| Bug #53859 | Valgrind: opt_sum_query(TABLE_LIST*, List<Item>&, Item*) at opt_sum.cc:305 | ||
|---|---|---|---|
| Submitted: | 20 May 2010 14:15 | Modified: | 14 Oct 2010 15:27 |
| Reporter: | John Embretsen | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server: Optimizer | Severity: | S3 (Non-critical) |
| Version: | 5.1.47, 5.6.99-m4 Dahlia, bzr_mysql-next-mr-opt-backporting, 6.0.14 | OS: | Any |
| Assigned to: | Martin Hansson | CPU Architecture: | Any |
| Tags: | uninitialized value, valgrind | ||
[20 May 2010 14:15]
John Embretsen
[20 May 2010 16:05]
John Embretsen
Bug verified using the mysql-test script pasted below. Against mysql-5.1-bugteam the trace was slightly different, starting with: ==15265== at 0x806C05: get_index_min_value(st_table*, st_table_ref*, Item_field*, unsigned int, unsigned int) (opt_sum.cc:159) ==15265== by 0x807F86: opt_sum_query(TABLE_LIST*, List<Item>&, Item*) (opt_sum.cc:379) (...) One further detail from using valgrind option --track-origins=yes: ==26670== Uninitialised value was created by a stack allocation ==26670== at 0x84E40F: opt_sum_query(TABLE_LIST*, List<Item>&, Item*) (opt_sum.cc:114) Also verified against: mysql-next-mr revid alik@sun.com-20100520100140-5bzrtadw4w419i3m mysql-6.0-codebase-bugfixing revid aelkin@mysql.com-20100519051128-0y11rwakkp49qva0 Test script for reproducing this issue: ----------------------------------- --disable_warnings DROP TABLE /*! IF EXISTS */ P; --enable_warnings CREATE TABLE `P` ( `pk` int(11) NOT NULL AUTO_INCREMENT, `col_int_key` int(11) DEFAULT NULL, PRIMARY KEY (`pk`), KEY `col_int_key` (`col_int_key`) ) ENGINE=InnoDB AUTO_INCREMENT=10 DEFAULT CHARSET=latin1; INSERT INTO `P` VALUES (3,NULL); INSERT INTO `P` VALUES (8,NULL); INSERT INTO `P` VALUES (5,-1219493888); INSERT INTO `P` VALUES (7,0); INSERT INTO `P` VALUES (6,3); INSERT INTO `P` VALUES (2,6); INSERT INTO `P` VALUES (9,7); INSERT INTO `P` VALUES (1,9); INSERT INTO `P` VALUES (4,1635516416); SELECT MIN( table1 . `col_int_key` ) AS field1 FROM P AS table1 LEFT JOIN P AS table2 ON table1 . `pk` = table2 . `pk` WHERE ( table1 . `col_int_key` > 244 AND table1 . `col_int_key` IS NULL ) ORDER BY field1 LIMIT 2 OFFSET 9; DROP TABLE P;
[27 May 2010 13:03]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/109367 3387 Martin Hansson 2010-05-27 Bug#53859: Valgrind: opt_sum_query(TABLE_LIST*, List<Item>&, Item*) at opt_sum.cc:305 Queries where MIN and MAX functions are applied to indexed columns are optimized to read directly from the index if all key parts of the index preceding the aggregated key part are bound to constants by the WHERE clause. A prefix length is also produced. If the aggregated column itself is bound to a constant, however, it is also included in the prefix. The function that was performing the read missed this detail and tried to read outside the key buffer. Fixed by simply reading the last key part's position in the key buffer if the prefix length equals the entire buffer length.
[28 May 2010 7:42]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/109448 3387 Martin Hansson 2010-05-28 Bug#53859: Valgrind: opt_sum_query(TABLE_LIST*, List<Item>&, Item*) at opt_sum.cc:305 Queries where MIN and MAX functions are applied to indexed columns are optimized to read directly from the index if all key parts of the index preceding the aggregated key part are bound to constants by the WHERE clause. A prefix length is also produced. If the aggregated column itself is bound to a constant, however, it is also included in the prefix. The function that was performing the read missed this detail and tried to read outside the key buffer. Fixed by simply reading the last key part's position in the key buffer if the prefix length equals the entire buffer length.
[3 Jun 2010 8:44]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/110064 3388 Martin Hansson 2010-06-03 Bug#53859: Valgrind: opt_sum_query(TABLE_LIST*, List<Item>&, Item*) at opt_sum.cc:305 Queries applying MIN/MAX functions to indexed columns are optimized to read directly from the index if all key parts of the index preceding the aggregated key part are bound to constants by the WHERE clause. A prefix length is also produced, equal to the total length of the bound key parts. If the aggregated column itself is bound to a constant, however, it is also included in the prefix. Such full search keys are read as closed intervals for reasons beyond the scope of this bug. However, the procedure missed one case where a key part meant for use as range endpoint was being overwritten with a NULL value destined for equality checking. In this case the key part was overwritten but the range flag remained, causing open interval reading to be performed. Bug was fixed by adding more stringent checking to the search key building procedure (matching_cond) and never allow overwrites of range predicates with non-range predicates. An assertion was added to make sure open intervals are never used with full search keys.
[17 Jun 2010 6:13]
Bugs System
Pushed into 5.5.5-m3 (revid:alexey.kopytov@sun.com-20100615145247-8bj0vmuqlotbqsn9) (version source revid:martin.hansson@sun.com-20100611081555-5j7634ulewwpyn1d) (merge vers: 5.5.5-m3) (pib:16)
[17 Jun 2010 6:16]
Bugs System
Pushed into mysql-next-mr (revid:alik@sun.com-20100615150216-cubqoyn1fj9b6a2p) (version source revid:alik@sun.com-20100615081608-4ieksdrefamsw3v9) (pib:16)
[19 Jul 2010 14:35]
Bugs System
Pushed into 5.1.49 (revid:build@mysql.com-20100719143034-omcma40sblwmay3x) (version source revid:martin.hansson@sun.com-20100611073829-dhr9aeh6d8iff672) (merge vers: 5.1.48) (pib:16)
[20 Jul 2010 2:40]
Paul DuBois
Noted in 5.1.49, 5.5.5 changelogs. Queries that used MIN() or MAX() on indexed columns could be optimized incorrectly.
[14 Oct 2010 8:34]
Bugs System
Pushed into mysql-5.1-telco-7.0 5.1.51-ndb-7.0.20 (revid:martin.skold@mysql.com-20101014082627-jrmy9xbfbtrebw3c) (version source revid:vasil.dimov@oracle.com-20100531152341-x2d4hma644icamh1) (merge vers: 5.5.5-m3) (pib:21)
[14 Oct 2010 8:49]
Bugs System
Pushed into mysql-5.1-telco-6.3 5.1.51-ndb-6.3.39 (revid:martin.skold@mysql.com-20101014083757-5qo48b86d69zjvzj) (version source revid:vasil.dimov@oracle.com-20100531152341-x2d4hma644icamh1) (merge vers: 5.5.5-m3) (pib:21)
[14 Oct 2010 9:03]
Bugs System
Pushed into mysql-5.1-telco-6.2 5.1.51-ndb-6.2.19 (revid:martin.skold@mysql.com-20101014084420-y54ecj85j5we27oa) (version source revid:vasil.dimov@oracle.com-20100531152341-x2d4hma644icamh1) (merge vers: 5.5.5-m3) (pib:21)
[14 Oct 2010 15:27]
Jon Stephens
Already documented in the 5.1.49 changelog; no new changelog entries required. setting back to Closed state.
[24 Mar 2011 9:54]
MySQL Verification Team
see bug #58705 for another problem in opt_sum_query
