[MDEV-32684] Server crash in JOIN::transform_in_predicates_into_in_subq on 2nd execution of PS with a mix of collations Created: 2023-11-04  Updated: 2023-11-28

Status: Open
Project: MariaDB Server
Component/s: Character Sets, Optimizer, Prepared Statements
Affects Version/s: 10.4, 10.5, 10.6, 10.10, 10.11, 11.0, 11.1, 11.2
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Dmitry Shulga
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Duplicate
is duplicated by MDEV-31551 [Draft] Assortment of crashes in conv... Closed
Relates
relates to MDEV-32880 Server crash in mark_select_range_as_... Open

 Description    

CREATE TABLE t1 (a INT, b VARCHAR(1), c VARCHAR(1)) CHARACTER SET eucjpms;
 
CREATE TABLE t2 (d VARCHAR(1)) CHARACTER SET latin1;
 
CREATE TABLE t3 (e VARCHAR(1), f INT) CHARACTER SET utf8;
 
 
 
# Optional, also fails with empty tables
 
INSERT INTO t1 VALUES (1,'x','x'),(2,'x','x');
 
INSERT INTO t2 VALUES ('x'),('x');
 
INSERT INTO t3 VALUES ('x',1),('x',2);
 
 
 
PREPARE stmt FROM 'SELECT * FROM t1 WHERE t1.c IN (SELECT d FROM t2) AND t1.b IN (SELECT e FROM t3 WHERE f = t1.a)';
 
 
 
--error ER_CANT_AGGREGATE_2COLLATIONS
 
EXECUTE stmt;
 
--error ER_CANT_AGGREGATE_2COLLATIONS
 
EXECUTE stmt;
 
 
 
# Cleanup
 
DROP TABLE t1, t2, t3;

10.4 64f44b22d9a3dab3d4c0b77addbcbdafde57b466

 
==2739158==ERROR: AddressSanitizer: use-after-poison on address 0x62b0000a2588 at pc 0x561c19672376 bp 0x7f25e2674330 sp 0x7f25e2674328
 
READ of size 8 at 0x62b0000a2588 thread T27
 
    #0 0x561c19672375 in JOIN::transform_in_predicates_into_in_subq(THD*) /data/bld/10.4-asan/sql/sql_tvc.cc:1117
 
    #1 0x561c1956ade5 in convert_join_subqueries_to_semijoins(JOIN*) /data/bld/10.4-asan/sql/opt_subselect.cc:1138
 
    #2 0x561c19152c6e in JOIN::optimize_inner() /data/bld/10.4-asan/sql/sql_select.cc:1987
 
    #3 0x561c1915053a in JOIN::optimize() /data/bld/10.4-asan/sql/sql_select.cc:1731
 
    #4 0x561c19171406 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/10.4-asan/sql/sql_select.cc:4832
 
    #5 0x561c19141eda in handle_select(THD*, LEX*, select_result*, unsigned long) /data/bld/10.4-asan/sql/sql_select.cc:442
 
    #6 0x561c190ac77b in execute_sqlcom_select /data/bld/10.4-asan/sql/sql_parse.cc:6521
 
    #7 0x561c19099b41 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:3978
 
    #8 0x561c19109b52 in Prepared_statement::execute(String*, bool) /data/bld/10.4-asan/sql/sql_prepare.cc:5025
 
    #9 0x561c19105192 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/bld/10.4-asan/sql/sql_prepare.cc:4472
 
    #10 0x561c190feed6 in mysql_sql_stmt_execute(THD*) /data/bld/10.4-asan/sql/sql_prepare.cc:3531
 
    #11 0x561c19099b86 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:3994
 
    #12 0x561c190b5a6a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:8060
 
    #13 0x561c1908bae1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:1857
 
    #14 0x561c19088650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378
 
    #15 0x561c1948ed14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419
 
    #16 0x561c1948e62b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323
 
    #17 0x7f26044a8043 in start_thread nptl/pthread_create.c:442
 
    #18 0x7f260452861b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
 
 
 
0x62b0000a2588 is located 5000 bytes inside of 24608-byte region [0x62b0000a1200,0x62b0000a7220)
 
allocated by thread T27 here:
 
    #0 0x7f2604ab89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
 
    #1 0x561c1ac2efd2 in my_malloc /data/bld/10.4-asan/mysys/my_malloc.c:101
 
    #2 0x561c1ac0b7da in reset_root_defaults /data/bld/10.4-asan/mysys/my_alloc.c:155
 
    #3 0x561c18f6fa1c in THD::init_for_queries() /data/bld/10.4-asan/sql/sql_class.cc:1385
 
    #4 0x561c1948df47 in prepare_new_connection_state(THD*) /data/bld/10.4-asan/sql/sql_connect.cc:1253
 
    #5 0x561c1948e671 in thd_prepare_connection(THD*) /data/bld/10.4-asan/sql/sql_connect.cc:1338
 
    #6 0x561c1948ec73 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1409
 
    #7 0x561c1948e62b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323
 
    #8 0x7f26044a8043 in start_thread nptl/pthread_create.c:442
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f2604a49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
 
    #1 0x561c1ac8fa28 in spawn_thread_noop /data/bld/10.4-asan/mysys/psi_noop.c:187
 
    #2 0x561c18d8ff89 in inline_mysql_thread_create /data/bld/10.4-asan/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x561c18da7714 in create_thread_to_handle_connection(CONNECT*) /data/bld/10.4-asan/sql/mysqld.cc:6296
 
    #4 0x561c18da7e5f in create_new_thread(CONNECT*) /data/bld/10.4-asan/sql/mysqld.cc:6366
 
    #5 0x561c18da832d in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.4-asan/sql/mysqld.cc:6464
 
    #6 0x561c18da91d9 in handle_connections_sockets() /data/bld/10.4-asan/sql/mysqld.cc:6622
 
    #7 0x561c18da6e77 in mysqld_main(int, char**) /data/bld/10.4-asan/sql/mysqld.cc:5954
 
    #8 0x561c18d8e0b8 in main /data/bld/10.4-asan/sql/main.cc:25
 
    #9 0x7f26044461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /data/bld/10.4-asan/sql/sql_tvc.cc:1117 in JOIN::transform_in_predicates_into_in_subq(THD*)
 
Shadow bytes around the buggy address:
 
  0x0c568000c460: 00 00 f7 00 00 f7 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000c470: 00 00 00 00 00 00 00 00 f7 00 00 f7 f7 f7 f7 f7
 
  0x0c568000c480: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c568000c490: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c568000c4a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
=>0x0c568000c4b0: f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c568000c4c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c568000c4d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c568000c4e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c568000c4f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
  0x0c568000c500: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
==2739158==ABORTING

Reproducible with at least InnoDB and MyISAM.
Generated at Thu Feb 08 10:33:13 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.