| Bug #11088 | Crash on query | ||
|---|---|---|---|
| Submitted: | 3 Jun 2005 22:34 | Modified: | 21 Jun 2005 12:18 |
| Reporter: | Bara Mustafa | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server: Optimizer | Severity: | S1 (Critical) |
| Version: | 4.1.12 & 5.0.6 | OS: | Linux (Linux & Windows) |
| Assigned to: | Igor Babaev | CPU Architecture: | Any |
[3 Jun 2005 22:37]
Bara Mustafa
I forgot to mention the returned message I get when using PHP is: #2006 - MySQL server has gone away
[3 Jun 2005 23:37]
MySQL Verification Team
Thank you for the bug report I was able to repeat with current BK source
5.0 server.
050604 2:29:38 [Note] /home/miguel/dbs/5.0/libexec/mysqld: ready for connections.
Version: '5.0.7-beta-debug' socket: '/tmp/mysql.sock' port: 3306 Source distribution
[New Thread 180236 (LWP 11539)]
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 180236 (LWP 11539)]
0x081ca927 in String::real_alloc (this=0x8e98d9c, arg_length=0) at sql_string.cc:57
warning: Source file is more recent than executable.
57 }
(gdb) backtrace full
#0 0x081ca927 in String::real_alloc (this=0x8e98d9c, arg_length=0) at sql_string.cc:57
No locals.
#1 0x0815fb01 in String (this=0x8e98d9c, length_arg=4294967295) at sql_string.h:48
No locals.
#2 0x0815f825 in Item_str_buff (this=0x8e98d90, arg=0x8e971e8) at item.h:1502
No locals.
#3 0x0815eef9 in new_Item_buff (item=0x8e971e8) at item_buff.cc:33
No locals.
#4 0x0823cfd2 in alloc_group_fields (join=0x8e97920, group=0x8e978d8) at sql_select.cc:12247
tmp = (class Item_buff *) 0xbe3fefcc
#5 0x0823cf73 in make_group_fields (main_join=0x8e97920, curr_join=0x8e97920) at sql_select.cc:12227
No locals.
#6 0x082235d1 in JOIN::exec (this=0x8e97920) at sql_select.cc:1481
tmp_error = -2138813952
_db_func_ = 0x8e7b634 " ré\b@té\b\002"
_db_file_ = 0x8e7b390 "H×a\b(ï\177\b,ï\177\bX×a\b(xé\b qé\b"
_db_level_ = 149518624
---Type <return> to continue, or q <return> to quit---
_db_framep_ = (char **) 0x8e7b5c4
curr_join = (JOIN *) 0x8e97920
curr_all_fields = (List<Item> *) 0x8e9864c
curr_fields_list = (List<Item> *) 0x8e7b634
curr_tmp_table = (TABLE *) 0x0
#7 0x08224e31 in mysql_select (thd=0x8e7b390, rref_pointer_array=0x8e7b6d4, tables=0x8e97488, wild_num=0,
fields=@0x8e7b634, conds=0x8e97718, og_num=1, order=0x0, group=0x8e978d8, having=0x0, proc_param=0x0,
select_options=2156153344, result=0x8e97910, unit=0x8e7b3e0, select_lex=0x8e7b5c4) at sql_select.cc:2042
err = false
free_join = true
_db_func_ = 0x8e7b5c4 "\2104_\b"
_db_file_ = 0xbe3ff10c "ĵç\bĵç\bà³ç\b\020yé\b,ñ?¾I9\037\b\020yé\b\001"
_db_level_ = 4294967295
_db_framep_ = (char **) 0xffffffff
join = (JOIN *) 0x8e97920
#8 0x0821f325 in handle_select (thd=0x8e7b390, lex=0x8e7b3d0, result=0x8e97910, setup_tables_done_option=0)
at sql_select.cc:242
---Type <return> to continue, or q <return> to quit---
unit = (SELECT_LEX_UNIT *) 0x8e7b3e0
res = false
select_lex = (SELECT_LEX *) 0x8e7b5c4
_db_func_ = 0x8e97910 "ÈÖa\b\220³ç\bà³ç\b\217\217\217\217\030\212é\bÄí?¾è\210é\b"
_db_file_ = 0x81f3949 "\213E\bÇ"
_db_level_ = 3191861548
_db_framep_ = (char **) 0x8e97910
#9 0x081e6e56 in mysql_execute_command (thd=0x8e7b390) at sql_parse.cc:2400
result = (class select_result *) 0x8e97910
res = false
result = 0
lex = (LEX *) 0x8e7b3d0
select_lex = (SELECT_LEX *) 0x8e7b5c4
slave_fake_lock = false
fake_prev_lock = (MYSQL_LOCK *) 0x0
first_table = (TABLE_LIST *) 0x8e97488
all_tables = (TABLE_LIST *) 0x8e97488
---Type <return> to continue, or q <return> to quit---
unit = (SELECT_LEX_UNIT *) 0x8e7b3e0
_db_func_ = 0x0
_db_file_ = 0x0
_db_level_ = 0
_db_framep_ = (char **) 0x8e7b3d0
#10 0x081ef6b1 in mysql_parse (thd=0x8e7b390,
inBuf=0x8e97130 "SELECT hostname AS name, COUNT(DISTINCT user_id) AS no FROM log_logins WHERE hostname LIKE '%aol%' GROUP BY hostname", length=116) at sql_parse.cc:5303
lex = (LEX *) 0x8e7b3d0
_db_func_ = 0x8e8f145 ""
_db_file_ = 0x0
_db_level_ = 12
_db_framep_ = (char **) 0x40051530
#11 0x081e4f72 in dispatch_command (command=COM_QUERY, thd=0x8e7b390,
packet=0x8e8f0d1 "SELECT hostname AS name, COUNT(DISTINCT user_id) AS no FROM log_logins WHERE hostname LIKE '%aol%' GROUP BY hostname", packet_length=117) at sql_parse.cc:1653
packet_end = 0x8e971a4 ""
---Type <return> to continue, or q <return> to quit---
net = (NET *) 0x8e7bb04
error = false
_db_func_ = 0x0
_db_file_ = 0x0
_db_level_ = 0
_db_framep_ = (char **) 0x0
#12 0x081e4782 in do_command (thd=0x8e7b390) at sql_parse.cc:1456
packet = 0x8e8f0d0 "\003SELECT hostname AS name, COUNT(DISTINCT user_id) AS no FROM log_logins WHERE hostname LIKE '%aol%' GROUP BY hostname"
old_timeout = 30
packet_length = 117
net = (NET *) 0x8e7bb04
command = COM_QUERY
_db_func_ = 0x8e7cb50 "ÿÿÿÿ"
_db_file_ = 0x81bbd44 "ÉÃU\211å\203ì(\213E\b\211\004$è¡"
_db_level_ = 3191863788
_db_framep_ = (char **) 0x1010
---Type <return> to continue, or q <return> to quit---
#13 0x081e38d7 in handle_one_connection (arg=0x8e7b390) at sql_parse.cc:1114
error = 0
net = (NET *) 0x8e7bb04
thd = (class THD *) 0x8e7b390
launch_time = 0
set = {__val = {0 <repeats 32 times>}}
#14 0x40187e51 in pthread_start_thread () from /lib/libpthread.so.0
No symbol table info available.
#15 0x40187ecf in pthread_start_thread_event () from /lib/libpthread.so.0
No symbol table info available.
#16 0x4030f92a in clone () from /lib/libc.so.6
No symbol table info available.
(gdb)
[4 Jun 2005 0:18]
MySQL Verification Team
Below call stack for server 4.1.13 BK on Windows:
/sql/sql_string.cpp
--53--
if (!(Ptr=(char*) my_malloc(arg_length,MYF(MY_WME))))
return TRUE;
Alloced_length=arg_length;
alloced=1;
}
Ptr[0]=0;
^^^^^^^^^^^^^^^^^^^^^crashes here
return FALSE;
}
> mysqld-debug.exe!String::real_alloc(unsigned long arg_length=0) Line 58 + 0x5 C++
mysqld-debug.exe!String::String(unsigned long length_arg=4294967295) Line 49 C++
mysqld-debug.exe!Item_str_buff::Item_str_buff(Item * arg=0x02fb8b08) Line 1121 + 0x2a C++
mysqld-debug.exe!new_Item_buff(Item * item=0x02fb8b08) Line 32 + 0x1f C++
mysqld-debug.exe!alloc_group_fields(JOIN * join=0x02fb9130, st_order * group=0x02fb90e8) Line 8637 + 0xe C++
mysqld-debug.exe!make_group_fields(JOIN * main_join=0x02fb9130, JOIN * curr_join=0x02fb9130) Line 8617 + 0x13 C++
mysqld-debug.exe!JOIN::exec() Line 1352 + 0xd C++
mysqld-debug.exe!mysql_select(THD * thd=0x00efced0, Item * * * rref_pointer_array=0x00efd108, st_table_list * tables=0x02fb8e38, unsigned int wild_num=0, List<Item> & fields={...}, Item * conds=0x02fb8fa8, unsigned int og_num=1, st_order * order=0x00000000, st_order * group=0x02fb90e8, Item * having=0x00000000, st_order * proc_param=0x00000000, unsigned long select_options=2189707776, select_result * result=0x02fb9120, st_select_lex_unit * unit=0x00efcf1c, st_select_lex * select_lex=0x00efd01c) Line 1607 C++
mysqld-debug.exe!handle_select(THD * thd=0x00efced0, st_lex * lex=0x00efcf10, select_result * result=0x02fb9120) Line 195 + 0x87 C++
mysqld-debug.exe!mysql_execute_command(THD * thd=0x00efced0) Line 2087 + 0x11 C++
mysqld-debug.exe!mysql_parse(THD * thd=0x00efced0, char * inBuf=0x02fb8a58, unsigned int length=116) Line 4222 + 0x9 C++
mysqld-debug.exe!dispatch_command(enum_server_command command=COM_QUERY, THD * thd=0x00efced0, char * packet=0x02fb0899, unsigned int packet_length=117) Line 1503 + 0x1d C++
mysqld-debug.exe!do_command(THD * thd=0x00efced0) Line 1316 + 0x31 C++
mysqld-debug.exe!handle_one_connection(void * arg=0x00efced0) Line 1048 + 0x9 C++
mysqld-debug.exe!pthread_start(void * param=0x00f0f520) Line 63 + 0x7 C
mysqld-debug.exe!_threadstart(void * ptd=0x00f0fde0) Line 173 + 0xd C
kernel32.dll!7c80b50b()
kernel32.dll!7c8399f3()
[7 Jun 2005 10:15]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/internals/25685
[7 Jun 2005 10:56]
Igor Babaev
The crash can be demonstrated with a simpler script:
CREATE TABLE t1 (id int PRIMARY KEY, user_id int, hostname longtext);
INSERT INTO t1 VALUES
(1, 7, 'cache-dtc-af05.proxy.aol.com'),
(2, 3, 'what.ever.com'),
(3, 7, 'cache-dtc-af05.proxy.aol.com'),
(4, 7, 'cache-dtc-af05.proxy.aol.com');
SELECT hostname, COUNT(DISTINCT user_id) as no FROM t1
WHERE hostname LIKE '%aol%'
GROUP BY hostname;
The crash happens due to an attempt to allocate a buffer of size 4294967295 bytes for the group value. Now the size of this buffer is limited by the value of max_sort_length.
[7 Jun 2005 14:23]
Igor Babaev
ChangeSet
1.2317 05/06/07 03:05:57 igor@rurik.mysql.com +5 -0
sql_select.cc, item_buff.cc, item.h:
Fixed bug #11088: a crash for queries with GROUP BY a BLOB column
+ COUNT(DISTINCT...) due to an attempt to allocate a too large
buffer for the BLOB field.
Now the size of the buffer is limited by max_sort_length.
group_by.test, group_by.result:
Added a test case for bug #11088.
The fix will appear in 4.1.13 and 5.0.7.
[10 Jun 2005 18:08]
Paul DuBois
Noted in 4.1.13, 5.0.7 changelogs.
[21 Jun 2005 11:24]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/internals/26234
Description: I have a table with 1709 rows in it. When I tried to do a query on it, the database died and had to be restarted. I have tested this with MySQl v4.1.12 on Linux & v5.0.6-beta on Windows. I will try to include all the data possible. How to repeat: CREATE TABLE `log_logins` ( `idd` int(11) NOT NULL auto_increment, `user_id` int(11) NOT NULL default '0', `datetime` int(11) NOT NULL default '0', `ipaddress` varchar(16) NOT NULL default '', `browser` varchar(250) NOT NULL default '', `country` varchar(20) NOT NULL default '', `hostname` longtext NOT NULL, PRIMARY KEY (`idd`), KEY `ipaddress` (`ipaddress`), KEY `browser` (`browser`), KEY `country` (`country`), KEY `user_id` (`user_id`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1710; INSERT INTO `log_logins` VALUES (15, 7, 1117282312, '205.188.117.69', 'Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; iebar; .NET CLR 1.1.4322)', 'US', 'cache-dtc-af05.proxy.aol.com'); INSERT INTO `log_logins` VALUES (16, 3, 1117282438, '192.168.1.1', 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Hotbar4.5.3.0)', 'AU', 'what.ever.com'); INSERT INTO `log_logins` VALUES (17, 7, 1117282522, '205.188.117.69', 'Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; iebar; .NET CLR 1.1.4322)', 'US', 'cache-dtc-af05.proxy.aol.com'); INSERT INTO `log_logins` VALUES (18, 7, 1117282542, '205.188.117.69', 'Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; SV1; iebar; .NET CLR 1.1.4322)', 'US', 'cache-dtc-af05.proxy.aol.com'); SELECT hostname AS name, COUNT(DISTINCT user_id) AS no FROM log_logins WHERE hostname LIKE '%aol%' GROUP BY hostname