[MDEV-28833] SIGSEGV in Item_field::used_tables on PREPARED STATEMENT with nested SELECT's Created: 2022-06-14  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Optimizer, Prepared Statements
Affects Version/s: 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Dmitry Shulga
Resolution: Unresolved Votes: 1
Labels: JOIN, not-10.11+

Issue Links:
Relates

 Description    

CREATE TABLE t (a INT) CHARSET utf8mb4 ENGINE=InnoDB;
 
INSERT INTO t VALUES();
 
INSERT INTO t VALUES (1),(2),(3),(4),(5),(6),(7),(8);
 
PREPARE s1 FROM ' SELECT a FROM t WHERE a in (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))';
 
SET max_JOIN_size=9;
 
EXECUTE s1;
 
SET SESSION sql_big_selects=1;
 
EXECUTE s1;

Leads to:

10.10.0 081a284712bb661349e2e3802077b12211cede3e (Debug)

 
Core was generated by `/test/MD310522-mariadb-10.10.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x000055df01a81017 in Item_field::used_tables (this=0x14f0c00744c8)
 
    at /test/10.10_dbg/sql/item.cc:3504
 
[Current thread is 1 (Thread 0x14f1003fa700 (LWP 3134736))]
 
(gdb) bt
 
#0  0x000055df01a81017 in Item_field::used_tables (this=0x14f0c00744c8) at /test/10.10_dbg/sql/item.cc:3504
 
#1  0x000055df0191c405 in optimize_semijoin_nests (join=join@entry=0x14f0c00148b8, all_table_map=all_table_map@entry=1152921504606846975) at /test/10.10_dbg/sql/sql_array.h:63
 
#2  0x000055df017e7f6c in make_join_statistics (join=join@entry=0x14f0c00148b8, tables_list=@0x14f0c0073460: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f0c0014e70, last = 0x14f0c0015220, elements = 60}, <No data fields>}, keyuse_array=keyuse_array@entry=0x14f0c0014bd8) at /test/10.10_dbg/sql/sql_select.cc:5928
 
#3  0x000055df017ef012 in JOIN::optimize_inner (this=this@entry=0x14f0c00148b8) at /test/10.10_dbg/sql/sql_select.cc:2503
 
#4  0x000055df017ef452 in JOIN::optimize (this=this@entry=0x14f0c00148b8) at /test/10.10_dbg/sql/sql_select.cc:1845
 
#5  0x000055df01733a24 in st_select_lex::optimize_unflattened_subqueries (this=0x14f0c0070848, const_only=const_only@entry=false) at /test/10.10_dbg/sql/sql_lex.cc:4916
 
#6  0x000055df01922669 in JOIN::optimize_unflattened_subqueries (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/opt_subselect.cc:5588
 
#7  0x000055df017ecafa in JOIN::optimize_stage2 (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/sql_select.cc:3104
 
#8  0x000055df017ef08d in JOIN::optimize_inner (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/sql_select.cc:2529
 
#9  0x000055df017ef452 in JOIN::optimize (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/sql_select.cc:1845
 
#10 0x000055df017ef545 in mysql_select (thd=thd@entry=0x14f0c0000db8, tables=0x14f0c0070e28, fields=@0x14f0c0070ae8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f0c0070de0, last = 0x14f0c0070de0, elements = 1}, <No data fields>}, conds=0x14f0c0013cd8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2201171004160, result=0x14f0c00d8d40, unit=0x14f0c006de60, select_lex=0x14f0c0070848) at /test/10.10_dbg/sql/sql_select.cc:5030
 
#11 0x000055df017efd8e in handle_select (thd=thd@entry=0x14f0c0000db8, lex=lex@entry=0x14f0c006dd88, result=result@entry=0x14f0c00d8d40, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.10_dbg/sql/sql_select.cc:578
 
#12 0x000055df0175bb5e in execute_sqlcom_select (thd=thd@entry=0x14f0c0000db8, all_tables=0x14f0c0070e28) at /test/10.10_dbg/sql/sql_parse.cc:6260
 
#13 0x000055df01767e70 in mysql_execute_command (thd=0x14f0c0000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true) at /test/10.10_dbg/sql/sql_parse.cc:3944
 
#14 0x000055df0179139e in Prepared_statement::execute (this=this@entry=0x14f0c006d908, expanded_query=expanded_query@entry=0x14f1003f8e60, open_cursor=open_cursor@entry=false) at /test/10.10_dbg/sql/sql_prepare.cc:5221
 
#15 0x000055df01791737 in Prepared_statement::execute_loop (this=this@entry=0x14f0c006d908, expanded_query=expanded_query@entry=0x14f1003f8e60, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/10.10_dbg/sql/sql_prepare.cc:4644
 
#16 0x000055df01791de2 in mysql_sql_stmt_execute (thd=thd@entry=0x14f0c0000db8) at /test/10.10_dbg/sql/sql_prepare.cc:3688
 
#17 0x000055df01767ecd in mysql_execute_command (thd=thd@entry=0x14f0c0000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.10_dbg/sql/sql_parse.cc:3960
 
#18 0x000055df01755e3a in mysql_parse (thd=thd@entry=0x14f0c0000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14f1003f9470) at /test/10.10_dbg/sql/sql_parse.cc:8036
 
#19 0x000055df01763422 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14f0c0000db8, packet=packet@entry=0x14f0c000b6d9 "EXECUTE s1", packet_length=packet_length@entry=10, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_class.h:1364
 
#20 0x000055df01765b2c in do_command (thd=0x14f0c0000db8, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_parse.cc:1407
 
#21 0x000055df018c53c0 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55df043a6b98, put_in_cache=put_in_cache@entry=true) at /test/10.10_dbg/sql/sql_connect.cc:1418
 
#22 0x000055df018c58c9 in handle_one_connection (arg=0x55df043a6b98) at /test/10.10_dbg/sql/sql_connect.cc:1312
 
#23 0x000014f1254c3609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#24 0x000014f1250af133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.3.36 (dbg), 10.3.36 (opt), 10.4.26 (dbg), 10.4.26 (opt), 10.5.17 (dbg), 10.5.17 (opt), 10.6.9 (dbg), 10.6.9 (opt), 10.7.5 (dbg), 10.7.5 (opt), 10.8.4 (dbg), 10.8.4 (opt), 10.9.2 (dbg), 10.9.2 (opt), 10.10.0 (dbg), 10.10.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

SIGSEGV|Item_field::used_tables|optimize_semijoin_nests|make_join_statistics|JOIN::optimize_inner



 Comments   
Comment by Roel Van de Paar [ 2022-06-14 ]

Interestingly, the same testcase causes a runaway query duration on MySQL 5.5 (opt+dbg) only:

mysql-5.5.62 (Debug)

 
mysql> show processlist;
 
+----+------+-----------+------+---------+------+--------------+------------------------------------------------------------------------------------------------------+
 
| Id | User | Host      | db   | Command | Time | State        | Info                                                                                                 |
 
+----+------+-----------+------+---------+------+--------------+------------------------------------------------------------------------------------------------------+
 
|  2 | root | localhost | test | Query   |  767 | Sending data | SELECT a FROM t WHERE a in (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t  |
 
|  3 | root | localhost | test | Query   |    0 | NULL         | show processlist                                                                                     |
 
+----+------+-----------+------+---------+------+--------------+------------------------------------------------------------------------------------------------------+
 
2 rows in set (0.00 sec)

Comment by Alice Sherepa [ 2023-09-29 ]

somehow not repeatable on 10.11+, but still exists on 10.4-10.10 (11c69177e9eebaab65984ee06e7b2873b3067d5f)

Generated at Thu Feb 08 10:03:49 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.