[MDEV-7751] Server crashes in TABLE_LIST::reset_const_table on 2nd execution of PS with ONLY_FULL_GROUP_BY, view, subqueries Created: 2015-03-11  Updated: 2015-12-02  Resolved: 2015-12-02

Status: Closed
Project: MariaDB Server
Component/s: Optimizer, Prepared Statements, Views
Affects Version/s: 5.5
Fix Version/s: 5.5.45, 10.0.21

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Blocks
Relates
relates to MDEV-7688 Server crashes in TABLE_LIST::is_view... Closed
relates to MDEV-7689 Server crashes in Item_subselect::rec... Closed
relates to MDEV-7690 Server crashes in Item_field::used_ta... Closed
relates to MDEV-7696 Server goes into an endless loop on 2... Closed
relates to MDEV-7688 Server crashes in TABLE_LIST::is_view... Closed
relates to MDEV-7689 Server crashes in Item_subselect::rec... Closed
relates to MDEV-7690 Server crashes in Item_field::used_ta... Closed
relates to MDEV-7696 Server goes into an endless loop on 2... Closed
Sprint: 5.5.47-1

 Description   

Attention: I am only getting the crash on a VALGRIND build
cmake . -DCMAKE_BUILD_TYPE=Debug -DWITH_VALGRIND=YES

See also MDEV-7688, MDEV-7689, MDEV-7690, MDEV-7696 - they all are somewhat similar, probably there are duplicates among them; but effects are different everywhere.

The problem appeared in 5.5 tree with the following revision:

revno: 4255
revision-id: sanja@askmonty.org-20140731071110-4uyuza0ykesfxe1b
parent: monty@mariadb.org-20140730102752-3ilbpvmbhr2r9a4x
committer: sanja@askmonty.org
branch nick: work-maria-5.5-MDEV-6441
timestamp: Thu 2014-07-31 10:11:10 +0300
message:
  MDEV-6441: memory leak
  
  mysql_derived_prepare() was executed on the statement memory.
  Now it is executed on the runtime memory.
  All bugs induced by this were fixed.

Stack trace from 5.5 commit 34f37aa0c0aa87cfb6908500e937516ff37ea6f0

#2  0x00000000007f0def in handle_fatal_signal (sig=11) at sql/signal_handler.cc:262
#3  <signal handler called>
#4  0x00000000007083ad in TABLE_LIST::reset_const_table (this=0x7f5fea045f18) at sql/table.cc:6631
#5  0x0000000000708404 in TABLE_LIST::reset_const_table (this=0x7f5fea04b418) at sql/table.cc:6638
#6  0x00000000005e6bbc in setup_table_map (table=0x7f5fea0e5018, table_list=0x7f5fea04b418, tablenr=0) at sql/sql_base.h:358
#7  0x00000000005e0e61 in setup_tables (thd=0x7f5fead18000, context=0x7f5fea088068, from_clause=0x7f5fea0881b0, tables=0x7f5fea04b418, leaves=..., select_insert=false, full_table_list=false) at sql/sql_base.cc:8321
#8  0x00000000005e1300 in setup_tables_and_check_access (thd=0x7f5fead18000, context=0x7f5fea088068, from_clause=0x7f5fea0881b0, tables=0x7f5fea04b418, leaves=..., select_insert=false, want_access_first=1, want_access=1, full_table_list=false) at sql/sql_base.cc:8431
#9  0x0000000000664861 in JOIN::prepare (this=0x7f5fea04ea18, rref_pointer_array=0x7f5fea0882d8, tables_init=0x7f5fea04b418, wild_num=0, conds_init=0x7f5fea020498, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7f5fea088018, unit_arg=0x7f5fea030018) at sql/sql_select.cc:651
#10 0x00000000006e7245 in st_select_lex_unit::prepare (this=0x7f5fea030018, thd_arg=0x7f5fead18000, sel_result=0x7f5fea0485d8, additional_options=0) at sql/sql_union.cc:332
#11 0x000000000060f1af in mysql_derived_prepare (thd=0x7f5fead18000, lex=0x7f5fea0e0018, derived=0x7f5fea04c018) at sql/sql_derived.cc:657
#12 0x000000000060e60f in mysql_handle_single_derived (lex=0x7f5fea0e0018, derived=0x7f5fea04c018, phases=2) at sql/sql_derived.cc:192
#13 0x00000000007084b7 in TABLE_LIST::handle_derived (this=0x7f5fea04c018, lex=0x7f5fea0e0018, phases=2) at sql/table.cc:6666
#14 0x000000000062adde in st_select_lex::handle_derived (this=0x7f5fea0e07c8, lex=0x7f5fea0e0018, phases=2) at sql/sql_lex.cc:3554
#15 0x000000000066476e in JOIN::prepare (this=0x7f5fea04de18, rref_pointer_array=0x7f5fea0e0a88, tables_init=0x7f5fea04c018, wild_num=0, conds_init=0x7f5fea047818, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7f5fea0e07c8, unit_arg=0x7f5fea0e00c8) at sql/sql_select.cc:636
#16 0x000000000066d531 in mysql_select (thd=0x7f5fead18000, rref_pointer_array=0x7f5fea0e0a88, tables=0x7f5fea04c018, wild_num=0, fields=..., conds=0x7f5fea047818, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184064, result=0x7f5fea044098, unit=0x7f5fea0e00c8, select_lex=0x7f5fea0e07c8) at sql/sql_select.cc:3074
#17 0x0000000000663e63 in handle_select (thd=0x7f5fead18000, lex=0x7f5fea0e0018, result=0x7f5fea044098, setup_tables_done_option=0) at sql/sql_select.cc:319
#18 0x000000000063c293 in execute_sqlcom_select (thd=0x7f5fead18000, all_tables=0x7f5fea04c018) at sql/sql_parse.cc:4689
#19 0x000000000063546c in mysql_execute_command (thd=0x7f5fead18000) at sql/sql_parse.cc:2234
#20 0x0000000000656b1b in Prepared_statement::execute (this=0x7f5fea0d6280, expanded_query=0x7f5feabb4c50, open_cursor=false) at sql/sql_prepare.cc:3928
#21 0x0000000000655c32 in Prepared_statement::execute_loop (this=0x7f5fea0d6280, expanded_query=0x7f5feabb4c50, open_cursor=false, packet=0x0, packet_end=0x0) at sql/sql_prepare.cc:3587
#22 0x0000000000653d56 in mysql_sql_stmt_execute (thd=0x7f5fead18000) at sql/sql_prepare.cc:2737
#23 0x000000000063549a in mysql_execute_command (thd=0x7f5fead18000) at sql/sql_parse.cc:2244
#24 0x000000000063ed98 in mysql_parse (thd=0x7f5fead18000, rawbuf=0x7f5fea01c0d8 "EXECUTE stmt", length=12, parser_state=0x7f5feabb5610) at sql/sql_parse.cc:5909
#25 0x00000000006329b3 in dispatch_command (command=COM_QUERY, thd=0x7f5fead18000, packet=0x7f5fead8c001 "EXECUTE stmt", packet_length=12) at sql/sql_parse.cc:1079
#26 0x0000000000631b3f in do_command (thd=0x7f5fead18000) at sql/sql_parse.cc:793
#27 0x0000000000739b14 in do_handle_one_connection (thd_arg=0x7f5fead18000) at sql/sql_connect.cc:1266
#28 0x00000000007395d3 in handle_one_connection (arg=0x7f5fead18000) at sql/sql_connect.cc:1181
#29 0x0000000000b836e3 in pfs_spawn_thread (arg=0x7f5feefed760) at storage/perfschema/pfs.cc:1015
#30 0x00007f5ff0db0b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
#31 0x00007f5fef6be70d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

Test case

SET sql_mode=ONLY_FULL_GROUP_BY;
 
CREATE TABLE t1 (a INT, f1 INT, f2 INT, f3 INT, f4 INT);
INSERT INTO t1 VALUES (1,10,11,12,13),(8,20,21,22,23);
CREATE VIEW v1 AS SELECT * FROM t1;
 
CREATE TABLE t2 (b INT);
INSERT INTO t2 VALUES (8),(6);
 
CREATE TABLE t3 (c INT);
INSERT INTO t3 VALUES (12),(22);
 
PREPARE stmt FROM "
  SELECT * FROM ( SELECT t1.* FROM v1 INNER JOIN t1 ON (t1.a = v1.a) WHERE 0 ) AS sq 
  WHERE a NOT IN ( SELECT MAX(b) FROM t1 INNER JOIN ( t2 INNER JOIN t3 ON (c = b) ) ON (c = b) ) 
";
 
EXECUTE stmt;
EXECUTE stmt;



 Comments   
Comment by Oleksandr Byelkin [ 2015-12-02 ]

it looks like fixed:

==============================================================================
 
TEST                                      RESULT   TIME (ms) or COMMENT
--------------------------------------------------------------------------
 
worker[1] Using MTR_BUILD_THREAD 300, with reserved ports 16000..16019
SET sql_mode=ONLY_FULL_GROUP_BY;
CREATE TABLE t1 (a INT, f1 INT, f2 INT, f3 INT, f4 INT);
INSERT INTO t1 VALUES (1,10,11,12,13),(8,20,21,22,23);
CREATE VIEW v1 AS SELECT * FROM t1;
CREATE TABLE t2 (b INT);
INSERT INTO t2 VALUES (8),(6);
CREATE TABLE t3 (c INT);
INSERT INTO t3 VALUES (12),(22);
PREPARE stmt FROM "
  SELECT * FROM ( SELECT t1.* FROM v1 INNER JOIN t1 ON (t1.a = v1.a) WHERE 0 ) AS sq 
  WHERE a NOT IN ( SELECT MAX(b) FROM t1 INNER JOIN ( t2 INNER JOIN t3 ON (c = b) ) ON (c = b) ) 
";
EXECUTE stmt;
a	f1	f2	f3	f4
EXECUTE stmt;
a	f1	f2	f3	f4
drop view v1;
drop table t1,t2,t3;
main.test                                [ pass ]      6
--------------------------------------------------------------------------
The servers were restarted 0 times
Spent 0.006 of 1 seconds executing testcases
 
Completed: All 1 tests were successful.
 
sanja@Sanja-ThinkPad:~/maria/git/server/mysql-test$ ../sql/mysqld --version
../sql/mysqld  Ver 5.5.46-MariaDB-valgrind-max-debug for Linux on x86_64 (Source distribution)
151202 12:49:27 [Note] ../sql/mysqld (mysqld 5.5.46-MariaDB-valgrind-max-debug) starting as process 24392 ...
sanja@Sanja-ThinkPad:~/maria/git/server/mysql-test$ 
 

Comment by Elena Stepanova [ 2015-12-02 ]

Fixed in 5.5.45 / 10.0.21 by the following commit:

commit 2e941fe9fce7f1667993916ff3f238a283286d3f
Author: Monty <monty@mariadb.org>
Date:   Thu Jun 25 23:18:48 2015 +0300
 
    Fixed crashing bug when using ONLY_FULL_GROUP_BY in a stored procedure/trigger that is repeatedly executed.
    This is MDEV-7601, including it's sub tasks MDEV-7594, MDEV-7555, MDEV-7590, MDEV-7581, MDEV-7589
    
    The problem was that select_lex->non_agg_fields was not properly reset for re-execution and this caused an overwrite of a random memory position.
    The fix was move non_agg_fields from select_lext to JOIN, which is properly reset.

Generated at Thu Feb 08 07:21:59 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.