MySQL Bugs: #80332: Valgrind THD::Query_plan::set_query

Bug #80332	Valgrind THD::Query_plan::set_query_plan
Submitted:	11 Feb 2016 0:42	Modified:	15 Feb 2016 14:11
Reporter:	Roel Van de Paar	Email Updates:
Status:	Duplicate	Impact on me:	None
Category:	MySQL Server: Optimizer	Severity:	S1 (Critical)
Version:	5.7.10, 5.7.11	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
==12410== Thread 31:
==12410== Conditional jump or move depends on uninitialised value(s)
==12410==    at 0x1494468: THD::Query_plan::set_query_plan(enum_sql_command, LEX*, bool) (sql_class.cc:4622)
==12410==    by 0x14F6FE3: mysql_execute_command(THD*, bool) (sql_parse.cc:4921)
==12410==    by 0x144C1C0: sp_instr_stmt::exec_core(THD*, unsigned int*) (sp_instr.cc:932)
==12410==    by 0x144AEF7: sp_lex_instr::reset_lex_and_exec_core(THD*, unsigned int*, bool) (sp_instr.cc:402)
==12410==    by 0x144B8FE: sp_lex_instr::validate_lex_and_execute_core(THD*, unsigned int*, bool) (sp_instr.cc:667)
==12410==    by 0x144BE59: sp_instr_stmt::execute(THD*, unsigned int*) (sp_instr.cc:843)
==12410==    by 0x14441AB: sp_head::execute(THD*, bool) (sp_head.cc:789)
==12410==    by 0x1446161: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:1522)
==12410==    by 0x162910C: Event_job_data::execute(THD*, bool) (event_data_objects.cc:1472)
==12410==    by 0x1726322: Event_worker_thread::run(THD*, Event_queue_element_for_exec*) (event_scheduler.cc:338)
==12410==    by 0x1726091: event_worker_thread (event_scheduler.cc:283)
==12410==    by 0x184D90F: pfs_spawn_thread (pfs.cc:2192)
==12410==    by 0x4E3CDC4: start_thread (pthread_create.c:308)
==12410==    by 0x6A1621C: clone (clone.S:113)
==12410==
==12410== Conditional jump or move depends on uninitialised value(s)
==12410==    at 0x1494475: THD::Query_plan::set_query_plan(enum_sql_command, LEX*, bool) (sql_class.cc:4623)
==12410==    by 0x14F6FE3: mysql_execute_command(THD*, bool) (sql_parse.cc:4921)
==12410==    by 0x144C1C0: sp_instr_stmt::exec_core(THD*, unsigned int*) (sp_instr.cc:932)
==12410==    by 0x144AEF7: sp_lex_instr::reset_lex_and_exec_core(THD*, unsigned int*, bool) (sp_instr.cc:402)
==12410==    by 0x144B8FE: sp_lex_instr::validate_lex_and_execute_core(THD*, unsigned int*, bool) (sp_instr.cc:667)
==12410==    by 0x144BE59: sp_instr_stmt::execute(THD*, unsigned int*) (sp_instr.cc:843)
==12410==    by 0x14441AB: sp_head::execute(THD*, bool) (sp_head.cc:789)
==12410==    by 0x1446161: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:1522)
==12410==    by 0x162910C: Event_job_data::execute(THD*, bool) (event_data_objects.cc:1472)
==12410==    by 0x1726322: Event_worker_thread::run(THD*, Event_queue_element_for_exec*) (event_scheduler.cc:338)
==12410==    by 0x1726091: event_worker_thread (event_scheduler.cc:283)
==12410==    by 0x184D90F: pfs_spawn_thread (pfs.cc:2192)
==12410==    by 0x4E3CDC4: start_thread (pthread_create.c:308)
==12410==    by 0x6A1621C: clone (clone.S:113)

How to repeat:
The attached tarball (bug_bundle.tar.gz) gives the testcase as an exact match of our system, including some handy utilities

$ vi 1455065673_mybase     # STEP1: Update the base path in this file (usually the only change required!). If you use a non-binary distribution, please update SOURCE_DIR location also
$ ./1455065673_init        # STEP2: Initializes the data dir
$ ./1455065673_start_valgrind   # STEP3: Starts mysqld under Valgrind (make sure to use a Valgrind instrumented build) (note: this can easily take 20-30 seconds or more)
$ ./1455065673_cl          # STEP4: To check mysqld is up
$ ./1455065673_run_pquery  # STEP5: Run the testcase with the pquery binary
$ vi /dev/shm/1455065673/error.log.out  # STEP6: Verify the error log

Bug bundle with all required files

Attachment: bug_bundle.tar.gz (application/x-gzip, text), 2.00 MiB.

Also seen as:

==28995== Conditional jump or move depends on uninitialised value(s)
==28995==    at 0x14B658A: THD::Query_plan::set_query_plan(enum_sql_command, LEX*, bool) (sql_class.cc:4922)
==28995==    by 0x151B172: mysql_execute_command(THD*, bool) (sql_parse.cc:5144)
==28995==    by 0x146A603: sp_instr_stmt::exec_core(THD*, unsigned int*) (sp_instr.cc:969)
==28995==    by 0x14692F4: sp_lex_instr::reset_lex_and_exec_core(THD*, unsigned int*, bool) (sp_instr.cc:403)
==28995==    by 0x1469CFC: sp_lex_instr::validate_lex_and_execute_core(THD*, unsigned int*, bool) (sp_instr.cc:668)
==28995==    by 0x146A29B: sp_instr_stmt::execute(THD*, unsigned int*) (sp_instr.cc:857)
==28995==    by 0x146254D: sp_head::execute(THD*, bool) (sp_head.cc:789)
==28995==    by 0x1464519: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:1523)
==28995==    by 0x1659BE4: Event_job_data::execute(THD*, bool) (event_data_objects.cc:1472)
==28995==    by 0x1746536: Event_worker_thread::run(THD*, Event_queue_element_for_exec*) (event_scheduler.cc:338)
==28995==    by 0x17462A5: event_worker_thread (event_scheduler.cc:283)
==28995==    by 0x1872B5F: pfs_spawn_thread (pfs.cc:2192)
==28995==    by 0x4E3CDC4: start_thread (pthread_create.c:308)
==28995==    by 0x6A1621C: clone (clone.S:113)
==28995==  Uninitialised value was created by a heap allocation
==28995==    at 0x4C2A105: operator new(unsigned long) (vg_replace_malloc.c:324)
==28995==    by 0x1746ED0: Event_scheduler::execute_top(Event_queue_element_for_exec*) (event_scheduler.cc:572)
==28995==    by 0x1746CE0: Event_scheduler::run(THD*) (event_scheduler.cc:530)
==28995==    by 0x17461DE: event_scheduler_thread (event_scheduler.cc:243)
==28995==    by 0x1872B5F: pfs_spawn_thread (pfs.cc:2192)
==28995==    by 0x4E3CDC4: start_thread (pthread_create.c:308)
==28995==    by 0x6A1621C: clone (clone.S:113)
==28995==
==28995== Conditional jump or move depends on uninitialised value(s)
==28995==    at 0x14B6597: THD::Query_plan::set_query_plan(enum_sql_command, LEX*, bool) (sql_class.cc:4923)
==28995==    by 0x151B172: mysql_execute_command(THD*, bool) (sql_parse.cc:5144)
==28995==    by 0x146A603: sp_instr_stmt::exec_core(THD*, unsigned int*) (sp_instr.cc:969)
==28995==    by 0x14692F4: sp_lex_instr::reset_lex_and_exec_core(THD*, unsigned int*, bool) (sp_instr.cc:403)
==28995==    by 0x1469CFC: sp_lex_instr::validate_lex_and_execute_core(THD*, unsigned int*, bool) (sp_instr.cc:668)
==28995==    by 0x146A29B: sp_instr_stmt::execute(THD*, unsigned int*) (sp_instr.cc:857)
==28995==    by 0x146254D: sp_head::execute(THD*, bool) (sp_head.cc:789)
==28995==    by 0x1464519: sp_head::execute_procedure(THD*, List<Item>*) (sp_head.cc:1523)
==28995==    by 0x1659BE4: Event_job_data::execute(THD*, bool) (event_data_objects.cc:1472)
==28995==    by 0x1746536: Event_worker_thread::run(THD*, Event_queue_element_for_exec*) (event_scheduler.cc:338)
==28995==    by 0x17462A5: event_worker_thread (event_scheduler.cc:283)
==28995==    by 0x1872B5F: pfs_spawn_thread (pfs.cc:2192)
==28995==    by 0x4E3CDC4: start_thread (pthread_create.c:308)
==28995==    by 0x6A1621C: clone (clone.S:113)
==28995==  Uninitialised value was created by a heap allocation
==28995==    at 0x4C2A105: operator new(unsigned long) (vg_replace_malloc.c:324)
==28995==    by 0x1746ED0: Event_scheduler::execute_top(Event_queue_element_for_exec*) (event_scheduler.cc:572)
==28995==    by 0x1746CE0: Event_scheduler::run(THD*) (event_scheduler.cc:530)
==28995==    by 0x17461DE: event_scheduler_thread (event_scheduler.cc:243)
==28995==    by 0x1872B5F: pfs_spawn_thread (pfs.cc:2192)
==28995==    by 0x4E3CDC4: start_thread (pthread_create.c:308)
==28995==    by 0x6A1621C: clone (clone.S:113)

And, this crash: http://bugs.mysql.com/bug.php?id=79905 was seen in the same run. It MAY be related (though that's not established)

Hello Roel,

Thank you for the report.

Thanks,
Umesh

Posted by developer:
 
I am unable to reproduce this, but my guess is that it's a duplicate of internal
Bug#22573117 VALGRIND: CONDITIONAL JUMP OR MOVE DEPENDS ON UNINITIALISED VALUE(S)
Pushed a couple of weeks ago, so should be part of 5.7.12

Umesh, can you repeat on current head of 5.7.12?

Posted by developer:
 
Duplicate of internal bug:
Bug#22573117 VALGRIND: CONDITIONAL JUMP OR MOVE DEPENDS ON UNINITIALISED VALUE(S)
Fixed in 5.7.12