Crash in decimal2double with subquery cache

Bug #615378 reported by Philip Stoev
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
MariaDB
Fix Released
High
Oleksandr "Sanja" Byelkin

Bug Description

Subuery cache crashed with the following backtrace:

# 2010-08-09T16:05:07 #3 0x0827e94a in handle_segfault (sig=11) at mysqld.cc:2703
# 2010-08-09T16:05:07 #4 <signal handler called>
# 2010-08-09T16:05:07 #5 0x0877a140 in decimal2double (from=0xaed867b0, to=0x9a1dc4d8) at decimal.c:961
# 2010-08-09T16:05:07 #6 0x081cdeac in my_decimal2double (mask=30, d=0xaed867b0, result=0x9a1dc4d8) at my_decimal.h:314
# 2010-08-09T16:05:07 #7 0x081cb865 in Item_cache_decimal::val_real (this=0xaed86740) at item.cc:7837
# 2010-08-09T16:05:07 #8 0x081c8942 in Item_cache_wrapper::val_real (this=0xaec17510) at item.cc:6808
# 2010-08-09T16:05:07 #9 0x081cf2de in Item::val_result (this=0xaec17510) at item.h:778
# 2010-08-09T16:05:07 #10 0x081c7a15 in Item_ref::val_real (this=0xaecb9778) at item.cc:6438
# 2010-08-09T16:05:07 #11 0x081f94f0 in Arg_comparator::compare_real (this=0xaecb9904) at item_cmpfunc.cc:1359
# 2010-08-09T16:05:07 #12 0x081dedc2 in Arg_comparator::compare (this=0xaecb9904) at item_cmpfunc.h:81
# 2010-08-09T16:05:07 #13 0x081fb16d in Item_func_le::val_int (this=0xaecb9888) at item_cmpfunc.cc:2015
# 2010-08-09T16:05:07 #14 0x081c4e7f in Item::save_in_field (this=0xaecb9888, field=0x9a051df8, no_conversions=true) at item.cc:5328
# 2010-08-09T16:05:07 #15 0x081d0c55 in Item_result_field::save_in_result_field (this=0xaecb9888, no_conversions=true) at item.h:2354
# 2010-08-09T16:05:07 #16 0x08328064 in copy_funcs (func_ptr=0xaecf5898) at sql_select.cc:17575
# 2010-08-09T16:05:07 #17 0x0831ff21 in end_write (join=0x9a06f840, join_tab=0xaece7548, end_of_records=false) at sql_select.cc:14252
# 2010-08-09T16:05:07 #18 0x0831d962 in evaluate_join_record (join=0x9a06f840, join_tab=0xaece7388, error=0) at sql_select.cc:13278
# 2010-08-09T16:05:07 #19 0x0831d309 in sub_select (join=0x9a06f840, join_tab=0xaece7388, end_of_records=false) at sql_select.cc:13087
# 2010-08-09T16:05:07 #20 0x0831d962 in evaluate_join_record (join=0x9a06f840, join_tab=0xaece71c8, error=0) at sql_select.cc:13278
# 2010-08-09T16:05:07 #21 0x0831d457 in sub_select (join=0x9a06f840, join_tab=0xaece71c8, end_of_records=false) at sql_select.cc:13126
# 2010-08-09T16:05:07 #22 0x0831d962 in evaluate_join_record (join=0x9a06f840, join_tab=0xaece7008, error=0) at sql_select.cc:13278
# 2010-08-09T16:05:07 #23 0x0831d309 in sub_select (join=0x9a06f840, join_tab=0xaece7008, end_of_records=false) at sql_select.cc:13087
# 2010-08-09T16:05:07 #24 0x0831c70f in do_select (join=0x9a06f840, fields=0x0, table=0xaecf4e00, procedure=0x0) at sql_select.cc:12633
# 2010-08-09T16:05:07 #25 0x08300e09 in JOIN::exec (this=0x9a06f840) at sql_select.cc:1933
# 2010-08-09T16:05:07 #26 0x08303209 in mysql_select (thd=0x9f715f0, rref_pointer_array=0xaec133ac, tables=0xaec8ebc0, wild_num=0, fields=..., conds=0xaedf7d98, og_num=12,
# 2010-08-09T16:05:07 order=0xaedd0f50, group=0xaedd98b8, having=0xaedd0d50, proc_param=0x0, select_options=2416200192, result=0xaec51228, unit=0x9a079630,
# 2010-08-09T16:05:07 select_lex=0xaec13290) at sql_select.cc:2556
# 2010-08-09T16:05:07 #27 0x084462d5 in mysql_derived_filling (thd=0x9f715f0, lex=0x9f72c70, orig_table_list=0xaec19380) at sql_derived.cc:295
# 2010-08-09T16:05:07 #28 0x08445bc7 in mysql_handle_derived (lex=0x9f72c70, processor=0x84460f0 <mysql_derived_filling(THD*, LEX*, TABLE_LIST*)>) at sql_derived.cc:56
# 2010-08-09T16:05:07 #29 0x082e4201 in open_and_lock_tables_derived (thd=0x9f715f0, tables=0xaec19380, derived=true) at sql_base.cc:5067
# 2010-08-09T16:05:07 #30 0x082a0865 in open_and_lock_tables (thd=0x9f715f0, tables=0xaec19380) at mysql_priv.h:1648
# 2010-08-09T16:05:07 #31 0x0829a01d in execute_sqlcom_select (thd=0x9f715f0, all_tables=0xaec19380) at sql_parse.cc:5046
# 2010-08-09T16:05:07 #32 0x08290c1c in mysql_execute_command (thd=0x9f715f0) at sql_parse.cc:2265
# 2010-08-09T16:05:07 #33 0x0829c405 in mysql_parse (thd=0x9f715f0,
# 2010-08-09T16:05:07 inBuf=0xaedad570 "SELECT * FROM ( SELECT table1 . `col_varchar_key` AS field1 , SUM( DISTINCT table2 . `pk` ) AS field2 , ( SELECT SUM( SUBQUERY1_t1 . `pk` ) AS SUBQUERY1_field1 FROM ( C AS SUBQUERY1_t1 STRAIGHT_JOIN ( D AS SUBQUERY1_t2 STRAIGHT_JOIN view_B AS SUBQUERY1_t3 ON (SUBQUERY1_t3 . `col_varchar_key` = SUBQUERY1_t2 . `col_varchar_key` ) ) ON (SUBQUERY1_t3 . `col_int_nokey` = SUBQUERY1_t2 . `col_int_key` ) ) WHERE SUBQUERY1_t2 . `col_varchar_key` <= table1 . `col_varchar_key` ) AS field3 , SUM( table1 . `col_varchar_key` ) AS field4 , table2 . `col_time_key` AS field5 , SUM( table1 . `col_varchar_key` ) AS field6 , ( SELECT COUNT( SUBQUERY2_t1 . `pk` ) AS SUBQUERY2_field1 FROM ( C AS SUBQUERY2_t1 STRAIGHT_JOIN CC AS SUBQUERY2_t2 ON (SUBQUERY2_t2 . `col_varchar_nokey` = SUBQUERY2_t1 . `col_varchar_key` ) ) WHERE SUBQUERY2_t2 . `col_int_key` = table1 . `col_int_nokey` AND SUBQUERY2_t1 . `pk` > table1 . `col_int_key` ) AS field7 FROM ( CC AS table1 LEFT JOIN ( ( D AS table2 STRAIGHT_JOIN C AS table3 ON (table3 . `pk` = table2 . `col_int_key` ) ) ) ON (table3 . `col_varchar_key` = table2 . `col_varchar_key` ) ) WHERE ( table3 . `pk` <= ALL ( SELECT 5 FROM DUAL ) ) OR ( table1 . `col_int_key` = 7 AND table1 . `pk` = 58 ) OR ( table1 . `col_varchar_nokey` IS NOT NULL OR table3 . `col_varchar_key` != table3 . `col_varchar_nokey` ) GROUP BY field1, field3, field5, field7 HAVING (field3 <= 'h' AND field2 != 4) ORDER BY table1 . `col_date_key` ASC , field1, field2, field3, field4, field5, field6, field7 ) AS FROM_SUBQUERY /* TRANSFORM_OUTCOME_UNORDERED_MATCH */", length=1589, found_semicolon=0x9a1de230) at sql_parse.cc:6027
# 2010-08-09T16:05:07 #34 0x0828e6d2 in dispatch_command (command=COM_QUERY, thd=0x9f715f0,
# 2010-08-09T16:05:07 packet=0x9fa7d61 " SELECT * FROM ( SELECT table1 . `col_varchar_key` AS field1 , SUM( DISTINCT table2 . `pk` ) AS field2 , ( SELECT SUM( SUBQUERY1_t1 . `pk` ) AS SUBQUERY1_field1 FROM ( C AS SUBQUERY1_t1 STRAIGHT_JOIN ( D AS SUBQUERY1_t2 STRAIGHT_JOIN view_B AS SUBQUERY1_t3 ON (SUBQUERY1_t3 . `col_varchar_key` = SUBQUERY1_t2 . `col_varchar_key` ) ) ON (SUBQUERY1_t3 . `col_int_nokey` = SUBQUERY1_t2 . `col_int_key` ) ) WHERE SUBQUERY1_t2 . `col_varchar_key` <= table1 . `col_varchar_key` ) AS field3 , SUM( table1 . `col_varchar_key` ) AS field4 , table2 . `col_time_key` AS field5 , SUM( table1 . `col_varchar_key` ) AS field6 , ( SELECT COUNT( SUBQUERY2_t1 . `pk` ) AS SUBQUERY2_field1 FROM ( C AS SUBQUERY2_t1 STRAIGHT_JOIN CC AS SUBQUERY2_t2 ON (SUBQUERY2_t2 . `col_varchar_nokey` = SUBQUERY2_t1 . `col_varchar_key` ) ) WHERE SUBQUERY2_t2 . `col_int_key` = table1 . `col_int_nokey` AND SUBQUERY2_t1 . `pk` > table1 . `col_int_key` ) AS field7 FROM ( CC AS table1 LEFT JOIN ( ( D AS table2 STRAIGHT_JOIN C AS table3 ON (table3 . `pk` = table2 . `col_int_key` ) ) ) ON (table3 . `col_varchar_key` = table2 . `col_varchar_key` ) ) WHERE ( table3 . `pk` <= ALL ( SELECT 5 FROM DUAL ) ) OR ( table1 . `col_int_key` = 7 AND table1 . `pk` = 58 ) OR ( table1 . `col_varchar_nokey` IS NOT NULL OR table3 . `col_varchar_key` != table3 . `col_varchar_nokey` ) GROUP BY field1, field3, field5, field7 HAVING (field3 <= 'h' AND field2 != 4) ORDER BY table1 . `col_date_key` ASC , field1, field2, field3, field4, field5, field6, field7 ) AS FROM_SUBQUERY /* TRANSFORM_OUTCOME_UNORDERED_MATCH */", packet_length=1591) at sql_parse.cc:1184
# 2010-08-09T16:05:07 #35 0x0828dbc0 in do_command (thd=0x9f715f0) at sql_parse.cc:890
# 2010-08-09T16:05:07 #36 0x0828ad58 in handle_one_connection (arg=0x9f715f0) at sql_connect.cc:1153
# 2010-08-09T16:05:07 #37 0x00a08919 in start_thread () from /lib/libpthread.so.0
# 2010-08-09T16:05:07 #38 0x00951e5e in clone () from /lib/libc.so.6

bzr version-info:

revision-id: <email address hidden>
date: 2010-08-09 13:00:58 +0300
build-date: 2010-08-09 16:55:50 +0300
revno: 2810
branch-nick: maria-5.3

a test case will be available shortly

Changed in maria:
milestone: none → 5.3
importance: Undecided → High
Revision history for this message
Philip Stoev (pstoev-askmonty) wrote :

This bug is sporadic , but does happen after a hundred thousand queries have been run.

Changed in maria:
assignee: nobody → Oleksandr "Sanja" Byelkin (sanja-byelkin)
Revision history for this message
Philip Stoev (pstoev-askmonty) wrote :
Download full text (14.9 KiB)

This is expressed more easily as a valgrind warning, and not a crash:

==2571== Conditional jump or move depends on uninitialised value(s)
==2571== at 0x8DA8DCD: decimal2double (decimal.c:963)
==2571== by 0x8202DB9: my_decimal2double(unsigned int, my_decimal const*, double*) (my_decimal.h:314)
==2571== by 0x81FD816: Item_cache_decimal::val_real() (item.cc:7837)
==2571== by 0x81F6F4E: Item_cache_wrapper::val_real() (item.cc:6808)
==2571== by 0x8205843: Item::val_result() (item.h:778)
==2571== by 0x81F4F78: Item_ref::val_real() (item.cc:6438)
==2571== by 0x8263EF3: Arg_comparator::compare_real() (item_cmpfunc.cc:1359)
==2571== by 0x822944F: Arg_comparator::compare() (item_cmpfunc.h:81)
==2571== by 0x8267CFB: Item_func_le::val_int() (item_cmpfunc.cc:2015)
==2571== by 0x81EF200: Item::save_in_field(Field*, bool) (item.cc:5328)
==2571== by 0x8209CBA: Item_result_field::save_in_result_field(bool) (item.h:2354)
==2571== by 0x84F9C37: copy_funcs(Item**) (sql_select.cc:17575)
==2571== by 0x84E8237: end_write(JOIN*, st_join_table*, bool) (sql_select.cc:14252)
==2571== by 0x84E2D6D: evaluate_join_record(JOIN*, st_join_table*, int) (sql_select.cc:13278)
==2571== by 0x84E1E64: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:13087)
==2571== by 0x84E2D6D: evaluate_join_record(JOIN*, st_join_table*, int) (sql_select.cc:13278)

Test case:

--disable_warnings
DROP TABLE /*! IF EXISTS */ CC;
DROP TABLE /*! IF EXISTS */ D;
DROP TABLE /*! IF EXISTS */ C;
--enable_warnings

CREATE TABLE `CC` (
  `pk` int(11) NOT NULL AUTO_INCREMENT,
  `col_int_nokey` int(11) DEFAULT NULL,
  `col_int_key` int(11) DEFAULT NULL,
  `col_date_key` date DEFAULT NULL,
  `col_time_key` time DEFAULT NULL,
  `col_varchar_key` varchar(1) DEFAULT NULL,
  `col_varchar_nokey` varchar(1) DEFAULT NULL,
  PRIMARY KEY (`pk`),
  KEY `col_int_key` (`col_int_key`),
  KEY `col_date_key` (`col_date_key`),
  KEY `col_time_key` (`col_time_key`),
  KEY `col_varchar_key` (`col_varchar_key`,`col_int_key`)
) ENGINE=InnoDB AUTO_INCREMENT=30 DEFAULT CHARSET=latin1;
INSERT INTO `CC` VALUES (10,7,8,NULL,'01:27:35','v','v');
INSERT INTO `CC` VALUES (11,1,9,'2006-06-14','19:48:31','r','r');
INSERT INTO `CC` VALUES (12,5,9,'2002-09-12','00:00:00','a','a');
INSERT INTO `CC` VALUES (13,3,186,'2005-02-15','19:53:05','m','m');
INSERT INTO `CC` VALUES (14,6,NULL,NULL,'19:18:56','y','y');
INSERT INTO `CC` VALUES (15,92,2,'2008-11-04','10:55:12','j','j');
INSERT INTO `CC` VALUES (16,7,3,'2004-09-04','00:25:00','d','d');
INSERT INTO `CC` VALUES (17,NULL,0,'2006-06-05','12:35:47','z','z');
INSERT INTO `CC` VALUES (18,3,133,'1900-01-01','19:53:03','e','e');
INSERT INTO `CC` VALUES (19,5,1,'1900-01-01','17:53:30','h','h');
INSERT INTO `CC` VALUES (20,1,8,'1900-01-01','11:35:49','b','b');
INSERT INTO `CC` VALUES (21,2,5,'2005-01-13',NULL,'s','s');
INSERT INTO `CC` VALUES (22,NULL,5,'2006-05-21','06:01:40','e','e');
INSERT INTO `CC` VALUES (23,1,8,'2003-09-08','05:45:11','j','j');
INSERT INTO `CC` VALUES (24,0,6,'2006-12-23','00:00:00','e','e');
INSERT INTO `CC` VALUES (25,210,51,'2006-10-15','00:00:00','f','f');
INSERT INTO `CC` VALUES (26,8,4,'2005-04-06','06:11:01','v','v...

Changed in maria:
status: New → In Progress
Revision history for this message
Oleksandr "Sanja" Byelkin (sanja-byelkin) wrote :

On the modern tree there is no problem with uninitialized data, but alot of probably lost allocated memory.

Changed in maria:
status: In Progress → Fix Committed
Changed in maria:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.