Re: Crash in JOIN::optimize in maria-5.3-mwl90
The same crash was observed with maria-5.3 and maria-5.3-mwl128, but with a vastly different data set and query.

Unfortunately, it was not possible to extract an MTR test case. So, in order to repeat, mount the attached datadir and execute;

SELECT n_nationkey FROM nation JOIN supplier JOIN partsupp ON s_suppkey = ps_suppkey JOIN lineitem ON ps_partkey = l_partkey AND ps_suppkey = l_suppkey JOIN orders JOIN customer ON o_custkey = c_custkey WHERE ps_partkey = 199;

If the datadir is dumped and loaded fresh, the query stops crashing and starts reporting "Impossible where", which is due to ps_partkey not having a value of 199.

The same crash was observed with maria-5.3 and maria-5.3-mwl128, but with a vastly different data set and query.

Unfortunately, it was not possible to extract an MTR test case. So, in order to repeat, mount the attached datadir and execute;

SELECT n_nationkey FROM nation JOIN supplier JOIN partsupp ON s_suppkey = ps_suppkey JOIN lineitem ON ps_partkey = l_partkey AND ps_suppkey = l_suppkey JOIN orders JOIN customer ON o_custkey = c_custkey WHERE ps_partkey = 199;

If the datadir is dumped and loaded fresh, the query stops crashing and starts reporting "Impossible where", which is due to ps_partkey not having a value of 199.

datadir
LPexportBug724275_var-bug724275.zip

Re: Crash in JOIN::optimize in maria-5.3
Relevant columns from EXPLAIN:

explain SELECT n_nationkey FROM nation JOIN supplier JOIN partsupp ON s_suppkey = ps_suppkey JOIN lineitem ON ps_partkey = l_partkey AND ps_suppkey = l_suppkey JOIN orders JOIN customer ON o_custkey = c_custkey WHERE ps_partkey = 199;
---------------------------------------------------------------------+

---------------------------------------------------------------------+

---------------------------------------------------------------------+

Re: Crash in JOIN::optimize in maria-5.3
Analysis:

The crash happens when processing ref access on the `partsupp` table. The EXPLAIN shows:

i.e. partsupp uses ref acess over 2 key parts, with references being:

const, test.lineitem.l_suppkey

Now, if we look inside create_ref_for_key() function, we see this code:

for (i=0 ; i < keyparts ; keyuse+,i+)
{
...
if (!keyuse->used_tables &&
!(join->select_options & SELECT_DESCRIBE))

else
*ref_key++= get_store_key(thd,
keyuse,join->const_table_map,
&keyinfo->key_part[i],
key_buff, maybe_null);

ref_key here points to tab->ref.key_copy, and it's easy to see that

• first part of the reference is "const", so we won't put anything into tab->ref.key_copy for it.
• second part of the reference is test.lineitem.l_suppkey, and we will get one element into tab->ref.key_copy for it.

If we then proceed to equality substitution code in JOIN::optimize():

/*
Perform the optimization on fields evaliation mentioned above
for all used ref items.
*/
1 for (JOIN_TAB *tab= join_tab + const_tables; tab < join_tab + tables; tab++)
{
for (uint i=0; i < tab->ref.key_parts; i++)
{

Item **ref_item_ptr= tab->ref.items+i;
Item *ref_item= *ref_item_ptr;
if (!ref_item->used_tables() && !(select_options & SELECT_DESCRIBE))
continue;
COND_EQUAL *equals= tab->first_inner ? tab->first_inner->cond_equal :
cond_equal;
ref_item= substitute_for_best_equal_field(ref_item, equals, map2table);
ref_item->update_used_tables();
if (*ref_item_ptr != ref_item)
{
*ref_item_ptr= ref_item;
Item *item= ref_item->real_item();
store_key *key_copy= tab->ref.key_copy[i];
=> if (key_copy->type() == store_key::FIELD_STORE_KEY)

}
}
}

we'll see that the line marked with => assumes that tab->ref.key_copy[i] will hold an element for the i-th keypart. As was shown above, this is not true when we've had a reference to constant for some keypart N<i.

As a result, we get the crash

Re: Crash in JOIN::optimize in maria-5.3
A simpler testcase:

create table t1 (a int);
insert into t1 values (1),(2);
insert into t1 select * from t1;

create table t2 (a int, b int, key(a,b));
insert into t2 values (1,1),(1,2),(1,3),(1,4),(2,5),(2,6),(2,7),(2,8),(2,9);
insert into t2 select * from t2;
insert into t2 select * from t2;
insert into t2 select * from t2;

create table t0 (a int, b int, key(a));
insert into t0 values (1,1),(2,2);

select * from t0 straight_join t1 straight_join t2 force index(a) where t2.a=1 and t2.b=t1.a and t1.a=t0.b and t0.a=1;

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x903c2b90 (LWP 6653)]
0x08357e57 in JOIN::optimize (this=0xb0df308) at sql_select.cc:1075
(gdb) list
1070 if (*ref_item_ptr != ref_item)
1071 {
1072 *ref_item_ptr= ref_item;
1073 Item *item= ref_item->real_item();
1074 store_key *key_copy= tab->ref.key_copy[i];
1075 if (key_copy->type() == store_key::FIELD_STORE_KEY)
1076

Launchpad bug id: 724275