[MDEV-28437] Assertion `!eliminated' failed in Item_subselect::exec Created: 2022-04-28  Updated: 2023-01-20  Resolved: 2022-05-05

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.2
Fix Version/s: 10.2.44, 10.3.35, 10.4.25, 10.5.16, 10.6.8, 10.7.4, 10.8.3

Type: Bug Priority: Blocker
Reporter: Elena Stepanova Assignee: Sergei Petrunia
Resolution: Fixed Votes: 0
Labels: regression

Issue Links:
Problem/Incident
is caused by MDEV-26047 MariaDB server crash at Item_subselec... Closed
Relates
relates to MDEV-28621 eliminated subquery: Server crash in ... Confirmed

 Description    

--source include/have_innodb.inc
 
 
 
CREATE TABLE t1 (a INT) ENGINE=InnoDB;
 
INSERT INTO t1 VALUES (1),(2);
 
CREATE TABLE t2 (b INT PRIMARY KEY) ENGINE=InnoDB;
 
INSERT INTO t1 VALUES (3),(4);
 
 
 
SELECT 1 IN (SELECT a FROM t1 LEFT JOIN t2 ON (a = b AND EXISTS (SELECT * FROM t1)));
 
 
 
# Cleanup
 
DROP TABLE t1, t2;

10.2 c711abd1

 
mysqld: /data/src/10.2/sql/item_subselect.cc:755: virtual bool Item_subselect::exec(): Assertion `!eliminated' failed.
 
220428 17:03:16 [ERROR] mysqld got signal 6 ;
 
 
 
#7  0x00007f08a1177662 in __GI___assert_fail (assertion=0x55aa3df68974 "!eliminated", file=0x55aa3df686a0 "/data/src/10.2/sql/item_subselect.cc", line=755, function=0x55aa3df68950 "virtual bool Item_subselect::exec()") at assert.c:101
 
#8  0x000055aa3d76e169 in Item_subselect::exec (this=0x7f0844015898) at /data/src/10.2/sql/item_subselect.cc:755
 
#9  0x000055aa3d7713a1 in Item_exists_subselect::val_int (this=0x7f0844015898) at /data/src/10.2/sql/item_subselect.cc:1722
 
#10 0x000055aa3d6ec704 in Item_in_optimizer::val_int (this=0x7f0844017b00) at /data/src/10.2/sql/item_cmpfunc.cc:1598
 
#11 0x000055aa3d6bf604 in Item::val_bool (this=0x7f0844017b00) at /data/src/10.2/sql/item.cc:112
 
#12 0x000055aa3d4b6cac in Item::eval_const_cond (this=0x7f0844017b00) at /data/src/10.2/sql/item.h:1190
 
#13 0x000055aa3d6f699f in Item_cond::eval_not_null_tables (this=0x7f0844015a70, opt_arg=0x0) at /data/src/10.2/sql/item_cmpfunc.cc:4708
 
#14 0x000055aa3d3cd0be in Item_func_or_sum::walk (this=0x7f0844015a70, processor=&virtual table offset 952, walk_subquery=false, arg=0x0) at /data/src/10.2/sql/item.h:4422
 
#15 0x000055aa3d6f6c92 in Item_cond::walk (this=0x7f0844015a70, processor=&virtual table offset 952, walk_subquery=false, arg=0x0) at /data/src/10.2/sql/item_cmpfunc.cc:4780
 
#16 0x000055aa3d41fe1d in st_select_lex::update_used_tables (this=0x7f08440128b8) at /data/src/10.2/sql/sql_lex.cc:4235
 
#17 0x000055aa3d41f3af in st_select_lex::optimize_unflattened_subqueries (this=0x7f08440050d8, const_only=true) at /data/src/10.2/sql/sql_lex.cc:3870
 
#18 0x000055aa3d5de843 in JOIN::optimize_constant_subqueries (this=0x7f0844016690) at /data/src/10.2/sql/opt_subselect.cc:5360
 
#19 0x000055aa3d46ff24 in JOIN::optimize_inner (this=0x7f0844016690) at /data/src/10.2/sql/sql_select.cc:1349
 
#20 0x000055aa3d46f412 in JOIN::optimize (this=0x7f0844016690) at /data/src/10.2/sql/sql_select.cc:1127
 
#21 0x000055aa3d4788eb in mysql_select (thd=0x7f0844000d90, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f0844016670, unit=0x7f0844004988, select_lex=0x7f08440050d8) at /data/src/10.2/sql/sql_select.cc:3835
 
#22 0x000055aa3d46cb7f in handle_select (thd=0x7f0844000d90, lex=0x7f08440048c8, result=0x7f0844016670, setup_tables_done_option=0) at /data/src/10.2/sql/sql_select.cc:361
 
#23 0x000055aa3d4380aa in execute_sqlcom_select (thd=0x7f0844000d90, all_tables=0x7f0844013550) at /data/src/10.2/sql/sql_parse.cc:6271
 
#24 0x000055aa3d42ec41 in mysql_execute_command (thd=0x7f0844000d90) at /data/src/10.2/sql/sql_parse.cc:3582
 
#25 0x000055aa3d43bdc0 in mysql_parse (thd=0x7f0844000d90, rawbuf=0x7f0844012708 "SELECT 1 IN (SELECT a FROM t1 LEFT JOIN t2 ON (a = b AND EXISTS (SELECT * FROM t1)))", length=84, parser_state=0x7f08975075e0, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7793
 
#26 0x000055aa3d42a163 in dispatch_command (command=COM_QUERY, thd=0x7f0844000d90, packet=0x7f0844008b61 "SELECT 1 IN (SELECT a FROM t1 LEFT JOIN t2 ON (a = b AND EXISTS (SELECT * FROM t1)))", packet_length=84, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1827
 
#27 0x000055aa3d428c7c in do_command (thd=0x7f0844000d90) at /data/src/10.2/sql/sql_parse.cc:1381
 
#28 0x000055aa3d580b26 in do_handle_one_connection (connect=0x55aa40292e10) at /data/src/10.2/sql/sql_connect.cc:1336
 
#29 0x000055aa3d58089a in handle_one_connection (arg=0x55aa40292e10) at /data/src/10.2/sql/sql_connect.cc:1241
 
#30 0x000055aa3dd88d1f in pfs_spawn_thread (arg=0x55aa4027d280) at /data/src/10.2/storage/perfschema/pfs.cc:1869
 
#31 0x00007f08a163bea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#32 0x00007f08a1240def in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

The failure started happening on 10.2 after this commit:

commit 5100b20b15edd93200f34a79d25f1b14e46a677e
 
Author: Sergei Petrunia
 
Date:   Fri Apr 22 20:26:14 2022 +0300
 
 
 
    MDEV-26047: MariaDB server crash at Item_subselect::init_expr_cache_tracker



 Comments   
Comment by Sergei Petrunia [ 2022-05-03 ]

The query:

SELECT 1 IN (
 
  SELECT a 
  FROM 
    t1 LEFT JOIN t2 ON (a = b AND EXISTS (SELECT * FROM t1))
 
)

Indeed, table elimination eliminates t2, and calls walk(Item::mark_as_eliminated) for the ON expression which is

$1 = "<in_optimizer>(1,exists(subquery#3)) and multiple equal(t1.a, t2.b)"

but then st_select_lex::update_used_tables is called for the subquery#2.

The code in st_select_lex::update_used_tables walks the ON expressions regardless of whether they were eliminated or not and makes these calls:

      tl->on_expr->update_used_tables();
 
      tl->on_expr->walk(&Item::eval_not_null_tables, 0, NULL);

This call reaches Item_cond::eval_not_null_tables which sees a constant part of WHERE and tries to evaluate it, where we hit the assert.

Comment by Sergei Petrunia [ 2022-05-04 ]

bb-10.2-mdev28437

Comment by Sergei Golubchik [ 2022-05-05 ]

4ba5b444b4b is ok to push

Generated at Thu Feb 08 10:00:44 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.