[MDEV-5791] Server crash or valgrind warnings "Invalid read" in Field::is_real_null, create_tmp_table Created: 2014-03-05  Updated: 2018-03-15  Resolved: 2018-03-15

Status: Closed
Project: MariaDB Server
Component/s: OTHER
Affects Version/s: 10.0, 10.1
Fix Version/s: N/A

Type: Bug Priority: Minor
Reporter: Elena Stepanova Assignee: Varun Gupta (Inactive)
Resolution: Cannot Reproduce Votes: 0
Labels: None

Issue Links:
Relates
Sprint: 10.1.29, 10.1.32

 Description   

CREATE TABLE t1 (i INT);
INSERT INTO t1 VALUES (1),(2);
SELECT DISTINCT DEFAULT(i) FROM t1 GROUP BY @A := 'a' WITH ROLLUP;

==18644== Thread 19:
==18644== Invalid read of size 1
==18644==    at 0x6E45B4: Field::is_real_null(long long) const (in /data/repo/10.0/sql/mysqld)
==18644==    by 0x6CD293: create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, char const*, bool, bool) (sql_select.cc:15925)
==18644==    by 0x6ACDA2: JOIN::exec_inner() (sql_select.cc:2738)
==18644==    by 0x6AB7CF: JOIN::exec() (sql_select.cc:2355)
==18644==    by 0x6AEB4E: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:3292)
==18644==    by 0x6A527E: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:372)
==18644==    by 0x67A250: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5301)
==18644==    by 0x6725FB: mysql_execute_command(THD*) (sql_parse.cc:2587)
==18644==    by 0x67C9DA: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:6447)
==18644==    by 0x66F7A8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1308)
==18644==    by 0x66EB4A: do_command(THD*) (sql_parse.cc:1005)
==18644==    by 0x7880EC: do_handle_one_connection(THD*) (sql_connect.cc:1379)
==18644==    by 0x787E3F: handle_one_connection (sql_connect.cc:1293)
==18644==    by 0xA2CAC4: pfs_spawn_thread (pfs.cc:1853)
==18644==    by 0x4E35B4F: start_thread (pthread_create.c:304)
==18644==    by 0x6964A7C: clone (clone.S:112)
==18644==  Address 0x166ca958 is 56 bytes inside a block of size 244 free'd
==18644==    at 0x4C27BF4: free (vg_replace_malloc.c:469)
==18644==    by 0xE0D576: free_memory (safemalloc.c:276)
==18644==    by 0xE0D23A: sf_free (safemalloc.c:194)
==18644==    by 0xDFC565: my_free (my_malloc.c:216)
==18644==    by 0xDD64EC: delete_dynamic (array.c:301)
==18644==    by 0x7BE33B: Dynamic_array<Explain_union*>::~Dynamic_array() (sql_array.h:223)
==18644==    by 0x7BB7C8: Explain_query::~Explain_query() (sql_explain.cc:32)
==18644==    by 0x7BDEE9: delete_explain_query(LEX*) (sql_explain.cc:937)
==18644==    by 0x670FD8: log_slow_statement(THD*) (sql_parse.cc:1823)
==18644==    by 0x670C98: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1739)
==18644==    by 0x66EB4A: do_command(THD*) (sql_parse.cc:1005)
==18644==    by 0x7880EC: do_handle_one_connection(THD*) (sql_connect.cc:1379)
==18644==    by 0x787E3F: handle_one_connection (sql_connect.cc:1293)
==18644==    by 0xA2CAC4: pfs_spawn_thread (pfs.cc:1853)
==18644==    by 0x4E35B4F: start_thread (pthread_create.c:304)
==18644==    by 0x6964A7C: clone (clone.S:112)
==18644== Invalid read of size 1
==18644==    at 0x4C2ABC4: memcpy (mc_replace_strmem.c:883)
==18644==    by 0x6CD301: create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, char const*, bool, bool) (sql_select.cc:15930)
==18644==    by 0x6ACDA2: JOIN::exec_inner() (sql_select.cc:2738)
==18644==    by 0x6AB7CF: JOIN::exec() (sql_select.cc:2355)
==18644==    by 0x6AEB4E: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:3292)
==18644==    by 0x6A527E: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:372)
==18644==    by 0x67A250: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5301)
==18644==    by 0x6725FB: mysql_execute_command(THD*) (sql_parse.cc:2587)
==18644==    by 0x67C9DA: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:6447)
==18644==    by 0x66F7A8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1308)
==18644==    by 0x66EB4A: do_command(THD*) (sql_parse.cc:1005)
==18644==    by 0x7880EC: do_handle_one_connection(THD*) (sql_connect.cc:1379)
==18644==    by 0x787E3F: handle_one_connection (sql_connect.cc:1293)
==18644==    by 0xA2CAC4: pfs_spawn_thread (pfs.cc:1853)
==18644==    by 0x4E35B4F: start_thread (pthread_create.c:304)
==18644==    by 0x6964A7C: clone (clone.S:112)
==18644==  Address 0x166ca95c is 60 bytes inside a block of size 244 free'd
==18644==    at 0x4C27BF4: free (vg_replace_malloc.c:469)
==18644==    by 0xE0D576: free_memory (safemalloc.c:276)
==18644==    by 0xE0D23A: sf_free (safemalloc.c:194)
==18644==    by 0xDFC565: my_free (my_malloc.c:216)
==18644==    by 0xDD64EC: delete_dynamic (array.c:301)
==18644==    by 0x7BE33B: Dynamic_array<Explain_union*>::~Dynamic_array() (sql_array.h:223)
==18644==    by 0x7BB7C8: Explain_query::~Explain_query() (sql_explain.cc:32)
==18644==    by 0x7BDEE9: delete_explain_query(LEX*) (sql_explain.cc:937)
==18644==    by 0x670FD8: log_slow_statement(THD*) (sql_parse.cc:1823)
==18644==    by 0x670C98: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1739)
==18644==    by 0x66EB4A: do_command(THD*) (sql_parse.cc:1005)
==18644==    by 0x7880EC: do_handle_one_connection(THD*) (sql_connect.cc:1379)
==18644==    by 0x787E3F: handle_one_connection (sql_connect.cc:1293)
==18644==    by 0xA2CAC4: pfs_spawn_thread (pfs.cc:1853)
==18644==    by 0x4E35B4F: start_thread (pthread_create.c:304)
==18644==    by 0x6964A7C: clone (clone.S:112)

Stack trace from:

revision-id: sergii@pisem.net-20140228200458-2nzjwfzn554m5aja
revno: 4017
branch-nick: 10.0



 Comments   
Comment by Elena Stepanova [ 2016-08-04 ]

Still happens on 10.0, 10.1, 10.2.
I also got an actual crash with a similar stack trace:

Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
mysqld.exe!Field::is_real_null()[field.h:700]
mysqld.exe!create_tmp_table()[sql_select.cc:16314]
mysqld.exe!JOIN::exec_inner()[sql_select.cc:2756]
mysqld.exe!JOIN::exec()[sql_select.cc:2375]
mysqld.exe!mysql_select()[sql_select.cc:3310]
mysqld.exe!handle_select()[sql_select.cc:373]
mysqld.exe!mysql_execute_command()[sql_parse.cc:3015]
mysqld.exe!Prepared_statement::execute()[sql_prepare.cc:3973]
mysqld.exe!Prepared_statement::execute_loop()[sql_prepare.cc:3628]
mysqld.exe!mysql_sql_stmt_execute()[sql_prepare.cc:2780]
mysqld.exe!mysql_execute_command()[sql_parse.cc:2574]
mysqld.exe!mysql_parse()[sql_parse.cc:6575]
mysqld.exe!dispatch_command()[sql_parse.cc:1312]
mysqld.exe!do_command()[sql_parse.cc:999]
mysqld.exe!threadpool_process_request()[threadpool_common.cc:239]
mysqld.exe!io_completion_callback()[threadpool_win.cc:568]
KERNEL32.DLL!VirtualUnlock()
ntdll.dll!RtlGetActiveActivationContext()
ntdll.dll!RtlFreeUnicodeString()
KERNEL32.DLL!BaseThreadInitThunk()
ntdll.dll!RtlUserThreadStart()

So, it's not a hypothetical problem.

Comment by Varun Gupta (Inactive) [ 2018-03-14 ]

Can't reproduce on the current 10.0, 10.1 and 10.2 .

Generated at Thu Feb 08 07:07:05 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.