Crash in hp_movelink called from Expression_cache_tmptable::put_value with subquery cache
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
MariaDB |
Fix Released
|
Critical
|
Oleksandr "Sanja" Byelkin |
Bug Description
The following queries:
CREATE OR REPLACE VIEW v1 AS
SELECT t2.b
FROM t1
JOIN t2
WHERE t2 .c > (
SELECT t2.c FROM t3
);
SELECT * FROM t4 WHERE b NOT IN ( SELECT * FROM v1 );
crash as follows:
#3 0x082987db in handle_segfault (sig=11) at mysqld.cc:2810
#4 <signal handler called>
#5 0x08549f99 in hp_movelink (pos=0xae762da0, next_link=0x0, newlink=0xae762d98) at hp_hash.c:232
#6 0x0854962f in hp_write_key (info=0xae728380, keyinfo=0xae72eb34, record=0xae7348e0 <incomplete sequence \375>, recpos=0xae751c90 "") at hp_write.c:364
#7 0x08548d09 in heap_write (info=0xae728380, record=0xae7348e0 <incomplete sequence \375>) at hp_write.c:51
#8 0x085466ca in ha_heap::write_row (this=0xae72e578, buf=0xae7348e0 <incomplete sequence \375>) at ha_heap.cc:236
#9 0x081f2916 in handler:
#10 0x084c1613 in Expression_
#11 0x081e618a in Item_cache_
#12 0x081dad41 in Item_cache_
#13 0x0820b1dc in Item_func_
#14 0x0833dc71 in evaluate_
#15 0x0833da24 in sub_select (join=0xae735280, join_tab=
#16 0x0833d12f in do_select (join=0xae735280, fields=0x97fe1b4, table=0x0, procedure=0x0) at sql_select.cc:14770
#17 0x08321a61 in JOIN::exec (this=0xae735280) at sql_select.cc:2679
#18 0x0832228e in mysql_select (thd=0x97fc6e0, rref_pointer_
order=0x0, group=0x0, having=0x0, proc_param=0x0, select_
at sql_select.cc:2900
#19 0x0831a05f in handle_select (thd=0x97fc6e0, lex=0x97fdde4, result=0xae731d78, setup_tables_
#20 0x082b482c in execute_
#21 0x082ab5e9 in mysql_execute_
#22 0x082b6e5b in mysql_parse (thd=0x97fc6e0, rawbuf=0xae7125f0 "SELECT * FROM t4 WHERE b NOT IN ( SELECT * FROM v1 )", length=52,
found_
#23 0x082a9238 in dispatch_command (command=COM_QUERY, thd=0x97fc6e0, packet=0x9855321 "", packet_length=52) at sql_parse.cc:1221
#24 0x082a8693 in do_command (thd=0x97fc6e0) at sql_parse.cc:916
#25 0x082a5677 in handle_
#26 0x00821919 in start_thread () from /lib/libpthread
#27 0x0076acce in clone () from /lib/libc.so.6
explain of the view:
id select_type table type possible_keys key key_len ref rows Extra
1 PRIMARY NULL NULL NULL NULL NULL NULL NULL Impossible WHERE noticed after reading const tables
2 DEPENDENT SUBQUERY t3 system NULL NULL NULL NULL 0 const row not found
explain of the select:
id select_type table type possible_keys key key_len ref rows Extra
1 PRIMARY t4 ALL NULL NULL NULL NULL 4 Using where
2 DEPENDENT SUBQUERY NULL NULL NULL NULL NULL NULL NULL Impossible WHERE noticed after reading const tables
4 DEPENDENT SUBQUERY t3 system NULL NULL NULL NULL 0 const row not found
optimizer switch: subquery_cache=on;
full switch: index_merge=
revision-id: <email address hidden>
date: 2011-10-12 13:19:37 +0400
build-date: 2011-10-12 13:40:45 +0300
revno: 3225
branch-nick: maria-5.3
test case:
CREATE TABLE t1 (a int) ;
CREATE TABLE t2 (b int, c varchar(1) NOT NULL ) ;
INSERT INTO t2 VALUES (1,'x'),(2,'y');
CREATE TABLE t3 (a int) ;
CREATE TABLE t4 ( pk int(11) NOT NULL , b int(11) NOT NULL ) ;
INSERT INTO t4 VALUES (26,9),
CREATE OR REPLACE VIEW v1 AS
SELECT t2.b
FROM t1
JOIN t2
WHERE t2 .c > (
SELECT t2.c FROM t3
);
SELECT * FROM t4 WHERE b NOT IN ( SELECT * FROM v1 );
Changed in maria: | |
importance: | Undecided → Critical |
status: | New → In Progress |
Changed in maria: | |
status: | In Progress → Fix Committed |
Changed in maria: | |
status: | Fix Committed → Fix Released |
Valgrind warnings:
==1034== Thread 4: simple. c:319) :write_ row(unsigned char*) (ha_heap.cc:236) :ha_write_ tmp_row( unsigned char*) (sql_class.h:3793) cache_tmptable: :put_value( Item*) (sql_expression _cache. cc:262) wrapper: :cache( ) (item.cc:7050) wrapper: :val_bool( ) (item.cc:7213) not::val_ int() (item_cmpfunc. cc:333) join_record( JOIN*, st_join_table*, int) (sql_select. cc:15202) cc:15107) cc:14770) cc:2679) lex_unit* , st_select_lex*) (sql_select. cc:2900) simple. c:313) :index_ read_map( unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) (ha_heap.cc:288) :ha_index_ read_map( unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) (sql_class.h:3655) key2(THD* , st_join_table*, st_table*, st_table_ref*) (sql_select. cc:15704) cache_tmptable: :check_ value(Item* *) (sql_expression _cache. cc:207) wrapper: :check_ cache() (item.cc:7034) wrapper: :val_bool( ) (item.cc:7207) not::val_ int() (item_cmpfunc. cc:333) join_record( JOIN*, st_join_table*, int) (sql_select. cc:15202) cc:15147) cc:14770) cc:2679) lex_unit* , st_select_lex*) (sql_select. cc:2900)
==1034== Use of uninitialised value of size 4
==1034== at 0x87BCEE7: my_hash_sort_simple (ctype-
==1034== by 0x854A47E: hp_rec_hashnr (hp_hash.c:348)
==1034== by 0x8549515: hp_write_key (hp_write.c:339)
==1034== by 0x8548D08: heap_write (hp_write.c:51)
==1034== by 0x85466C9: ha_heap:
==1034== by 0x81F2915: handler:
==1034== by 0x84C1612: Expression_
==1034== by 0x81E6189: Item_cache_
==1034== by 0x81DAD40: Item_cache_
==1034== by 0x820B1DB: Item_func_
==1034== by 0x833DC70: evaluate_
==1034== by 0x833D8DB: sub_select(JOIN*, st_join_table*, bool) (sql_select.
==1034== by 0x833D12E: do_select(JOIN*, List<Item>*, st_table*, Procedure*) (sql_select.
==1034== by 0x8321A60: JOIN::exec() (sql_select.
==1034== by 0x832228D: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, uns
igned long long, select_result*, st_select_
==1034== by 0x831A05E: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:283)
==1034==
==1034== Conditional jump or move depends on uninitialised value(s)
==1034== at 0x87BCEC1: my_hash_sort_simple (ctype-
==1034== by 0x854A47E: hp_rec_hashnr (hp_hash.c:348)
==1034== by 0x8549D5B: hp_search (hp_hash.c:149)
==1034== by 0x854C0A0: heap_rkey (hp_rkey.c:62)
==1034== by 0x854694F: ha_heap:
==1034== by 0x81BC16D: handler:
==1034== by 0x833ED7E: join_read_
==1034== by 0x84C1320: Expression_
==1034== by 0x81DA498: Item_cache_
==1034== by 0x81DACE1: Item_cache_
==1034== by 0x820B1DB: Item_func_
==1034== by 0x833DC70: evaluate_
==1034== by 0x833DA23: sub_select(JOIN*, st_join_table*, bool) (sql_select.
==1034== by 0x833D12E: do_select(JOIN*, List<Item>*, st_table*, Procedure*) (sql_select.
==1034== by 0x8321A60: JOIN::exec() (sql_select.
==1034== by 0x832228D: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, uns
igned long long, select_result*, st_select_
==1034==
==1034== Use of uninitialised value of size 4
==1034== at 0x87BCEE7: my_has...