MySQL Bugs: #553: group_concat crashes with empty result set

Bug #553	group_concat crashes with empty result set
Submitted:	31 May 2003 3:53	Modified:	18 Aug 2003 12:58
Reporter:	Pieter Ennes	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server	Severity:	S3 (Non-critical)
Version:	4.1	OS:	Linux (Linux GNU/Debian Kernel 2.4.20)
Assigned to:	Bugs System	CPU Architecture:	Any

Description:
Using the new group_concat function with something that doesn't return rows results in a server crash.

How to repeat:
Executing the following query will probably crash the server:

create table test (name	varchar(16));
select group_concat(name) from test;

Suggested fix:
N/A.

The problem is that in item_sum.cc:1591

bool Item_func_group_concat::add()
{
  copy_fields(tmp_table_param);

At this point tmp_table_param->copy_field is 0x0 which causes crash later.

(gdb) bt 
#0  0x08184d37 in copy_fields(TMP_TABLE_PARAM*) (param=0x8b13e88) at sql_select.cc:7687
#1  0x080e71c9 in Item_func_group_concat::add() (this=0x8b13220) at item_sum.cc:1591
#2  0x080e71ab in Item_func_group_concat::reset() (this=0x8b13220) at item_sum.cc:1585
#3  0x080e82d0 in Item_sum::no_rows_in_result() (this=0x8b13e88) at item_sum.h:79
#4  0x0817bb76 in return_zero_rows (join=0x8b13e88, result=0x8b13468, tables=0x8b13410, fields=@0x8b0872c, send_row=true, select_options=0, info=0x8b13e88 "
#5  0x08174d43 in JOIN::exec() (this=0x8b13478) at sql_select.cc:953
#6  0x081763a8 in mysql_select(THD*, Item***, st_table_list*, unsigned, List<Item>&, Item*, unsigned, st_order*, st_order*, Item*, st_order*, unsigned long, select_result*, st_select_lex_unit*, st_select_lex*, bool) (thd=0x8b08310, rref_pointer_array=0x8b13e88, tables=0x8b13e88, wild_num=145833608, fields=@0x8b13e88, conds=0x8b13e88, og_num=145833608, order=0x8b13e88, group=0x8b13e88, having=0x8b13e88, proc_param=0x8b13e88, select_options=17339392, result=0x8b13468, unit=0x8b08594, select_lex=0x8b08690, tables_and_fields_initied=false) at sql_select.cc:1387
#7  0x08172bb0 in handle_select(THD*, st_lex*, select_result*) (thd=0x8b08310, lex=0x8b08588, result=0x8b13468) at sql_select.cc:174
#8  0x08151cb6 in mysql_execute_command(THD*) (thd=0x8b08310) at sql_parse.cc:2026
#9  0x08155fcb in mysql_parse(THD*, char*, unsigned) (thd=0x8b08310, inBuf=0x8b13160 "select group_concat(t) from t", length=145786248) at sql_parse.cc:3563
#10 0x0814fdc4 in dispatch_command(enum_server_command, THD*, char*, unsigned) (command=COM_QUERY, thd=0x8b08310, packet=0x8b09b81 "", packet_length=30) at sql_parse.cc:1284
#11 0x0814f644 in do_command(THD*) (thd=0x8b08310) at sql_parse.cc:1084
#12 0x0814eb67 in handle_one_connection (arg=0x8b13e88) at sql_parse.cc:873
#13 0x40047332 in start_thread () from /lib/tls/libpthread.so.0

BTW. A workaround is to add a group by clause, like

select
  group_concat(name)
from
  test
group by
  'dummy';

Thank you for this bug report. To properly diagnose the problem, we
need a backtrace to see what is happening behind the scenes. To
find out how to generate a backtrace, please read
http://www.mysql.com/doc/en/Making_trace_files.html

Once you have generated a backtrace, please submit it to this bug
report and change the status back to 'Open'. Thank you for helping
us make our products better.

I change the status of this bug from "Closed" to "Need Feedack", as it's not
closed yet.

Changed to non-critical, because there is a workaround...

About the backtrace, i can try to provide it, but didn't Alexander already reproduce it including the trace?

no there is no need for backtrace.
thank you

Thank you for your bug report. This issue has been committed to our
source repository of that product and will be incorporated into the
next release.

If necessary, you can access the source repository and build the latest
available version, including the bugfix, yourself. More information 
about accessing the source trees is available at
    http://www.mysql.com/doc/en/Installing_source_tree.html