| Bug #59686 | crash in String::copy() with time data type | ||
|---|---|---|---|
| Submitted: | 24 Jan 2011 2:48 | Modified: | 31 Mar 2011 2:57 |
| Reporter: | Shane Bester (Platinum Quality Contributor) | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server: Data Types | Severity: | S1 (Critical) |
| Version: | 5.5.6,5.5.10, 5.6.2 | OS: | Any |
| Assigned to: | Tor Didriksen | CPU Architecture: | Any |
| Tags: | regression | ||
[24 Jan 2011 3:15]
MySQL Verification Team
another testcase that is nearly identical, but with different stack trace (presumably due to indexes):
drop table if exists g4;
create table g4(`a` date,`b` int,unique(`b`),unique(`a`),key(`b`))engine=innodb;
insert into g4 values ('2011-05-13',0);
select 1 from g4 where `b`<(select cast(`a` as date) from g4 group by `a`);
Version: '5.5.8' socket: '' port: 3306 MySQL Community Server (GPL)
110124 5:08:19 - mysqld got exception 0xc0000005 ;
mysqld.exe!Item::save_in_field()[item.cc:5401]
mysqld.exe!Item::save_in_field_no_warnings()[item.cc:1065]
mysqld.exe!get_mm_leaf()[opt_range.cc:5933]
mysqld.exe!get_mm_parts()[opt_range.cc:5717]
mysqld.exe!get_func_mm_tree()[opt_range.cc:5396]
mysqld.exe!get_full_func_mm_tree()[opt_range.cc:5495]
mysqld.exe!get_mm_tree()[opt_range.cc:5685]
mysqld.exe!SQL_SELECT::test_quick_select()[opt_range.cc:2275]
mysqld.exe!get_quick_record_count()[sql_select.cc:2606]
mysqld.exe!make_join_statistics()[sql_select.cc:3040]
mysqld.exe!JOIN::optimize()[sql_select.cc:1051]
mysqld.exe!mysql_select()[sql_select.cc:2556]
mysqld.exe!handle_select()[sql_select.cc:297]
mysqld.exe!execute_sqlcom_select()[sql_parse.cc:4452]
mysqld.exe!mysql_execute_command()[sql_parse.cc:2046]
mysqld.exe!mysql_parse()[sql_parse.cc:5496]
mysqld.exe!dispatch_command()[sql_parse.cc:1035]
mysqld.exe!do_command()[sql_parse.cc:772]
mysqld.exe!do_handle_one_connection()[sql_connect.cc:745]
mysqld.exe!handle_one_connection()[sql_connect.cc:684]
mysqld.exe!pthread_start()[my_winthread.c:61]
mysqld.exe!_callthreadstartex()[threadex.c:348]
mysqld.exe!_threadstartex()[threadex.c:326]
kernel32.dll!FlsSetValue()
[24 Jan 2011 4:24]
Valeriy Kravchuk
Verified on Mac OS X:
macbook-pro:5.5 openxs$ bin/mysql -uroot test
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 1
Server version: 5.5.10-debug Source distribution
Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> drop table if exists g3;
Query OK, 0 rows affected, 1 warning (0.00 sec)
mysql> create table g3(`a` time)engine=myisam;
Query OK, 0 rows affected (0.05 sec)
mysql> insert into g3 values ('00:00:00'),('00:01:00');
Query OK, 2 rows affected (0.00 sec)
Records: 2 Duplicates: 0 Warnings: 0
mysql> select 1 from g3 where 1 < some (select cast(`a` as datetime) from g3);
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql> 110124 06:22:57 mysqld_safe mysqld restarted
mysql> exit
Bye
macbook-pro:5.5 openxs$ tail -80 data/macbook-pro.err
key_buffer_size=8388608
read_buffer_size=131072
max_used_connections=1
max_threads=151
thread_count=1
connection_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 337960 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
Thread pointer: 0x103c200
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0xb077ef30 thread_stack 0x30000
0 mysqld 0x0036ec71 my_print_stacktrace + 44
1 mysqld 0x00121206 handle_segfault + 884
2 libSystem.B.dylib 0x940472bb _sigtramp + 43
3 ??? 0xffffffff 0x0 + 4294967295
4 mysqld 0x00049337 _ZN14Item_cache_str11cache_valueEv + 229
5 mysqld 0x000b93e3 _ZN24Item_singlerow_subselect5storeEjP4Item + 121
6 mysqld 0x001c9485 _ZN26select_singlerow_subselect9send_dataER4ListI4ItemE + 297
7 mysqld 0x00247f3c _ZN4JOIN5clearEv + 910
8 mysqld 0x00249473 _Z10sub_selectP4JOINP13st_join_tableb + 65
9 mysqld 0x0025952c _ZN4JOIN9join_freeEv + 1610
10 mysqld 0x0026b392 _ZN4JOIN4execEv + 8740
11 mysqld 0x000bbc2e _ZN30subselect_single_select_engine4execEv + 1278
12 mysqld 0x000be2fa _ZN14Item_subselect4execEv + 218
13 mysqld 0x000ba3c5 _ZN24Item_singlerow_subselect8val_realEv + 93
14 mysqld 0x0010c3a4 _ZN4Item10val_resultEv + 24
15 mysqld 0x00041f9e _ZN15Item_cache_real11cache_valueEv + 56
16 mysqld 0x0005938f _ZN10Item_cache9has_valueEv + 37
17 mysqld 0x0004387c _ZN15Item_cache_real8val_realEv + 84
18 mysqld 0x0005fd24 _ZN14Arg_comparator18compare_real_fixedEv + 88
19 mysqld 0x00070c65 _ZN14Arg_comparator7compareEv + 73
20 mysqld 0x0006437b _ZN12Item_func_lt7val_intEv + 87
21 mysqld 0x00064b6f _ZN17Item_func_nop_all7val_intEv + 101
22 mysqld 0x000891e2 _Z15eval_const_condP4Item + 24
23 mysqld 0x00253aaf _Z19simple_remove_constP8st_orderP4Item + 2393
24 mysqld 0x00253ddf _Z15remove_eq_condsP3THDP4ItemPNS1_11cond_resultE + 567
25 mysqld 0x00258b62 _Z15find_item_equalP10COND_EQUALP5FieldPb + 5432
26 mysqld 0x00261d42 _ZN4JOIN8optimizeEv + 928
27 mysqld 0x00266188 _Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex + 778
28 mysqld 0x0026b6dd _Z13handle_selectP3THDP3LEXP13select_resultm + 547
29 mysqld 0x00203bb9 _Z15update_precheckP3THDP10TABLE_LIST + 1075
30 mysqld 0x00206236 _Z21mysql_execute_commandP3THD + 2864
31 mysqld 0x0020dfb2 _Z11mysql_parseP3THDPcjP12Parser_state + 644
32 mysqld 0x0020eb80 _Z16dispatch_command19enum_server_commandP3THDPcj + 2692
33 mysqld 0x00210044 _Z10do_commandP3THD + 664
34 mysqld 0x002f451d _Z24do_handle_one_connectionP3THD + 1095
35 mysqld 0x002f460b handle_one_connection + 37
36 libSystem.B.dylib 0x9400c095 _pthread_start + 321
37 libSystem.B.dylib 0x9400bf52 thread_start + 34
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x10a8c10): select 1 from g3 where 1 < some (select cast(`a` as datetime) from g3)
Connection ID (thread ID): 1
Status: NOT_KILLED
[31 Jan 2011 6:17]
MySQL Verification Team
Another testcase that crashes 5.6.2 and 5.5.10:
select min(timestampadd(month,1>'',from_days('%Z')));
[9 Feb 2011 15:45]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/130900 3326 Tor Didriksen 2011-02-09 Bug #59686 crash in String::copy() with time data type The problem was that Item_sum_hybrid::val_xxx() did not propagate null values up the expression tree. @ mysql-test/r/func_time.result New test case. @ mysql-test/t/func_time.test New test case. @ sql/item_sum.cc Check for null_value when evaluating sub-items in sub-trees in Item_sum_hybrid::val_xxx()
[10 Feb 2011 12:43]
Tor Didriksen
Split bug in two, see Bug #60085 crash in Item::save_in_field() with time data type.
[10 Feb 2011 12:46]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/131037 3322 Tor Didriksen 2011-02-09 Bug #59686 crash in String::copy() with time data type The problem was that Item_sum_hybrid::val_xxx() did not propagate null values up the expression tree. @ mysql-test/r/func_time.result New test case. @ mysql-test/t/func_time.test New test case. @ sql/item_sum.cc Check for null_value when evaluating sub-items in sub-trees in Item_sum_hybrid::val_xxx()
[11 Feb 2011 9:12]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/131105 3323 Tor Didriksen 2011-02-11 Bug #59686 crash in String::copy() with time data type The problem was that Item_sum_hybrid::val_xxx() did not propagate null values up the expression tree. @ mysql-test/r/func_time.result New test case. @ mysql-test/t/func_time.test New test case. @ sql/item_sum.cc Check for null_value when evaluating sub-items in sub-trees in Item_sum_hybrid::val_xxx()
[11 Feb 2011 9:16]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/131106 3639 Tor Didriksen 2011-02-11 [merge] merge Bug #59686 from 5.5
[3 Mar 2011 0:32]
MySQL Verification Team
Hi Tor. Does this patch fix the crash and/or assertion from this: set @a:=(select distinct max(adddate(from_days(convert(1,time)),interval 1 month))); Release build crashes: String::copy()[sql_string.cc:133] Item_cache_str::cache_value()[item.cc:7719] Item_singlerow_subselect::store()[item_subselect.cc:498] select_singlerow_subselect::send_data()[sql_class.cc:2450] end_send_group()[sql_select.cc:12687] do_select()[sql_select.cc:11409] JOIN::exec()[sql_select.cc:2362] subselect_single_select_engine::exec()[item_subselect.cc:1986] Item_subselect::exec()[item_subselect.cc:275] Item_singlerow_subselect::val_str()[item_subselect.cc:602] Item_func_set_user_var::check()[item_func.cc:4529] set_var_user::check()[set_var.cc:688] sql_set_variables()[set_var.cc:570] mysql_execute_command()[sql_parse.cc:3053] mysql_parse()[sql_parse.cc:5509] dispatch_command()[sql_parse.cc:1038] do_command()[sql_parse.cc:772] do_handle_one_connection()[sql_connect.cc:748] handle_one_connection()[sql_connect.cc:685] pthread_start()[my_winthread.c:62] _callthreadstartex()[threadex.c:348] _threadstartex()[threadex.c:331] BaseThreadStart() And this on debug build: select distinct max(adddate(from_days(convert(1,time)),interval 1 month)); Version: '5.5.9-debug' socket: '' port: 3306 MySQL Community Server - Debug (GPL) Assertion failed: null_value, file ..\..\mysql-5.5.9\sql\item.cc, line 5844 raise()[winsig.c:597] abort()[abort.c:78] _wassert()[assert.c:163] Item::send()[item.cc:5844] Protocol::send_result_set_row()[protocol.cc:848] select_send::send_data()[sql_class.cc:1862] end_send_group()[sql_select.cc:12687] do_select()[sql_select.cc:11409] JOIN::exec()[sql_select.cc:2362] mysql_select()[sql_select.cc:2573] handle_select()[sql_select.cc:297] execute_sqlcom_select()[sql_parse.cc:4472] mysql_execute_command()[sql_parse.cc:2053] mysql_parse()[sql_parse.cc:5509] dispatch_command()[sql_parse.cc:1038] do_command()[sql_parse.cc:772] do_handle_one_connection()[sql_connect.cc:748] handle_one_connection()[sql_connect.cc:685] pthread_start()[my_winthread.c:62] _callthreadstartex()[threadex.c:348] _threadstartex()[threadex.c:331] BaseThreadStart()(GPL) Assertion failed: null_value, file ..\..\mysql-5.5.9\sql\item.cc, line 5844
[31 Mar 2011 2:57]
Paul DuBois
Noted in 5.5.10 changelog. String::copy could crash with time types. CHANGESET - http://lists.mysql.com/commits/131106
Description: Version: '5.5.8' socket: '' port: 3306 MySQL Community Server (GPL) 110124 4:41:03 - mysqld got exception 0xc0000005 ; mysqld.exe!String::copy()[sql_string.cc:133] mysqld.exe!Item_cache_str::cache_value()[item.cc:7725] mysqld.exe!Item_singlerow_subselect::store()[item_subselect.cc:510] mysqld.exe!select_singlerow_subselect::send_data()[sql_class.cc:2416] mysqld.exe!end_send_group()[sql_select.cc:12679] mysqld.exe!sub_select()[sql_select.cc:11641] mysqld.exe!do_select()[sql_select.cc:11430] mysqld.exe!JOIN::exec()[sql_select.cc:2361] mysqld.exe!subselect_single_select_engine::exec()[item_subselect.cc:1997] mysqld.exe!Item_subselect::exec()[item_subselect.cc:290] mysqld.exe!Item_singlerow_subselect::val_real()[item_subselect.cc:586] mysqld.exe!Item_cache_real::cache_value()[item.cc:7611] mysqld.exe!Item_cache_real::val_real()[item.cc:7620] mysqld.exe!Arg_comparator::compare_real_fixed()[item_cmpfunc.cc:1441] mysqld.exe!Item_func_lt::val_int()[item_cmpfunc.cc:2012] mysqld.exe!Item_func_nop_all::val_int()[item_cmpfunc.cc:365] mysqld.exe!eval_const_cond()[item_func.cc:78] mysqld.exe!internal_remove_eq_conds()[sql_select.cc:9512] mysqld.exe!remove_eq_conds()[sql_select.cc:9611] mysqld.exe!optimize_cond()[sql_select.cc:9393] mysqld.exe!JOIN::optimize()[sql_select.cc:918] mysqld.exe!mysql_select()[sql_select.cc:2556] mysqld.exe!handle_select()[sql_select.cc:297] mysqld.exe!execute_sqlcom_select()[sql_parse.cc:4452] mysqld.exe!mysql_execute_command()[sql_parse.cc:2046] mysqld.exe!mysql_parse()[sql_parse.cc:5496] mysqld.exe!dispatch_command()[sql_parse.cc:1035] mysqld.exe!do_command()[sql_parse.cc:772] mysqld.exe!do_handle_one_connection()[sql_connect.cc:745] mysqld.exe!handle_one_connection()[sql_connect.cc:684] mysqld.exe!pthread_start()[my_winthread.c:61] mysqld.exe!_callthreadstartex()[threadex.c:348] mysqld.exe!_threadstartex()[threadex.c:326] kernel32.dll!FlsSetValue() 5.5.5 and 5.1.56 didn't crash so this is a regression in 5.5.6+ How to repeat: drop table if exists g3; create table g3(`a` time)engine=myisam; insert into g3 values ('00:00:00'),('00:01:00'); select 1 from g3 where 1 < some (select cast(`a` as datetime) from g3);