[MDEV-32009] mariadb server crash Created: 2023-08-25  Updated: 2023-08-30  Resolved: 2023-08-28

Status: Closed
Project: MariaDB Server
Component/s: Optimizer, Server
Affects Version/s: 11.0.2, 10.5.22, 10.6.15, 10.10.6, 10.11.5, 11.0.3
Fix Version/s: N/A

Type: Bug Priority: Critical
Reporter: fuying Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: None
Environment:

docker mariadb:11.0


Attachments: File crash.sql     File init_tables.sql    
Issue Links:
Duplicate
duplicates MDEV-16808 Server crash in in JOIN_CACHE_HASHED:... Confirmed

 Description   

Reproduce step:

docker run --restart=always  --name mariadbcrash -p 3390:3306 -e MYSQL_ROOT_PASSWORD=123456  -d mariadb:11.0
docker exec -it mariadbcrash bash
# in container
apt update && \ 
apt-get -y install mariadb-plugin-provider-lz4 && \ 
apt-get -y install mariadb-plugin-provider-bzip2 && \ 
apt-get -y install mariadb-plugin-provider-lzma && \ 
apt-get -y install mariadb-plugin-provider-lzo && \ 
apt-get -y install mariadb-plugin-provider-snappy && \ 
apt-get -y install mariadb-plugin-mroonga && \ 
apt-get -y install mariadb-plugin-rocksdb && \ 
apt-get -y install mariadb-plugin-s3
 
mariadb -u root -p
# password 123456
 
# in mariadb
INSTALL SONAME 'ha_mroonga';
create database test;
use test;
source init_tables.sql;
source crash.sql

Then you will get an error like "Lost connection to server during query".



 Comments   
Comment by fuying [ 2023-08-25 ]

And I found that if you don't add 'SET Session join_cache_level = 8;', the server will not crash.

Comment by Daniel Black [ 2023-08-25 ]

10.6-e0398c5b8c118cbdb14e0e6807bfa7c72b03a544 with ENGINE=Mroonga removed

(gdb) bt
#0  0x0000000000760c7e in store_key::copy (this=0x7f8d4c5d8c68, thd=0x7f8d4c000c68) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.h:1923
#1  cp_buffer_from_ref (thd=0x7f8d4c000c68, table=<optimized out>, ref=ref@entry=0x7f8d4c5d7348) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:25546
#2  0x000000000082912e in JOIN_CACHE_HASHED::put_record (this=0x7f8d4c5e0268) at /home/dan/repos/mariadb-server-10.6/sql/sql_join_cache.cc:3064
#3  0x000000000075e14e in sub_select_cache (join=0x7f8d4c5058b8, join_tab=0x7f8d4c5d7110, end_of_records=<optimized out>) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:21440
#4  0x00000000008285f1 in JOIN_CACHE::generate_full_extensions (this=this@entry=0x7f8d4c5dfc38, rec_ptr=0x7f8d4c0d1169 "") at /home/dan/repos/mariadb-server-10.6/sql/sql_join_cache.cc:2522
#5  0x0000000000828757 in JOIN_CACHE::join_null_complements (this=0x7f8d4c5dfc38, skip_last=<optimized out>) at /home/dan/repos/mariadb-server-10.6/sql/sql_join_cache.cc:2670
#6  0x0000000000828170 in JOIN_CACHE::join_records (this=0x7f8d4c5dfc38, skip_last=false) at /home/dan/repos/mariadb-server-10.6/sql/sql_join_cache.cc:2213
#7  0x000000000075e079 in sub_select_cache (join=0x7f8d4c5058b8, join_tab=0x7f8d4c5d6d50, end_of_records=false) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:21425
#8  0x0000000000747270 in do_select (join=join@entry=0x7f8d4c5058b8, procedure=<optimized out>) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:21198
#9  0x0000000000746c2e in JOIN::exec_inner (this=this@entry=0x7f8d4c5058b8) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:4826
#10 0x000000000072f037 in JOIN::exec (this=0x7f8d4c5058b8) at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:4604
#11 mysql_select (thd=thd@entry=0x7f8d4c000c68, tables=<optimized out>, fields=@0x7f8d4c017110: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7f8d4c017440, last = 0x7f8d4c017818, elements = 4}, <No data fields>}, 
    conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x7f8d4c505890, unit=0x7f8d4c004e50, select_lex=0x7f8d4c016e58)
    at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:5083
#12 0x000000000072ec6f in handle_select (thd=thd@entry=0x7f8d4c000c68, lex=lex@entry=0x7f8d4c004d88, result=result@entry=0x7f8d4c505890, setup_tables_done_option=setup_tables_done_option@entry=0)
    at /home/dan/repos/mariadb-server-10.6/sql/sql_select.cc:559
#13 0x000000000070d798 in execute_sqlcom_select (thd=thd@entry=0x7f8d4c000c68, all_tables=0x7f8d4c504508) at /home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc:6283
#14 0x00000000007086e8 in mysql_execute_command (thd=thd@entry=0x7f8d4c000c68, is_called_from_prepared_stmt=<optimized out>) at /home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc:3959
#15 0x000000000070461a in mysql_parse (thd=thd@entry=0x7f8d4c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7f8de8123560) at /home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc:8053
#16 0x0000000000702c55 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f8d4c000c68, packet=packet@entry=0x7f8d4c008579 "", packet_length=packet_length@entry=7847, blocking=true)
    at /home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc:1896
#17 0x0000000000704a60 in do_command (thd=0x7f8d4c000c68, blocking=true) at /home/dan/repos/mariadb-server-10.6/sql/sql_parse.cc:1409
#18 0x0000000000801e8e in do_handle_one_connection (connect=<optimized out>, connect@entry=0x2af7668, put_in_cache=true) at /home/dan/repos/mariadb-server-10.6/sql/sql_connect.cc:1416
#19 0x0000000000801cab in handle_one_connection (arg=arg@entry=0x2af7668) at /home/dan/repos/mariadb-server-10.6/sql/sql_connect.cc:1318
#20 0x0000000000b1313e in pfs_spawn_thread (arg=0x2aa7c48) at /home/dan/repos/mariadb-server-10.6/storage/perfschema/pfs.cc:2201
#21 0x00007f8de84ae907 in start_thread () from /lib64/libc.so.6
#22 0x00007f8de8534870 in clone3 () from /lib64/libc.so.6
(gdb) list
1918	    key buffers don't end up as errors (because of an enclosing INSERT/UPDATE).
1919	  */
1920	  enum store_key_result copy(THD *thd)
1921	  {
1922	    enum_check_fields org_count_cuted_fields= thd->count_cuted_fields;
1923	    Use_relaxed_field_copy urfc(to_field->table->in_use);
1924	    store_key_result result= copy_inner();
1925	    thd->count_cuted_fields= org_count_cuted_fields;
1926	    return result;
1927	  }
(gdb) p to_field 
$1 = (Field *) 0x0
(gdb) p *this
$2 = (store_key_field) {<store_key> = {<Sql_alloc> = {<No data fields>}, _vptr$store_key = 0xe3b1e0 <vtable for store_key_field+16>, null_key = false, to_field = 0x0, null_ptr = 0x7f8d4c5d8c88 "", err = 0 '\000'}, 
  copy_field = {<Sql_alloc> = {<No data fields>}, from_ptr = 0x0, to_ptr = 0x0, from_null_ptr = 0x0, to_null_ptr = 0x0, null_row = 0x0, from_bit = 0, to_bit = 0, from_length = 0, to_length = 0, from_field = 0x0, to_field = 0x0, 
    tmp = {<Charset> = {m_charset = 0x1595ae0 <my_charset_bin>}, <Binary_string> = {<Sql_alloc> = {<No data fields>}, Ptr = 0x0, str_length = 0, Alloced_length = 0, extra_alloc = 0, alloced = false, 
        thread_specific = false}, <No data fields>}, do_copy = 0x0, do_copy2 = 0x0}, field_name = 0x7f8d4c5d8d10 "test.ref_0.v0"}

Note that source is required as stdin fails to correctly initialize.

$ mariadb test < ~/Downloads/init_tables.sql 
ERROR 1062 (23000) at line 7: Duplicate entry 'v6' for key 'PRIMARY'

Note to test the very latest you can use the quay.io/mariadb-foundation/mariadb-devel:11.0 image (other tags available too ).

Comment by Alice Sherepa [ 2023-08-28 ]

Thanks for the report!
I repeated as described on 10.4-11.3, this is the same bug as MDEV-16808 - the problem about compressed blob column.

Version: '11.3.0-MariaDB-debug-log'  
mariadbd: /11/sql/field.h:4736: virtual Field* Field_blob_compressed::new_key_field(MEM_ROOT*, TABLE*, uchar*, uint32, uchar*, uint): Assertion `0' failed.
230828 13:08:56 [ERROR] mysqld got signal 6 ;
 
Server version: 11.3.0-MariaDB-debug-log source revision: cb37c99dd87c5648040396f6fbfb6d974494d855
 
sql/signal_handler.cc:241(handle_fatal_signal)[0x555889a180be]
sql/field.h:4736(Field_blob_compressed::new_key_field(st_mem_root*, TABLE*, unsigned char*, unsigned int, unsigned char*, unsigned int))[0x5558899ed34d]
sql/sql_select.h:2012(store_key::store_key(THD*, Field*, unsigned char*, unsigned char*, unsigned int))[0x5558892c0f5c]
sql/sql_select.h:2059(store_key_field::store_key_field(THD*, Field*, unsigned char*, unsigned char*, unsigned int, Field*, char const*))[0x5558892c159f]
sql/sql_select.cc:13156(get_store_key(THD*, keyuse_t*, unsigned long long, st_key_part_info*, unsigned char*, unsigned int))[0x55588921f475]
sql/sql_select.cc:13063(create_ref_for_key(JOIN*, st_join_table*, keyuse_t*, bool, unsigned long long))[0x55588921e35c]
sql/sql_select.cc:12721(JOIN::get_best_combination())[0x55588921af91]
sql/sql_select.cc:2665(JOIN::optimize_stage2())[0x5558891cc690]
sql/sql_select.cc:2644(JOIN::optimize_inner())[0x5558891cc0e6]
sql/sql_select.cc:1944(JOIN::optimize())[0x5558891c4dde]
sql/sql_select.cc:5229(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5558891e6b66]
sql/sql_select.cc:628(handle_select(THD*, LEX*, select_result*, unsigned long long))[0x5558891b63b8]
sql/sql_parse.cc:6023(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5558890d83d4]
sql/sql_parse.cc:3922(mysql_execute_command(THD*, bool))[0x5558890c8b3a]
sql/sql_parse.cc:7760(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5558890e3267]
sql/sql_parse.cc:1895(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5558890bb392]
sql/sql_parse.cc:1406(do_command(THD*, bool))[0x5558890b80dc]
sql/sql_connect.cc:1445(do_handle_one_connection(CONNECT*, bool))[0x55588959658d]
sql/sql_connect.cc:1349(handle_one_connection)[0x555889595eea]
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55588a1ff318]
nptl/pthread_create.c:478(start_thread)[0x7f872f4b5609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f872f086133]
 
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x6290000e62a8): select  
subq_0.c0 as c0, 
subq_0.c2 as c1, 
subq_0.c2 as c2, 
subq_0.c1 as c3
from 
(select  
ref_2.v6 as c0, 
ref_8.v8 as c1, 
ref_7.v31 as c2
from 
test.table60 as ref_0
inner join test.table44 as ref_1
on (ref_0.v0 = ref_1.v0 )
inner join test.table7 as ref_2
on (((((((EXISTS (
select  
ref_3.v14 as c0, 
ref_1.v0 as c1, 
ref_2.v5 as c2, 
ref_3.v30 as c3, 
ref_2.v3 as c4, 
ref_2.v0 as c5, 
ref_1.v2 as c6, 
ref_0.v33 as c7, 
ref_3.v12 as c8
from 
test.table60 as ref_3
where 0)) 
or (((0) 
or (ref_2.v7 is not NULL)) 
or ((1) 
and (0)))) 
or (1)) 
and (1)) 
and (1)) 
and (0)) 
and (ref_2.v2 is NULL))
right join test.table38 as ref_4
on (EXISTS (
select  
ref_1.v2 as c0, 
ref_4.v0 as c1
from 
test.table19 as ref_5
where ref_5.v0 is NULL))
left join test.table7 as ref_6
right join test.table60 as ref_7
inner join test.table6 as ref_8
on (((((((ref_7.v15 is NULL) 
or (EXISTS (
select  
ref_7.v3 as c0, 
ref_9.v4 as c1, 
(select v8 from test.table43)
as c2, 
ref_8.v3 as c3, 
ref_9.v3 as c4, 
ref_8.v1 as c5, 
ref_7.v8 as c6, 
ref_9.v7 as c7, 
ref_8.v1 as c8
from 
test.table43 as ref_9
where 1))) 
or (((EXISTS (
select  
(select v9 from test.table69)
as c0, 
ref_10.v0 as c1
from 
test.table19 as ref_10
where 0)) 
or (ref_8.v1 is NULL)) 
and (1))) 
or (1)) 
and (((0) 
or ((((EXISTS (
select  
71 as c0, 
ref_7.v9 as c1, 
ref_11.v16 as c2, 
ref_7.v15 as c3, 
ref_7.v10 as c4, 
(select v3 from test.table12)
as c5, 
ref_7.v13 as c6, 
ref_7.v7 as c7, 
ref_7.v1 as c8
from 
test.table54 as ref_11
where ((EXISTS (
select  
ref_11.v4 as c0
from 
test.table38 as ref_12
where (0) 
and (1))) 
and ((0) 
or (0))) 
or ((1) 
or ((0) 
or (1))))) 
or (((((0) 
and ((0) 
and (ref_8.v4 is NULL))) 
or (EXISTS (
select  
ref_8.v3 as c0, 
ref_13.v71 as c1, 
ref_8.v3 as c2, 
61 as c3, 
ref_7.v15 as c4, 
(select v39 from test.table65)
as c5, 
ref_8.v2 as c6
from 
test.table65 as ref_13
where 1))) 
and (1)) 
and (1))) 
or (((EXISTS (
select  
(select v19 from test.table60)
as c0, 
72 as c1, 
ref_7.v19 as c2, 
ref_8.v0 as c3, 
(select v3 from test.table44)
as c4, 
ref_14.v4 as c5, 
ref_8.v9 as c6
from 
test.table40 as ref_14
where 0)) 
and (((((ref_8.v8 is NULL) 
or ((0) 
or (((ref_8.v7 is NULL) 
or (1)) 
or ((0) 
and (0))))) 
or (ref_7.v15 is not NULL)) 
and ((1) 
and (0))) 
and (ref_7.v1 is not NULL))) 
and (0))) 
or (ref_7.v30 is not NULL))) 
or (1))) 
and (EXISTS (
select distinct 
(select v0 from test.table19)
as c0
from 
test.table69 as ref_15
where ref_15.v37 is NULL))) 
and (ref_8.v7 is NULL))
on (ref_6.v0 is not NULL)
on (EXISTS (
select  
3 as c0, 
ref_4.v0 as c1, 
ref_7.v36 as c2, 
ref_7.v13 as c3, 
ref_1.v0 as c4, 
ref_1.v1 as c5
from 
test.table75 as ref_16
where ref_1.v3 is not NULL))
where coalesce(ref_6.v3,
ref_2.v0) is NULL) as subq_0
where json_object() is not NULL

Comment by fuying [ 2023-08-29 ]

I found that MDEV-16808 was created in 2018. Has this bug not been fixed during this time?

Comment by Alice Sherepa [ 2023-08-30 ]

Not fixed yet, I checked the test case. I set it to critical.

Generated at Thu Feb 08 10:28:07 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.