[MDEV-31162] Crash for query using ROWNUM over multi-table view with ORDER BY Created: 2023-05-01  Updated: 2023-05-09  Resolved: 2023-05-02

Status: Closed
Project: MariaDB Server
Component/s: Views
Affects Version/s: 10.6, 10.8, 10.9, 10.10, 10.11, 11.0
Fix Version/s: 10.11.3, 10.6.13, 10.8.8, 10.9.6, 10.10.4

Type: Bug Priority: Blocker
Reporter: Elena Stepanova Assignee: Igor Babaev
Resolution: Fixed Votes: 0
Labels: regression


 Description   

Note: Patch for MDEV-31143 is already in the branch.

create table t1 (a INT) engine=MyISAM;
insert into t1 values (1),(2);
 
create table t2 (b INT) engine=MyISAM;
insert into t2 values (3),(4);
 
create view v AS select * from t1 join t2 order by b;
select * from v where rownum() <= 2;

10.6 7e2e9689

#3  <signal handler called>
#4  0x00005623a946a347 in get_sort_by_table (a=0x0, b=0x0, tables=..., const_tables=0) at /data/src/10.6/sql/sql_select.cc:26124
#5  0x00005623a93d924a in make_join_statistics (join=0x629000272130, tables_list=..., keyuse_array=0x629000272458) at /data/src/10.6/sql/sql_select.cc:5676
#6  0x00005623a93b8ee2 in JOIN::optimize_inner (this=0x629000272130) at /data/src/10.6/sql/sql_select.cc:2509
#7  0x00005623a93b1edd in JOIN::optimize (this=0x629000272130) at /data/src/10.6/sql/sql_select.cc:1848
#8  0x00005623a93d3950 in mysql_select (thd=0x62b00007e218, tables=0x62b000085940, fields=..., conds=0x62b0000861e0, og_num=1, order=0x62b00008ac68, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x62b00008add8, unit=0x62b000082588, select_lex=0x62b0000852f0) at /data/src/10.6/sql/sql_select.cc:5055
#9  0x00005623a93a3790 in handle_select (thd=0x62b00007e218, lex=0x62b0000824c0, result=0x62b00008add8, setup_tables_done_option=0) at /data/src/10.6/sql/sql_select.cc:559
#10 0x00005623a9308599 in execute_sqlcom_select (thd=0x62b00007e218, all_tables=0x62b000085940) at /data/src/10.6/sql/sql_parse.cc:6273
#11 0x00005623a92f6c72 in mysql_execute_command (thd=0x62b00007e218, is_called_from_prepared_stmt=false) at /data/src/10.6/sql/sql_parse.cc:3949
#12 0x00005623a9313511 in mysql_parse (thd=0x62b00007e218, rawbuf=0x62b000085238 "select * from v where rownum() <= 2", length=35, parser_state=0x7f3459fcaa30) at /data/src/10.6/sql/sql_parse.cc:8036
#13 0x00005623a92e9358 in dispatch_command (command=COM_QUERY, thd=0x62b00007e218, packet=0x62900025d219 "select * from v where rownum() <= 2", packet_length=35, blocking=true) at /data/src/10.6/sql/sql_parse.cc:1896
#14 0x00005623a92e6096 in do_command (thd=0x62b00007e218, blocking=true) at /data/src/10.6/sql/sql_parse.cc:1409
#15 0x00005623a9752b1a in do_handle_one_connection (connect=0x608000002db8, put_in_cache=true) at /data/src/10.6/sql/sql_connect.cc:1416
#16 0x00005623a97524db in handle_one_connection (arg=0x608000002d38) at /data/src/10.6/sql/sql_connect.cc:1318
#17 0x00005623aa3acc30 in pfs_spawn_thread (arg=0x617000005b98) at /data/src/10.6/storage/perfschema/pfs.cc:2201
#18 0x00007f3461aa7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#19 0x00007f3461b285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Same test case, but with an extra operation in order by, produces a different stack trace on the same build:

create table t1 (a INT) engine=MyISAM;
insert into t1 values (1),(2);
 
create table t2 (b INT) engine=MyISAM;
insert into t2 values (3),(4);
 
create view v AS select * from t1 join t2 order by b/a;
select * from v where rownum() <= 2;

#3  <signal handler called>
#4  0x000055b205744fc5 in update_depend_map_for_order (join=0x629000272130, order=0x62b00008aee0) at /data/src/10.6/sql/sql_select.cc:14983
#5  0x000055b205745804 in remove_const (join=0x629000272130, first_order=0x62b00008aee0, cond=0x62b0000861e0, change_list=true, simple_order=0x629000272443) at /data/src/10.6/sql/sql_select.cc:15096
#6  0x000055b2056e72c5 in JOIN::optimize_stage2 (this=0x629000272130) at /data/src/10.6/sql/sql_select.cc:2814
#7  0x000055b2056e41fb in JOIN::optimize_inner (this=0x629000272130) at /data/src/10.6/sql/sql_select.cc:2535
#8  0x000055b2056dcedd in JOIN::optimize (this=0x629000272130) at /data/src/10.6/sql/sql_select.cc:1848
#9  0x000055b2056fe950 in mysql_select (thd=0x62b00007e218, tables=0x62b000085940, fields=..., conds=0x62b0000861e0, og_num=1, order=0x62b00008aee0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x62b00008b050, unit=0x62b000082588, select_lex=0x62b0000852f0) at /data/src/10.6/sql/sql_select.cc:5055
#10 0x000055b2056ce790 in handle_select (thd=0x62b00007e218, lex=0x62b0000824c0, result=0x62b00008b050, setup_tables_done_option=0) at /data/src/10.6/sql/sql_select.cc:559
#11 0x000055b205633599 in execute_sqlcom_select (thd=0x62b00007e218, all_tables=0x62b000085940) at /data/src/10.6/sql/sql_parse.cc:6273
#12 0x000055b205621c72 in mysql_execute_command (thd=0x62b00007e218, is_called_from_prepared_stmt=false) at /data/src/10.6/sql/sql_parse.cc:3949
#13 0x000055b20563e511 in mysql_parse (thd=0x62b00007e218, rawbuf=0x62b000085238 "select * from v where rownum() <= 2", length=35, parser_state=0x7f48e9b35a30) at /data/src/10.6/sql/sql_parse.cc:8036
#14 0x000055b205614358 in dispatch_command (command=COM_QUERY, thd=0x62b00007e218, packet=0x62900025d219 "select * from v where rownum() <= 2", packet_length=35, blocking=true) at /data/src/10.6/sql/sql_parse.cc:1896
#15 0x000055b205611096 in do_command (thd=0x62b00007e218, blocking=true) at /data/src/10.6/sql/sql_parse.cc:1409
#16 0x000055b205a7db1a in do_handle_one_connection (connect=0x608000002db8, put_in_cache=true) at /data/src/10.6/sql/sql_connect.cc:1416
#17 0x000055b205a7d4db in handle_one_connection (arg=0x608000002d38) at /data/src/10.6/sql/sql_connect.cc:1318
#18 0x000055b2066d7c30 in pfs_spawn_thread (arg=0x617000005b98) at /data/src/10.6/storage/perfschema/pfs.cc:2201
#19 0x00007f48f12a7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#20 0x00007f48f13285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Reproducible with at least MyISAM, InnoDB, Aria.

Same as MDEV-31073 and MDEV-31143, the failure started happening on 10.6 after this merge:

commit 5bada1246de48ef4a18fa30388f06719c971c3d7
Merge: 375991a531f fb72dfbf7fb
Author: Marko Mäkelä
Date:   Tue Apr 11 16:15:19 2023 +0300
    Merge 10.5 into 10.6


Generated at Thu Feb 08 10:21:45 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.