MySQL Bugs: #9798: Rollup crash with InnoDB in setup_sum

Bug #9798	Rollup crash with InnoDB in setup_sum_funcs()
Submitted:	11 Apr 2005 0:03	Modified:	20 Jun 2010 22:42
Reporter:	Peter Gulutzan	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Optimizer	Severity:	S3 (Non-critical)
Version:	5.0.5-beta-debug	OS:	Linux (SUSE 9.2)
Assigned to:	Ramil Kalimullin	CPU Architecture:	Any

Description:
A crash occurs if I create a table with an indexed column with engine=innodb, then select from that table using GROUP BY ... WITH ROLLUP.

How to repeat:
mysql> create table tx (s1 int, key (s1)) engine=innodb;
Query OK, 0 rows affected (0.11 sec)

mysql> insert into tx values (1);
Query OK, 1 row affected (0.00 sec)

mysql> select s1, count(s1) from tx group by s1 with rollup;
ERROR 2013 (HY000): Lost connection to MySQL server during query

Thank you for the bug report.

Miguel,

what is the stack trace if you run inside gdb?

Regards,

Heikki

Hi!

Changing this bug to the 'Server' category. The crash does not happen with MyISAM, therefore it might be an InnoDB bug. But the crash is inside MySQL code, and I guess the bug is in MySQL.

Regards,

Heikki

050425  4:02:09  InnoDB: Database was not shut down normally!
InnoDB: Starting crash recovery.
InnoDB: Reading tablespace information from the .ibd files...
InnoDB: Restoring possible half-written data pages from the doublewrite
InnoDB: buffer...
050425  4:02:09  InnoDB: Starting log scan based on checkpoint at
InnoDB: log sequence number 0 73390.
InnoDB: Doing recovery: scanned up to log sequence number 0 73747
050425  4:02:10  InnoDB: Starting an apply batch of log records to the database.
..
InnoDB: Progress in percents: 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99
InnoDB: Apply batch completed
InnoDB: Last MySQL binlog file position 0 324, file name ./binlog.000003
[New Thread 81926 (LWP 7752)]
[New Thread 98311 (LWP 7753)]
[New Thread 114696 (LWP 7754)]
[New Thread 131081 (LWP 7755)]
050425  4:02:12  InnoDB: Started; log sequence number 0 73747
050425  4:02:12 [Note] Recovering after a crash using binlog
050425  4:02:12 [Note] Starting crash recovery...
050425  4:02:12  InnoDB: Starting recovery for XA transactions...
050425  4:02:12  InnoDB: 0 transactions in prepared state after recovery
050425  4:02:12 [Note] Crash recovery finished.
050425  4:02:12  InnoDB: Starting recovery for XA transactions...
050425  4:02:12  InnoDB: 0 transactions in prepared state after recovery
[New Thread 147466 (LWP 7756)]
050425  4:02:12 [Warning] mysql.user table is not updated to new password format
; Disabling new password usage until mysql_fix_privilege_tables is run
050425  4:02:12 [Note] /home/heikki/mysql-5.0/sql/mysqld: ready for connections.
Version: '5.0.5-beta-debug-log'  socket: '/home/heikki/bugsocket'  port: 3307  S
ource distribution
[New Thread 163851 (LWP 7770)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 163851 (LWP 7770)]
0x082070b4 in setup_sum_funcs (thd=0xa381270, func_ptr=0xa379da8)
    at sql_select.cc:12573
12573       if (func->setup(thd))
(gdb) print *func_ptr
$1 = (class Item_sum *) 0x0
(gdb) bt
#0  0x082070b4 in setup_sum_funcs (thd=0xa381270, func_ptr=0xa379da8)
    at sql_select.cc:12573
#1  0x081ebf13 in JOIN::optimize() (this=0xa378f00) at sql_select.cc:1032
#2  0x081ef0cb in mysql_select(THD*, Item***, st_table_list*, unsigned, List<Ite
m>&, Item*, unsigned, st_order*, st_order*, Item*, st_order*, unsigned long, sel
ect_result*, st_select_lex_unit*, st_select_lex*) (thd=0xa381270,
    rref_pointer_array=0xa381598, tables=0xa378ca8, wild_num=0,
    fields=@0xa381500, conds=0x0, og_num=1, order=0x0, group=0xa378eb8,
    having=0x0, proc_param=0x0, select_options=2156153344, result=0xa378ef0,
    unit=0xa3812c0, select_lex=0xa381494) at sql_select.cc:2048
#3  0x081e9630 in handle_select(THD*, st_lex*, select_result*, unsigned long) (
    thd=0xa381270, lex=0xa3812b0, result=0xa378ef0, setup_tables_done_option=0)
    at sql_select.cc:228
#4  0x081b6139 in mysql_execute_command(THD*) (thd=0xa381270)
    at sql_parse.cc:2391
#5  0x081be315 in mysql_parse(THD*, char*, unsigned) (thd=0xa381270,
    inBuf=0xa3789e8 "select s1, count(s1) from tx group by s1 with rollup",
    length=52) at sql_parse.cc:5176
#6  0x081b428b in dispatch_command(enum_server_command, THD*, char*, unsigned)
    (command=COM_QUERY, thd=0xa381270,
    packet=0xa399a71 "select s1, count(s1) from tx group by s1 with rollup",
    packet_length=53) at sql_parse.cc:1651
#7  0x081b3ad1 in do_command(THD*) (thd=0xa381270) at sql_parse.cc:1457
#8  0x081b2c60 in handle_one_connection (arg=0xa381270) at sql_parse.cc:1114
#9  0x40062f60 in pthread_start_thread () from /lib/i686/libpthread.so.0
#10 0x400630fe in pthread_start_thread_event () from /lib/i686/libpthread.so.0
#11 0x401f5327 in clone () from /lib/i686/libc.so.6

(gdb) print func->setup
$2 = &Item_sum::setup(THD*)
(gdb) print *thd
$3 = {<ilink> = {_vptr.ilink = 0x8488c28, prev = 0x862fec4,
    next = 0x862fec8}, <Statement> = {<Item_arena> = {
      _vptr.Item_arena = 0x8488c38, free_list = 0xa37a610, main_mem_root = {
        free = 0xa3789d8, used = 0x0, pre_alloc = 0xa3789d8, min_malloc = 32,
        block_size = 8136, block_num = 4, first_block_usage = 0,
        error_handler = 0x816163c <sql_alloc_error_handler>},
      mem_root = 0xa381284, backup_arena = false,

Fixed in 5.0.6.

Noted in 5.0.6 changelog.

Pushed into 5.1.47 (revid:joro@sun.com-20100505145753-ivlt4hclbrjy8eye) (version source revid:vasil.dimov@oracle.com-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

Push resulted from incorporation of InnoDB tree. No changes pertinent to this bug. Re-closing.

Pushed into mysql-next-mr (revid:alik@sun.com-20100524190136-egaq7e8zgkwb9aqi) (version source revid:vasil.dimov@oracle.com-20100331130613-8ja7n0vh36a80457) (pib:16)

Pushed into 6.0.14-alpha (revid:alik@sun.com-20100524190941-nuudpx60if25wsvx) (version source revid:vasil.dimov@oracle.com-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

Pushed into 5.5.5-m3 (revid:alik@sun.com-20100524185725-c8k5q7v60i5nix3t) (version source revid:vasil.dimov@oracle.com-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

Push resulted from incorporation of InnoDB tree. No changes pertinent to this bug.
Re-closing.

Pushed into 5.1.47-ndb-7.0.16 (revid:martin.skold@mysql.com-20100617114014-bva0dy24yyd67697) (version source revid:vasil.dimov@oracle.com-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

Pushed into 5.1.47-ndb-6.2.19 (revid:martin.skold@mysql.com-20100617115448-idrbic6gbki37h1c) (version source revid:vasil.dimov@oracle.com-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

Pushed into 5.1.47-ndb-6.3.35 (revid:martin.skold@mysql.com-20100617114611-61aqbb52j752y116) (version source revid:vasil.dimov@oracle.com-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)