Server crashes in different ways while executing concurrent flow involving views and non-empty sql_mode (MDEV-7601)

[MDEV-7590] Server crashes in st_select_lex_unit::cleanup on executing a trigger Created: 2015-02-15  Updated: 2015-12-02  Resolved: 2015-05-19

Status: Closed
Project: MariaDB Server
Component/s: Data Definition - Procedure, Optimizer
Affects Version/s: 5.5
Fix Version/s: 5.5.45, 10.0.21

Type: Technical task Priority: Major
Reporter: Elena Stepanova Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: None


 Description   

Note: see also MDEV-7581, might be related.

Stack trace from 5.5 revno 4433

#3  <signal handler called>
#4  0x00000000006e67f1 in st_select_lex_unit::cleanup (this=0x7f502b649128) at 5.5/sql/sql_union.cc:887
#5  0x00000000006e6c19 in st_select_lex::cleanup (this=0x7f502b56a1d0) at 5.5/sql/sql_union.cc:1022
#6  0x000000000066c523 in mysql_select (thd=0x7f502c550060, rref_pointer_array=0x7f502b56a440, tables=0x7f502b554648, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=3489663744, result=0x7f502b662da8, unit=0x7f502b569af0, select_lex=0x7f502b56a1d0) at 5.5/sql/sql_select.cc:3106
#7  0x0000000000662f69 in handle_select (thd=0x7f502c550060, lex=0x7f502b569a40, result=0x7f502b662da8, setup_tables_done_option=1073741824) at 5.5/sql/sql_select.cc:319
#8  0x000000000063735d in mysql_execute_command (thd=0x7f502c550060) at 5.5/sql/sql_parse.cc:3060
#9  0x000000000091a5ac in sp_instr_stmt::exec_core (this=0x7f502b56b010, thd=0x7f502c550060, nextp=0x7f502bfb46a8) at 5.5/sql/sp_head.cc:3222
#10 0x0000000000919d91 in sp_lex_keeper::reset_lex_and_exec_core (this=0x7f502b56b050, thd=0x7f502c550060, nextp=0x7f502bfb46a8, open_tables=false, instr=0x7f502b56b010) at 5.5/sql/sp_head.cc:3000
#11 0x000000000091a310 in sp_instr_stmt::execute (this=0x7f502b56b010, thd=0x7f502c550060, nextp=0x7f502bfb46a8) at 5.5/sql/sp_head.cc:3146
#12 0x0000000000916144 in sp_head::execute (this=0x7f502b569078, thd=0x7f502c550060, merge_da_on_success=false) at 5.5/sql/sp_head.cc:1433
#13 0x0000000000916c13 in sp_head::execute_trigger (this=0x7f502b569078, thd=0x7f502c550060, db_name=0x7f502b458ca8, table_name=0x7f502b458cb8, grant_info=0x7f502b460728) at 5.5/sql/sp_head.cc:1738
#14 0x00000000006e0372 in Table_triggers_list::process_triggers (this=0x7f502b460678, thd=0x7f502c550060, event=TRG_EVENT_INSERT, time_type=TRG_ACTION_BEFORE, old_row_is_record1=true) at 5.5/sql/sql_trigger.cc:2156
#15 0x00000000005e4661 in fill_record_n_invoke_before_triggers (thd=0x7f502c550060, fields=..., values=..., ignore_errors=false, triggers=0x7f502b460678, event=TRG_EVENT_INSERT) at 5.5/sql/sql_base.cc:9068
#16 0x00000000006187bd in mysql_insert (thd=0x7f502c550060, table_list=0x7f502b687198, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false) at 5.5/sql/sql_insert.cc:907
#17 0x0000000000636ef1 in mysql_execute_command (thd=0x7f502c550060) at 5.5/sql/sql_parse.cc:2974
#18 0x000000000063ec8e in mysql_parse (thd=0x7f502c550060, rawbuf=0x7f502b687078 "INSERT INTO `view_DD` ( `pk` ) VALUES (NULL)", length=44, parser_state=0x7f502bfb5620) at 5.5/sql/sql_parse.cc:5909
#19 0x00000000006328d1 in dispatch_command (command=COM_QUERY, thd=0x7f502c550060, packet=0x7f502c607061 "INSERT INTO `view_DD` ( `pk` ) VALUES (NULL)", packet_length=44) at 5.5/sql/sql_parse.cc:1079
#20 0x0000000000631a5d in do_command (thd=0x7f502c550060) at 5.5/sql/sql_parse.cc:793
#21 0x00000000007340ea in do_handle_one_connection (thd_arg=0x7f502c550060) at 5.5/sql/sql_connect.cc:1266
#22 0x0000000000733ba9 in handle_one_connection (arg=0x7f502c550060) at 5.5/sql/sql_connect.cc:1181
#23 0x0000000000b6c2cd in pfs_spawn_thread (arg=0x7f502c571ca0) at 5.5/storage/perfschema/pfs.cc:1015
#24 0x00007f50327d5b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
#25 0x00007f5030a8b70d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x7f502b662078): INSERT INTO `view_BB` SELECT * FROM `view_A` LIMIT 0
Connection ID (thread ID): 2
Status: NOT_KILLED

Test case

SET sql_mode = ONLY_FULL_GROUP_BY;
 
CREATE TABLE A (
    pk INTEGER AUTO_INCREMENT,
    col_int_key INTEGER,
    col_varchar_key VARCHAR(1),
    PRIMARY KEY (pk)
) ENGINE=MyISAM;
CREATE VIEW view_A AS SELECT * FROM A;
CREATE TABLE C (
    pk INTEGER AUTO_INCREMENT,
    col_int_nokey INTEGER,
    col_int_key INTEGER,
    col_date_key DATE,
    col_date_nokey DATE,
    col_time_key TIME,
    col_time_nokey TIME,
    col_datetime_key DATETIME,
    col_datetime_nokey DATETIME,
    col_varchar_key VARCHAR(1),
    col_varchar_nokey VARCHAR(1),
    PRIMARY KEY (pk)
) ENGINE=MyISAM;
CREATE VIEW view_C AS SELECT * FROM C;
CREATE TABLE AA (
    pk INTEGER AUTO_INCREMENT,
    col_int_nokey INTEGER,
    col_int_key INTEGER,
    col_date_key DATE,
    col_date_nokey DATE,
    col_time_key TIME,
    col_time_nokey TIME,
    col_datetime_key DATETIME,
    col_datetime_nokey DATETIME,
    col_varchar_key VARCHAR(1),
    col_varchar_nokey VARCHAR(1),
    PRIMARY KEY (pk),
    KEY (col_varchar_key, col_int_key)
) ENGINE=MyISAM;
CREATE VIEW view_AA AS SELECT * FROM AA;
CREATE TABLE BB (
    pk INTEGER AUTO_INCREMENT,
    col_int_key INTEGER,
    col_varchar_key VARCHAR(1),
    col_varchar_nokey VARCHAR(1),
    PRIMARY KEY (pk),
    KEY (col_varchar_key, col_int_key)
) ENGINE=MyISAM;
CREATE VIEW view_BB AS SELECT * FROM BB;
CREATE TABLE DD (
    pk INTEGER AUTO_INCREMENT,
    col_int_key INTEGER,
    col_date_key DATE,
    col_time_key TIME,
    col_datetime_key DATETIME,
    col_varchar_key VARCHAR(1),
    PRIMARY KEY (pk),
    KEY (col_varchar_key, col_int_key)
) ENGINE=MyISAM;
CREATE VIEW view_DD AS SELECT * FROM DD;
CREATE TRIGGER k BEFORE INSERT ON `DD` FOR EACH ROW INSERT INTO `view_BB` SELECT * FROM `view_A` LIMIT 0 ;
CREATE TRIGGER r BEFORE INSERT ON `A` FOR EACH ROW INSERT INTO `view_AA` SELECT * FROM `view_C` LIMIT 0 ;
--error ER_WRONG_AUTO_KEY
ALTER TABLE `DD` DROP PRIMARY KEY;
INSERT INTO `view_A` ( `pk` ) VALUES (NULL);
--error 0,ER_WRONG_VALUE_COUNT_ON_ROW
INSERT INTO `DD` ( `pk` ) VALUES (NULL);
INSERT INTO `A` ( `pk` ) VALUES (NULL);
INSERT INTO `view_DD` ( `pk` ) VALUES (NULL);



 Comments   
Comment by Michael Widenius [ 2015-05-19 ]

The problem was that select_lex->non_agg_fields was not properly reset for re-execution and this caused an overwrite of a random memory position.
The fix was move non_agg_fields from select_lext to JOIN, which is properly reset.

Fix pushed into the 5.5 tree.

Generated at Thu Feb 08 07:20:46 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.