[MDEV-31418] One SQL query crashes the server Created: 2023-06-06  Updated: 2023-06-07  Resolved: 2023-06-06

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.11.3
Fix Version/s: 10.4.30, 10.5.21, 10.6.14, 10.9.7, 10.11.4

Type: Bug Priority: Critical
Reporter: Ugo Bellavance Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: crash
Environment:

RHEL 8

Attachments: Text File tables_and_query.txt    
Issue Links:
Duplicate
is duplicated by MDEV-31240 Crash with condition pushable into de... Closed

 Description   

Hi,

We're starting to work on a MariaDB 5.5 => 10.11 upgrade. Our current 5.5 server is still in production and I have setup a test VM with 10.11 to test our code. One of our queries crashes the server. The issue has been reproduced on a our VM at first, but also on a fresh docker instance.

Attached is a file with the tables definitions and the query. It has been reproduced succesfully even with empty tables.

 Comments   
Comment by Elena Stepanova [ 2023-06-06 ]

Thanks for the report, reproducible as described.
The problem was fixed in the scope of MDEV-31240 by the same patch. Releases with the fix should be out very soon.

#3  <signal handler called>
 
#4  0x0000559f67af99d7 in st_join_table::choose_best_splitting (this=0x62900028b0b8, idx=0, remaining_tables=1, spl_pd_boundary=0x7fb53eb62d00) at /data/src/bb-10.4-release/sql/opt_split.cc:1049
 
#5  0x0000559f6760e8e5 in best_access_path (join=0x62900026a408, s=0x62900028b0b8, remaining_tables=1, join_positions=0x62900028b670, idx=0, disable_jbuf=true, record_count=1, pos=0x62900028b670, loose_scan_pos=0x7fb53eb63140) at /data/src/bb-10.4-release/sql/sql_select.cc:7453
 
#6  0x0000559f6761b9d5 in best_extension_by_limited_search (join=0x62900026a408, remaining_tables=1, idx=0, record_count=1, read_time=0, search_depth=62, prune_level=1, use_cond_selectivity=4) at /data/src/bb-10.4-release/sql/sql_select.cc:9763
 
#7  0x0000559f6761780a in greedy_search (join=0x62900026a408, remaining_tables=1, search_depth=62, prune_level=1, use_cond_selectivity=4) at /data/src/bb-10.4-release/sql/sql_select.cc:8933
 
#8  0x0000559f67615596 in choose_plan (join=0x62900026a408, join_tables=1) at /data/src/bb-10.4-release/sql/sql_select.cc:8495
 
#9  0x0000559f67600bd3 in make_join_statistics (join=0x62900026a408, tables_list=..., keyuse_array=0x62900026a6f8) at /data/src/bb-10.4-release/sql/sql_select.cc:5696
 
#10 0x0000559f675ddd26 in JOIN::optimize_inner (this=0x62900026a408) at /data/src/bb-10.4-release/sql/sql_select.cc:2347
 
#11 0x0000559f675d6cdd in JOIN::optimize (this=0x62900026a408) at /data/src/bb-10.4-release/sql/sql_select.cc:1690
 
#12 0x0000559f674b4e6a in st_select_lex::optimize_unflattened_subqueries (this=0x62b0000a1b90, const_only=false) at /data/src/bb-10.4-release/sql/sql_lex.cc:4236
 
#13 0x0000559f67a10fed in JOIN::optimize_unflattened_subqueries (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/opt_subselect.cc:5601
 
#14 0x0000559f675e40ca in JOIN::optimize_stage2 (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/sql_select.cc:2921
 
#15 0x0000559f675de03f in JOIN::optimize_inner (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/sql_select.cc:2373
 
#16 0x0000559f675d6cdd in JOIN::optimize (this=0x6290002682a0) at /data/src/bb-10.4-release/sql/sql_select.cc:1690
 
#17 0x0000559f675f7d4f in mysql_select (thd=0x62b00009a208, tables=0x6290002645a8, wild_num=0, fields=..., conds=0x6290002675d8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2214857472, result=0x629000268270, unit=0x62b00009e140, select_lex=0x62b0000a1b90) at /data/src/bb-10.4-release/sql/sql_select.cc:4797
 
#18 0x0000559f675c8a9d in handle_select (thd=0x62b00009a208, lex=0x62b00009e080, result=0x629000268270, setup_tables_done_option=0) at /data/src/bb-10.4-release/sql/sql_select.cc:442
 
#19 0x0000559f67538627 in execute_sqlcom_select (thd=0x62b00009a208, all_tables=0x6290002645a8) at /data/src/bb-10.4-release/sql/sql_parse.cc:6463
 
#20 0x0000559f67525b3c in mysql_execute_command (thd=0x62b00009a208) at /data/src/bb-10.4-release/sql/sql_parse.cc:3966
 
#21 0x0000559f675417ff in mysql_parse (thd=0x62b00009a208, rawbuf=0x62b0000a1228 "SET STATEMENT SQL_SELECT_LIMIT=501 FOR SELECT a.utilisateur_id, a.nom, a.prenom, a.nom_utilisateur, a.titre, a.courriel, a.telephone, a.reinitialiser_mot_passe, a.statut, a.type, a.activation_token, a"..., length=989, parser_state=0x7fb53eb668b0, is_com_multi=false, is_next_command=false) at /data/src/bb-10.4-release/sql/sql_parse.cc:7998
 
#22 0x0000559f67517cab in dispatch_command (command=COM_QUERY, thd=0x62b00009a208, packet=0x62900025d209 "SET STATEMENT SQL_SELECT_LIMIT=501 FOR SELECT a.utilisateur_id, a.nom, a.prenom, a.nom_utilisateur, a.titre, a.courriel, a.telephone, a.reinitialiser_mot_passe, a.statut, a.type, a.activation_token, a"..., packet_length=989, is_com_multi=false, is_next_command=false) at /data/src/bb-10.4-release/sql/sql_parse.cc:1857
 
#23 0x0000559f67514824 in do_command (thd=0x62b00009a208) at /data/src/bb-10.4-release/sql/sql_parse.cc:1378
 
#24 0x0000559f67912c60 in do_handle_one_connection (connect=0x608000000e28) at /data/src/bb-10.4-release/sql/sql_connect.cc:1420
 
#25 0x0000559f67912577 in handle_one_connection (arg=0x608000000e28) at /data/src/bb-10.4-release/sql/sql_connect.cc:1324
 
#26 0x00007fb55f5c8fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
 
#27 0x00007fb55f6495bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment by Ugo Bellavance [ 2023-06-07 ]

Thanks a lot, I'm sorry: I didn't even think about searching if an existing Jira existed.

We have another query that crashes the server. How to know if it's that bug?

Stack trace: 

stack_bottom = 0x7f3e0c0b2bd8 thread_stack 0x40000
 
/usr/sbin/mariadbd(my_print_stacktrace+0x2e)[0x55bf7afbdd6e]
 
/usr/sbin/mariadbd(handle_fatal_signal+0x485)[0x55bf7aab2445]
 
/lib64/libpthread.so.0(+0x12cf0)[0x7f4438d60cf0]
 
/usr/sbin/mariadbd(_ZN13st_join_table21choose_best_splittingEjyPy+0x539)[0x55bf7aa2e909]
 
/usr/sbin/mariadbd(_Z16best_access_pathP4JOINP13st_join_tableyPK8POSITIONjbdPS3_S6_+0x169)[0x55bf7a8b8b39]
 
/usr/sbin/mariadbd(+0x83b4fb)[0x55bf7a8bc4fb]
 
/usr/sbin/mariadbd(+0x83f4cb)[0x55bf7a8c04cb]
 
/usr/sbin/mariadbd(_Z11choose_planP4JOINy+0x306)[0x55bf7a8c1836]
 
/usr/sbin/mariadbd(_ZN4JOIN14optimize_innerEv+0x3846)[0x55bf7a8e75f6]
 
/usr/sbin/mariadbd(_ZN4JOIN8optimizeEv+0xa0)[0x55bf7a8e7be0]
 
/usr/sbin/mariadbd(_ZN13st_select_lex31optimize_unflattened_subqueriesEb+0x10e)[0x55bf7a85213e]
 
/usr/sbin/mariadbd(_ZN4JOIN15optimize_stage2Ev+0x1bd5)[0x55bf7a8e2f85]
 
/usr/sbin/mariadbd(_ZN4JOIN14optimize_innerEv+0x2651)[0x55bf7a8e6401]
 
/usr/sbin/mariadbd(_ZN4JOIN8optimizeEv+0xa0)[0x55bf7a8e7be0]
 
/usr/sbin/mariadbd(+0x7b29b9)[0x55bf7a8339b9]
 
/usr/sbin/mariadbd(_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj+0x99)[0x55bf7a8331e9]
 
/usr/sbin/mariadbd(_ZN4JOIN14optimize_innerEv+0xdac)[0x55bf7a8e4b5c]
 
/usr/sbin/mariadbd(_ZN4JOIN8optimizeEv+0xa0)[0x55bf7a8e7be0]
 
/usr/sbin/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0xce)[0x55bf7a8e7cce]
 
/usr/sbin/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0x14b)[0x55bf7a8e84ab]
 
/usr/sbin/mariadbd(+0x7eef83)[0x55bf7a86ff83]
 
/usr/sbin/mariadbd(_Z21mysql_execute_commandP3THDb+0x1244)[0x55bf7a878408]
 
/usr/sbin/mariadbd(_ZN18Prepared_statement7executeEP6Stringb+0x3df)[0x55bf7a89a0df]
 
/usr/sbin/mariadbd(_ZN18Prepared_statement12execute_loopEP6StringbPhS2_+0x9d)[0x55bf7a89a39d]
 
/usr/sbin/mariadbd(+0x81a295)[0x55bf7a89b295]
 
/usr/sbin/mariadbd(_Z19mysqld_stmt_executeP3THDPcj+0x2b)[0x55bf7a89b43b]
 
/usr/sbin/mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x13ed)[0x55bf7a8752b9]
 
/usr/sbin/mariadbd(_Z10do_commandP3THDb+0x12f)[0x55bf7a876612]
 
/usr/sbin/mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x3f7)[0x55bf7a98add7]
 
/usr/sbin/mariadbd(handle_one_connection+0x5d)[0x55bf7a98b11d]
 
/usr/sbin/mariadbd(+0xc4233d)[0x55bf7acc333d]
 
/lib64/libpthread.so.0(+0x81ca)[0x7f4438d561ca]
 
/lib64/libc.so.6(clone+0x43)[0x7f44380a7e73]

Comment by Ugo Bellavance [ 2023-06-07 ]

When I use the workaround optimizer_switch="split_materialized=off", both queries return w/o crashing. Does that mean that the patch would fix the issue for both requests?

Generated at Thu Feb 08 10:23:43 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.