Description:
Some combination of blobs, different databases and SHOW TABLES, will crash server on "SELECT * FROM T1" statement.
The problem does not occur if the tables created in below test case don't have the blob columns.
Stack trace from gdb:
(gdb) where
#0 0xffffe002 in ?? ()
#1 0x08269573 in write_core (sig=9026) at stacktrace.c:220
#2 0x0817ec92 in handle_segfault (sig=22) at mysqld.cc:1863
#3 <signal handler called>
#4 0x0833897a in NdbDictionary::Table::getColumn(char const*) const (
this=0x0, name=0x0) at NdbDictionary.cpp:338
#5 0x08346871 in NdbBlob::atPrepare(NdbConnection*, NdbOperation*, NdbColumnImpl const*) (this=0x8c4ead0, aCon=0x0, anOp=0xb, aColumn=0xb) at NdbBlob.cpp:1035
#6 0x0832e0f8 in NdbOperation::getBlobHandle(NdbConnection*, NdbColumnImpl const*) (this=0x8c23ae8, aCon=0x0, tAttrInfo=0x8c47ce0)
at NdbOperationDefine.cpp:595
#7 0x0833140a in NdbScanOperation::getBlobHandle(unsigned) (this=0x8c23ae8,
anAttrId=11) at NdbDictionaryImpl.hpp:564
#8 0x0821eea1 in ha_ndbcluster::get_ndb_value(NdbOperation*, Field*, unsigned,
char*) (this=0x8c494f8, ndb_op=0x8c23ae8, field=0x8c23ae8, fieldnr=1,
buf=0x8bcd698 "?") at ha_ndbcluster.cc:585
#9 0x0822a367 in ha_ndbcluster::define_read_attrs(char*, NdbOperation*) (
this=0x8c494f8, buf=0x8bcd698 "?", op=0x8c23ae8) at ha_ndbcluster.cc:1516
#10 0x0822181c in ha_ndbcluster::full_table_scan(char*) (this=0x8c494f8,
buf=0x0) at ha_ndbcluster.cc:1496
#11 0x08223c8a in ha_ndbcluster::rnd_next(char*) (this=0x8c494f8,
buf=0x8bcd698 "?") at ha_ndbcluster.cc:2374
#12 0x0820df8d in handler::read_first_row(char*, unsigned) (this=0x8bcd698,
buf=0x8bcd698 "?", primary_key=147100920) at handler.cc:931
#13 0x081c9974 in join_read_system (tab=0x0) at sql_select.cc:5965
#14 0x081c9763 in join_read_const_table (tab=0x8c39f30, pos=0x8c3947c)
at sql_select.cc:5914
#15 0x081bf7b5 in make_join_statistics (join=0x8c39420, tables=0x0, conds=0x0,
keyuse_array=0x8c39d38) at sql_select.cc:1772
#16 0x081bbbae in JOIN::optimize() (this=0x8c39420) at sql_select.cc:542
#17 0x081bed17 in mysql_select(THD*, Item***, st_table_list*, unsigned, List<Item>&, Item*, unsigned, st_order*, st_order*, Item*, st_order*, unsigned long, select_result*, st_select_lex_unit*, st_select_lex*) (thd=0x8c261a0,
rref_pointer_array=0x8c263a8, tables=0x8c393a8, wild_num=1, fields=@0x0,
conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0,
select_options=8669696, result=0x8c39410, unit=0x8c261e4,
select_lex=0x8c262c0) at sql_select.cc:1570
#18 0x081baf53 in handle_select(THD*, st_lex*, select_result*) (thd=0x8c261a0,
lex=0x8c261d8, result=0x8c39410) at sql_select.cc:182
#19 0x08194de2 in mysql_execute_command(THD*) (thd=0x8c261a0)
at sql_parse.cc:1991
#20 0x08199eeb in mysql_parse(THD*, char*, unsigned) (thd=0x8c261a0,
inBuf=0x8c392d0 "select * from t1", length=146956760) at sql_parse.cc:4046
#21 0x081937e7 in dispatch_command(enum_server_command, THD*, char*, unsigned)
(command=COM_QUERY, thd=0x8c261a0, packet=0x8c27531 "select * from t1",
packet_length=17) at sql_parse.cc:1457
#22 0x08193101 in do_command(THD*) (thd=0x8c261a0) at sql_parse.cc:1272
#23 0x08192602 in handle_one_connection (arg=0x0) at sql_parse.cc:1016
#24 0x4004f484 in start_thread () from /lib/tls/libpthread.so.0
(gdb) up 5
#5 0x08346871 in NdbBlob::atPrepare(NdbConnection*, NdbOperation*, NdbColumnImpl const*) (this=0x8c4ead0, aCon=0x0, anOp=0xb, aColumn=0xb) at NdbBlob.cpp:1035
1035 if (theStripeSize == 0 ||
(gdb) l
1030 assert((NDB_BLOB_HEAD_SIZE << 2) == sizeof(Head));
1031 assert(theColumn->m_attrSize * theColumn->m_arraySize == sizeof(Head)
+ theInlineSize);
1032 if (thePartSize > 0) {
1033 const NdbDictionary::Table* bt = NULL;
1034 const NdbDictionary::Column* bc = NULL;
1035 if (theStripeSize == 0 ||
1036 (bt = theColumn->getBlobTable()) == NULL ||
1037 (bc = bt->getColumn("DATA")) == NULL ||
1038 bc->getType() != partType ||
1039 bc->getLength() != (int)thePartSize) {
(gdb) p bt
$1 = (const class Table *) 0x100
(gdb) p bc
$2 = (const Column *) 0x0
(gdb) p theStripSize
No symbol "theStripSize" in current context.
(gdb) p theStripeSize
$3 = 16
(gdb) p theColumn
$4 = (const NdbColumnImpl *) 0x8c47ce0
(gdb) p theColumn->m_impl
$5 = (NdbColumnImpl &) @0x8c47ce0: {<Column> = {static FRAGMENT = 0x8b989d8,
static ROW_COUNT = 0x8bc9278, static COMMIT_COUNT = 0x8bc9310,
m_impl = @0x8c47ce0}, m_attrId = 1, m_name = {m_chr = 0x8c47d50 "b",
m_len = 1}, m_type = Blob, m_precision = 256, m_scale = 2000,
m_length = 16, m_cs = 0x0, m_pk = false, m_tupleKey = false,
m_distributionKey = false, m_distributionGroup = false,
m_distributionGroupBits = 16, m_nullable = true, m_indexOnly = false,
m_autoIncrement = false, m_autoIncrementInitialValue = 18446744073709551615,
m_defaultValue = {m_chr = 0x8c47cc0 "", m_len = 0}, m_blobTable = 0x8c24100,
m_attrType = 3, m_attrSize = 1, m_arraySize = 264, m_keyInfoPos = 0,
m_extType = 20, m_facade = 0x8c47ce0}
(gdb) p aCon
$6 = (NdbConnection *) 0x0
(gdb)
How to repeat:
Run this as a test in mysql-test-run
show tables;
create table t1 (a int, b blob) engine=ndb;
show tables;
create database test2;
use test2;
show tables;
--error 1146
select * from t1;
create table t2 (b int, c text) engine=ndb;
use test;
select * from t1; << ===== Crash
show tables;
drop table t1;
use test2;
drop table t2;
drop database test2;
show databases;
use test;
Description: Some combination of blobs, different databases and SHOW TABLES, will crash server on "SELECT * FROM T1" statement. The problem does not occur if the tables created in below test case don't have the blob columns. Stack trace from gdb: (gdb) where #0 0xffffe002 in ?? () #1 0x08269573 in write_core (sig=9026) at stacktrace.c:220 #2 0x0817ec92 in handle_segfault (sig=22) at mysqld.cc:1863 #3 <signal handler called> #4 0x0833897a in NdbDictionary::Table::getColumn(char const*) const ( this=0x0, name=0x0) at NdbDictionary.cpp:338 #5 0x08346871 in NdbBlob::atPrepare(NdbConnection*, NdbOperation*, NdbColumnImpl const*) (this=0x8c4ead0, aCon=0x0, anOp=0xb, aColumn=0xb) at NdbBlob.cpp:1035 #6 0x0832e0f8 in NdbOperation::getBlobHandle(NdbConnection*, NdbColumnImpl const*) (this=0x8c23ae8, aCon=0x0, tAttrInfo=0x8c47ce0) at NdbOperationDefine.cpp:595 #7 0x0833140a in NdbScanOperation::getBlobHandle(unsigned) (this=0x8c23ae8, anAttrId=11) at NdbDictionaryImpl.hpp:564 #8 0x0821eea1 in ha_ndbcluster::get_ndb_value(NdbOperation*, Field*, unsigned, char*) (this=0x8c494f8, ndb_op=0x8c23ae8, field=0x8c23ae8, fieldnr=1, buf=0x8bcd698 "?") at ha_ndbcluster.cc:585 #9 0x0822a367 in ha_ndbcluster::define_read_attrs(char*, NdbOperation*) ( this=0x8c494f8, buf=0x8bcd698 "?", op=0x8c23ae8) at ha_ndbcluster.cc:1516 #10 0x0822181c in ha_ndbcluster::full_table_scan(char*) (this=0x8c494f8, buf=0x0) at ha_ndbcluster.cc:1496 #11 0x08223c8a in ha_ndbcluster::rnd_next(char*) (this=0x8c494f8, buf=0x8bcd698 "?") at ha_ndbcluster.cc:2374 #12 0x0820df8d in handler::read_first_row(char*, unsigned) (this=0x8bcd698, buf=0x8bcd698 "?", primary_key=147100920) at handler.cc:931 #13 0x081c9974 in join_read_system (tab=0x0) at sql_select.cc:5965 #14 0x081c9763 in join_read_const_table (tab=0x8c39f30, pos=0x8c3947c) at sql_select.cc:5914 #15 0x081bf7b5 in make_join_statistics (join=0x8c39420, tables=0x0, conds=0x0, keyuse_array=0x8c39d38) at sql_select.cc:1772 #16 0x081bbbae in JOIN::optimize() (this=0x8c39420) at sql_select.cc:542 #17 0x081bed17 in mysql_select(THD*, Item***, st_table_list*, unsigned, List<Item>&, Item*, unsigned, st_order*, st_order*, Item*, st_order*, unsigned long, select_result*, st_select_lex_unit*, st_select_lex*) (thd=0x8c261a0, rref_pointer_array=0x8c263a8, tables=0x8c393a8, wild_num=1, fields=@0x0, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=8669696, result=0x8c39410, unit=0x8c261e4, select_lex=0x8c262c0) at sql_select.cc:1570 #18 0x081baf53 in handle_select(THD*, st_lex*, select_result*) (thd=0x8c261a0, lex=0x8c261d8, result=0x8c39410) at sql_select.cc:182 #19 0x08194de2 in mysql_execute_command(THD*) (thd=0x8c261a0) at sql_parse.cc:1991 #20 0x08199eeb in mysql_parse(THD*, char*, unsigned) (thd=0x8c261a0, inBuf=0x8c392d0 "select * from t1", length=146956760) at sql_parse.cc:4046 #21 0x081937e7 in dispatch_command(enum_server_command, THD*, char*, unsigned) (command=COM_QUERY, thd=0x8c261a0, packet=0x8c27531 "select * from t1", packet_length=17) at sql_parse.cc:1457 #22 0x08193101 in do_command(THD*) (thd=0x8c261a0) at sql_parse.cc:1272 #23 0x08192602 in handle_one_connection (arg=0x0) at sql_parse.cc:1016 #24 0x4004f484 in start_thread () from /lib/tls/libpthread.so.0 (gdb) up 5 #5 0x08346871 in NdbBlob::atPrepare(NdbConnection*, NdbOperation*, NdbColumnImpl const*) (this=0x8c4ead0, aCon=0x0, anOp=0xb, aColumn=0xb) at NdbBlob.cpp:1035 1035 if (theStripeSize == 0 || (gdb) l 1030 assert((NDB_BLOB_HEAD_SIZE << 2) == sizeof(Head)); 1031 assert(theColumn->m_attrSize * theColumn->m_arraySize == sizeof(Head) + theInlineSize); 1032 if (thePartSize > 0) { 1033 const NdbDictionary::Table* bt = NULL; 1034 const NdbDictionary::Column* bc = NULL; 1035 if (theStripeSize == 0 || 1036 (bt = theColumn->getBlobTable()) == NULL || 1037 (bc = bt->getColumn("DATA")) == NULL || 1038 bc->getType() != partType || 1039 bc->getLength() != (int)thePartSize) { (gdb) p bt $1 = (const class Table *) 0x100 (gdb) p bc $2 = (const Column *) 0x0 (gdb) p theStripSize No symbol "theStripSize" in current context. (gdb) p theStripeSize $3 = 16 (gdb) p theColumn $4 = (const NdbColumnImpl *) 0x8c47ce0 (gdb) p theColumn->m_impl $5 = (NdbColumnImpl &) @0x8c47ce0: {<Column> = {static FRAGMENT = 0x8b989d8, static ROW_COUNT = 0x8bc9278, static COMMIT_COUNT = 0x8bc9310, m_impl = @0x8c47ce0}, m_attrId = 1, m_name = {m_chr = 0x8c47d50 "b", m_len = 1}, m_type = Blob, m_precision = 256, m_scale = 2000, m_length = 16, m_cs = 0x0, m_pk = false, m_tupleKey = false, m_distributionKey = false, m_distributionGroup = false, m_distributionGroupBits = 16, m_nullable = true, m_indexOnly = false, m_autoIncrement = false, m_autoIncrementInitialValue = 18446744073709551615, m_defaultValue = {m_chr = 0x8c47cc0 "", m_len = 0}, m_blobTable = 0x8c24100, m_attrType = 3, m_attrSize = 1, m_arraySize = 264, m_keyInfoPos = 0, m_extType = 20, m_facade = 0x8c47ce0} (gdb) p aCon $6 = (NdbConnection *) 0x0 (gdb) How to repeat: Run this as a test in mysql-test-run show tables; create table t1 (a int, b blob) engine=ndb; show tables; create database test2; use test2; show tables; --error 1146 select * from t1; create table t2 (b int, c text) engine=ndb; use test; select * from t1; << ===== Crash show tables; drop table t1; use test2; drop table t2; drop database test2; show databases; use test;