Bug #31075 crash in get_func_mm_tree
| Submitted: | 18 Sep 2007 5:28 | Modified: | 1 Nov 2007 3:06 |
|---|---|---|---|
| Reporter: | Shane Bester (Platinum Quality Contributor) | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server: Optimizer | Severity: | S2 (Serious) |
| Version: | 5.1.23BK | OS: | Any |
| Assigned to: | Gleb Shchepa | CPU Architecture: | Any |
[18 Sep 2007 5:28]
Shane Bester
[18 Sep 2007 10:12]
Shane Bester
testcase -------------- drop table if exists t1; create table `t1` (`col000` time ,key(`col000` ),`col001` tinyblob ,key(`col001` (1)))engine=myisam; insert into t1 values (),(),(),(),(),(),(),(),(),(); select interval(col001,col000,col000,col001,col001,col000) from t1 where col000 not in (col000,col001,col001,col000,col000) group by convert(col000 using hp8) ;
[18 Sep 2007 10:15]
Shane Bester
sometimes the testcase will cause a hang. sometimes nothing, but memory is silently overridden/corrupted in this case. recommend running under valgrind or debug server to test.
[18 Sep 2007 10:15]
Domas Mituzas
Same crash on Mac:
5056 if (func->array->result_type() != ROW_RESULT)
(gdb) bt
#0 0x0019c40b in get_func_mm_tree (param=0xb04c8338, cond_func=0x50930e8, field=0x5090f50, value=0x0, cmp_type=INT_RESULT, inv=1) at opt_range.cc:5056
#1 0x0019c8fb in get_full_func_mm_tree (param=0xb04c8338, cond_func=0x50930e8, field_item=0x5092d20, value=0x0, inv=true) at opt_range.cc:5312
#2 0x0019cf3a in get_mm_tree (param=0xb04c8338, cond=0x50930e8) at opt_range.cc:5459
#3 0x0019e37a in SQL_SELECT::test_quick_select (this=0x5093898, thd=0x5082400, keys_to_use={map = 1}, prev_tables=0, limit=18446744073709551615, force_quick_range=false) at opt_range.cc:2252
#4 0x0012442f in make_join_statistics (join=0x50fd010, tables=0x0, conds=0x50930e8, keyuse_array=0x50fe114) at sql_select.cc:2356
#5 0x00128482 in JOIN::optimize (this=0x50fd010) at sql_select.cc:933
#6 0x00134152 in mysql_select (thd=0x5082400, rref_pointer_array=0x5083568, tables=0x5092b38, wild_num=0, fields=@0x5083504, conds=0x50930e8, og_num=1, order=0x0, group=0x50932c8, having=0x0, proc_param=0x0, select_options=2147764736, result=0x5093358, unit=0x5083208, select_lex=0x5083470) at sql_select.cc:2299
#7 0x00134749 in handle_select (thd=0x5082400, lex=0x50831ac, result=0x5093358, setup_tables_done_option=0) at sql_select.cc:263
#8 0x000ba304 in execute_sqlcom_select (thd=0x5082400, all_tables=0x5092b38) at sql_parse.cc:4549
#9 0x000bce9b in mysql_execute_command (thd=0x5082400) at sql_parse.cc:1886
#10 0x000c48ea in mysql_parse (thd=0x5082400, inBuf=0x5092410 "select interval(col001,col000,col000,col001,col001,col000) from t1 where col000 not in\n(col000,col001,col001,col000,col000) group by convert(col000 using hp8)", length=158, found_semicolon=0xb04cbe3c) at sql_parse.cc:5462
#11 0x000c5736 in dispatch_command (command=COM_QUERY, thd=0x5082400, packet=0x3f49001 "select interval(col001,col000,col000,col001,col001,col000) from t1 where col000 not in\n(col000,col001,col001,col000,col000) group by convert(col000 using hp8)", packet_length=159) at sql_parse.cc:958
#12 0x000c688a in do_command (thd=0x5082400) at sql_parse.cc:717
#13 0x000b56d2 in handle_one_connection (arg=0x5082400) at sql_connect.cc:1099
#14 0x90024227 in _pthread_body ()
[18 Sep 2007 10:17]
Domas Mituzas
stripped the header of previous paste: Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_PROTECTION_FAILURE at address: 0x00000000 [Switching to process 5813 thread 0x3103] 0x0019c40b in get_func_mm_tree (param=0xb04c8338, cond_func=0x50930e8, field=0x5090f50, value=0x0, cmp_type=INT_RESULT, inv=1) at opt_range.cc:5056 5056 if (func->array->result_type() != ROW_RESULT)
[18 Sep 2007 10:35]
Valeriy Kravchuk
Same crash on 5.1.23-BK on Linux, even without -debug: openxs@linux:~/dbs/5.1> bin/mysql -uroot test Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 1 Server version: 5.1.23-beta Source distribution Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql> create table t01 (c1 time, key(c1), c2 tinyblob, key(c2(1))) engine=MyISAM; Query OK, 0 rows affected (0.04 sec) mysql> insert into t01 values (), (), (), (), (), (), (), (), (), (); Query OK, 10 rows affected (0.01 sec) Records: 10 Duplicates: 0 Warnings: 0 mysql> select interval(c2,c1,c1,c2,c2,c1) from t01 where c1 not in (c1, c2, c2, c1, c1) group by convert(c1 using hp8); ERROR 2013 (HY000): Lost connection to MySQL server during query mysql> 070913 15:00:59 mysqld_safe Number of processes running now: 0 070913 15:01:00 mysqld_safe mysqld restarted mysql> exit Bye openxs@linux:~/dbs/5.1> vi var/linux.err openxs@linux:~/dbs/5.1> vi 31075.stack openxs@linux:~/dbs/5.1> nm -n libexec/mysqld > /tmp/mysqld51.sym openxs@linux:~/dbs/5.1> bin/resolve_stack_dump -s /tmp/mysqld51.sym -n 31075.stack 0x8214dbb handle_segfault + 683 0x82ed239 _Z16get_func_mm_treeP15RANGE_OPT_PARAMP9Item_funcP5FieldP4Item11Item_resultb + 153 0x82ed86e _Z21get_full_func_mm_treeP15RANGE_OPT_PARAMP9Item_funcP10Item_fieldP4Itemb + 494 0x82edc54 _Z11get_mm_treeP15RANGE_OPT_PARAMP4Item + 980 0x82f0137 _ZN10SQL_SELECT17test_quick_selectEP3THD6BitmapILj64EEymb + 2311
[22 Sep 2007 21:13]
Shane Bester
so far I've only seen this particular crash with "not in (..)" clauses in the query
[23 Sep 2007 21:49]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/34500 ChangeSet@1.2562, 2007-09-23 22:51:25+02:00, gshchepa@devsrv-b.mysql.com +3 -0 Fixed bug #31075. The `SELECT col FROM t WHERE col NOT IN (col, ...) GROUP BY col' crashed in the range optimizer. The get_func_mm_tree function has been modified to check the Item_func_in::array field for the NULL value before using of that value.
[23 Sep 2007 23:00]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/34501 ChangeSet@1.2562, 2007-09-24 00:02:39+02:00, gshchepa@devsrv-b.mysql.com +3 -0 Fixed bug #31075. The `SELECT col FROM t WHERE col NOT IN (col, ...) GROUP BY col' crashed in the range optimizer. The get_func_mm_tree function has been modified to check the Item_func_in::array field for the NULL value before using of that value.
[26 Sep 2007 11:43]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/34556 ChangeSet@1.2562, 2007-09-26 12:45:08+02:00, gshchepa@devsrv-b.mysql.com +3 -0 Fixed bug #31075. The `SELECT col FROM t WHERE col NOT IN (col, ...) GROUP BY col' crashed in the range optimizer. The get_func_mm_tree function has been modified to check the Item_func_in::array field for the NULL value before using of that value.
[29 Oct 2007 8:46]
Bugs System
Pushed into 5.1.23-beta
[29 Oct 2007 8:50]
Bugs System
Pushed into 6.0.4-alpha
[1 Nov 2007 3:06]
Paul DuBois
Noted in 5.1.23, 6.0.4 changelogs. Expressions of the form WHERE col NOT IN (col, ...), where the same column was named both times, could cause a server crash in the optimizer.
Portions of this website are copyright © 2001, 2002 The PHP Group
Page generated in 0.068 sec. using MySQL 8.4.7-u6-cloud
Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the
respective copyright holders.
It is not reviewed in advance
by Oracle and does not necessarily represent the opinion of
Oracle or any other party.