|
test is derived from the reported test case, but I added table t2, because otherwise in 10.2 "target for 'UPDATE' and as a separate source for data":
CREATE TABLE t1 ( a int );
|
insert into t1 values (1),(2),(3); #
|
|
CREATE TABLE t2 ( a int );
|
insert into t2 values (1),(2),(3); #
|
|
UPDATE t2 SET a = 5 WHERE
|
(SELECT 1 FROM t1
|
WINDOW w1 AS (ORDER BY (SELECT 1 FROM
|
(SELECT 1 FROM (SELECT a=10 FROM t1) dt1 NATURAL JOIN t1 GROUP BY a
|
WINDOW w2 AS (order by a)) dt )));
|
|
bb-10.2-release 84984b79f27399d01
|
|
220518 14:47:43 [ERROR] mysqld got signal 11 ;
|
|
Server version: 10.2.44-MariaDB-debug-log
|
|
mysys/stacktrace.c:172(my_print_stacktrace)[0x55e5589d2f90]
|
sql/signal_handler.cc:221(handle_fatal_signal)[0x55e5577096c0]
|
sql/sql_select.cc:23196(get_sort_by_table(st_order*, st_order*, List<TABLE_LIST>&, unsigned long long))[0x55e5571ee3f9]
|
sql/sql_select.cc:4356(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x55e557167661]
|
sql/sql_select.cc:1597(JOIN::optimize_inner())[0x55e55714c1c7]
|
sql/sql_select.cc:1127(JOIN::optimize())[0x55e5571474d4]
|
sql/sql_lex.cc:3867(st_select_lex::optimize_unflattened_subqueries(bool))[0x55e557077efe]
|
sql/sql_update.cc:393(mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*))[0x55e557338ddb]
|
sql/sql_parse.cc:4056(mysql_execute_command(THD*))[0x55e5570a0923]
|
sql/sql_parse.cc:7793(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55e5570bb8ae]
|
sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55e5570928fb]
|
sql/sql_parse.cc:1381(do_command(THD*))[0x55e55708f32c]
|
sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x55e55743c1f2]
|
sql/sql_connect.cc:1242(handle_one_connection)[0x55e55743bab3]
|
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55e5588d7766]
|
nptl/pthread_create.c:487(start_thread)[0x7f770672bfa3]
|
x86_64/clone.S:97(clone)[0x7f7705ad2eff]
|
|
Query (0x62b000000290): UPDATE t2 SET a = 5 WHERE
|
(SELECT 1 FROM t1
|
WINDOW w1 AS (ORDER BY (SELECT 1 FROM
|
(SELECT 1 FROM (SELECT a=10 FROM t1) dt1 NATURAL JOIN t1 GROUP BY a
|
WINDOW w2 AS (order by a)) dt )))
|
|
|
|
UBSAN from the original testcase:
|
10.9.0 161fd2d29cc2f8390fa3bf7e739c52bc8d5c39df (Debug, UBASAN)
|
/test/10.9_dbg_san/sql/sql_select.cc:25485:21: runtime error: member access within null pointer of type 'struct TABLE_LIST'
|
#0 0x556cd8bd45ed in get_sort_by_table /test/10.9_dbg_san/sql/sql_select.cc:25485
|
#1 0x556cd8bd45ed in make_join_statistics /test/10.9_dbg_san/sql/sql_select.cc:5614
|
#2 0x556cd8c11d13 in JOIN::optimize_inner() /test/10.9_dbg_san/sql/sql_select.cc:2466
|
#3 0x556cd8c13a30 in JOIN::optimize() /test/10.9_dbg_san/sql/sql_select.cc:1808
|
#4 0x556cd85fa04d in st_select_lex::optimize_unflattened_subqueries(bool) /test/10.9_dbg_san/sql/sql_lex.cc:4916
|
#5 0x556cd95837a5 in JOIN::optimize_constant_subqueries() /test/10.9_dbg_san/sql/opt_subselect.cc:5622
|
#6 0x556cd8c0958d in JOIN::optimize_inner() /test/10.9_dbg_san/sql/sql_select.cc:2128
|
#7 0x556cd8c13a30 in JOIN::optimize() /test/10.9_dbg_san/sql/sql_select.cc:1808
|
#8 0x556cd8c17260 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.9_dbg_san/sql/sql_select.cc:4993
|
#9 0x556cd900acc1 in mysql_multi_update(THD*, TABLE_LIST*, List<Item>*, List<Item>*, Item*, unsigned long long, enum_duplicates, bool, st_select_lex_unit*, st_select_lex*, multi_update**) /test/10.9_dbg_san/sql/sql_update.cc:1969
|
#10 0x556cd87f3823 in mysql_execute_command(THD*, bool) /test/10.9_dbg_san/sql/sql_parse.cc:4502
|
#11 0x556cd874d728 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.9_dbg_san/sql/sql_parse.cc:8043
|
#12 0x556cd87c344e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.9_dbg_san/sql/sql_parse.cc:1910
|
#13 0x556cd87d9fa9 in do_command(THD*, bool) /test/10.9_dbg_san/sql/sql_parse.cc:1407
|
#14 0x556cd92a6c4b in do_handle_one_connection(CONNECT*, bool) /test/10.9_dbg_san/sql/sql_connect.cc:1418
|
#15 0x556cd92a9ae5 in handle_one_connection /test/10.9_dbg_san/sql/sql_connect.cc:1312
|
#16 0x556cdb802c62 in pfs_spawn_thread /test/10.9_dbg_san/storage/perfschema/pfs.cc:2201
|
#17 0x14dddca97608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
|
#18 0x14dddbd0c132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
|
UBSAN from the reduced testcase above:
|
10.9.0 161fd2d29cc2f8390fa3bf7e739c52bc8d5c39df (Debug, UBASAN)
|
/test/10.9_dbg_san/sql/sql_select.cc:25485:21: runtime error: member access within null pointer of type 'struct TABLE_LIST'
|
#0 0x55ada08d95ed in get_sort_by_table /test/10.9_dbg_san/sql/sql_select.cc:25485
|
#1 0x55ada08d95ed in make_join_statistics /test/10.9_dbg_san/sql/sql_select.cc:5614
|
#2 0x55ada0916d13 in JOIN::optimize_inner() /test/10.9_dbg_san/sql/sql_select.cc:2466
|
#3 0x55ada0918a30 in JOIN::optimize() /test/10.9_dbg_san/sql/sql_select.cc:1808
|
#4 0x55ada02ff04d in st_select_lex::optimize_unflattened_subqueries(bool) /test/10.9_dbg_san/sql/sql_lex.cc:4916
|
#5 0x55ada0d26c37 in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /test/10.9_dbg_san/sql/sql_update.cc:533
|
#6 0x55ada04f7b17 in mysql_execute_command(THD*, bool) /test/10.9_dbg_san/sql/sql_parse.cc:4421
|
#7 0x55ada0452728 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.9_dbg_san/sql/sql_parse.cc:8043
|
#8 0x55ada04c844e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.9_dbg_san/sql/sql_parse.cc:1910
|
#9 0x55ada04defa9 in do_command(THD*, bool) /test/10.9_dbg_san/sql/sql_parse.cc:1407
|
#10 0x55ada0fabc4b in do_handle_one_connection(CONNECT*, bool) /test/10.9_dbg_san/sql/sql_connect.cc:1418
|
#11 0x55ada0faeae5 in handle_one_connection /test/10.9_dbg_san/sql/sql_connect.cc:1312
|
#12 0x55ada3507c62 in pfs_spawn_thread /test/10.9_dbg_san/storage/perfschema/pfs.cc:2201
|
#13 0x15352540e608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
|
#14 0x153524683132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
|
|
|
MDEV-28516 Is a possible duplicate of this bug
|
|
With this testcase (UPDATE) the original bug (apparently duplicated by MDEV-28516) is reproduced:
CREATE TABLE t(v INT);
|
UPDATE t SET v=1 WHERE (SELECT 1 FROM (SELECT 1 AS v) AS v2 WHERE 22 WINDOW v3 AS (PARTITION BY v ORDER BY (SELECT 1 FROM (SELECT 1 FROM (SELECT 1 FROM (SELECT 1 AS v) AS v WHERE v=0 AND v=-1) AS v4 JOIN (SELECT 1 AS v) AS v GROUP BY v WINDOW v5 AS(PARTITION BY v)) AS v6)));
|
SIGSEGV|get_sort_by_table|make_join_statistics|JOIN::optimize_inner|JOIN::optimize
|
Taking the same testcase, but removing the UPDATE (and therefore the CREATE TABLE is no longer needed either), MDEV-28506 is reproduced:
SELECT 1 FROM (SELECT 1 AS v) AS v2 WHERE 22 WINDOW v3 AS (PARTITION BY v ORDER BY (SELECT 1 FROM (SELECT 1 FROM (SELECT 1 FROM (SELECT 1 AS v) AS v WHERE v=0 AND v=-1) AS v4 JOIN (SELECT 1 AS v) AS v GROUP BY v WINDOW v5 AS(PARTITION BY v)) AS v6));
|
table_list->table|SIGABRT|find_field_in_table_ref|find_field_in_tables|Item_field::fix_fields|Item::fix_fields_if_needed
|
Thus, MDEV-28516 is likely a duplicate of this bug, and this bug is a duplicate of MDEV-28506 when the UPDATE is removed..
|
|
As MDEV-28516 does have a SELECT (and not UDPATE) statement leading to the same crash, leaving both bugs open ftm.
|
|
Additional partially optimized testcase which leads to a new stack on debug:
SIGSEGV|subquery_types_allow_materialization|convert_join_subqueries_to_semijoins|JOIN::optimize_inner|JOIN::optimize
|
On optimized it leads to the already known stack from this ticket:
SIGSEGV|get_sort_by_table|make_join_statistics|JOIN::optimize_inner|JOIN::optimize
|
CREATE TABLE t0(c INT);
|
UPDATE t0 SET c= 0 WHERE c LIKE''AND c IN(SELECT * FROM t0 AS c NATURAL JOIN t0 WHERE c % 0=-0 WINDOW c AS(PARTITION BY c AND 0 BETWEEN(SELECT * FROM t0 GROUP BY c WINDOW c AS(PARTITION BY c)) AND 0));
|
Leads to:
|
10.10.0 e1caa4bd5e8b4645944b85d4b603bf9fc9ef6ca4 (Debug)
|
Core was generated by `/test/MD290722-mariadb-10.10.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x000055ce1b165132 in subquery_types_allow_materialization (thd=thd@entry=
|
0x14afe0000db8, in_subs=in_subs@entry=0x14afe00258f0)
|
at /test/10.10_dbg/sql/opt_subselect.cc:889
|
889 all_are_fields &= (outer->real_item()->type() == Item::FIELD_ITEM &&
|
[Current thread is 1 (Thread 0x14b0515fe700 (LWP 2687120))]
|
(gdb) bt
|
#0 0x000055ce1b165132 in subquery_types_allow_materialization (thd=thd@entry=0x14afe0000db8, in_subs=in_subs@entry=0x14afe00258f0) at /test/10.10_dbg/sql/opt_subselect.cc:889
|
#1 0x000055ce1b169bad in convert_join_subqueries_to_semijoins (join=join@entry=0x14afe0026018) at /test/10.10_dbg/sql/opt_subselect.cc:1274
|
#2 0x000055ce1b03bd94 in JOIN::optimize_inner (this=this@entry=0x14afe0026018) at /test/10.10_dbg/sql/sql_select.cc:2096
|
#3 0x000055ce1b03d56e in JOIN::optimize (this=this@entry=0x14afe0026018) at /test/10.10_dbg/sql/sql_select.cc:1863
|
#4 0x000055ce1b03d661 in mysql_select (thd=thd@entry=0x14afe0000db8, tables=tables@entry=0x14afe0013e78, fields=@0x14b0515fcd20: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55ce1c48f860 <end_of_list>, last = 0x14b0515fcd20, elements = 0}, <No data fields>}, conds=conds@entry=0x14afe0025b58, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2200096997504, result=0x14afe0025f08, unit=0x14afe0004ff0, select_lex=0x14afe00057f0) at /test/10.10_dbg/sql/sql_select.cc:5048
|
#5 0x000055ce1b0b6feb in mysql_multi_update (thd=thd@entry=0x14afe0000db8, table_list=0x14afe0013e78, fields=fields@entry=0x14afe0005a90, values=values@entry=0x14afe0005ec0, conds=0x14afe0025b58, options=0, handle_duplicates=DUP_ERROR, ignore=false, unit=0x14afe0004ff0, select_lex=0x14afe00057f0, result=0x14b0515fcf00) at /test/10.10_dbg/sql/sql_update.cc:1979
|
#6 0x000055ce1afb5be1 in mysql_execute_command (thd=thd@entry=0x14afe0000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.10_dbg/sql/sql_parse.cc:4487
|
#7 0x000055ce1afa2534 in mysql_parse (thd=thd@entry=0x14afe0000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14b0515fd330) at /test/10.10_dbg/sql/sql_parse.cc:8037
|
#8 0x000055ce1afafb1c in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14afe0000db8, packet=packet@entry=0x14afe000b6e9 "UPDATE t0 SET c= 0 WHERE c LIKE''AND c IN(SELECT * FROM t0 AS c NATURAL JOIN t0 WHERE c % 0=-0 WINDOW c AS(PARTITION BY c AND 0 BETWEEN(SELECT * FROM t0 GROUP BY c WINDOW c AS(PARTITION BY c)) AND 0))", packet_length=packet_length@entry=200, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_class.h:1366
|
#9 0x000055ce1afb2226 in do_command (thd=0x14afe0000db8, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_parse.cc:1407
|
#10 0x000055ce1b113744 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55ce1dbe1bf8, put_in_cache=put_in_cache@entry=true) at /test/10.10_dbg/sql/sql_connect.cc:1418
|
#11 0x000055ce1b113c4d in handle_one_connection (arg=0x55ce1dbe1bf8) at /test/10.10_dbg/sql/sql_connect.cc:1312
|
#12 0x000014b0804a3609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#13 0x000014b08008f133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
Bug confirmed present in:
MariaDB: 10.3.36 (dbg), 10.3.36 (opt), 10.4.26 (dbg), 10.4.26 (opt), 10.5.17 (dbg), 10.5.17 (opt), 10.6.9 (dbg), 10.6.9 (opt), 10.7.5 (dbg), 10.7.5 (opt), 10.8.4 (dbg), 10.8.4 (opt), 10.9.2 (dbg), 10.9.2 (opt), 10.10.0 (dbg), 10.10.0 (opt)
Bug (or feature/syntax) confirmed not present in:
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
|
|
Partially new stack with this testcase on 10.3 to 10.7 debug. All versions crash on the testcase, but the new stack is only seen on 10.3 to 10.7 debug builds.
CREATE TABLE t (c INT) ENGINE=InnoDB;
|
UPDATE t SET c=0 WHERE c LIKE '' AND c IN (SELECT * FROM t AS c NATURAL JOIN t WHERE c=1 WINDOW c AS (PARTITION BY c BETWEEN (SELECT * FROM t GROUP BY c WINDOW c AS (PARTITION BY c)) AND 1));
|
Leads to:
|
10.7.6 dc11fd07fdaf7316d340569f97a84fa0fd2d307e (Debug)
|
Core was generated by `/test/MD200822-mariadb-10.7.6-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x0000556867685aea in subquery_types_allow_materialization (thd=thd@entry=
|
0x1456ec000db8, in_subs=in_subs@entry=0x1456ec025600)
|
at /test/10.7_dbg/sql/opt_subselect.cc:889
|
[Current thread is 1 (Thread 0x145724089700 (LWP 2033292))]
|
(gdb) bt
|
#0 0x0000556867685aea in subquery_types_allow_materialization (thd=thd@entry=0x1456ec000db8, in_subs=in_subs@entry=0x1456ec025600) at /test/10.7_dbg/sql/opt_subselect.cc:889
|
#1 0x0000556867687835 in check_and_do_in_subquery_rewrites (join=join@entry=0x1456ec0264b8) at /test/10.7_dbg/sql/opt_subselect.cc:706
|
#2 0x000055686754f367 in JOIN::prepare (this=0x1456ec0264b8, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=skip_order_by@entry=false, group_init=<optimized out>, having_init=<optimized out>, proc_param_init=<optimized out>, select_lex_arg=<optimized out>, unit_arg=<optimized out>) at /test/10.7_dbg/sql/sql_select.cc:1529
|
#3 0x00005568678c4bfd in subselect_single_select_engine::prepare (this=0x1456ec025828, thd=0x1456ec000db8) at /test/10.7_dbg/sql/sql_lex.h:1362
|
#4 0x00005568678c40cb in Item_subselect::fix_fields (this=this@entry=0x1456ec025600, thd_param=thd_param@entry=0x1456ec000db8, ref=ref@entry=0x1456ec025978) at /test/10.7_dbg/sql/item_subselect.cc:295
|
#5 0x00005568678c4510 in Item_in_subselect::fix_fields (this=0x1456ec025600, thd_arg=0x1456ec000db8, ref=0x1456ec025978) at /test/10.7_dbg/sql/item_subselect.cc:3582
|
#6 0x0000556867801836 in Item::fix_fields_if_needed (ref=0x1456ec025978, thd=0x1456ec000db8, this=0x1456ec025600) at /test/10.7_dbg/sql/item.h:1152
|
#7 Item::fix_fields_if_needed_for_scalar (ref=0x1456ec025978, thd=0x1456ec000db8, this=0x1456ec025600) at /test/10.7_dbg/sql/item.h:1148
|
#8 Item::fix_fields_if_needed_for_bool (ref=0x1456ec025978, thd=0x1456ec000db8, this=0x1456ec025600) at /test/10.7_dbg/sql/item.h:1152
|
#9 Item_cond::fix_fields (this=0x1456ec025868, thd=0x1456ec000db8, ref=<optimized out>) at /test/10.7_dbg/sql/item_cmpfunc.cc:4911
|
#10 0x00005568674599e7 in Item::fix_fields_if_needed (ref=0x1456ec026170, thd=0x1456ec000db8, this=0x1456ec025868) at /test/10.7_dbg/sql/item.h:1152
|
#11 Item::fix_fields_if_needed_for_scalar (ref=0x1456ec026170, thd=0x1456ec000db8, this=0x1456ec025868) at /test/10.7_dbg/sql/item.h:1148
|
#12 Item::fix_fields_if_needed_for_bool (ref=0x1456ec026170, thd=0x1456ec000db8, this=0x1456ec025868) at /test/10.7_dbg/sql/item.h:1152
|
#13 setup_conds (thd=thd@entry=0x1456ec000db8, tables=tables@entry=0x1456ec013e00, leaves=@0x1456ec0059d0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1456ec025d10, last = 0x1456ec025d10, elements = 1}, <No data fields>}, conds=conds@entry=0x1456ec026170) at /test/10.7_dbg/sql/sql_base.cc:8535
|
#14 0x000055686754e91d in setup_without_group (reserved=0x1456ec005b74, hidden_group_fields=0x1456ec026037, win_funcs=@0x1456ec005c08: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55686898cac0 <end_of_list>, last = 0x1456ec005c08, elements = 0}, <No data fields>}, win_specs=@0x1456ec005bf0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55686898cac0 <end_of_list>, last = 0x1456ec005bf0, elements = 0}, <No data fields>}, group=0x0, order=0x0, conds=0x1456ec026170, all_fields=@0x1456ec026088: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55686898cac0 <end_of_list>, last = 0x1456ec026088, elements = 0}, <No data fields>}, fields=@0x145724087d60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55686898cac0 <end_of_list>, last = 0x145724087d60, elements = 0}, <No data fields>}, leaves=@0x1456ec0059d0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1456ec025d10, last = 0x1456ec025d10, elements = 1}, <No data fields>}, tables=0x1456ec013e00, ref_pointer_array=<optimized out>, thd=0x1456ec000db8) at /test/10.7_dbg/sql/sql_select.cc:857
|
#15 JOIN::prepare (this=this@entry=0x1456ec025d20, tables_init=tables_init@entry=0x1456ec013e00, conds_init=conds_init@entry=0x1456ec025868, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x1456ec0057b8, unit_arg=0x1456ec004fc0) at /test/10.7_dbg/sql/sql_select.cc:1429
|
#16 0x0000556867565b0c in mysql_select (thd=thd@entry=0x1456ec000db8, tables=tables@entry=0x1456ec013e00, fields=@0x145724087d60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55686898cac0 <end_of_list>, last = 0x145724087d60, elements = 0}, <No data fields>}, conds=conds@entry=0x1456ec025868, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2200096997504, result=0x1456ec025c10, unit=0x1456ec004fc0, select_lex=0x1456ec0057b8) at /test/10.7_dbg/sql/sql_select.cc:5015
|
#17 0x00005568675dd47b in mysql_multi_update (thd=thd@entry=0x1456ec000db8, table_list=0x1456ec013e00, fields=fields@entry=0x1456ec005a58, values=values@entry=0x1456ec005e90, conds=0x1456ec025868, options=0, handle_duplicates=DUP_ERROR, ignore=false, unit=0x1456ec004fc0, select_lex=0x1456ec0057b8, result=0x145724087f40) at /test/10.7_dbg/sql/sql_update.cc:1973
|
#18 0x00005568674df299 in mysql_execute_command (thd=thd@entry=0x1456ec000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.7_dbg/sql/sql_parse.cc:4487
|
#19 0x00005568674cbc75 in mysql_parse (thd=thd@entry=0x1456ec000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x145724088330) at /test/10.7_dbg/sql/sql_parse.cc:8028
|
#20 0x00005568674d931d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1456ec000db8, packet=packet@entry=0x1456ec00b689 "UPDATE t SET c=0 WHERE c LIKE '' AND c IN (SELECT * FROM t AS c NATURAL JOIN t WHERE c=1 WINDOW c AS (PARTITION BY c BETWEEN (SELECT * FROM t GROUP BY c WINDOW c AS (PARTITION BY c)) AND 1))", packet_length=packet_length@entry=190, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_class.h:1360
|
#21 0x00005568674dba2a in do_command (thd=0x1456ec000db8, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_parse.cc:1407
|
#22 0x0000556867638260 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55686a19ccf8, put_in_cache=put_in_cache@entry=true) at /test/10.7_dbg/sql/sql_connect.cc:1418
|
#23 0x0000556867638769 in handle_one_connection (arg=0x55686a19ccf8) at /test/10.7_dbg/sql/sql_connect.cc:1312
|
#24 0x000014573c115609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#25 0x000014573bd01133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
On 10.8+ debug and optimized we see these following UniqueID's/stacks instead:
SIGSEGV|subquery_types_allow_materialization|convert_join_subqueries_to_semijoins|JOIN::optimize_inner|JOIN::optimize # dbg
|
SIGSEGV|get_sort_by_table|make_join_statistics|JOIN::optimize_inner|JOIN::optimize # opt
|
And 10.3-10.7 optimized also has the same optimized UniqueID/stack.
|
|
Turning off semijoin in the same testcase leads to yet another stack in debug builds. All versions (10.3-10.11) result in the same crash.
CREATE TABLE t (c INT);
|
SET SESSION optimizer_switch='semijoin=off';
|
UPDATE t SET c=0 WHERE c LIKE '' AND c IN (SELECT * FROM t AS c NATURAL JOIN t WHERE c=1 WINDOW c AS (PARTITION BY c BETWEEN (SELECT * FROM t GROUP BY c WINDOW c AS (PARTITION BY c)) AND 1));
|
Leads to:
|
10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Debug)
|
Core was generated by `/test/MD190822-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x0000558ca23d9d18 in subquery_types_allow_materialization (thd=thd@entry=
|
0x145eb8000db8, in_subs=in_subs@entry=0x145eb802a128)
|
at /test/10.11_dbg/sql/opt_subselect.cc:889
|
[Current thread is 1 (Thread 0x145f40532700 (LWP 4018180))]
|
(gdb) bt
|
#0 0x0000558ca23d9d18 in subquery_types_allow_materialization (thd=thd@entry=0x145eb8000db8, in_subs=in_subs@entry=0x145eb802a128) at /test/10.11_dbg/sql/opt_subselect.cc:889
|
#1 0x0000558ca23dae94 in is_materialization_applicable (thd=thd@entry=0x145eb8000db8, in_subs=in_subs@entry=0x145eb802a128, child_select=child_select@entry=0x145eb8014b90) at /test/10.11_dbg/sql/sql_lex.h:1650
|
#2 0x0000558ca23db4e8 in check_and_do_in_subquery_rewrites (join=join@entry=0x145eb802b018) at /test/10.11_dbg/sql/opt_subselect.cc:755
|
#3 0x0000558ca229b959 in JOIN::prepare (this=0x145eb802b018, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=skip_order_by@entry=false, group_init=<optimized out>, having_init=<optimized out>, proc_param_init=<optimized out>, select_lex_arg=<optimized out>, unit_arg=<optimized out>) at /test/10.11_dbg/sql/sql_select.cc:1556
|
#4 0x0000558ca2622e91 in subselect_single_select_engine::prepare (this=0x145eb802a350, thd=0x145eb8000db8) at /test/10.11_dbg/sql/sql_lex.h:1367
|
#5 0x0000558ca262235f in Item_subselect::fix_fields (this=this@entry=0x145eb802a128, thd_param=thd_param@entry=0x145eb8000db8, ref=ref@entry=0x145eb802a4a0) at /test/10.11_dbg/sql/item_subselect.cc:295
|
#6 0x0000558ca26227a4 in Item_in_subselect::fix_fields (this=0x145eb802a128, thd_arg=0x145eb8000db8, ref=0x145eb802a4a0) at /test/10.11_dbg/sql/item_subselect.cc:3588
|
#7 0x0000558ca255e78c in Item::fix_fields_if_needed (ref=0x145eb802a4a0, thd=0x145eb8000db8, this=0x145eb802a128) at /test/10.11_dbg/sql/item.h:1152
|
#8 Item::fix_fields_if_needed_for_scalar (ref=0x145eb802a4a0, thd=0x145eb8000db8, this=0x145eb802a128) at /test/10.11_dbg/sql/item.h:1148
|
#9 Item::fix_fields_if_needed_for_bool (ref=0x145eb802a4a0, thd=0x145eb8000db8, this=0x145eb802a128) at /test/10.11_dbg/sql/item.h:1152
|
#10 Item_cond::fix_fields (this=0x145eb802a390, thd=0x145eb8000db8, ref=<optimized out>) at /test/10.11_dbg/sql/item_cmpfunc.cc:4906
|
#11 0x0000558ca21a3972 in Item::fix_fields_if_needed (ref=0x145eb802acd0, thd=0x145eb8000db8, this=0x145eb802a390) at /test/10.11_dbg/sql/item.h:1152
|
#12 Item::fix_fields_if_needed_for_scalar (ref=0x145eb802acd0, thd=0x145eb8000db8, this=0x145eb802a390) at /test/10.11_dbg/sql/item.h:1148
|
#13 Item::fix_fields_if_needed_for_bool (ref=0x145eb802acd0, thd=0x145eb8000db8, this=0x145eb802a390) at /test/10.11_dbg/sql/item.h:1152
|
#14 setup_conds (thd=thd@entry=0x145eb8000db8, tables=tables@entry=0x145eb8013e60, leaves=@0x145eb8005a08: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x145eb802a840, last = 0x145eb802a840, elements = 1}, <No data fields>}, conds=conds@entry=0x145eb802acd0) at /test/10.11_dbg/sql/sql_base.cc:8801
|
#15 0x0000558ca229af0f in setup_without_group (reserved=0x145eb8005bac, hidden_group_fields=0x145eb802ab97, win_funcs=@0x145eb8005c40: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558ca37eec20 <end_of_list>, last = 0x145eb8005c40, elements = 0}, <No data fields>}, win_specs=@0x145eb8005c28: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558ca37eec20 <end_of_list>, last = 0x145eb8005c28, elements = 0}, <No data fields>}, group=0x0, order=0x0, conds=0x145eb802acd0, all_fields=@0x145eb802abe8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558ca37eec20 <end_of_list>, last = 0x145eb802abe8, elements = 0}, <No data fields>}, fields=@0x145f40530d20: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558ca37eec20 <end_of_list>, last = 0x145f40530d20, elements = 0}, <No data fields>}, leaves=@0x145eb8005a08: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x145eb802a840, last = 0x145eb802a840, elements = 1}, <No data fields>}, tables=0x145eb8013e60, ref_pointer_array=<optimized out>, thd=0x145eb8000db8) at /test/10.11_dbg/sql/sql_select.cc:884
|
#16 JOIN::prepare (this=this@entry=0x145eb802a850, tables_init=tables_init@entry=0x145eb8013e60, conds_init=conds_init@entry=0x145eb802a390, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x145eb80057f0, unit_arg=0x145eb8004ff0) at /test/10.11_dbg/sql/sql_select.cc:1456
|
#17 0x0000558ca22b2184 in mysql_select (thd=thd@entry=0x145eb8000db8, tables=tables@entry=0x145eb8013e60, fields=@0x145f40530d20: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558ca37eec20 <end_of_list>, last = 0x145f40530d20, elements = 0}, <No data fields>}, conds=conds@entry=0x145eb802a390, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2200096997504, result=0x145eb802a740, unit=0x145eb8004ff0, select_lex=0x145eb80057f0) at /test/10.11_dbg/sql/sql_select.cc:5045
|
#18 0x0000558ca232ba5f in mysql_multi_update (thd=thd@entry=0x145eb8000db8, table_list=0x145eb8013e60, fields=fields@entry=0x145eb8005a90, values=values@entry=0x145eb8005ec0, conds=0x145eb802a390, options=0, handle_duplicates=DUP_ERROR, ignore=false, unit=0x145eb8004ff0, select_lex=0x145eb80057f0, result=0x145f40530f00) at /test/10.11_dbg/sql/sql_update.cc:1980
|
#19 0x0000558ca2229f3e in mysql_execute_command (thd=thd@entry=0x145eb8000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4487
|
#20 0x0000558ca2216882 in mysql_parse (thd=thd@entry=0x145eb8000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x145f40531330) at /test/10.11_dbg/sql/sql_parse.cc:8035
|
#21 0x0000558ca2223e6a in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x145eb8000db8, packet=packet@entry=0x145eb800b6e9 "UPDATE t SET c=0 WHERE c LIKE '' AND c IN (SELECT * FROM t AS c NATURAL JOIN t WHERE c=1 WINDOW c AS (PARTITION BY c BETWEEN (SELECT * FROM t GROUP BY c WINDOW c AS (PARTITION BY c)) AND 1))", packet_length=packet_length@entry=190, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1339
|
#22 0x0000558ca2226574 in do_command (thd=0x145eb8000db8, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
|
#23 0x0000558ca23881da in do_handle_one_connection (connect=<optimized out>, connect@entry=0x558ca563ed58, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1418
|
#24 0x0000558ca23886e3 in handle_one_connection (arg=0x558ca563ed58) at /test/10.11_dbg/sql/sql_connect.cc:1312
|
#25 0x0000145f675c4609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#26 0x0000145f671b0133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
Bug confirmed present in:
MariaDB: 10.3.37 (dbg), 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.2 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)
Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.37 (opt), 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.2 (opt), 10.10.2 (opt), 10.11.0 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
|
274_stack