[MDEV-27315] SIGSEGV in next_breadth_first_tab when setting tmp_disk_table_size to zero Created: 2021-12-20  Updated: 2023-09-27  Resolved: 2023-09-27

Status: Closed
Project: MariaDB Server
Component/s: OTHER
Affects Version/s: 10.3, 10.4, 10.5, 10.6, 10.7, 10.8
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Ramesh Sivaraman Assignee: Oleksandr Byelkin
Resolution: Cannot Reproduce Votes: 0
Labels: debug, not-10.2


 Description   

XA START 'a';
XA END 'a';
SET SESSION tmp_disk_table_size=0;
SELECT * FROM information_schema.tables t JOIN information_schema.COLUMNS c ON t.table_schema=c.table_schema WHERE c.table_schema=(SELECT COUNT(*) FROM information_schema.COLUMNS GROUP BY column_type) GROUP BY t.table_name;

Leads to:

10.8.0 c9fcea14e9e1f34a97451706eac51276c85bbea7 (Debug)

Core was generated by `/test/MD181221-mariadb-10.8.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000056506ea7b299 in next_breadth_first_tab (
    first_top_tab=0x152e2c06ff40, n_top_tabs_count=2, 
    tab=tab@entry=0x152e2c0706a0) at /test/10.8_dbg/sql/sql_select.cc:10355
10355	  n_top_tabs_count += tab->join->aggr_tables;
[Current thread is 1 (Thread 0x152e701ad700 (LWP 1762831))]
(gdb) bt
#0  0x000056506ea7b299 in next_breadth_first_tab (first_top_tab=0x152e2c06ff40, n_top_tabs_count=2, tab=tab@entry=0x152e2c0706a0) at /test/10.8_dbg/sql/sql_select.cc:10355
#1  0x000056506eac1d37 in JOIN::cleanup (this=this@entry=0x152e2c028b20, full=full@entry=true) at /test/10.8_dbg/sql/sql_select.h:1724
#2  0x000056506eac221f in JOIN::destroy (this=0x152e2c028b20) at /test/10.8_dbg/sql/sql_select.cc:4764
#3  0x000056506eb3e002 in st_select_lex::cleanup (this=this@entry=0x152e2c013fe8) at /test/10.8_dbg/sql/sql_union.cc:2788
#4  0x000056506eacce24 in mysql_select (thd=thd@entry=0x152e2c000db8, tables=0x152e2c0145e8, fields=@0x152e2c014288: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152e2c014578, last = 0x152e2c04b070, elements = 45}, <No data fields>}, conds=0x152e2c017aa8, og_num=1, order=0x0, group=0x152e2c017ce8, having=0x0, proc_param=0x0, select_options=2685668096, result=0x152e2c028af8, unit=0x152e2c0051c0, select_lex=0x152e2c013fe8) at /test/10.8_dbg/sql/sql_select.cc:5012
#5  0x000056506eaccfa2 in handle_select (thd=thd@entry=0x152e2c000db8, lex=lex@entry=0x152e2c0050e8, result=result@entry=0x152e2c028af8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.8_dbg/sql/sql_select.cc:545
#6  0x000056506ea2ca82 in execute_sqlcom_select (thd=thd@entry=0x152e2c000db8, all_tables=0x152e2c0145e8) at /test/10.8_dbg/sql/sql_parse.cc:6253
#7  0x000056506ea39942 in mysql_execute_command (thd=thd@entry=0x152e2c000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.8_dbg/sql/sql_parse.cc:3944
#8  0x000056506ea25c74 in mysql_parse (thd=thd@entry=0x152e2c000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152e701ac400) at /test/10.8_dbg/sql/sql_parse.cc:8028
#9  0x000056506ea348f9 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152e2c000db8, packet=packet@entry=0x152e2c00b879 "SELECT * FROM information_schema.tables t JOIN information_schema.COLUMNs c ON t.table_schema=c.table_schema WHERE c.table_schema=(SELECT COUNT(*) FROM information_schema.COLUMNs GROUP BY column_type)"..., packet_length=packet_length@entry=222, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_class.h:1360
#10 0x000056506ea37d3b in do_command (thd=0x152e2c000db8, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_parse.cc:1402
#11 0x000056506ebb1272 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x565071517ee8, put_in_cache=put_in_cache@entry=true) at /test/10.8_dbg/sql/sql_connect.cc:1418
#12 0x000056506ebb1877 in handle_one_connection (arg=arg@entry=0x565071517ee8) at /test/10.8_dbg/sql/sql_connect.cc:1312
#13 0x000056506f033ea8 in pfs_spawn_thread (arg=0x56507142b808) at /test/10.8_dbg/storage/perfschema/pfs.cc:2201
#14 0x0000152e85138609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#15 0x0000152e84d27293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.3.33 (dbg), 10.4.23 (dbg), 10.5.14 (dbg), 10.6.6 (dbg), 10.7.1 (dbg), 10.7.2 (dbg), 10.8.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (opt), 10.4.23 (opt), 10.5.14 (opt), 10.6.6 (opt), 10.7.2 (opt), 10.8.0 (opt)



 Comments   
Comment by Oleksandr Byelkin [ 2023-09-27 ]

It is not reproducible any more

Generated at Thu Feb 08 09:51:59 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.