[MDEV-29139] Crash when using ANY predicand with redundant subquery in GROUP BY clause Created: 2022-07-20  Updated: 2022-12-05  Resolved: 2022-07-27

Status: Closed
Project: MariaDB Server
Component/s: Data Manipulation - Subquery
Affects Version/s: 10.3, 10.4, 10.5, 10.6
Fix Version/s: 10.3.36, 10.4.26, 10.5.17, 10.6.9, 10.7.5, 10.8.4, 10.9.2

Type: Bug Priority: Major
Reporter: Igor Babaev Assignee: Igor Babaev
Resolution: Fixed Votes: 0
Labels: None


 Description   

The following test case causes an assertion failure in Debug build of the current 10.3 and most probably of all other versions:

create table t1 (a int);
insert into t1 values (3), (2);
create table t2 (b int);
insert into t2 values (4), (2);
create table t3 (c int);
insert into t3 values (7), (1);
 
select a from t1
  where a >= any (select b from t2 group by (select c from t3 where c = 1));
 
drop table t1,t2,t3;

The failure happens in item_subselect.cc():

4  0x00007fde8f9b1187 in raise () from /lib64/libc.so.6
#5  0x00007fde8f9b2538 in abort () from /lib64/libc.so.6
#6  0x00007fde8f9aa126 in __assert_fail_base () from /lib64/libc.so.6
#7  0x00007fde8f9aa1d2 in __assert_fail () from /lib64/libc.so.6
#8  0x00005618d77c3f94 in Item_subselect::exec (this=0x7fde78017750) at /home/igor/maria-git/10.3/sql/item_subselect.cc:766
#9  0x00005618d77c6307 in Item_singlerow_subselect::val_str (this=0x7fde78017750, str=0x7fde78113020) at /home/igor/maria-git/10.3/sql/item_subselect.cc:1437
#10 0x00005618d7710bbe in Item_copy_string::copy (this=0x7fde78112ff0) at /home/igor/maria-git/10.3/sql/item.cc:5281
#11 0x00005618d7440132 in copy_fields (param=0x7fde7810e008) at /home/igor/maria-git/10.3/sql/sql_select.cc:24580
#12 0x00005618d743796f in end_send_group (join=0x7fde7810de18, join_tab=0x7fde78112be0, end_of_records=false) at /home/igor/maria-git/10.3/sql/sql_select.cc:21282
#13 0x00005618d7434687 in evaluate_join_record (join=0x7fde7810de18, join_tab=0x7fde78112850, error=0) at /home/igor/maria-git/10.3/sql/sql_select.cc:20119
#14 0x00005618d7433ed9 in sub_select (join=0x7fde7810de18, join_tab=0x7fde78112850, end_of_records=false) at /home/igor/maria-git/10.3/sql/sql_select.cc:19892
#15 0x00005618d7433356 in do_select (join=0x7fde7810de18, procedure=0x0) at /home/igor/maria-git/10.3/sql/sql_sel
...



 Comments   
Comment by Oleksandr Byelkin [ 2022-07-21 ]

You do not dig deeper so this will crash server again:

diff --git a/mysql-test/main/subselect4.test b/mysql-test/main/subselect4.test
index a59f4bbcdac..c41fbcfa7b7 100644
--- a/mysql-test/main/subselect4.test
+++ b/mysql-test/main/subselect4.test
@@ -2452,7 +2452,7 @@ insert into t3 values (7), (1);
 
 let $q1=
 select a from t1
-  where a >= any (select b from t2 group by (select c from t3 where c = 1));
+  where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1));
 
 eval explain extended $q1;
 eval $q1;
@@ -2464,7 +2464,7 @@ deallocate prepare stmt;
 
 let $q2=
 select a from t1
-  where a <= all (select b from t2 group by (select c from t3 where c = 1));
+  where a <= all (select b from t2 group by 1 + (select c from t3 where c = 1));
 
 eval explain extended $q2;
 eval $q2;

here is result:

CURRENT_TEST: main.subselect4
mysqltest: At line 2458: query '$q1' failed: 2013: Lost connection to MySQL server during query
 
The result from queries just before the failure was:
< snip >
DROP TABLE t1;
# End of 10.2 tests
#
# MDEV-29139: Redundannt subquery in GROUP BY clause of ANY/ALL subquery
#
create table t1 (a int);
insert into t1 values (3), (1), (2);
create table t2 (b int not null);
insert into t2 values (4), (2);
create table t3 (c int);
insert into t3 values (7), (1);
explain extended select a from t1
where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1));
id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	3	100.00	Using where
2	SUBQUERY	t2	ALL	NULL	NULL	NULL	NULL	2	100.00	
Warnings:
Note	1003	/* select#1 */ select `test`.`t1`.`a` AS `a` from `test`.`t1` where <nop>(<in_optimizer>(`test`.`t1`.`a`,(/* select#2 */ select min(`test`.`t2`.`b`) from `test`.`t2`) <= <cache>(`test`.`t1`.`a`)))
select a from t1
where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1));
 
More results from queries before failure can be found in /home/sanja/maria/git/10.3/mysql-test/var/log/subselect4.log
 
 
Server [mysqld.1 - pid: 36431, winpid: 36431, exit: 256] failed during test run
Server log from this test:
----------SERVER LOG START-----------
$ /home/sanja/maria/git/10.3/sql/mysqld --defaults-group-suffix=.1 --defaults-file=/home/sanja/maria/git/10.3/mysql-test/var/my.cnf --log-output=file --loose-sequence --core-file --loose-debug-sync-timeout=300
2022-07-21 10:12:17 0 [Note] /home/sanja/maria/git/10.3/sql/mysqld (mysqld 10.3.36-MariaDB-debug-log) starting as process 36432 ...
2022-07-21 10:12:17 0 [Warning] Could not increase number of max_open_files to more than 1024 (request: 32198)
2022-07-21 10:12:17 0 [Warning] Changed limits: max_open_files: 1024  max_connections: 151 (was 151)  table_cache: 421 (was 2000)
2022-07-21 10:12:17 0 [Note] Plugin 'partition' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'InnoDB' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_DATAFILES' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_TABLESTATS' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_LOCKS' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_MUTEXES' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMPMEM' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP_PER_INDEX' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_DELETED' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP_RESET' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_LOCK_WAITS' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_TABLESPACES_ENCRYPTION' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_BUFFER_PAGE_LRU' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_FIELDS' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMPMEM_RESET' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'FEEDBACK' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_COLUMNS' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_INDEX_TABLE' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_CMP_PER_INDEX_RESET' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'user_variables' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_INDEX_CACHE' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_FOREIGN_COLS' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_BEING_DELETED' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_BUFFER_POOL_STATS' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_TRX' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_FOREIGN' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_TABLES' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_DEFAULT_STOPWORD' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_FT_CONFIG' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_BUFFER_PAGE' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_TABLESPACES' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_METRICS' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_INDEXES' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_VIRTUAL' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_TABLESPACES_SCRUBBING' is disabled.
2022-07-21 10:12:17 0 [Note] Plugin 'INNODB_SYS_SEMAPHORE_WAITS' is disabled.
2022-07-21 10:12:17 0 [Warning] /home/sanja/maria/git/10.3/sql/mysqld: unknown option '--loose-pam-debug'
2022-07-21 10:12:17 0 [Note] Server socket created on IP: '127.0.0.1'.
2022-07-21 10:12:17 0 [Note] Reading of all Master_info entries succeeded
2022-07-21 10:12:17 0 [Note] Added new Master_info '' to hash table
2022-07-21 10:12:17 0 [Note] /home/sanja/maria/git/10.3/sql/mysqld: ready for connections.
Version: '10.3.36-MariaDB-debug-log'  socket: '/home/sanja/maria/git/10.3/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution
mysqld: /home/sanja/maria/git/10.3/sql/item_subselect.cc:766: virtual bool Item_subselect::exec(): Assertion `!eliminated' failed.
220721 10:12:18 [ERROR] mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
 
To report this bug, see https://mariadb.com/kb/en/reporting-bugs
 
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed, 
something is definitely wrong and this may fail.
 
Server version: 10.3.36-MariaDB-debug-log
key_buffer_size=1048576
read_buffer_size=131072
max_used_connections=1
max_threads=153
thread_count=1
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63289 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
 
Thread pointer: 0x7fa0c0000da0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7fa0dcddcda8 thread_stack 0x49000
mysys/stacktrace.c:174(my_print_stacktrace)[0x560fb50d5ee5]
sql/signal_handler.cc:231(handle_fatal_signal)[0x560fb47746dd]
libc_sigaction.c:0(__restore_rt)[0x7fa0e2cf1520]
nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7fa0e2d45a7c]
posix/raise.c:27(__GI_raise)[0x7fa0e2cf1476]
stdlib/abort.c:81(__GI_abort)[0x7fa0e2cd77f3]
intl/loadmsgcat.c:1177(_nl_load_domain)[0x7fa0e2cd771b]
:0(__GI___assert_fail)[0x7fa0e2ce8e96]
sql/item_subselect.cc:768(Item_subselect::exec())[0x560fb485f780]
sql/item_subselect.cc:1415(Item_singlerow_subselect::val_int())[0x560fb4861bfb]
sql/item_func.cc:1213(Item_func_plus::int_op())[0x560fb4808fc6]
sql/item_func.cc:854(Item_func_hybrid_field_type::val_str_from_int_op(String*))[0x560fb4807891]
sql/sql_type.cc:3524(Type_handler_int_result::Item_func_hybrid_field_type_val_str(Item_func_hybrid_field_type*, String*) const)[0x560fb464ab83]
/home/sanja/maria/git/10.3/sql/mysqld(_ZN27Item_func_hybrid_field_type7val_strEP6String+0xbf)[0x560fb440cfeb]
/home/sanja/maria/git/10.3/sql/mysqld(_ZN16Item_copy_string4copyEv+0x42)[0x560fb47a42ba]
sql/item_func.h:585(Item_func_hybrid_field_type::val_str(String*))[0x560fb44b5983]
sql/item.cc:5281(Item_copy_string::copy())[0x560fb44acb1a]
sql/sql_select.cc:24603(copy_fields(TMP_TABLE_PARAM*))[0x560fb44a9564]
sql/sql_select.cc:21307(end_send_group(JOIN*, st_join_table*, bool))[0x560fb44a8cf6]
sql/sql_select.cc:20143(evaluate_join_record(JOIN*, st_join_table*, int))[0x560fb44a8002]
sql/sql_select.cc:19916(sub_select(JOIN*, st_join_table*, bool))[0x560fb447d0f9]
sql/sql_select.cc:19454(do_select(JOIN*, Procedure*))[0x560fb447c2f6]
sql/sql_select.cc:4172(JOIN::exec_inner())[0x560fb486d7cc]
sql/sql_select.cc:3967(JOIN::exec())[0x560fb485f962]
sql/item_subselect.cc:791(Item_subselect::exec())[0x560fb4861bfb]
sql/item_subselect.cc:1415(Item_singlerow_subselect::val_int())[0x560fb47c4375]
sql/item_cmpfunc.cc:916(Arg_comparator::compare_int_signed())[0x560fb47dac5e]
sql/item_cmpfunc.h:102(Arg_comparator::compare())[0x560fb47c747f]
sql/item_cmpfunc.cc:1795(Item_func_le::val_int())[0x560fb47c636c]
sql/item_cmpfunc.cc:1541(Item_in_optimizer::val_int())[0x560fb47c188a]
sql/item_cmpfunc.cc:284(Item_func_nop_all::val_int())[0x560fb44a9189]
sql/sql_select.cc:20011(evaluate_join_record(JOIN*, st_join_table*, int))[0x560fb44a8cf6]
sql/sql_select.cc:19916(sub_select(JOIN*, st_join_table*, bool))[0x560fb44a8002]
sql/sql_select.cc:19454(do_select(JOIN*, Procedure*))[0x560fb447d0f9]
sql/sql_select.cc:4172(JOIN::exec_inner())[0x560fb447c2f6]
sql/sql_select.cc:3967(JOIN::exec())[0x560fb447d926]
sql/sql_select.cc:4377(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x560fb446e378]
sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x560fb4430ce9]
sql/sql_parse.cc:6339(execute_sqlcom_select(THD*, TABLE_LIST*))[0x560fb4427406]
sql/sql_parse.cc:3870(mysql_execute_command(THD*))[0x560fb44354e5]
sql/sql_parse.cc:7870(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x560fb442113a]
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x560fb441fa06]
sql/sql_parse.cc:1398(do_command(THD*))[0x560fb45b1f85]
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x560fb45b1ce5]
sql/sql_connect.cc:1309(handle_one_connection)[0x560fb50056ec]
nptl/pthread_create.c:442(start_thread)[0x7fa0e2d43b43]
x86_64/clone3.S:83(__clone3)[0x7fa0e2dd5a00]
 
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x7fa0c0012ae8): select a from t1
where a >= any (select b from t2 group by 1 + (select c from t3 where c = 1))
 
Connection ID (thread ID): 4
Status: NOT_KILLED
 
Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on
 
The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains
information that should help you find out what is causing the crash.
Writing a core file...
Working directory at /dev/shm/var_auto_sr36/mysqld.1/data
Resource Limits:
Limit                     Soft Limit           Hard Limit           Units     
Max cpu time              unlimited            unlimited            seconds   
Max file size             unlimited            unlimited            bytes     
Max data size             unlimited            unlimited            bytes     
Max stack size            8388608              unlimited            bytes     
Max core file size        unlimited            unlimited            bytes     
Max resident set          unlimited            unlimited            bytes     
Max processes             255871               255871               processes 
Max open files            1024                 1024                 files     
Max locked memory         8393273344           8393273344           bytes     
Max address space         unlimited            unlimited            bytes     
Max file locks            unlimited            unlimited            locks     
Max pending signals       255871               255871               signals   
Max msgqueue size         819200               819200               bytes     
Max nice priority         0                    0                    
Max realtime priority     0                    0                    
Max realtime timeout      unlimited            unlimited            us        
Core pattern: |/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E
 
Kernel version: Linux version 5.15.0-41-generic (buildd@lcy02-amd64-065) (gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #44-Ubuntu SMP Wed Jun 22 14:20:53 UTC 2022
 
----------SERVER LOG END-------------

Comment by Oleksandr Byelkin [ 2022-07-21 ]

Probably it is better make with Item tree walking

Comment by Oleksandr Byelkin [ 2022-07-22 ]

the last variant OK to push

Comment by Igor Babaev [ 2022-07-27 ]

A fix for this bug was pushed into 10.3

Generated at Thu Feb 08 10:06:12 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.