c08ac50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7f864c09ad70, last = 0x7f864c09ad70, elements = 1}, <No data fields>}, elements=2, all_fields=@0x7f864c08ac38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7f864c090de0, last = 0x7f864c0392c0, elements = 56}, <No data fields>}) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:26137
        it = {<base_list_iterator> = {list = 0x7f864c08ac38, el = 0x7f864c090de0, prev = 0x0, current = 0x0}, <No data fields>}
        item = 0x7f864c0404b0
        new_item = 0x7f864c09ac20
        i = 0
        border = 54
        itr = {<base_list_iterator> = {list = 0x7f864c09abd0, el = 0x7f864c0925e0, prev = 0x1007f8600000001, current = 0x7f864c092500}, <No data fields>}
#6  0x0000000000972bc0 in JOIN::make_aggr_tables_info (this=0x7f864c08a8e0) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:3614
        tmp_group = 0x0
        save_sum_fields = false
        curr_all_fields = 0x7f864c08ac38
        curr_fields_list = 0x7f864c01f930
        curr_tab = 0x7f864c092070
        exec_tmp_table = 0x7f864c0925e0
        distinct = false
        has_group_by = false
        keep_row_order = false
        is_having_added_as_table_cond = false
        _db_stack_frame_ = {func = 0x1826cfb "JOIN::optimize_stage2", file = 0x182670e "/home/dan/repos/mariadb-server-10.6/sql/sql_select.cc", level = 2147483657, line = -1, prev = 0x7f867c072b78}
        implicit_grouping_with_window_funcs = false
        implicit_grouping_without_tables = false
#7  0x000000000095f03c in JOIN::optimize_stage2 (this=0x7f864c08a8e0) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:3227
        select_opts_for_readinfo = 0
        no_jbuf_after = 1
        tab = 0x0
        _db_stack_frame_ = {func = 0x1826bbb "JOIN::optimize_inner", file = 0x182670e "/home/dan/repos/mariadb-server-10.6/sql/sql_select.cc", level = 2147483656, line = -1, prev = 0x7f867c072ef0}
        res = -1
#8  0x0000000000961ba4 in JOIN::optimize_inner (this=0x7f864c08a8e0) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:2479
        _db_stack_frame_ = {func = 0x182747c "mysql_select", file = 0x182670e "/home/dan/repos/mariadb-server-10.6/sql/sql_select.cc", level = 2147483655, line = -1, prev = 0x7f867c0730c0}
        trace_wrapper = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0x1f19e90 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_prepare = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0x1f19e90 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_steps = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0x1f19ef8 <vtable for Json_writer_array+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        sel = 0x7f864c01f690
        eq_list = {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x227f048 <end_of_list>, last = 0x7f867c072f20, elements = 0}, <No data fields>}
        ignore_on_expr = false
#9  0x000000000095c158 in JOIN::optimize (this=0x7f864c08a8e0) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:1809
        res = 0
        init_state = JOIN::NOT_OPTIMIZED
#10 0x000000000095368e in mysql_select (thd=0x7f864c002688, tables=0x7f864c01b250, fields=@0x7f864c01f930: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7f864c032880, last = 0x7f864c0392c0, elements = 2}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2202244745984, result=0x7f864c08a7e0, unit=0x7f864c0069f0, select_lex=0x7f864c01f690) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:4980
        err = 0
        free_join = true
        _db_stack_frame_ = {func = 0x1826744 "handle_select", file = 0x182670e "/home/dan/repos/mariadb-server-10.6/sql/sql_select.cc", level = 2147483654, line = -1, prev = 0x7f867c073218}
        join = 0x7f864c08a8e0
#11 0x0000000000952f84 in handle_select (thd=0x7f864c002688, lex=0x7f864c006928, result=0x7f864c08a7e0, setup_tables_done_option=1073741824) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:545
        unit = 0x7f864c0069f0
        res = false
        select_lex = 0x7f864c01f690
        _db_stack_frame_ = {func = 0x181e483 "mysql_execute_command", file = 0x181dbb6 "/home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc", level = 2147483653, line = -1, prev = 0x7f867c073ec8}
#12 0x0000000000901218 in mysql_execute_command (thd=0x7f864c002688, is_called_from_prepared_stmt=false) at /home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc:4711
        save_protocol = 0x0
        second_table = 0x7f864c01b250
        sel_result = 0x7f864c08a7e0
        result = 0x0
        explain = false
        res = 0
        up_result = 0
        lex = 0x7f864c006928
        select_lex = 0x7f864c01f690
        first_table = 0x7f864c02ad60
        all_tables = 0x7f864c02ad60
        unit = 0x7f864c0069f0
        have_table_map_for_update = false
        rpl_filter = 0x170af02 <_my_thread_var+18>
        _db_stack_frame_ = {func = 0x181efa3 "mysql_parse", file = 0x181dbb6 "/home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc", level = 2147483652, line = -1, prev = 0x7f867c0743e0}
        ots = {ctx = 0x7f864c0065d0, traceable = false}
        trace_command = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0x1f19e90 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_command_steps = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0x1f19ef8 <vtable for Json_writer_array+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        orig_binlog_format = BINLOG_FORMAT_MIXED
        orig_current_stmt_binlog_format = BINLOG_FORMAT_STMT
#13 0x00000000008f4113 in mysql_parse (thd=0x7f864c002688, rawbuf=0x7f864c018cd0 "insert into t1 (id, r)\nselect id,p from v2\non duplicate key update r=p", length=70, parser_state=0x7f867c074958) at /home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc:8030
        found_semicolon = 0x0
        error = 32646
        lex = 0x7f864c006928
        err = false
        _db_stack_frame_ = {func = 0x181dff3 "dispatch_command", file = 0x181dbb6 "/home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc", level = 2147483651, line = -1, prev = 0x7f867c074b10}
#14 0x00000000008f0cd7 in dispatch_command (command=COM_QUERY, thd=0x7f864c002688, packet=0x7f864c00df09 "insert into t1 (id, r)\nselect id,p from v2\non duplicate key update r=p", packet_length=70, blocking=true) at /home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc:1896
        packet_end = 0x7f864c018d16 ""
        parser_state = {m_lip = {lookahead_token = -1, lookahead_yylval = 0x0, m_thd = 0x7f864c002688, m_ptr = 0x7f864c018d17 "\004", m_tok_start = 0x7f864c018d17 "\004", m_tok_end = 0x7f864c018d17 "\004", m_end_of_query = 0x7f864c018d16 "", m_tok_start_prev = 0x7f864c018d16 "", m_buf = 0x7f864c018cd0 "insert into t1 (id, r)\nselect id,p from v2\non duplicate key update r=p", m_buf_length = 70, m_echo = true, m_echo_saved = false, m_cpp_buf = 0x7f864c00c100 "insert into t1 (id, r)\nselect id,p from v2\non duplicate key update r=p", m_cpp_ptr = 0x7f864c00c146 "", m_cpp_tok_start = 0x7f864c00c146 "", m_cpp_tok_start_prev = 0x7f864c00c146 "", m_cpp_tok_end = 0x7f864c00c146 "", m_body_utf8 = 0x0, m_body_utf8_ptr = 0x19f1d60 "info", m_cpp_utf8_processed_ptr = 0x0, next_state = MY_LEX_END, found_semicolon = 0x0, ignore_space = false, stmt_prepare_mode = false, multi_statements = true, yylineno = 3, m_digest = 0x0, in_comment = NO_COMMENT, in_comment_saved = (DISCARD_COMMENT | unknown: 0x7f84), m_cpp_text_start = 0x7f864c00c145 "p", m_cpp_text_end = 0x7f864c00c146 "", m_underscore_cs = 0x0}, m_yacc = {yacc_yyss = 0x0, yacc_yyvs = 0x0, m_set_signal_info = {m_item = {0x0 <repeats 12 times>}}, m_lock_type = TL_READ_DEFAULT, m_mdl_type = MDL_SHARED_READ}, m_digest_psi = 0x0}
        net = 0x7f864c0029a0
        error = false
        do_end_of_statement = true
        _db_stack_frame_ = {func = 0x181dd0e "do_command", file = 0x181dbb6 "/home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc", level = 2147483650, line = -1, prev = 0x7f867c075b58}
        drop_more_results = false
#15 0x00000000008f5368 in do_command (thd=0x7f864c002688, blocking=true) at /home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc:1404
        return_value = (unknown: 0x4c0029a0)
        packet = 0x7f864c00df08 "\003insert into t1 (id, r)\nselect id,p from v2\non duplicate key update r=p"
        packet_length = 71
        net = 0x7f864c0029a0
        command = COM_QUERY
        _db_stack_frame_ = {func = 0x1ae5bbe "?func", file = 0x1ae5bc4 "?file", level = 2147483649, line = -1, prev = 0x0}
#16 0x0000000000ae1d38 in do_handle_one_connection (connect=0x3b36d58, put_in_cache=true) at /home/dan/repos/mariadb-server-10.6/sql/sql_connect.cc:1418
        create_user = true
        thr_create_utime = 130262199523
        thd = 0x7f864c002688
#17 0x0000000000ae19aa in handle_one_connection (arg=0x3b36d58) at /home/dan/repos/mariadb-server-10.6/sql/sql_connect.cc:1312
        connect = 0x3b36d58
#18 0x00000000010aee3f in pfs_spawn_thread (arg=0x3b3aa68) at /home/dan/repos/mariadb-server-10.6/storage/perfschema/pfs.cc:2201
        typed_arg = 0x3b3aa68
        user_arg = 0x3b36d58
        user_start_routine = 0xae1950 <handle_one_connection(void*)>
        pfs = 0x0
        klass = 0x0
#19 0x00007f867dda8299 in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
#20 0x00007f867da8d353 in clone () from /lib64/libc.so.6
No symbol table info available.

Comment by Alice Sherepa [ 2021-10-28 ]

--source include/have_innodb.inc
 
CREATE TABLE t1 ( id int, r int) engine=innodb;
CREATE VIEW v1 AS SELECT id,if(r=r,1,2) AS d FROM t1;
 
INSERT INTO t1 (id, r)
SELECT id,p FROM (SELECT id, d+d+d+d+d+d+d+d+d+d AS p from v1) dt
ON duplicate KEY UPDATE r=p;

Assertion `n < m_size' failed in Element_type& Bounds_checked_array<Element_type>::operator[]

10.2 a441a569157bf75303e3f9f4852

#3  <signal handler called>
#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#5  0x00007fdf9dcef859 in __GI_abort () at abort.c:79
#6  0x00007fdf9dcef729 in __assert_fail_base (fmt=0x7fdf9de85588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x558ca240e9cc "n < m_size", file=0x558ca240e9a0 "/10.2/src/sql/sql_array.h", line=64, function=<optimized out>) at assert.c:92
#7  0x00007fdf9dd00f36 in __GI___assert_fail (assertion=0x558ca240e9cc "n < m_size", file=0x558ca240e9a0 "/10.2/src/sql/sql_array.h", line=64, function=0x558ca240e920 "Element_type& Bounds_checked_array<Element_type>::operator[](size_t) [with Element_type = Item*; size_t = long unsigned int]") at assert.c:101
#8  0x0000558ca18de4e1 in Bounds_checked_array<Item*>::operator[] (this=0x7fdf93f67520, n=21) at /10.2/src/sql/sql_array.h:64
#9  0x0000558ca1a00855 in change_refs_to_tmp_fields (thd=0x7fdf40000d90, ref_pointer_array=..., res_selected_fields=..., res_all_fields=..., elements=2, all_fields=...) at /10.2/src/sql/sql_select.cc:23819
#10 0x0000558ca19c9688 in JOIN::make_aggr_tables_info (this=0x7fdf40191f00) at /10.2/src/sql/sql_select.cc:2611
#11 0x0000558ca19c807a in JOIN::optimize_inner (this=0x7fdf40191f00) at /10.2/src/sql/sql_select.cc:2259
#12 0x0000558ca19c4198 in JOIN::optimize (this=0x7fdf40191f00) at /10.2/src/sql/sql_select.cc:1127
#13 0x0000558ca19cd6ee in mysql_select (thd=0x7fdf40000d90, tables=0x7fdf400157f0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=3489925888, result=0x7fdf40191e58, unit=0x7fdf40004988, select_lex=0x7fdf400050d8) at /10.2/src/sql/sql_select.cc:3835
#14 0x0000558ca19c18d2 in handle_select (thd=0x7fdf40000d90, lex=0x7fdf400048c8, result=0x7fdf40191e58, setup_tables_done_option=1073741824) at /10.2/src/sql/sql_select.cc:361
#15 0x0000558ca1984e6c in mysql_execute_command (thd=0x7fdf40000d90) at /10.2/src/sql/sql_parse.cc:4333
#16 0x0000558ca198fc62 in mysql_parse (thd=0x7fdf40000d90, rawbuf=0x7fdf40012708 "INSERT INTO t1 (id, r)\nSELECT id,p FROM (SELECT id, d+d+d+d+d+d+d+d+d+d AS p from v1) dt\nON duplicate KEY UPDATE r=p", length=116, parser_state=0x7fdf93f68560, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:7793
#17 0x0000558ca197debd in dispatch_command (command=COM_QUERY, thd=0x7fdf40000d90, packet=0x7fdf40008b61 "INSERT INTO t1 (id, r)\nSELECT id,p FROM (SELECT id, d+d+d+d+d+d+d+d+d+d AS p from v1) dt\nON duplicate KEY UPDATE r=p", packet_length=116, is_com_multi=false, is_next_command=false) at /10.2/src/sql/sql_parse.cc:1827
#18 0x0000558ca197c9b8 in do_command (thd=0x7fdf40000d90) at /10.2/src/sql/sql_parse.cc:1381
#19 0x0000558ca1ad89f5 in do_handle_one_connection (connect=0x558ca47f2a80) at /10.2/src/sql/sql_connect.cc:1336
#20 0x0000558ca1ad875a in handle_one_connection (arg=0x558ca47f2a80) at /10.2/src/sql/sql_connect.cc:1241
#21 0x0000558ca2302ef8 in pfs_spawn_thread (arg=0x558ca47d5e70) at /10.2/src/storage/perfschema/pfs.cc:1869
#22 0x00007fdf9e211609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#23 0x00007fdf9ddec293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment by Alice Sherepa [ 2023-10-04 ]

not reproducible on recent 10.4 (50a2e8b1892b6b8a276d4bd) -11.2

Generated at Thu Feb 08 09:48:59 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.