MySQL Bugs: #13351: Mysql 4.1 crashes when we're using union+format function

Bug #13351	Mysql 4.1 crashes when we're using union+format function
Submitted:	20 Sep 2005 13:51	Modified:	20 Sep 2005 14:18
Reporter:	Oleksiy Kovyrin	Email Updates:
Status:	Can't repeat	Impact on me:	None
Category:	MySQL Server	Severity:	S2 (Serious)
Version:	4.1.11	OS:	Linux (Linux (Debian Sarge))
Assigned to:	MySQL Verification Team	CPU Architecture:	Any

Description:
When we're using format statement in union queries, mysql 4.1 crashes. Is it known error and I need update my mysql, or there is a serious bug in mysql?

How to repeat:
I've created test database and there are results:

-------------------------------------------------------------------------------
db:~# mysql test
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 3 to server version: 4.1.11-Debian_4sarge1-log

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> show tables;
+----------------+
| Tables_in_test |
+----------------+
| test1          |
| test2          |
+----------------+
2 rows in set (0.00 sec)

mysql> describe test1;
+-------+---------+------+-----+---------+----------------+
| Field | Type    | Null | Key | Default | Extra          |
+-------+---------+------+-----+---------+----------------+
| id    | int(11) |      | PRI | NULL    | auto_increment |
| dbl   | double  |      |     | 0       |                |
+-------+---------+------+-----+---------+----------------+
2 rows in set (0.00 sec)

mysql> describe test2;
+-------+---------+------+-----+---------+----------------+
| Field | Type    | Null | Key | Default | Extra          |
+-------+---------+------+-----+---------+----------------+
| id    | int(11) |      | PRI | NULL    | auto_increment |
| dbl   | double  |      |     | 0       |                |
+-------+---------+------+-----+---------+----------------+
2 rows in set (0.00 sec)

mysql> (select format(dbl,2) from test1)
    -> union
    -> (select format(dbl,2) from test2);

-------------------------------------------------------------------------------
After that query mysqld crashes with following message in error log:

Sep 20 16:39:28 db mysqld[9774]: mysqld got signal 11;
Sep 20 16:39:28 db mysqld[9774]: This could be because you hit a bug. It is also possible that this binary
Sep 20 16:39:28 db mysqld[9774]: or one of the libraries it was linked against is corrupt, improperly built,
Sep 20 16:39:28 db mysqld[9774]: or misconfigured. This error can also be caused by malfunctioning hardware.
Sep 20 16:39:28 db mysqld[9774]: We will try our best to scrape up some info that will hopefully help diagnose
Sep 20 16:39:28 db mysqld[9774]: the problem, but since we have already crashed, something is definitely wrong
Sep 20 16:39:28 db mysqld[9774]: and this may fail.
Sep 20 16:39:28 db mysqld[9774]:
Sep 20 16:39:28 db mysqld[9774]: key_buffer_size=16777216
Sep 20 16:39:28 db mysqld[9774]: read_buffer_size=131072
Sep 20 16:39:28 db mysqld[9774]: max_used_connections=2
Sep 20 16:39:28 db mysqld[9774]: max_connections=100
Sep 20 16:39:28 db mysqld[9774]: threads_connected=1
Sep 20 16:39:28 db mysqld[9774]: It is possible that mysqld could use up to
Sep 20 16:39:28 db mysqld[9774]: key_buffer_size + (read_buffer_size + sort_buffer_size)*max_connections = 233983 K
Sep 20 16:39:28 db mysqld[9774]: bytes of memory
Sep 20 16:39:28 db mysqld[9774]: Hope that's ok; if not, decrease some variables in the equation.
Sep 20 16:39:28 db mysqld[9774]:
Sep 20 16:39:28 db mysqld[9774]: thd=0x8b69030
Sep 20 16:39:28 db mysqld[9774]: Attempting backtrace. You can use the following information to find out
Sep 20 16:39:28 db mysqld[9774]: where mysqld died. If you see no messages after this, something went
Sep 20 16:39:28 db mysqld[9774]: terribly wrong...
Sep 20 16:39:28 db mysqld[9774]: Cannot determine thread, fp=0x5c7fda98, backtrace may not be correct.
Sep 20 16:39:28 db mysqld[9774]: Stack range sanity check OK, backtrace follows:
Sep 20 16:39:28 db mysqld[9774]: 0x81893bf
Sep 20 16:39:28 db mysqld[9774]: 0x247a4825
Sep 20 16:39:28 db mysqld[9774]: 0x2498956b
Sep 20 16:39:28 db mysqld[9774]: 0x8176e67
Sep 20 16:39:28 db mysqld[9774]: 0x81cd11f
Sep 20 16:39:28 db mysqld[9774]: 0x82596f7
Sep 20 16:39:28 db mysqld[9774]: 0x8258d07
Sep 20 16:39:28 db mysqld[9774]: 0x81c3339
Sep 20 16:39:28 db mysqld[9774]: 0x819d716
Sep 20 16:39:28 db mysqld[9774]: 0x81a2dac
Sep 20 16:39:28 db mysqld[9774]: 0x819c165
Sep 20 16:39:28 db mysqld[9774]: 0x819bd46
Sep 20 16:39:28 db mysqld[9774]: 0x819b4a8
Sep 20 16:39:28 db mysqld[9774]: 0x2479ee51
Sep 20 16:39:28 db mysqld[9774]: 0x249e992a
Sep 20 16:39:28 db mysqld[9774]: New value of fp=(nil) failed sanity check, terminating stack trace!
Sep 20 16:39:28 db mysqld[9774]: Please read http://dev.mysql.com/doc/mysql/en/Using_stack_trace.html and follow instructions on how to resolve the stack trac
Sep 20 16:39:28 db mysqld[9774]: stack trace is much more helpful in diagnosing the problem, so please do
Sep 20 16:39:28 db mysqld[9774]: resolve it
Sep 20 16:39:28 db mysqld[9774]: Trying to get some variables.
Sep 20 16:39:28 db mysqld[9774]: Some pointers may be invalid and cause the dump to abort...
Sep 20 16:39:28 db mysqld[9774]: thd->query at 0x8b7db28 =
Sep 20 16:39:28 db mysqld[9774]:
Sep 20 16:39:28 db mysqld[9774]: thd->thread_id=74
Sep 20 16:39:28 db mysqld[9774]: The manual page at http://www.mysql.com/doc/en/Crashing.html contains
Sep 20 16:39:28 db mysqld[9774]: information that should help you find out what is causing the crash.
-------------------------------------------------------------------------------

If we're removing format statements from query, everything is OK.

I was unable to repeat the behavior reported with current source server,
could you please test with more released server:

miguel@hegel:~/dbs/4.1> bin/mysql -uroot test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2 to server version: 4.1.15-debug-log

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create table test1 (id int not null auto_increment primary key,
    -> dbl double);
Query OK, 0 rows affected (0.04 sec)

mysql> insert into test1 set dbl=2.34;
Query OK, 1 row affected (0.00 sec)

mysql> create table test2 (id int not null auto_increment primary key,
    -> dbl double);
Query OK, 0 rows affected (0.05 sec)

mysql> insert into test2 set dbl=2.35;
Query OK, 1 row affected (0.00 sec)

mysql> (select format(dbl,2) from test1)
    -> union
    -> (select format(dbl,2) from test2);
+---------------+
| format(dbl,2) |
+---------------+
| 2.34          |
| 2.35          |
+---------------+
2 rows in set (0.01 sec)

mysql> 

Thanks in advance.

Yes. Mysql 4.1.14 haven't this bug.
Thanks!