[MDEV-30756] Crash in make_join_statistics Created: 2023-02-28  Updated: 2023-11-04

Status: Stalled
Project: MariaDB Server
Component/s: Server
Affects Version/s: 11.0.2
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Yongheng Chen Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-29935 Server crashes in get_sort_by_table/m... Confirmed

 Description   

POC:

CREATE TABLE v0 ( v1 INT , v2 CHAR UNIQUE UNIQUE NOT NULL CHECK ( v2 NOT IN ( v1 > 59 OR v1 > 67 AND FALSE NOT LIKE 'x' , 'x' ) ) ) ;
 
 CREATE VIEW v3 AS SELECT DISTINCT 41503055.000000 FROM v0 WHERE v2 ;
 
 UPDATE v0 SET v2 = v2 * 0 WHERE v2 IN ( SELECT DISTINCT v2 FROM v0 WHERE EXISTS ( SELECT v1 FROM v3 WHERE v1 = v2 + -1 GROUP BY ( SELECT v2 FROM v0 AS v4 WHERE v2 = 'x' OR v1 = 'x' OR v1 = 'x' GROUP BY v2 HAVING v1 < 'x' ) BETWEEN 44 AND 0 HAVING 2147483647 ) ) ORDER BY v1 IS NULL ;
 
 DROP TABLE v3 ;
 
 INSERT INTO v0 VALUES ( 15 ) ;

Backtrace:
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f02b8109c00 thread_stack 0x49000
addr2line: DWARF error: invalid or unhandled FORM value: 0x23
??:0(my_print_stacktrace)[0x56554d0d200b]
??:0(handle_fatal_signal)[0x56554c89b68f]
??:0(__sigaction)[0x7f02baa08520]
addr2line: DWARF error: invalid or unhandled FORM value: 0x23
sql_select.cc:0(get_sort_by_table(st_order*, st_order*, List<TABLE_LIST>&, unsigned long long))[0x56554c56656b]
sql_select.cc:0(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x56554c508744]
??:0(JOIN::optimize_inner())[0x56554c5027db]
??:0(JOIN::optimize())[0x56554c4fd5d6]
??:0(st_select_lex::optimize_unflattened_subqueries(bool))[0x56554c44916c]
??:0(JOIN::optimize_stage2())[0x56554c4ff3c4]
??:0(JOIN::optimize_inner())[0x56554c50232b]
??:0(JOIN::optimize())[0x56554c4fd5d6]
??:0(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x56554c4f3048]
??:0(mysql_multi_update(THD*, TABLE_LIST*, List<Item>, List<Item>, Item*, unsigned long long, enum_duplicates, bool, st_select_lex_unit*, st_select_lex*, multi_update**))[0x56554c611053]
??:0(mysql_execute_command(THD*, bool))[0x56554c492722]
??:0(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x56554c481aa2]
??:0(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x56554c47f01b]
??:0(do_command(THD*, bool))[0x56554c4821d1]
??:0(do_handle_one_connection(CONNECT*, bool))[0x56554c68edc5]
??:0(handle_one_connection)[0x56554c68e9f7]
:0(pfs_spawn_thread)[0x56554cc1582f]
??:0(pthread_condattr_setpshared)[0x7f02baa5ab43]
??:0(clone)[0x7f02baaebbb4]

Trying to get some variables.

 Comments   
Comment by Alice Sherepa [ 2023-03-01 ]

Thank you for the report!
I will add the test case to MDEV-29681 to be checked after the patch, it seems to be the same problem.

Comment by Oleg Smirnov [ 2023-11-04 ]

MDEV-29681 is a different case, reopening this issue. 

CREATE TABLE t1 (id int);
 
 
SELECT * FROM t1 k WHERE 1 IN
 
  (SELECT  1 FROM t1 WHERE EXISTS (SELECT id  FROM (SELECT 1 FROM t1) d GROUP BY  (SELECT 1 FROM t1 dt HAVING id) BETWEEN 0 AND 10 HAVING 1)) ;


--source include/have_innodb.inc
 
CREATE TABLE t1 (id int) engine=innodb;
 
 
SELECT * FROM t1 k WHERE 1 IN
 
  (SELECT  1 FROM t1 WHERE EXISTS (SELECT id  FROM (SELECT 1 FROM t1 where id) d GROUP BY  (SELECT 1 FROM t1 dt HAVING id)  having 1 )) ;

Generated at Thu Feb 08 10:18:39 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.