Crash in __bzero_sse2 from JOIN_CACHE_BKA_UNIQUE::cleanup_hash_table with join_cache_level = 8

Bug #636922 reported by Philip Stoev
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
MariaDB
Invalid
High
Igor Babaev

Bug Description

When executing the following query

SELECT table2 .`col_int`
FROM I LEFT JOIN N table2 ON table2 .`col_varchar_10_latin1` LEFT JOIN F table3 LEFT JOIN L table4 JOIN P table6 ON table6 .`col_int` ON table3 .`col_int_key` = table4 .`col_int_key` ON table2 .`col_varchar_10_latin1` = table6 .`col_varchar_10_utf8_key`
;

the server crashed as follows:

#5 0x00b774f4 in __bzero_sse2 () from /lib/libc.so.6
#6 0x082dae51 in JOIN_CACHE_BKA_UNIQUE::cleanup_hash_table (this=0xb6db6528) at sql_join_cache.cc:2916
#7 0x082da95d in JOIN_CACHE_BKA_UNIQUE::reset (this=0xb6db6528, for_writing=true) at sql_join_cache.cc:2659
#8 0x082d92d0 in JOIN_CACHE::join_records (this=0xb6db6528, skip_last=false) at sql_join_cache.cc:1709
#9 0x082d9102 in JOIN_CACHE::join_records (this=0xb6d96450, skip_last=false) at sql_join_cache.cc:1650
#10 0x0831ef60 in sub_select_cache (join=0xb6d8df88, join_tab=0xb6d94a20, end_of_records=true) at sql_select.cc:12822
#11 0x0831f179 in sub_select (join=0xb6d8df88, join_tab=0xb6d94860, end_of_records=true) at sql_select.cc:12984
#12 0x0831e733 in do_select (join=0xb6d8df88, fields=0x9fef714, table=0x0, procedure=0x0) at sql_select.cc:12580
#13 0x08304ac1 in JOIN::exec (this=0xb6d8df88) at sql_select.cc:2300
#14 0x083051f7 in mysql_select (thd=0x9fedd00, rref_pointer_array=0x9fef798, tables=0xb6d80808, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0,
    group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xb6d8df58, unit=0x9fef3dc, select_lex=0x9fef67c) at sql_select.cc:2501
#15 0x082fd95b in handle_select (thd=0x9fedd00, lex=0x9fef380, result=0xb6d8df58, setup_tables_done_option=0) at sql_select.cc:276
#16 0x0829bf3c in execute_sqlcom_select (thd=0x9fedd00, all_tables=0xb6d80808) at sql_parse.cc:5081
#17 0x08292914 in mysql_execute_command (thd=0x9fedd00) at sql_parse.cc:2265
#18 0x0829e0fd in mysql_parse (thd=0x9fedd00,
    inBuf=0xb6d4ecc8 "SELECT table2 .`col_int`\nFROM I LEFT JOIN N table2 ON table2 .`col_varchar_10_latin1` LEFT JOIN F table3 LEFT JOIN L table4 JOIN P table6 ON table6 .`col_int` ON table3 .`col_int_key` = tab"..., length=291, found_semicolon=0xa6eb7230) at sql_parse.cc:6027
#19 0x082903ca in dispatch_command (command=COM_QUERY, thd=0x9fedd00, packet=0x9fefd21 "", packet_length=292) at sql_parse.cc:1184
#20 0x0828f8b8 in do_command (thd=0x9fedd00) at sql_parse.cc:890
#21 0x0828c8f0 in handle_one_connection (arg=0x9fedd00) at sql_connect.cc:1153
#22 0x00bea919 in start_thread () from /lib/libpthread.so.0
#23 0x00b2ccbe in clone () from /lib/libc.so.6

Revision history for this message
Philip Stoev (pstoev-askmonty) wrote :
Download full text (3.1 KiB)

Valgrind warnings:

==28984== Invalid write of size 8
==28984== at 0xB774F4: __bzero_sse2 (in /lib/libc-2.12.so)
==28984== by 0x82DA95C: JOIN_CACHE_BKA_UNIQUE::reset(bool) (sql_join_cache.cc:2659)
==28984== by 0x82D92CF: JOIN_CACHE::join_records(bool) (sql_join_cache.cc:1709)
==28984== by 0x82D9101: JOIN_CACHE::join_records(bool) (sql_join_cache.cc:1650)
==28984== by 0x831EF5F: sub_select_cache(JOIN*, st_join_table*, bool) (sql_select.cc:12822)
==28984== by 0x831F178: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:12984)
==28984== by 0x831E732: do_select(JOIN*, List<Item>*, st_table*, Procedure*) (sql_select.cc:12580)
==28984== by 0x8304AC0: JOIN::exec() (sql_select.cc:2300)
==28984== by 0x83051F6: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2501)
==28984== by 0x82FD95A: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:276)
==28984== by 0x829BF3B: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5081)
==28984== by 0x8292913: mysql_execute_command(THD*) (sql_parse.cc:2265)
==28984== by 0x829E0FC: mysql_parse(THD*, char const*, unsigned int, char const**) (sql_parse.cc:6027)
==28984== by 0x82903C9: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1184)
==28984== by 0x828F8B7: do_command(THD*) (sql_parse.cc:890)
==28984== by 0x828C8EF: handle_one_connection (sql_connect.cc:1153)
==28984== Address 0x7a5d5d0 is 120,672 bytes inside a block of size 131,072 free'd
==28984== at 0x40057F6: free (vg_replace_malloc.c:325)
==28984== by 0x873A406: my_no_flags_free (my_malloc.c:62)
==28984== by 0x833004D: JOIN_CACHE::free() (sql_select.h:771)
==28984== by 0x8311FB0: set_join_cache_denial(st_join_table*) (sql_select.cc:7087)
==28984== by 0x83120EC: revise_cache_usage(st_join_table*) (sql_select.cc:7194)
==28984== by 0x83129DD: check_join_cache_usage(st_join_table*, JOIN*, unsigned long long, unsigned int, bool*) (sql_select.cc:7476)
==28984== by 0x8312F53: make_join_readinfo(JOIN*, unsigned long long, unsigned int) (sql_select.cc:7601)
==28984== by 0x8300B05: JOIN::optimize() (sql_select.cc:1281)
==28984== by 0x8305171: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2487)
==28984== by 0x82FD95A: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:276)
==28984== by 0x829BF3B: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5081)
==28984== by 0x8292913: mysql_execute_command(THD*) (sql_parse.cc:2265)
==28984== by 0x829E0FC: mysql_parse(THD*, char const*, unsigned int, char const**) (sql_parse.cc:6027)
==28984== by 0x82903C9: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1184)
==28984== by 0x828F8B7: do_command(THD*) (sql_parse.cc:890)
==28984== by 0x828C8EF: handle_one_connection (sql_connect.cc:1...

Read more...

Revision history for this message
Philip Stoev (pstoev-askmonty) wrote :
Download full text (15.6 KiB)

Test case

--source include/have_innodb.inc

SET SESSION join_cache_level = 8;
CREATE TABLE `F` (
  `col_varchar_10_utf8_key` varchar(10) CHARACTER SET utf8 DEFAULT NULL,
  `col_varchar_10_latin1` varchar(10) DEFAULT NULL,
  `col_int` int(11) DEFAULT NULL,
  `col_int_key` int(11) DEFAULT NULL,
  KEY `col_varchar_10_utf8_key` (`col_varchar_10_utf8_key`),
  KEY `col_int_key` (`col_int_key`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
INSERT INTO `F` VALUES ('BCOIA','going',9,76939264);
INSERT INTO `F` VALUES ('get','v',NULL,NULL);
INSERT INTO `F` VALUES ('itrnayglbw','q',NULL,3);
INSERT INTO `F` VALUES ('ouitrnaygl','QDKGF',9,NULL);
INSERT INTO `F` VALUES ('KBWOG','look',NULL,NULL);
INSERT INTO `F` VALUES ('ehyouitrna','YITGO',4,8);
INSERT INTO `F` VALUES ('c','fvwpehyoui',8,9);
INSERT INTO `F` VALUES ('glswfvwpeh','u',5,5);
INSERT INTO `F` VALUES ('w','qaysglswfv',NULL,6);
INSERT INTO `F` VALUES ('VNVAA','r',NULL,349831168);
CREATE TABLE `N` (
  `col_int_key` int(11) DEFAULT NULL,
  `col_int` int(11) DEFAULT NULL,
  `col_varchar_10_utf8_key` varchar(10) CHARACTER SET utf8 DEFAULT NULL,
  `col_varchar_10_latin1` varchar(10) DEFAULT NULL,
  KEY `col_int_key` (`col_int_key`),
  KEY `col_varchar_10_utf8_key` (`col_varchar_10_utf8_key`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
INSERT INTO `N` VALUES (4,-1707802624,'wwhanhcjzz','fwwhanhcjz');
INSERT INTO `N` VALUES (-1268908032,NULL,'d','think');
INSERT INTO `N` VALUES (0,3,'j','was');
INSERT INTO `N` VALUES (8,2,'ngyrowgyfw','LZUOE');
INSERT INTO `N` VALUES (0,-1214578688,'s','don\'t');
INSERT INTO `N` VALUES (1,8,'ohfngyrowg','oohfngyrow');
INSERT INTO `N` VALUES (3,NULL,'and','gvoohfngyr');
INSERT INTO `N` VALUES (4,NULL,'x','yeah');
INSERT INTO `N` VALUES (NULL,NULL,'his','x');
INSERT INTO `N` VALUES (1012334592,-1012072448,'rayypigvoo','s');
INSERT INTO `N` VALUES (NULL,1132986368,'up','PRYNJ');
INSERT INTO `N` VALUES (1552613376,374341632,'a','a');
INSERT INTO `N` VALUES (NULL,653000704,'joafdrayyp','YVHIF');
INSERT INTO `N` VALUES (-392691712,NULL,'g','zxjoafdray');
INSERT INTO `N` VALUES (4,3,'cszxjoafdr','you');
INSERT INTO `N` VALUES (NULL,NULL,'q','or');
INSERT INTO `N` VALUES (-1692925952,4,'SNFCA','DSVSL');
INSERT INTO `N` VALUES (NULL,0,'qooagbcszx','HLPLE');
INSERT INTO `N` VALUES (2,6,'q','p');
INSERT INTO `N` VALUES (1318977536,8,'j','j');
INSERT INTO `N` VALUES (-190382080,8,'your','did');
INSERT INTO `N` VALUES (NULL,3,'p','say');
INSERT INTO `N` VALUES (1045889024,NULL,'gxmugamnqo','ztgxmugamn');
INSERT INTO `N` VALUES (NULL,-2013134848,'v','eztgxmugam');
INSERT INTO `N` VALUES (NULL,NULL,'j','would');
INSERT INTO `N` VALUES (NULL,-345636864,'nzcheztgxm','TBDRG');
INSERT INTO `N` VALUES (NULL,-975044608,'the','don\'t');
INSERT INTO `N` VALUES (-445382656,NULL,'no','ZXTXS');
INSERT INTO `N` VALUES (1,NULL,'back','NGNHE');
INSERT INTO `N` VALUES (-1165623296,0,'JNXCI','d');
INSERT INTO `N` VALUES (1406402560,-473628672,'u','SJCZQ');
INSERT INTO `N` VALUES (4,NULL,'a','ddhapqmoun');
INSERT INTO `N` VALUES (9,NULL,'GJNDI','q');
INSERT INTO `N` VALUES (NULL,NULL,'OVWKC','s');
INSERT INTO `N` VALUES (317849600,157155328,'l','they');
INSERT INTO `N` VALUES (567214080,-895811584,'MJLVP','QGUQ...

Changed in maria:
milestone: none → 5.3
importance: Undecided → High
Changed in maria:
assignee: nobody → Igor Babaev (igorb-seattle)
Revision history for this message
Igor Babaev (igorb-seattle) wrote :

I failed to reproduce this bug on the current 5,3 tree with the submitted test case.

Changed in maria:
status: New → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.