MySQL Bugs: #48459: valgrind errors with query using 'Range checked for each record'

Bug #48459	valgrind errors with query using 'Range checked for each record'
Submitted:	2 Nov 2009 9:36	Modified:	12 Mar 2010 17:01
Reporter:	Shane Bester (Platinum Quality Contributor)	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Optimizer	Severity:	S2 (Serious)
Version:	5.1.40	OS:	Linux
Assigned to:	Martin Hansson	CPU Architecture:	Any
Tags:	regression, valgrind

Description:
a sample of the 5.1.40 valgrind output (cut to fit!)

Conditional jump or move depends on uninitialised value(s)
at: key_and (opt_range.cc:6387)
by: and_all_keys (opt_range.cc:6343)
by: tree_and (opt_range.cc:6097)
by: get_mm_tree (opt_range.cc:5452)
by: SQL_SELECT::test_quick_select (opt_range.cc:2331)
by: JOIN::optimize() (sql_select.cc:6268)
by: mysql_select (sql_select.cc:2380)
by: handle_select (sql_select.cc:268)
by: execute_sqlcom_select (sql_parse.cc:5043)
by: mysql_execute_command(THD*) (sql_parse.cc:2238)
by: mysql_parse(THD*, char const*, unsigned, char const**) (sql_parse.cc:5963)
by: dispatch_command(enum_server_command, THD*, char*, unsigned) (sql_parse.cc:1224)

How to repeat:
run mysqld under valgrind.
import the attached sql.

import into mysql client

Attachment: bug48459_testcase.sql (application/unknown, text), 2.71 KiB.

output from valgrind on 5.1.40

Attachment: bug48459_5.1.40_valgrind_output.txt (text/plain), 4.20 KiB.

Not repeatable with 5.0.86 on 64-bit Ubuntu (valgrind 3.4.1 reports no leaks). Looks like a regression.

Verified just as described on 64-bit Ubuntu 9.04 with 5.1.40.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/90678

3201 Martin Hansson	2009-11-17
      Bug#48459: valgrind errors with query using 'Range checked
      for each record'
      
      There was an error in an internal structure in the range
      optimizer. Bad design causes parts of a data structure not
      to be initialized when it is in a certain state. All client
      code must check that this state is not present before trying
      to access the structure's data before checking the
      state. Fixed by checking the state before trying to access
      data.
     @ mysql-test/r/range.result
        Bug#48459: Test result.
     @ mysql-test/t/range.test
        Bug#48459: Test case.
     @ sql/opt_range.cc
        Bug#48459: Fix: swapped two lines.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/90832

3201 Martin Hansson	2009-11-18
      Bug#48459: valgrind errors with query using 'Range checked
      for each record'
      
      There was an error in an internal structure in the range
      optimizer (SEL_ARG). Bad design causes parts of a data
      structure not to be initialized when it is in a certain
      state. All client code must check that this state is not
      present before trying to access the structure's data. Fixed
      by
      
      - Checking the state before trying to access data (in
      several places, most of which not covered by test case.)
      
      - Copying the keypart id when cloning SEL_ARGs
     @ mysql-test/r/range.result
        Bug#48459: Test result.
     @ mysql-test/t/range.test
        Bug#48459: Test case.
     @ sql/opt_range.cc
        Bug#48459: Fix + doxygenated count_key_part_usage comment.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/90836

3201 Martin Hansson	2009-11-18
      Bug#48459: valgrind errors with query using 'Range checked
      for each record'
      
      There was an error in an internal structure in the range
      optimizer (SEL_ARG). Bad design causes parts of a data
      structure not to be initialized when it is in a certain
      state. All client code must check that this state is not
      present before trying to access the structure's data. Fixed
      by
      
      - Checking the state before trying to access data (in
      several places, most of which not covered by test case.)
      
      - Copying the keypart id when cloning SEL_ARGs
     @ mysql-test/r/range.result
        Bug#48459: Test result.
     @ mysql-test/t/range.test
        Bug#48459: Test case.
     @ sql/opt_range.cc
        Bug#48459: Fix + doxygenated count_key_part_usage comment.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/91559

3224 Martin Hansson	2009-11-25
      Bug#48459: valgrind errors with query using 'Range checked
      for each record'
      
      There was an error in an internal structure in the range
      optimizer (SEL_ARG). Bad design causes parts of a data
      structure not to be initialized when it is in a certain
      state. All client code must check that this state is not
      present before trying to access the structure's data. Fixed
      by
      
      - Checking the state before trying to access data (in
      several places, most of which not covered by test case.)
      
      - Copying the keypart id when cloning SEL_ARGs
     @ mysql-test/r/range.result
        Bug#48459: Test result.
     @ mysql-test/t/range.test
        Bug#48459: Test case.
     @ sql/opt_range.cc
        Bug#48459: Fix + doxygenated count_key_part_usage comment.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/91588

3712 Martin Hansson	2009-11-25 [merge]
      Merge of 
      - fix for Bug#48459
      - auto-merge by Tatiana A. Nurnberg
      - Post-merge fix for bug 41728 by Davi Arnaut

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/91752

3225 Martin Hansson	2009-11-26 [merge]
      Merge of fix for Bug#48459

Pushed into 5.1.42 (revid:joro@sun.com-20091202080033-mndu4sxwx19lz2zs) (version source revid:kent.boortz@sun.com-20091127083511-dqyetiycohpq0xfx) (merge vers: 5.1.42) (pib:13)

Noted in 5.1.42 changelog.

Parts of the range optimizer could be initialized incorrectly,
resulting in Valgrind errors. 

Setting report to NDI pending push to 5.5.x+.

Pushed into 6.0.14-alpha (revid:alik@sun.com-20091216083311-xorsasf5kopjxshf) (version source revid:alik@sun.com-20091214191830-wznm8245ku8xo702) (merge vers: 6.0.14-alpha) (pib:14)

Pushed into 5.5.0-beta (revid:alik@sun.com-20091216082430-s0gtzibcgkv4pqul) (version source revid:alexey.kopytov@sun.com-20091126114659-f3imubfuye9fn7qp) (merge vers: 5.5.0-beta) (pib:14)

Pushed into mysql-next-mr (revid:alik@sun.com-20091216083231-rp8ecpnvkkbhtb27) (version source revid:alik@sun.com-20091212203859-fx4rx5uab47wwuzd) (merge vers: 5.6.0-beta) (pib:14)

Noted in 5.5.1, 6.0.14 changelogs.

Pushed into 5.1.44-ndb-7.0.14 (revid:jonas@mysql.com-20100312135944-t0z8s1da2orvl66x) (version source revid:jonas@mysql.com-20100312115609-woou0te4a6s4ae9y) (merge vers: 5.1.44-ndb-7.0.14) (pib:16)

Pushed into 5.1.44-ndb-6.2.19 (revid:jonas@mysql.com-20100312134846-tuqhd9w3tv4xgl3d) (version source revid:jonas@mysql.com-20100312060623-mx6407w2vx76h3by) (merge vers: 5.1.44-ndb-6.2.19) (pib:16)

Pushed into 5.1.44-ndb-6.3.33 (revid:jonas@mysql.com-20100312135724-xcw8vw2lu3mijrhn) (version source revid:jonas@mysql.com-20100312103652-snkltsd197l7q2yg) (merge vers: 5.1.44-ndb-6.3.33) (pib:16)