Bug #4878 Service crashes on query execution
Submitted: 3 Aug 2004 19:26 Modified: 12 Aug 2004 13:01
Reporter: Brett Pappas Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server Severity:S1 (Critical)
Version:4.1.3b/ BK source tree OS:Windows (Windows 2000 Server / Linux)
Assigned to: Ramil Kalimullin CPU Architecture:Any

[3 Aug 2004 19:26] Brett Pappas
Description:
We have certain queries that will cause MySQL to crash based on the rows that should return. I have tried 4.1.3 and 4.1.3b and both crash but 4.1.2 runs fine using the same data.

How to repeat:
Query (this is just one example set of criteria):
select b.main_id main_id,
	0 parent_id,
	0 request_id,
	b.submitting_user submitting_user,
	f.implementing_user implementing_user,
	c.change_status main_status,
	c.descr main_status_descr,
	c.form_type form_type,
	e.descr form_descr,
if(b.change_status=30,concat(c.descr,' ',e.descr),if(b.change_status=60,concat(c.descr,' ',e.descr),if(left(b.change_status,1)=9,concat(c.descr,' ',e.descr),e.descr))) form_descr2,
	d.system_id system_id,
	concat(d.descr,' - ',d.unitid) system_descr,
	b.change_title title,
				if(b.change_status=30,1,if(b.change_status=60,1,if(left(b.change_status,1)=9,1,0))) next_step,
				if(b.change_status<=30,'changeform.php',if(b.change_status<=60,'testplan.php',if(b.change_status<=100,'productionmove.php',0))) view_file,
				if(b.change_status=30,'Create Test Plan',if(b.change_status=60,'Create Production Move',if(left(b.change_status,1)=9,'Implement/ Update',if(b.change_status=10,'Approval Requested',if(b.change_status=40,'Approval Requested',if(b.change_status=70,'Approval Requested',c.descr)))))) next_step_descr,
				if(b.change_status=30,'testplan.php',if(b.change_status=60,'productionmove.php',if(left(b.change_status,1)=9,'changestatus.php','changeform.php'))) next_step_file,
				if(left(b.change_status,1)=9,1,0) final_step,
				'0000-00-00' tmp_access_date
				from change_main b,
				change_status_types c,
				systems d,
				form_types e
				
				left join change_production f on b.main_id=f.main_id
				where b.change_status=c.change_status
				and b.system_id=d.system_id
				and e.form_type=c.form_type
			and ((c.change_status in (10,40,70) and b.submitting_user='122999')
						 
			or (c.change_status in (10,40,70) and c.form_type>1 and b.main_id in (select c.main_id from change_access_additional c
				where b.main_id=c.main_id
				and (
				   (c.division_id='9' and c.unitid=0 and c.dept_id=0 and c.user_id=0)
				or (c.division_id='9' and c.unitid='09098' and c.dept_id=0 and c.user_id=0)
				or (c.division_id='9' and c.unitid='09098' and c.dept_id='5130' and c.user_id=0)
				or (c.user_id='122999')						
							)))				

				or (c.change_status in (10,40,70) and b.main_id in (select b.main_id from workflow_history_tbl b
				where b.approver_id='122999' and b.main_id=b.main_id and c.form_type=b.form_type
				and b.current_approver<>1 and rework=0))
				
				or (c.change_status in (10,40,70) and b.main_id in (select d.main_id from workflow_history_tbl d
				where d.delegated_by='122999' and b.main_id=d.main_id and c.form_type=d.form_type
				and d.current_approver=1)))
						
				order by  if(c.form_type=1,1,2),b.main_id
[3 Aug 2004 19:43] MySQL Verification Team
Could you please can provide the tables with data or a test case for
to run the offended query ?

You can download the zip file at:

ftp://ftp.mysql.com/pub/mysql/upload

making reference to this bug report.

Thanks in advance.
[3 Aug 2004 20:28] Brett Pappas
I uploaded a file called 4878_changemanagement.zip that contains a data dump of the database called 'changemanagement'.
[3 Aug 2004 21:20] MySQL Verification Team
I was able to repeat with 4.1.3 source. I will test it on linux and today BK
source. Thank you for the bug report:

Call stack:

>	mysqld.exe!my_strntod_8bit(charset_info_st * cs=0x007bee68, char * str=0x00000000, unsigned int length=1, char * * end=0x00000000, int * err=0x03dfebb4)  Line 749 + 0xf	C
 	mysqld.exe!Item_str_func::val()  Line 68 + 0x35	C++
 	mysqld.exe!Arg_comparator::compare_real()  Line 394 + 0x13	C++
 	mysqld.exe!Arg_comparator::compare()  Line 63 + 0x10	C++
 	mysqld.exe!Item_func_eq::val_int()  Line 583 + 0xb	C++
 	mysqld.exe!Item_func_if::val_str(String * str=0x00e4b184)  Line 978 + 0x15	C++
 	mysqld.exe!Item_func_if::val_str(String * str=0x00e4b184)  Line 979 + 0xf	C++
 	mysqld.exe!Item_func_if::val_str(String * str=0x00e4b184)  Line 979 + 0xf	C++
 	mysqld.exe!Item::save_in_field(Field * field=0x02f1ca58, int no_conversions=1)  Line 1577 + 0x1b	C++
 	mysqld.exe!Item_result_field::save_in_result_field(int no_conversions=1)  Line 766	C++
 	mysqld.exe!copy_funcs(Item * * func_ptr=0x02f1d804)  Line 8846 + 0x10	C++
 	mysqld.exe!end_write(JOIN * join=0x02f07f80, st_join_table * join_tab=0x02f1ae70, int end_of_records=0)  Line 6541 + 0xf	C++
 	mysqld.exe!sub_select(JOIN * join=0x02f07f80, st_join_table * join_tab=0x02f1ad18, int end_of_records=0)  Line 5807 + 0x16	C++
 	mysqld.exe!sub_select(JOIN * join=0x02f07f80, st_join_table * join_tab=0x02f1abc0, int end_of_records=0)  Line 5807 + 0x16	C++
 	mysqld.exe!sub_select(JOIN * join=0x02f07f80, st_join_table * join_tab=0x02f1aa68, int end_of_records=0)  Line 5807 + 0x16	C++
 	mysqld.exe!flush_cached_records(JOIN * join=0x02f07f80, st_join_table * join_tab=0x02f1a910, int skip_last=0)  Line 5896 + 0x16	C++
 	mysqld.exe!sub_select_cache(JOIN * join=0x02f07f80, st_join_table * join_tab=0x02f1a910, int end_of_records=1)  Line 5748 + 0xf	C++
 	mysqld.exe!sub_select(JOIN * join=0x02f07f80, st_join_table * join_tab=0x02f1a7b8, int end_of_records=1)  Line 5775 + 0x17	C++
 	mysqld.exe!do_select(JOIN * join=0x02f07f80, List<Item> * fields=0x00000000, st_table * table=0x02f1d1f0, Procedure * procedure=0x00000000)  Line 5693 + 0xf	C++
 	mysqld.exe!JOIN::exec()  Line 1171 + 0x11	C++
 	mysqld.exe!mysql_select(THD * thd=0x00e437a8, Item * * * rref_pointer_array=0x00e439b4, st_table_list * tables=0x02efce10, unsigned int wild_num=0, List<Item> & fields={...}, Item * conds=0x02f077d8, unsigned int og_num=2, st_order * order=0x02f07af8, st_order * group=0x00000000, Item * having=0x00000000, st_order * proc_param=0x00000000, unsigned long select_options=8669696, select_result * result=0x02f07f70, st_select_lex_unit * unit=0x00e437cc, st_select_lex * select_lex=0x00e438c8)  Line 1626	C++
 	mysqld.exe!handle_select(THD * thd=0x00e437a8, st_lex * lex=0x00e437c0, select_result * result=0x02f07f70)  Line 193 + 0x87	C++
 	mysqld.exe!mysql_execute_command(THD * thd=0x00e437a8)  Line 1994 + 0x11	C++
 	mysqld.exe!mysql_parse(THD * thd=0x00e437a8, char * inBuf=0x00e49530, unsigned int length=2589)  Line 4034 + 0x9	C++
 	mysqld.exe!dispatch_command(enum_server_command command=COM_QUERY, THD * thd=0x00e437a8, char * packet=0x00e454c9, unsigned int packet_length=2590)  Line 1457 + 0x1d	C++
 	mysqld.exe!do_command(THD * thd=0x00e437a8)  Line 1272 + 0x31	C++
 	mysqld.exe!handle_one_connection(void * arg=0x00e437a8)  Line 1016 + 0x9	C++
 	mysqld.exe!pthread_start(void * param=0x00e4c9c8)  Line 63 + 0x7	C
 	mysqld.exe!_threadstart(void * ptd=0x00e3dd48)  Line 173 + 0xd	C
 	kernel32.dll!77e6d33b()
[4 Aug 2004 9:12] MySQL Verification Team
The crash happens also on Linux Slackware:

miguel@hegel:~/dbs/4.1$ ./start_d41
040804  4:01:47  InnoDB: Started; log sequence number 0 44383
/home/miguel/dbs/4.1/libexec/mysqld: ready for connections.
Version: '4.1.4-beta-debug-log'  socket: '/home/miguel/dbs/4.1/tmp/mysql.sock'  port: 3341
mysqld got signal 11;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.
key_buffer_size=16777216
read_buffer_size=258048
max_used_connections=1
max_connections=100
threads_connected=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_connections = 92780 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

thd=0x872a9c8
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
Cannot determine thread, fp=0xbe5fe718, backtrace may not be correct.
Stack range sanity check OK, backtrace follows:
0x81860d1
0x4018dbe5
0x8466cef
0x81388be
0x812bb40
0x812c440
0x812d4ee
0x812d511
0x812d511
0x810a122
0x810ed2e
0x81d93f3
0x81d4ae2
0x81d3377
0x81d3377
0x81d3377
0x81d3611
0x81d322f
0x81d3291
0x81d2f97
0x81c75e7
0x81c8b7c
0x81c4cbb
0x819b56c
0x81a0d3f
0x8199f2f
0x8199847
0x8198d1a
0x40187cc4
0x40313037
New value of fp=(nil) failed sanity check, terminating stack trace!
Please read http://www.mysql.com/doc/en/Using_stack_trace.html and follow instructions on how to resolve the stack trace. Resolved
stack trace is much more helpful in diagnosing the problem, so please do
resolve it
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at 0x873d8b8 = select b.main_id main_id,
        0 parent_id,
        0 request_id,
        b.submitting_user submitting_user,
        f.implementing_user implementing_user,
        c.change_status main_status,
        c.descr main_status_descr,
        c.form_type form_type,
        e.descr form_descr,
if(b.change_status=30,concat(c.descr,'
',e.descr),if(b.change_status=60,concat(c.descr,'
',e.descr),if(left(b.change_status,1)=9,concat(c.descr,' ',e.descr),e.descr)))
form_descr2,
        d.system_id system_id,
        concat(d.descr,' - ',d.unitid) system_descr,
        b.change_title title,
                                if(b.change_status=30,1,if(b.change_status=60,1,if(left(b.change_status,1)=9
,1,0))) next_step,
                                if(b.change_status<=30,'changeform.php',if(b.change_status<=60,'testplan.php
',if(b.change_status<=100,'productionmove.php',0))) view_file,
                                if(b.change_status=30,'Create Test Plan',if(b.change_status=60,'Create
Production Move',if(left(b.change_status,1)=9,'Implement/
Update',if(b.change_status=10,'Approval
Requested',if(b.change_status=40,'Approval
Requested',if(b.change_status=70,'Approval Requested',c.
thd->thread_id=1
The manual page at http://www.mysql.com/doc/en/Crashing.html contains
information that should help you find out what is causing the crash.
[12 Aug 2004 13:01] Ramil Kalimullin
Thank you for your bug report. This issue has been committed to our
source repository of that product and will be incorporated into the
next release.

If necessary, you can access the source repository and build the latest
available version, including the bugfix, yourself. More information 
about accessing the source trees is available at
    http://www.mysql.com/doc/en/Installing_source_tree.html