Bug #59686 | crash in String::copy() with time data type | ||
---|---|---|---|
Submitted: | 24 Jan 2011 2:48 | Modified: | 31 Mar 2011 2:57 |
Reporter: | Shane Bester (Platinum Quality Contributor) | Email Updates: | |
Status: | Closed | Impact on me: | |
Category: | MySQL Server: Data Types | Severity: | S1 (Critical) |
Version: | 5.5.6,5.5.10, 5.6.2 | OS: | Any |
Assigned to: | Tor Didriksen | CPU Architecture: | Any |
Tags: | regression |
[24 Jan 2011 2:48]
Shane Bester
[24 Jan 2011 3:15]
MySQL Verification Team
another testcase that is nearly identical, but with different stack trace (presumably due to indexes): drop table if exists g4; create table g4(`a` date,`b` int,unique(`b`),unique(`a`),key(`b`))engine=innodb; insert into g4 values ('2011-05-13',0); select 1 from g4 where `b`<(select cast(`a` as date) from g4 group by `a`); Version: '5.5.8' socket: '' port: 3306 MySQL Community Server (GPL) 110124 5:08:19 - mysqld got exception 0xc0000005 ; mysqld.exe!Item::save_in_field()[item.cc:5401] mysqld.exe!Item::save_in_field_no_warnings()[item.cc:1065] mysqld.exe!get_mm_leaf()[opt_range.cc:5933] mysqld.exe!get_mm_parts()[opt_range.cc:5717] mysqld.exe!get_func_mm_tree()[opt_range.cc:5396] mysqld.exe!get_full_func_mm_tree()[opt_range.cc:5495] mysqld.exe!get_mm_tree()[opt_range.cc:5685] mysqld.exe!SQL_SELECT::test_quick_select()[opt_range.cc:2275] mysqld.exe!get_quick_record_count()[sql_select.cc:2606] mysqld.exe!make_join_statistics()[sql_select.cc:3040] mysqld.exe!JOIN::optimize()[sql_select.cc:1051] mysqld.exe!mysql_select()[sql_select.cc:2556] mysqld.exe!handle_select()[sql_select.cc:297] mysqld.exe!execute_sqlcom_select()[sql_parse.cc:4452] mysqld.exe!mysql_execute_command()[sql_parse.cc:2046] mysqld.exe!mysql_parse()[sql_parse.cc:5496] mysqld.exe!dispatch_command()[sql_parse.cc:1035] mysqld.exe!do_command()[sql_parse.cc:772] mysqld.exe!do_handle_one_connection()[sql_connect.cc:745] mysqld.exe!handle_one_connection()[sql_connect.cc:684] mysqld.exe!pthread_start()[my_winthread.c:61] mysqld.exe!_callthreadstartex()[threadex.c:348] mysqld.exe!_threadstartex()[threadex.c:326] kernel32.dll!FlsSetValue()
[24 Jan 2011 4:24]
Valeriy Kravchuk
Verified on Mac OS X: macbook-pro:5.5 openxs$ bin/mysql -uroot test Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 1 Server version: 5.5.10-debug Source distribution Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql> drop table if exists g3; Query OK, 0 rows affected, 1 warning (0.00 sec) mysql> create table g3(`a` time)engine=myisam; Query OK, 0 rows affected (0.05 sec) mysql> insert into g3 values ('00:00:00'),('00:01:00'); Query OK, 2 rows affected (0.00 sec) Records: 2 Duplicates: 0 Warnings: 0 mysql> select 1 from g3 where 1 < some (select cast(`a` as datetime) from g3); ERROR 2013 (HY000): Lost connection to MySQL server during query mysql> 110124 06:22:57 mysqld_safe mysqld restarted mysql> exit Bye macbook-pro:5.5 openxs$ tail -80 data/macbook-pro.err key_buffer_size=8388608 read_buffer_size=131072 max_used_connections=1 max_threads=151 thread_count=1 connection_count=1 It is possible that mysqld could use up to key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 337960 K bytes of memory Hope that's ok; if not, decrease some variables in the equation. Thread pointer: 0x103c200 Attempting backtrace. You can use the following information to find out where mysqld died. If you see no messages after this, something went terribly wrong... stack_bottom = 0xb077ef30 thread_stack 0x30000 0 mysqld 0x0036ec71 my_print_stacktrace + 44 1 mysqld 0x00121206 handle_segfault + 884 2 libSystem.B.dylib 0x940472bb _sigtramp + 43 3 ??? 0xffffffff 0x0 + 4294967295 4 mysqld 0x00049337 _ZN14Item_cache_str11cache_valueEv + 229 5 mysqld 0x000b93e3 _ZN24Item_singlerow_subselect5storeEjP4Item + 121 6 mysqld 0x001c9485 _ZN26select_singlerow_subselect9send_dataER4ListI4ItemE + 297 7 mysqld 0x00247f3c _ZN4JOIN5clearEv + 910 8 mysqld 0x00249473 _Z10sub_selectP4JOINP13st_join_tableb + 65 9 mysqld 0x0025952c _ZN4JOIN9join_freeEv + 1610 10 mysqld 0x0026b392 _ZN4JOIN4execEv + 8740 11 mysqld 0x000bbc2e _ZN30subselect_single_select_engine4execEv + 1278 12 mysqld 0x000be2fa _ZN14Item_subselect4execEv + 218 13 mysqld 0x000ba3c5 _ZN24Item_singlerow_subselect8val_realEv + 93 14 mysqld 0x0010c3a4 _ZN4Item10val_resultEv + 24 15 mysqld 0x00041f9e _ZN15Item_cache_real11cache_valueEv + 56 16 mysqld 0x0005938f _ZN10Item_cache9has_valueEv + 37 17 mysqld 0x0004387c _ZN15Item_cache_real8val_realEv + 84 18 mysqld 0x0005fd24 _ZN14Arg_comparator18compare_real_fixedEv + 88 19 mysqld 0x00070c65 _ZN14Arg_comparator7compareEv + 73 20 mysqld 0x0006437b _ZN12Item_func_lt7val_intEv + 87 21 mysqld 0x00064b6f _ZN17Item_func_nop_all7val_intEv + 101 22 mysqld 0x000891e2 _Z15eval_const_condP4Item + 24 23 mysqld 0x00253aaf _Z19simple_remove_constP8st_orderP4Item + 2393 24 mysqld 0x00253ddf _Z15remove_eq_condsP3THDP4ItemPNS1_11cond_resultE + 567 25 mysqld 0x00258b62 _Z15find_item_equalP10COND_EQUALP5FieldPb + 5432 26 mysqld 0x00261d42 _ZN4JOIN8optimizeEv + 928 27 mysqld 0x00266188 _Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex + 778 28 mysqld 0x0026b6dd _Z13handle_selectP3THDP3LEXP13select_resultm + 547 29 mysqld 0x00203bb9 _Z15update_precheckP3THDP10TABLE_LIST + 1075 30 mysqld 0x00206236 _Z21mysql_execute_commandP3THD + 2864 31 mysqld 0x0020dfb2 _Z11mysql_parseP3THDPcjP12Parser_state + 644 32 mysqld 0x0020eb80 _Z16dispatch_command19enum_server_commandP3THDPcj + 2692 33 mysqld 0x00210044 _Z10do_commandP3THD + 664 34 mysqld 0x002f451d _Z24do_handle_one_connectionP3THD + 1095 35 mysqld 0x002f460b handle_one_connection + 37 36 libSystem.B.dylib 0x9400c095 _pthread_start + 321 37 libSystem.B.dylib 0x9400bf52 thread_start + 34 Trying to get some variables. Some pointers may be invalid and cause the dump to abort. Query (0x10a8c10): select 1 from g3 where 1 < some (select cast(`a` as datetime) from g3) Connection ID (thread ID): 1 Status: NOT_KILLED
[31 Jan 2011 6:17]
MySQL Verification Team
Another testcase that crashes 5.6.2 and 5.5.10: select min(timestampadd(month,1>'',from_days('%Z')));
[9 Feb 2011 15:45]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/130900 3326 Tor Didriksen 2011-02-09 Bug #59686 crash in String::copy() with time data type The problem was that Item_sum_hybrid::val_xxx() did not propagate null values up the expression tree. @ mysql-test/r/func_time.result New test case. @ mysql-test/t/func_time.test New test case. @ sql/item_sum.cc Check for null_value when evaluating sub-items in sub-trees in Item_sum_hybrid::val_xxx()
[10 Feb 2011 12:43]
Tor Didriksen
Split bug in two, see Bug #60085 crash in Item::save_in_field() with time data type.
[10 Feb 2011 12:46]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/131037 3322 Tor Didriksen 2011-02-09 Bug #59686 crash in String::copy() with time data type The problem was that Item_sum_hybrid::val_xxx() did not propagate null values up the expression tree. @ mysql-test/r/func_time.result New test case. @ mysql-test/t/func_time.test New test case. @ sql/item_sum.cc Check for null_value when evaluating sub-items in sub-trees in Item_sum_hybrid::val_xxx()
[11 Feb 2011 9:12]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/131105 3323 Tor Didriksen 2011-02-11 Bug #59686 crash in String::copy() with time data type The problem was that Item_sum_hybrid::val_xxx() did not propagate null values up the expression tree. @ mysql-test/r/func_time.result New test case. @ mysql-test/t/func_time.test New test case. @ sql/item_sum.cc Check for null_value when evaluating sub-items in sub-trees in Item_sum_hybrid::val_xxx()
[11 Feb 2011 9:16]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/131106 3639 Tor Didriksen 2011-02-11 [merge] merge Bug #59686 from 5.5
[3 Mar 2011 0:32]
MySQL Verification Team
Hi Tor. Does this patch fix the crash and/or assertion from this: set @a:=(select distinct max(adddate(from_days(convert(1,time)),interval 1 month))); Release build crashes: String::copy()[sql_string.cc:133] Item_cache_str::cache_value()[item.cc:7719] Item_singlerow_subselect::store()[item_subselect.cc:498] select_singlerow_subselect::send_data()[sql_class.cc:2450] end_send_group()[sql_select.cc:12687] do_select()[sql_select.cc:11409] JOIN::exec()[sql_select.cc:2362] subselect_single_select_engine::exec()[item_subselect.cc:1986] Item_subselect::exec()[item_subselect.cc:275] Item_singlerow_subselect::val_str()[item_subselect.cc:602] Item_func_set_user_var::check()[item_func.cc:4529] set_var_user::check()[set_var.cc:688] sql_set_variables()[set_var.cc:570] mysql_execute_command()[sql_parse.cc:3053] mysql_parse()[sql_parse.cc:5509] dispatch_command()[sql_parse.cc:1038] do_command()[sql_parse.cc:772] do_handle_one_connection()[sql_connect.cc:748] handle_one_connection()[sql_connect.cc:685] pthread_start()[my_winthread.c:62] _callthreadstartex()[threadex.c:348] _threadstartex()[threadex.c:331] BaseThreadStart() And this on debug build: select distinct max(adddate(from_days(convert(1,time)),interval 1 month)); Version: '5.5.9-debug' socket: '' port: 3306 MySQL Community Server - Debug (GPL) Assertion failed: null_value, file ..\..\mysql-5.5.9\sql\item.cc, line 5844 raise()[winsig.c:597] abort()[abort.c:78] _wassert()[assert.c:163] Item::send()[item.cc:5844] Protocol::send_result_set_row()[protocol.cc:848] select_send::send_data()[sql_class.cc:1862] end_send_group()[sql_select.cc:12687] do_select()[sql_select.cc:11409] JOIN::exec()[sql_select.cc:2362] mysql_select()[sql_select.cc:2573] handle_select()[sql_select.cc:297] execute_sqlcom_select()[sql_parse.cc:4472] mysql_execute_command()[sql_parse.cc:2053] mysql_parse()[sql_parse.cc:5509] dispatch_command()[sql_parse.cc:1038] do_command()[sql_parse.cc:772] do_handle_one_connection()[sql_connect.cc:748] handle_one_connection()[sql_connect.cc:685] pthread_start()[my_winthread.c:62] _callthreadstartex()[threadex.c:348] _threadstartex()[threadex.c:331] BaseThreadStart()(GPL) Assertion failed: null_value, file ..\..\mysql-5.5.9\sql\item.cc, line 5844
[31 Mar 2011 2:57]
Paul DuBois
Noted in 5.5.10 changelog. String::copy could crash with time types. CHANGESET - http://lists.mysql.com/commits/131106