[MDEV-27388] SIGSEGV in spider_set_direct_limit_offset on SELECT Created: 2021-12-30  Updated: 2022-01-18  Resolved: 2022-01-07

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - Spider
Affects Version/s: 10.5, 10.6, 10.7, 10.8
Fix Version/s: N/A

Type: Bug Priority: Critical
Reporter: Roel Van de Paar Assignee: Nayuta Yanagisawa (Inactive)
Resolution: Duplicate Votes: 0
Labels: not-10.2, not-10.3, not-10.4, regression, spider

Issue Links:
Duplicate
duplicates MDEV-27240 SIGSEGV in ha_spider::store_lock on L... Closed
Relates
relates to MDEV-24769 Spider crash when selecting all rows ... Closed

 Description   

INSTALL PLUGIN spider SONAME 'ha_spider.so';                                                                            
CREATE TABLE t0 (a INT,KEY(a)) ENGINE=SPIDER;                                                                           
CREATE TABLE t1 (a INT,KEY(a)) ENGINE=SPIDER;                                                                           
INSERT INTO t1 SELECT * FROM t1 ;                                                                                       
ALTER TABLE t1 CHANGE COLUMN n o CHAR(10);                                                                              
INSERT INTO t0 VALUES (0);                                                                                              
SELECT MIN(a) FROM t1;                 

Leads to:

10.8.0 ccdf5711a8fff0cd610a91fdcf37c8ff1182878c (Optimized)

Core was generated by `/test/MD121221-mariadb-10.8.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00001518ac4db28b in spider_set_direct_limit_offset (
    spider=spider@entry=0x1517f007d870)
    at /test/10.8_opt/storage/spider/spd_table.cc:9535
9535	    if (spider->partition_handler_share->owner->
[Current thread is 1 (Thread 0x1518ac5c1700 (LWP 2638237))]
(gdb) bt
#0  0x00001518ac4db28b in spider_set_direct_limit_offset (spider=spider@entry=0x1517f007d870) at /test/10.8_opt/storage/spider/spd_table.cc:9535
#1  0x00001518ac4f8ecf in ha_spider::check_direct_order_limit (this=0x1517f007d870) at /test/10.8_opt/storage/spider/ha_spider.cc:13105
#2  ha_spider::check_direct_order_limit (this=0x1517f007d870) at /test/10.8_opt/storage/spider/ha_spider.cc:13089
#3  0x00001518ac4fe74b in ha_spider::index_read_map_internal (find_flag=HA_READ_AFTER_KEY, keypart_map=1, key=0x1518ac5be930 "\001", buf=0x1517f006ff38 "\377", this=0x1517f007d870) at /test/10.8_opt/storage/spider/ha_spider.cc:1918
#4  ha_spider::index_read_map_internal (this=0x1517f007d870, buf=0x1517f006ff38 "\377", key=0x1518ac5be930 "\001", keypart_map=1, find_flag=HA_READ_AFTER_KEY) at /test/10.8_opt/storage/spider/ha_spider.cc:1882
#5  0x0000557bad24ead8 in handler::ha_index_read_map (this=0x1517f007d870, buf=0x1517f006ff38 "\377", key=0x1518ac5be930 "\001", keypart_map=1, find_flag=find_flag@entry=HA_READ_AFTER_KEY) at /test/10.8_opt/sql/handler.cc:3450
#6  0x0000557bacf303d4 in get_index_min_value (item_field=0x1517f0010db8, prefix_len=<optimized out>, range_fl=<optimized out>, ref=0x1518ac5be8c0, table=0x1517f006fb58) at /test/10.8_opt/sql/opt_sum.cc:154
#7  opt_sum_query (thd=0x1517f0000c58, tables=@0x1517f0010b50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1517f0012618, last = 0x1517f0012618, elements = 1}, <No data fields>}, all_fields=@0x1517f00123c8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1517f0011010, last = 0x1517f0011010, elements = 1}, <No data fields>}, conds=0x0) at /test/10.8_opt/sql/opt_sum.cc:411
#8  0x0000557bad0796bd in JOIN::optimize_inner (this=0x1517f0012060) at /test/10.8_opt/sql/sql_select.cc:2364
#9  0x0000557bad07b803 in JOIN::optimize (this=this@entry=0x1517f0012060) at /test/10.8_opt/sql/sql_select.cc:1809
#10 0x0000557bad07b8ee in mysql_select (thd=0x1517f0000c58, tables=0x1517f0011070, fields=@0x1517f0010bd8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1517f0011010, last = 0x1517f0011010, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x1517f0012038, unit=0x1517f0004ea0, select_lex=0x1517f0010938) at /test/10.8_opt/sql/sql_select.cc:4979
#11 0x0000557bad07c0f7 in handle_select (thd=thd@entry=0x1517f0000c58, lex=lex@entry=0x1517f0004dc8, result=result@entry=0x1517f0012038, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.8_opt/sql/sql_select.cc:545
#12 0x0000557bacffcc01 in execute_sqlcom_select (thd=0x1517f0000c58, all_tables=0x1517f0011070) at /test/10.8_opt/sql/sql_parse.cc:6253
#13 0x0000557bad00aef2 in mysql_execute_command (thd=0x1517f0000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.8_opt/sql/sql_parse.cc:3944
#14 0x0000557bacff7986 in mysql_parse (thd=0x1517f0000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.8_opt/sql/sql_parse.cc:8028
#15 0x0000557bad003b35 in dispatch_command (command=COM_QUERY, thd=0x1517f0000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.8_opt/sql/sql_class.h:1360
#16 0x0000557bad005d27 in do_command (thd=0x1517f0000c58, blocking=blocking@entry=true) at /test/10.8_opt/sql/sql_parse.cc:1402
#17 0x0000557bad1242e7 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/10.8_opt/sql/sql_connect.cc:1418
#18 0x0000557bad12462d in handle_one_connection (arg=arg@entry=0x557bafb61be8) at /test/10.8_opt/sql/sql_connect.cc:1312
#19 0x0000557bad4925d8 in pfs_spawn_thread (arg=0x557bafb19218) at /test/10.8_opt/storage/perfschema/pfs.cc:2201
#20 0x00001518cb751609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#21 0x00001518cb33f293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.5.14 (opt), 10.6.6 (opt), 10.7.2 (opt), 10.8.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt), 10.5.14 (dbg), 10.6.6 (dbg), 10.7.2 (dbg), 10.8.0 (dbg)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)



 Comments   
Comment by Roel Van de Paar [ 2022-01-01 ]

Please also try any fixes with

INSTALL PLUGIN spider SONAME 'ha_spider.so';
SET SESSION spider_same_server_link=ON;
CREATE TABLE t (col1 CHAR(1),col2 VARCHAR(1),UNIQUE KEY KEY1 USING HASH (col1,col2)) ENGINE=SPIDER;
CREATE TEMPORARY TABLE t (c BLOB);
CREATE TABLE t2 (c INT,c2 INT,c3 BLOB,PRIMARY KEY(c));
DROP TABLE t;
SELECT COUNT(TABLE1.colvck) FROM t AS TABLE1 JOIN (SELECT * FROM t) AS TABLE2 ON (1=1) WHERE TABLE1.pk=1;
ALTER TABLE t CHANGE c c NUMERIC ZEROFILL;
CREATE TABLE t3 (a INT,b INT,KEY(a));
INSERT INTO t VALUES (1,0);

Leads to:

10.8.0 ccdf5711a8fff0cd610a91fdcf37c8ff1182878c (Debug)

Core was generated by `/test/MD121221-mariadb-10.8.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000014fc90100ef2 in spider_set_direct_limit_offset (
    spider=spider@entry=0x14fbd40d6760)
    at /test/10.8_dbg/storage/spider/spd_table.cc:9535
9535	    if (spider->partition_handler_share->owner->
[Current thread is 1 (Thread 0x14fc9ca87700 (LWP 692285))]
(gdb) bt
#0  0x000014fc90100ef2 in spider_set_direct_limit_offset (spider=spider@entry=0x14fbd40d6760) at /test/10.8_dbg/storage/spider/spd_table.cc:9535
#1  0x000014fc90130e0b in ha_spider::check_direct_order_limit (this=this@entry=0x14fbd40d6760) at /test/10.8_dbg/storage/spider/ha_spider.cc:13105
#2  0x000014fc9013916e in ha_spider::index_read_map_internal (this=this@entry=0x14fbd40d6760, buf=buf@entry=0x14fbd40d62d8 "\370\061\001\060\223#\001", key=key@entry=0x14fc9ca859cf "", keypart_map=keypart_map@entry=18446744073709551615, find_flag=find_flag@entry=HA_READ_KEY_EXACT) at /test/10.8_dbg/storage/spider/ha_spider.cc:1918
#3  0x000014fc9013a429 in ha_spider::index_read_map (this=0x14fbd40d6760, buf=0x14fbd40d62d8 "\370\061\001\060\223#\001", key=0x14fc9ca859cf "", keypart_map=18446744073709551615, find_flag=HA_READ_KEY_EXACT) at /test/10.8_dbg/storage/spider/ha_spider.cc:2406
#4  0x000056458d69d77d in handler::ha_index_read_map (this=0x14fbd40d6760, buf=0x14fbd40d62d8 "\370\061\001\060\223#\001", key=key@entry=0x14fc9ca859cf "", keypart_map=keypart_map@entry=18446744073709551615, find_flag=find_flag@entry=HA_READ_KEY_EXACT) at /test/10.8_dbg/sql/handler.cc:3450
#5  0x000056458d6a72f0 in handler::check_duplicate_long_entry_key (this=this@entry=0x14fbd40d6760, new_rec=new_rec@entry=0x14fbd40d62d8 "\370\061\001\060\223#\001", key_no=key_no@entry=0) at /test/10.8_dbg/sql/handler.cc:7166
#6  0x000056458d6a7902 in handler::check_duplicate_long_entries (this=this@entry=0x14fbd40d6760, new_rec=new_rec@entry=0x14fbd40d62d8 "\370\061\001\060\223#\001") at /test/10.8_dbg/sql/handler.cc:7246
#7  0x000056458d6a857a in handler::ha_write_row (this=0x14fbd40d6760, buf=0x14fbd40d62d8 "\370\061\001\060\223#\001") at /test/10.8_dbg/sql/handler.cc:7508
#8  0x000056458d34706a in write_record (thd=thd@entry=0x14fbd4000db8, table=table@entry=0x14fbd40d5e88, info=info@entry=0x14fc9ca85ca0, sink=sink@entry=0x0) at /test/10.8_dbg/sql/sql_insert.cc:2156
#9  0x000056458d352cd9 in mysql_insert (thd=thd@entry=0x14fbd4000db8, table_list=0x14fbd4013eb0, fields=@0x14fbd4006078: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56458e9cdb00 <end_of_list>, last = 0x14fbd4006078, elements = 0}, <No data fields>}, values_list=@0x14fbd40060c0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14fbd4014b48, last = 0x14fbd4014b48, elements = 1}, <No data fields>}, update_fields=@0x14fbd40060a8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56458e9cdb00 <end_of_list>, last = 0x14fbd40060a8, elements = 0}, <No data fields>}, update_values=@0x14fbd4006090: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56458e9cdb00 <end_of_list>, last = 0x14fbd4006090, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.8_dbg/sql/sql_insert.cc:1127
#10 0x000056458d3993d3 in mysql_execute_command (thd=thd@entry=0x14fbd4000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.8_dbg/sql/sql_parse.cc:4563
#11 0x000056458d383e0f in mysql_parse (thd=thd@entry=0x14fbd4000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14fc9ca86400) at /test/10.8_dbg/sql/sql_parse.cc:8028
#12 0x000056458d392aab in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14fbd4000db8, packet=packet@entry=0x14fbd400b879 "INSERT INTO t VALUES (1,0)", packet_length=packet_length@entry=26, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_class.h:1360
#13 0x000056458d395eea in do_command (thd=0x14fbd4000db8, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_parse.cc:1402
#14 0x000056458d50f89c in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5645901f1d08, put_in_cache=put_in_cache@entry=true) at /test/10.8_dbg/sql/sql_connect.cc:1418
#15 0x000056458d50fea1 in handle_one_connection (arg=arg@entry=0x5645901f1d08) at /test/10.8_dbg/sql/sql_connect.cc:1312
#16 0x000056458d991442 in pfs_spawn_thread (arg=0x564590103908) at /test/10.8_dbg/storage/perfschema/pfs.cc:2201
#17 0x000014fca81fa609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#18 0x000014fca7de8293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.5.14 (dbg), 10.5.14 (opt), 10.6.6 (dbg), 10.6.6 (opt), 10.7.2 (dbg), 10.7.2 (opt), 10.8.0 (dbg), 10.8.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)

Comment by Roel Van de Paar [ 2022-01-01 ]

Note that the outcome in the secondary testcase is different from the original (debug affected, ha_index_read_map frame difference), but only for debug versions. The original testcase did not seem to affect debug versions.

Comment by Nayuta Yanagisawa (Inactive) [ 2022-01-07 ]

The bug is fixed by the patch for MDEV-27240.

Comment by Nayuta Yanagisawa (Inactive) [ 2022-01-16 ]

I confirmed that the bug is really fixed.

Generated at Thu Feb 08 09:52:33 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.