[MDEV-3903] Exists2In: Server crashes in Item_cond::fix_fields on 2nd execution of a prepared stmt with exists_to_in+materialization+semijoin, EXISTS subquery, STRAIGHT_JOIN Created: 2012-12-01  Updated: 2013-02-07  Resolved: 2013-02-07

Status: Closed
Project: MariaDB Server
Component/s: None
Affects Version/s: None
Fix Version/s: 10.0.2

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Oleksandr Byelkin
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
PartOf
is part of MDEV-38 NOT EXISTS to IN (part of exists2in t... Closed
Relates

 Description   

#3  <signal handler called>
#4  0x000000000081458e in Item_cond::fix_fields (this=0x392f628, thd=0x38f6df0, ref=0x3929458) at 10.0-exists2in/sql/item_cmpfunc.cc:4308
#5  0x0000000000766503 in setup_jtbm_semi_joins (join=0x3928fe8, join_list=0x3926db0, join_where=0x3929458) at 10.0-exists2in/sql/opt_subselect.cc:5230
#6  0x0000000000645b5a in JOIN::optimize_inner (this=0x3928fe8) at 10.0-exists2in/sql/sql_select.cc:1140
#7  0x0000000000645414 in JOIN::optimize (this=0x3928fe8) at 10.0-exists2in/sql/sql_select.cc:994
#8  0x000000000064d0f2 in mysql_select (thd=0x38f6df0, rref_pointer_array=0x3926ed0, tables=0x39278f8, wild_num=0, fields=..., conds=0x392a438, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184066, result=0x37f36a8, unit=0x3926528, select_lex=0x3926c20) at 10.0-exists2in/sql/sql_select.cc:3193
#9  0x000000000064387e in handle_select (thd=0x38f6df0, lex=0x3926478, result=0x37f36a8, setup_tables_done_option=0) at 10.0-exists2in/sql/sql_select.cc:362
#10 0x000000000061b13b in execute_sqlcom_select (thd=0x38f6df0, all_tables=0x39278f8) at 10.0-exists2in/sql/sql_parse.cc:4937
#11 0x00000000006137a8 in mysql_execute_command (thd=0x38f6df0) at 10.0-exists2in/sql/sql_parse.cc:2421
#12 0x0000000000635b95 in Prepared_statement::execute (this=0x38fefc0, expanded_query=0x7f87e83a7c30, open_cursor=false) at 10.0-exists2in/sql/sql_prepare.cc:3914
#13 0x0000000000634c2c in Prepared_statement::execute_loop (this=0x38fefc0, expanded_query=0x7f87e83a7c30, open_cursor=false, packet=0x0, packet_end=0x0) at 10.0-exists2in/sql/sql_prepare.cc:3570
#14 0x0000000000632ce3 in mysql_sql_stmt_execute (thd=0x38f6df0) at 10.0-exists2in/sql/sql_prepare.cc:2732
#15 0x00000000006137d9 in mysql_execute_command (thd=0x38f6df0) at 10.0-exists2in/sql/sql_parse.cc:2431
#16 0x000000000061d9f6 in mysql_parse (thd=0x38f6df0, rawbuf=0x391c368 "EXECUTE stmt", length=12, parser_state=0x7f87e83a84e0) at 10.0-exists2in/sql/sql_parse.cc:6056
#17 0x000000000061099a in dispatch_command (command=COM_QUERY, thd=0x38f6df0, packet=0x3901001 "EXECUTE stmt", packet_length=12) at 10.0-exists2in/sql/sql_parse.cc:1216
#18 0x000000000060fb93 in do_command (thd=0x38f6df0) at 10.0-exists2in/sql/sql_parse.cc:945
#19 0x000000000071a57a in do_handle_one_connection (thd_arg=0x38f6df0) at 10.0-exists2in/sql/sql_connect.cc:1254

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x3905028): SELECT STRAIGHT_JOIN * FROM t1 WHERE EXISTS ( SELECT * FROM t2 WHERE b = a )
Connection ID (thread ID): 2
Status: NOT_KILLED

branch: 10.0-exists2in
revision-id: sanja@montyprogram.com-20121129184233-zxp9qe77tfcupomh
date: 2012-11-29 20:42:33 +0200
revno: 3486

Minimal optimizer_switch: materialization=on,semijoin=on,exists_to_in=on
Full optimizer_switch (default + exists_to_in=on):

index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on,extended_keys=off,exists_to_in=on

Test case:

SET optimizer_switch='materialization=on,semijoin=on,exists_to_in=on';
 
CREATE TABLE t1 (a INT) ENGINE=MyISAM;
INSERT INTO t1 VALUES (1),(2);
 
CREATE TABLE t2 (b INT) ENGINE=MyISAM;
INSERT INTO t2 VALUES (3),(4);
 
PREPARE stmt FROM
'SELECT STRAIGHT_JOIN * FROM t1
WHERE EXISTS ( SELECT * FROM t2 WHERE b = a )';
 
EXECUTE stmt;
EXECUTE stmt;
 



 Comments   
Comment by Oleksandr Byelkin [ 2012-12-03 ]

Address which we try to access during the crash (where variable item points) is beginning of memory allocated my mem_root internal allocator (not pointer returned by it).

Comment by Oleksandr Byelkin [ 2013-02-07 ]

the problem is that when we create IN subquery unit->item is already assigned and the subquery writes itself there as temporary changing.

Generated at Thu Feb 08 06:52:09 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.