[MDEV-27171] Spider: SIGSEGV in spider_set_direct_limit_offset on INSERT Created: 2021-12-05  Updated: 2022-04-25  Resolved: 2021-12-21

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - Spider
Affects Version/s: 10.5, 10.6, 10.7, 10.8
Fix Version/s: N/A

Type: Bug Priority: Critical
Reporter: Roel Van de Paar Assignee: Nayuta Yanagisawa (Inactive)
Resolution: Duplicate Votes: 0
Labels: regression

Issue Links:
Duplicate
duplicates MDEV-27240 SIGSEGV in ha_spider::store_lock on L... Closed
Problem/Incident
is caused by MDEV-19002 Partition performance optimization Stalled
Relates
relates to MDEV-24769 Spider crash when selecting all rows ... Closed
relates to MDEV-28406 Spider: SIGSEGV in ha_spider::index_l... Closed

 Description    

Use test;
 
INSTALL PLUGIN spider SONAME 'ha_spider.so';
 
CREATE SERVER d FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',DATABASE'',USER'',PORT 10000,PASSWORD'');
 
SET SESSION spider_same_server_link=ON;
 
CREATE TABLE t (id INT AUTO_INCREMENT,i INT,KEY(id)) ENGINE=SPIDER;
 
EXPLAIN SELECT * FROM t AS nt2 WHERE 1 IN (SELECT it.a FROM t AS it JOIN t AS it3 ON it.a=it3.a);
 
ALTER TABLE t CHANGE c c FLOAT UNSIGNED ZEROFILL;
 
CREATE TEMPORARY TABLE tm1 (c INT) ENGINE=SPIDER UNION=(t);
 
INSERT INTO t VALUES (0,0),(0,0),(0,0),(0,0),(0,0);

Leads to:

10.6.6 e0e24b180d090d7ee378c097ab02df891b61a965 (Optimized)

 
Core was generated by `/test/MD031221-mariadb-10.6.6-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x000014d56c12344b in spider_set_direct_limit_offset (
 
    spider=spider@entry=0x14d4d80811e0)
 
    at /test/10.6_opt/storage/spider/spd_table.cc:9535
 
9535	    if (spider->partition_handler_share->owner->
 
[Current thread is 1 (Thread 0x14d580aa4700 (LWP 1207506))]
 
(gdb) bt
 
#0  0x000014d56c12344b in spider_set_direct_limit_offset (spider=spider@entry=0x14d4d80811e0) at /test/10.6_opt/storage/spider/spd_table.cc:9535
 
#1  0x000014d56c14107f in ha_spider::check_direct_order_limit (this=0x14d4d80811e0) at /test/10.6_opt/storage/spider/ha_spider.cc:13105
 
#2  ha_spider::check_direct_order_limit (this=0x14d4d80811e0) at /test/10.6_opt/storage/spider/ha_spider.cc:13089
 
#3  0x000014d56c14b0cd in ha_spider::index_last_internal (buf=0x14d4d80739f8 "", this=0x14d4d80811e0) at /test/10.6_opt/storage/spider/ha_spider.cc:3350
 
#4  ha_spider::index_last_internal (this=0x14d4d80811e0, buf=0x14d4d80739f8 "") at /test/10.6_opt/storage/spider/ha_spider.cc:3310
 
#5  0x000014d56c154229 in ha_spider::get_auto_increment (this=0x14d4d80811e0, offset=<optimized out>, increment=1, nb_desired_values=5, first_value=0x14d580aa2980, nb_reserved_values=0x14d580aa2988) at /test/10.6_opt/storage/spider/ha_spider.cc:9812
 
#6  0x000055d88b2308e8 in handler::update_auto_increment (this=this@entry=0x14d4d80811e0) at /test/10.6_opt/sql/handler.cc:3954
 
#7  0x000014d56c143386 in ha_spider::update_auto_increment (this=0x14d4d80811e0) at /test/10.6_opt/storage/spider/ha_spider.cc:9755
 
#8  0x000014d56c155455 in ha_spider::write_row (this=0x14d4d80811e0, buf=0x14d4d80739e8 <incomplete sequence \375>) at /test/10.6_opt/storage/spider/ha_spider.cc:10014
 
#9  0x000055d88b2362a0 in handler::ha_write_row (this=0x14d4d80811e0, buf=0x14d4d80739e8 <incomplete sequence \375>) at /test/10.6_opt/sql/handler.cc:7519
 
#10 0x000055d88afb7cad in write_record (thd=thd@entry=0x14d4d8000c58, table=table@entry=0x14d4d80735d8, info=info@entry=0x14d580aa2c40, sink=sink@entry=0x0) at /test/10.6_opt/sql/sql_insert.cc:2146
 
#11 0x000055d88afbe4bf in mysql_insert (thd=thd@entry=0x14d4d8000c58, table_list=<optimized out>, fields=@0x14d4d8005ca8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55d88c158590 <end_of_list>, last = 0x14d4d8005ca8, elements = 0}, <No data fields>}, values_list=@0x14d4d8005cf0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d4d80115f8, last = 0x14d4d8011b18, elements = 5}, <No data fields>}, update_fields=@0x14d4d8005cd8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55d88c158590 <end_of_list>, last = 0x14d4d8005cd8, elements = 0}, <No data fields>}, update_values=@0x14d4d8005cc0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55d88c158590 <end_of_list>, last = 0x14d4d8005cc0, elements = 0}, <No data fields>}, duplic=<optimized out>, ignore=<optimized out>, result=<optimized out>) at /test/10.6_opt/sql/sql_insert.cc:1123
 
#12 0x000055d88aff8df9 in mysql_execute_command (thd=0x14d4d8000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:4565
 
#13 0x000055d88afe89a6 in mysql_parse (thd=0x14d4d8000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:8030
 
#14 0x000055d88aff4b65 in dispatch_command (command=COM_QUERY, thd=0x14d4d8000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.6_opt/sql/sql_class.h:1358
 
#15 0x000055d88aff6d57 in do_command (thd=0x14d4d8000c58, blocking=blocking@entry=true) at /test/10.6_opt/sql/sql_parse.cc:1404
 
#16 0x000055d88b106957 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/10.6_opt/sql/sql_connect.cc:1418
 
#17 0x000055d88b106c9d in handle_one_connection (arg=arg@entry=0x55d88e836c18) at /test/10.6_opt/sql/sql_connect.cc:1312
 
#18 0x000055d88b492828 in pfs_spawn_thread (arg=0x55d88e7c75d8) at /test/10.6_opt/storage/perfschema/pfs.cc:2201
 
#19 0x000014d58c1dd609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#20 0x000014d58bdcb293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.5.14 (opt), 10.6.6 (opt), 10.7.2 (opt), 10.8.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt), 10.5.14 (dbg), 10.6.6 (dbg), 10.7.2 (dbg), 10.8.0 (dbg)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)

 Comments   
Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-15 ]

I confirmed the bug is reproducible on a non-debug build.

Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-15 ]

I'm not yet sure but the current estimation is that the bug is possibly related to memory allocation. The bug is not reproduced with a debug build possibly because the memory allocator is replaced in the debug mode.

So, I tried the above test case with an ASAN build. Then, the server died by global-buffer-overflow at the CREATE TEMPORARY TABLE statement, while I'm not yet sure whether this is the cause of the present bug.

mysqld.1.err

 
==2175693==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f05731ee221 at pc 0x55f99ec79adc bp 0x7f05735e7220 sp 0x7f05735e7210
 
READ of size 1 at 0x7f05731ee221 thread T14
 
    #0 0x55f99ec79adb in my_charlen_utf8mb3 /home/nayuta_mariadb/repo/mariadb-server/10.5/strings/ctype-utf8.c:5205
 
    #1 0x55f99ec79adb in my_well_formed_char_length_utf8mb3 /home/nayuta_mariadb/repo/mariadb-server/10.5/strings/ctype-mb.ic:187
 
    #2 0x55f99ec2668d in my_ci_well_formed_char_length /home/nayuta_mariadb/repo/mariadb-server/10.5/include/m_ctype.h:1021
 
    #3 0x55f99ec2668d in my_copy_fix_mb /home/nayuta_mariadb/repo/mariadb-server/10.5/strings/ctype-mb.c:406
 
    #4 0x55f99d4e4c2a in charset_info_st::copy_fix(char*, unsigned long, char const*, unsigned long, unsigned long, MY_STRCOPY_STATUS*) const /home/nayuta_mariadb/repo/mariadb-server/10.5/include/m_ctype.h:761
 
    #5 0x55f99d4e4c2a in String_copier::well_formed_copy(charset_info_st const*, char*, unsigned long, charset_info_st const*, char const*, unsigned long, unsigned long) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_string.cc:1115
 
    #6 0x55f99d989233 in Field_longstr::well_formed_copy_with_check(char*, unsigned long, charset_info_st const*, char const*, unsigned long, unsigned long, bool, unsigned int*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/field.h:2178
 
    #7 0x55f99d989233 in Field_string::store(char const*, unsigned long, charset_info_st const*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/field.cc:7291
 
    #8 0x7f0572fe00e6 in spider_sys_get_table_sts(THD*, char const*, unsigned int, ha_statistics*, bool) /home/nayuta_mariadb/repo/mariadb-server/10.5/storage/spider/spd_sys_table.cc:3442
 
    #9 0x7f05730a8902 in spider_get_sts(st_spider_share*, int, long, ha_spider*, double, int, int, int, unsigned int) /home/nayuta_mariadb/repo/mariadb-server/10.5/storage/spider/spd_table.cc:8006
 
    #10 0x7f05730cc798 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /home/nayuta_mariadb/repo/mariadb-server/10.5/storage/spider/spd_table.cc:5505
 
    #11 0x7f0573144b15 in ha_spider::open(char const*, int, unsigned int) /home/nayuta_mariadb/repo/mariadb-server/10.5/storage/spider/ha_spider.cc:437
 
    #12 0x55f99d9c05c3 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/handler.cc:2997
 
    #13 0x55f99d5cafb9 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/table.cc:4242
 
    #14 0x55f99d85651c in THD::open_temporary_table(TMP_TABLE_SHARE*, char const*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/temporary_tables.cc:1117
 
    #15 0x55f99d85b2ba in THD::create_and_open_tmp_table(st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, bool) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/temporary_tables.cc:74
 
    #16 0x55f99d519191 in create_table_impl /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_table.cc:5424
 
    #17 0x55f99d51a2c9 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_table.cc:5496
 
    #18 0x55f99d51ab93 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_table.cc:5600
 
    #19 0x55f99d52af0e in Sql_cmd_create_table_like::execute(THD*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_table.cc:12238
 
    #20 0x55f99d2d7c0b in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_parse.cc:6056
 
    #21 0x55f99d2e4f01 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_parse.cc:8100
 
    #22 0x55f99d2ebf64 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_parse.cc:1891
 
    #23 0x55f99d2f0c04 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_parse.cc:1370
 
    #24 0x55f99d6659c6 in do_handle_one_connection(CONNECT*, bool) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_connect.cc:1418
 
    #25 0x55f99d666074 in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/sql_connect.cc:1312
 
    #26 0x55f99e1edc18 in pfs_spawn_thread /home/nayuta_mariadb/repo/mariadb-server/10.5/storage/perfschema/pfs.cc:2201
 
    #27 0x7f058595e44f in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x944f)
 
    #28 0x7f05854f5d52 in clone (/lib/x86_64-linux-gnu/libc.so.6+0x117d52)
 
 
 
0x7f05731ee221 is located 63 bytes to the left of global variable '*.LC27' defined in '/home/nayuta_mariadb/repo/mariadb-server/10.5/storage/spider/spd_sys_table.cc' (0x7f05731ee260) of size 26
 
  '*.LC27' is ascii string 'This xid is already exist'
 
0x7f05731ee221 is located 0 bytes to the right of global variable '*.LC22' defined in '/home/nayuta_mariadb/repo/mariadb-server/10.5/storage/spider/spd_sys_table.cc' (0x7f05731ee220) of size 1
 
  '*.LC22' is ascii string ''
 
SUMMARY: AddressSanitizer: global-buffer-overflow /home/nayuta_mariadb/repo/mariadb-server/10.5/strings/ctype-utf8.c:5205 in my_charlen_utf8mb3
 
Shadow bytes around the buggy address:
 
  0x0fe12e635bf0: f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 00 00 00 f9
 
  0x0fe12e635c00: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 04
 
  0x0fe12e635c10: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 00 00 00 00
 
  0x0fe12e635c20: 03 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 03 f9 f9 f9
 
  0x0fe12e635c30: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
 
=>0x0fe12e635c40: 00 00 00 00[01]f9 f9 f9 f9 f9 f9 f9 00 00 00 02
 
  0x0fe12e635c50: f9 f9 f9 f9 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9
 
  0x0fe12e635c60: 00 00 06 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
 
  0x0fe12e635c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0fe12e635c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0fe12e635c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07
 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
Thread T14 created by T0 here:
 
    #0 0x7f0585f376d5 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216
 
    #1 0x55f99e1edeb6 in my_thread_create /home/nayuta_mariadb/repo/mariadb-server/10.5/storage/perfschema/my_thread.h:48
 
    #2 0x55f99e1edeb6 in pfs_spawn_thread_v1 /home/nayuta_mariadb/repo/mariadb-server/10.5/storage/perfschema/pfs.cc:2252
 
    #3 0x55f99d03d19e in inline_mysql_thread_create /home/nayuta_mariadb/repo/mariadb-server/10.5/include/mysql/psi/mysql_thread.h:1323
 
    #4 0x55f99d03d19e in create_thread_to_handle_connection(CONNECT*) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/mysqld.cc:6010
 
    #5 0x55f99d048b75 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/mysqld.cc:6134
 
    #6 0x55f99d0495d4 in handle_connections_sockets() /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/mysqld.cc:6261
 
    #7 0x55f99d04b2c9 in mysqld_main(int, char**) /home/nayuta_mariadb/repo/mariadb-server/10.5/sql/mysqld.cc:5656
 
    #8 0x7f0585406564 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x28564)
 
 
 
==2175693==ABORTING

Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-16 ]

The result of git-bisect:

42cdc37ff92b7c84abee4d9ec49c47ccbd34ba24 is the first bad commit
 
commit 42cdc37ff92b7c84abee4d9ec49c47ccbd34ba24
 
Author: Kentoku SHIBA <kentokushiba@gmail.com>
 
Date:   Mon Apr 19 22:54:45 2021 +0900
 
 
 
    MDEV-22265 Connect string character limit too small for full 64 character InnoDB table-name limit when using ad-hoc Spider server definitions.
 
    
    Fix length for getting default table name.
 
 
 
 .../spider/bugfix/include/mdev_22265_deinit.inc    |  7 ++++++
 
 .../spider/bugfix/include/mdev_22265_init.inc      |  7 ++++++
 
 .../mysql-test/spider/bugfix/r/mdev_22265.result   | 23 ++++++++++++++++++
 
 .../mysql-test/spider/bugfix/t/mdev_22265.cnf      |  2 ++
 
 .../mysql-test/spider/bugfix/t/mdev_22265.test     | 28 ++++++++++++++++++++++
 
 storage/spider/spd_table.cc                        |  3 ++-
 
 6 files changed, 69 insertions(+), 1 deletion(-)
 
 create mode 100644 storage/spider/mysql-test/spider/bugfix/include/mdev_22265_deinit.inc
 
 create mode 100644 storage/spider/mysql-test/spider/bugfix/include/mdev_22265_init.inc
 
 create mode 100644 storage/spider/mysql-test/spider/bugfix/r/mdev_22265.result
 
 create mode 100644 storage/spider/mysql-test/spider/bugfix/t/mdev_22265.cnf
 
 create mode 100644 storage/spider/mysql-test/spider/bugfix/t/mdev_22265.test

Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-16 ]

Reverting the above commit fix the present bug. So, what we need to do is to find a proper fix for MDEV-22265.

Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-16 ]

The above statement appeared not to be true. Reverting the above commit just suppresses the present bug. When we revert the commit, CREATE TEMPORARY TABLE statement fails due to ERROR 12502 (HY000): The connect info 'tm1' for table is too long and this seems to suppress the bug.

Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-16 ]

A slightly modified version of the test case in the issue description fails even before 42cdc37.

USE test;
 
INSTALL PLUGIN spider SONAME 'ha_spider.so';
 
CREATE SERVER d FOREIGN DATA WRAPPER mysql
 
    OPTIONS (HOST'',DATABASE'',USER'',PORT 10000,PASSWORD'');
 
SET SESSION spider_same_server_link=ON;
 
CREATE TABLE t 
(
 
    id INT AUTO_INCREMENT,
 
    i INT,KEY(id)
 
) ENGINE=SPIDER;
 
EXPLAIN SELECT * FROM t AS nt2 WHERE 1 IN (SELECT it.a FROM t AS it JOIN t AS it3 ON it.a=it3.a);
 
ALTER TABLE t CHANGE c c FLOAT UNSIGNED ZEROFILL;
 
CREATE TEMPORARY TABLE tm1 (c INT) ENGINE=SPIDER COMMENT='tbl "tm1"' UNION=(t);
 
INSERT INTO t VALUES (0,0),(0,0),(0,0),(0,0),(0,0);

Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-16 ]

I conclude that the bug is introduced by MDEV-19002 (e954d9d).

Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-20 ]

Roel Hi! I have two things to ask you.

  • Could you confirm that the patch for MDEV-27240 also fixes the present bug?
  • Could you please try to reproduce the present bug with partitioned tables?
Comment by Roel Van de Paar [ 2021-12-21 ]

nayuta-yanagisawa The bug is confirmed fixed on the patched tree. Is testing against partitioned tables still required in that case?

Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-21 ]

Roel Thank you for your confirmation. It is OK for this case. However, it is possible that a similar bug occurs on partitioned tables, considering the way the bug occurs.

Comment by Roel Van de Paar [ 2021-12-21 ]

Thank you. A quick test mockup does not show the same bug with partitioning

USE test;
 
CREATE TABLE t (id INT AUTO_INCREMENT,i INT,KEY(id)) ENGINE=InnoDB PARTITION BY KEY(id) PARTITIONS 5;
 
EXPLAIN SELECT * FROM t AS nt2 WHERE 1 IN (SELECT it.a FROM t AS it JOIN t AS it3 ON it.a=it3.a);
 
ALTER TABLE t CHANGE c c FLOAT UNSIGNED ZEROFILL;
 
CREATE TEMPORARY TABLE tm1 (c INT) ENGINE=SPIDER UNION=(t);
 
INSERT INTO t VALUES (0,0),(0,0),(0,0),(0,0),(0,0);

10.8.0 ccdf5711a8fff0cd610a91fdcf37c8ff1182878c (Optimized)

 
10.7.2-dbg>INSERT INTO t VALUES (0,0),(0,0),(0,0),(0,0),(0,0);
 
Query OK, 5 rows affected (0.003 sec)
 
Records: 5  Duplicates: 0  Warnings: 0

Comment by Roel Van de Paar [ 2021-12-21 ]

Also tested, as a variation;

USE test;
 
INSTALL PLUGIN spider SONAME 'ha_spider.so';
 
CREATE SERVER d FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',DATABASE'',USER'',PORT 10000,PASSWORD'');
 
SET SESSION spider_same_server_link=ON;
 
CREATE TABLE t (id INT AUTO_INCREMENT,i INT,KEY(id)) ENGINE=InnoDB PARTITION BY KEY(id) PARTITIONS 5;
 
EXPLAIN SELECT * FROM t AS nt2 WHERE 1 IN (SELECT it.a FROM t AS it JOIN t AS it3 ON it.a=it3.a);
 
ALTER TABLE t CHANGE c c FLOAT UNSIGNED ZEROFILL;
 
CREATE TEMPORARY TABLE tm1 (c INT) ENGINE=SPIDER COMMENT='tbl "tm1"' UNION=(t);
 
INSERT INTO t VALUES (0,0),(0,0),(0,0),(0,0),(0,0);

Same outcome (Query OK).

Comment by Roel Van de Paar [ 2021-12-21 ]

Interestingly, if you take the original testcase and change it to a partition based Spider table, the sever no longer crashes

CREATE TABLE t (id INT AUTO_INCREMENT,i INT,KEY(id)) ENGINE=SPIDER PARTITION BY KEY(id) PARTITIONS 5;

Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-21 ]

Roel Thank you very much. I've also tried to reproduce but had no success. I guess this is because the Spider handles a non-partitioned table and a partitioned table quite differently.

Comment by Nayuta Yanagisawa (Inactive) [ 2021-12-21 ]

Fixed by MDEV-27240.

Generated at Thu Feb 08 09:50:52 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.