Bug #48291 crash with row() operator,select into @var, and subquery returning multiple rows

• Submitted: 25 Oct 2009 16:53
• Modified: 20 Nov 2010 18:16
• Reporter: Shane Bester (Platinum Quality Contributor)
• Status: Closed
• Category: MySQL Server: DML
• Severity: S1 (Critical)
• Version: >=5.0.32, 5.0.86, 5.1.40
• OS: Any
• Assigned to: Georgi Kodinov
• CPU Architecture: Any
• Tags: regression

[25 Oct 2009 16:53] Shane Bester

Description:
5.1.40 stack trace:

mysqld.exe!update_hash()[item_func.cc:3948]
mysqld.exe!Item_func_set_user_var::update_hash()[item_func.cc:3999]
mysqld.exe!Item_func_set_user_var::update()[item_func.cc:4285]
mysqld.exe!select_dumpvar::send_data()[sql_class.cc:2720]
mysqld.exe!end_send()[sql_select.cc:11986]
mysqld.exe!evaluate_join_record()[sql_select.cc:11247]
mysqld.exe!sub_select()[sql_select.cc:11134]
mysqld.exe!do_select()[sql_select.cc:10888]
mysqld.exe!JOIN::exec()[sql_select.cc:2206]
mysqld.exe!mysql_select()[sql_select.cc:2396]
mysqld.exe!handle_select()[sql_select.cc:268]
mysqld.exe!execute_sqlcom_select()[sql_parse.cc:5044]
mysqld.exe!mysql_execute_command()[sql_parse.cc:2238]
mysqld.exe!mysql_parse()[sql_parse.cc:5967]
mysqld.exe!dispatch_command()[sql_parse.cc:1226]
mysqld.exe!do_command()[sql_parse.cc:865]
mysqld.exe!handle_one_connection()[sql_connect.cc:1127]
mysqld.exe!pthread_start()[my_winthread.c:85]
mysqld.exe!_callthreadstart()[thread.c:295]
mysqld.exe!_threadstart()[thread.c:275]

How to repeat:
drop table if exists `t1`;
create table `t1`(`a` float);
insert into `t1` values (-2),(-1);
select  1 from `t1`
where
`a` <> '1' and not
row(`a`,`a`) <=>
row((select 1 from `t1` where 1=2),(select 1 from `t1`)) 
into @`var0`;

[25 Oct 2009 16:58] Valeriy Kravchuk

Verified just as described with recent 5.1.41 from bzr on Mac OS X:

Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0xb026af64 thread_stack 0x30000
0   mysqld                              0x0058919a my_print_stacktrace + 45
1   mysqld                              0x000fcfc6 handle_segfault + 882
2   libSystem.B.dylib                   0x940472bb _sigtramp + 43
3   ???                                 0xffffffff 0x0 + 4294967295
4   mysqld                              0x00055be5 _ZN22Item_func_set_user_var11update_hashEPvj11Item_resultP15charset_info_st10Derivationb + 173
5   mysqld                              0x0005669e _ZN22Item_func_set_user_var6updateEv + 336
6   mysqld                              0x000e83b1 _ZN14select_dumpvar9send_dataER4ListI4ItemE + 663
7   mysqld                              0x00198840 _Z27join_read_next_same_or_nullP14st_read_record + 464
8   mysqld                              0x001944dd _Z21setup_end_select_funcP4JOIN + 1361
9   mysqld                              0x00194886 _Z10sub_selectP4JOINP13st_join_tableb + 290
10  mysqld                              0x00194cbe _Z10sub_selectP4JOINP13st_join_tableb + 1370
11  mysqld                              0x001aded9 _ZN4JOIN4execEv + 9377
12  mysqld                              0x001ae3ac _Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex + 900
13  mysqld                              0x001ae75c _Z13handle_selectP3THDP6st_lexP13select_resultm + 570
14  mysqld                              0x0010f2d7 _Z20prepare_schema_tableP3THDP6st_lexP11Table_ident18enum_schema_tables + 2175
15  mysqld                              0x001162a4 _Z21mysql_execute_commandP3THD + 2970
16  mysqld                              0x001203c6 _Z11mysql_parseP3THDPKcjPS2_ + 592
17  mysqld                              0x0012117f _Z16dispatch_command19enum_server_commandP3THDPcj + 3053
18  mysqld                              0x0012258a _Z10do_commandP3THD + 666
19  mysqld                              0x0010cd8f handle_one_connection + 385
20  libSystem.B.dylib                   0x9400c095 _pthread_start + 321
21  libSystem.B.dylib                   0x9400bf52 thread_start + 34
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at 0x1075228 = select  1 from `t1`
where
`a` <> '1' and not
row(`a`,`a`) <=>
row((select 1 from `t1` where 1=2),(select 1 from `t1`)) 
into @`var0`
thd->thread_id=2
thd->killed=NOT_KILLED

[25 Oct 2009 17:27] MySQL Verification Team

This bug was introduced with some bugfix that made it into 5.0.32 and 5.1.15.

[27 Oct 2009 16:57] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/88409

2828 Georgi Kodinov	2009-10-27
      Bug #48291 : crash with row() operator,select into @var, and 
        subquery returning multiple rows
      
      Error handling was missing when handling subqueires in WHERE 
      and when assigning a SELECT result to a @variable.
      This caused crash(es). 
      
      Fixed by adding error handling code to both the WHERE 
      condition evaluation and to assignment to an @variable.

[30 Oct 2009 13:16] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/88741

2828 Georgi Kodinov	2009-10-30
      Bug #48291 : crash with row() operator,select into @var, and 
        subquery returning multiple rows
      
      Error handling was missing when handling subqueires in WHERE 
      and when assigning a SELECT result to a @variable.
      This caused crash(es). 
      
      Fixed by adding error handling code to both the WHERE 
      condition evaluation and to assignment to an @variable.

[30 Oct 2009 13:16] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/88742

2831 Georgi Kodinov	2009-10-30
      Bug #48291 : crash with row() operator,select into @var, and 
        subquery returning multiple rows
      
      Error handling was missing when handling subqueires in WHERE 
      and when assigning a SELECT result to a @variable.
      This caused crash(es). 
      
      Fixed by adding error handling code to both the WHERE 
      condition evaluation and to assignment to an @variable.

[4 Nov 2009 9:16] Bugs System

Pushed into 5.0.88 (revid:[e-mail]-20091104091355-hpz6dwgkrfmokj3k) (version source revid:[e-mail]-20091030131543-2b23fnqckgbzvete) (merge vers: 5.0.88) (pib:13)

[4 Nov 2009 9:24] Bugs System

Pushed into 5.1.41 (revid:[e-mail]-20091104092152-qz96bzlf2o1japwc) (version source revid:[e-mail]-20091103162305-08l4gkeuif2ozsoj) (merge vers: 5.1.41) (pib:13)

[11 Nov 2009 6:50] Bugs System

Pushed into 6.0.14-alpha (revid:[e-mail]-20091110093407-rw5g8dys2baqkt67) (version source revid:[e-mail]-20091109080109-7dxapd5y5pxlu08w) (merge vers: 6.0.14-alpha) (pib:13)

[11 Nov 2009 6:57] Bugs System

Pushed into 5.5.0-beta (revid:[e-mail]-20091109115615-nuohp02h8mdrz8m2) (version source revid:[e-mail]-20091105092355-jzukkw6wnd7hmgrj) (merge vers: 5.5.0-beta) (pib:13)

[11 Nov 2009 16:18] Paul DuBois

Noted in 5.0.88, 5.1.41, 5.5.0, 6.0.14 changelogs.

Error handling was missing for SELECT statements containing
subqueries in the WHERE clause and that assigned a SELECT result to a
user variable. The server could crash as a result.

[14 Nov 2009 15:24] MySQL Verification Team

bug #48300 is a duplicate of this bug.  here is another testcase:

drop table if exists `t1`,`t2`;
create table `t1` (`a` int) engine=myisam ;
insert into `t1` values (null),(0),(0),(0);
create table `t2` (`b` time) engine=myisam;
insert into `t2` values ('444:45:08');
select 1 from  `t1`,`t2` where `a` <=> (select 1 union select 2) into @`var0`;

[7 Dec 2009 16:45] Paul DuBois

Noted in 5.1.40sp1 changelog.

[8 Dec 2009 9:30] Bugs System

Pushed into 5.1.43 (revid:[e-mail]-20091208092611-pbno5awyb0v38hs7) (version source revid:[e-mail]-20091208092611-pbno5awyb0v38hs7) (merge vers: 5.1.43) (pib:13)

[16 Dec 2009 8:35] Bugs System

Pushed into 6.0.14-alpha (revid:[e-mail]-20091216083311-xorsasf5kopjxshf) (version source revid:[e-mail]-20091215065750-5m04ogppd5l0pol5) (merge vers: 6.0.14-alpha) (pib:14)

[16 Dec 2009 8:42] Bugs System

Pushed into 5.5.0-beta (revid:[e-mail]-20091216082430-s0gtzibcgkv4pqul) (version source revid:[e-mail]-20091211070127-kl8uvlrv9cr11kva) (merge vers: 5.5.0-beta) (pib:14)

[16 Dec 2009 8:48] Bugs System

Pushed into mysql-next-mr (revid:[e-mail]-20091216083231-rp8ecpnvkkbhtb27) (version source revid:[e-mail]-20091212203859-fx4rx5uab47wwuzd) (merge vers: 5.6.0-beta) (pib:14)

[18 Dec 2009 10:26] Bugs System

Pushed into 5.1.41-ndb-7.1.0 (revid:[e-mail]-20091218102229-64tk47xonu3dv6r6) (version source revid:[e-mail]-20091218095730-26gwjidfsdw45dto) (merge vers: 5.1.41-ndb-7.1.0) (pib:15)

[18 Dec 2009 10:42] Bugs System

Pushed into 5.1.41-ndb-6.2.19 (revid:[e-mail]-20091218100224-vtzr0fahhsuhjsmt) (version source revid:[e-mail]-20091217101452-qwzyaig50w74xmye) (merge vers: 5.1.41-ndb-6.2.19) (pib:15)

[18 Dec 2009 10:57] Bugs System

Pushed into 5.1.41-ndb-6.3.31 (revid:[e-mail]-20091218100616-75d9tek96o6ob6k0) (version source revid:[e-mail]-20091217154335-290no45qdins5bwo) (merge vers: 5.1.41-ndb-6.3.31) (pib:15)

[18 Dec 2009 11:12] Bugs System

Pushed into 5.1.41-ndb-7.0.11 (revid:[e-mail]-20091218101303-ga32mrnr15jsa606) (version source revid:[e-mail]-20091218064304-ezreonykd9f4kelk) (merge vers: 5.1.41-ndb-7.0.11) (pib:15)

[17 Feb 2010 16:27] Paul DuBois

Noted in 5.0.87sp1 changelog.

[20 Feb 2010 17:11] Bugs System

Pushed into 5.0.91 (revid:[e-mail]-20100220170835-5kr6ztsg25va7qzz) (version source revid:[e-mail]-20100220170835-5kr6ztsg25va7qzz) (merge vers: 5.0.91) (pib:16)

[1 Mar 2010 8:42] Bugs System

Pushed into 5.1.45 (revid:[e-mail]-20100301083827-xnimmrjg6bh33o1o) (version source revid:[e-mail]-20100226131646-kpvzk740hxbtaexn) (merge vers: 5.1.45) (pib:16)

[2 Mar 2010 14:33] Bugs System

Pushed into 6.0.14-alpha (revid:[e-mail]-20100302142746-u1gxdf5yk2bjrq3e) (version source revid:[e-mail]-20100301095421-4cz64ibem1h2quve) (merge vers: 6.0.14-alpha) (pib:16)

[2 Mar 2010 14:38] Bugs System

Pushed into 5.5.3-m2 (revid:[e-mail]-20100302072233-t3uqgjzdukt1pyhe) (version source revid:[e-mail]-20100301090215-63o2w2y16go8n53p) (merge vers: 5.5.3-m2) (pib:16)

[2 Mar 2010 14:44] Bugs System

Pushed into mysql-next-mr (revid:[e-mail]-20100302072432-k8xvfkgcggkwgi94) (version source revid:[e-mail]-20100301094536-2zc4uqyy3os8san7) (pib:16)

[12 Mar 2010 14:06] Bugs System

Pushed into 5.1.44-ndb-7.0.14 (revid:[e-mail]-20100312135944-t0z8s1da2orvl66x) (version source revid:[e-mail]-20100312115609-woou0te4a6s4ae9y) (merge vers: 5.1.44-ndb-7.0.14) (pib:16)

[12 Mar 2010 14:22] Bugs System

Pushed into 5.1.44-ndb-6.2.19 (revid:[e-mail]-20100312134846-tuqhd9w3tv4xgl3d) (version source revid:[e-mail]-20100312060623-mx6407w2vx76h3by) (merge vers: 5.1.44-ndb-6.2.19) (pib:16)

[12 Mar 2010 14:36] Bugs System

Pushed into 5.1.44-ndb-6.3.33 (revid:[e-mail]-20100312135724-xcw8vw2lu3mijrhn) (version source revid:[e-mail]-20100312103652-snkltsd197l7q2yg) (merge vers: 5.1.44-ndb-6.3.33) (pib:16)

[17 Jun 2010 11:45] Bugs System

Pushed into 5.1.47-ndb-7.0.16 (revid:[e-mail]-20100617114014-bva0dy24yyd67697) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

[17 Jun 2010 12:23] Bugs System

Pushed into 5.1.47-ndb-6.2.19 (revid:[e-mail]-20100617115448-idrbic6gbki37h1c) (version source revid:[e-mail]-20100609140708-52rvuyq4q500sxkq) (merge vers: 5.1.45-ndb-6.2.19) (pib:16)

[17 Jun 2010 13:10] Bugs System

Pushed into 5.1.47-ndb-6.3.35 (revid:[e-mail]-20100617114611-61aqbb52j752y116) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

[30 Sep 2010 15:02] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/119564

3258 Tor Didriksen	2010-09-30
      Removed a part of the test case for bug#48291 since it is not valid anymore.

[13 Nov 2010 16:04] Bugs System

Pushed into mysql-trunk 5.6.99-m5 (revid:[e-mail]-20101113155825-czmva9kg4n31anmu) (version source revid:[e-mail]-20100629074804-359l9m9gniauxr94) (merge vers: 5.6.99-m4) (pib:21)

[13 Nov 2010 16:28] Bugs System

Pushed into mysql-next-mr (revid:[e-mail]-20101113160336-atmtmfb3mzm4pz4i) (version source revid:[e-mail]-20100804103744-vbpeghipkz6pyc9z) (pib:21)