Crash in JOIN_CACHE::write_record_data with derived_merge + semijoin + innodb + nested views

[Philip Stoev]

backtrace:

#5 0x007b7836 in __memcpy_ssse3 () from /lib/libc.so.6
#6 0x082f2381 in JOIN_CACHE::write_record_data (this=0x9b0439b8, link=0x0, is_full=0xa1571f1b) at sql_join_cache.cc:1421
#7 0x082f2632 in JOIN_CACHE::put_record (this=0x9b0439b8) at sql_join_cache.cc:1530
#8 0x0833daf8 in sub_select_cache (join=0xa162fe08, join_tab=0x9b042f1c, end_of_records=false) at sql_select.cc:14916
#9 0x0833e8c9 in evaluate_null_complemented_join_record (join=0xa162fe08, join_tab=0x9b042d18) at sql_select.cc:15434
#10 0x0833e05f in sub_select (join=0xa162fe08, join_tab=0x9b042b14, end_of_records=false) at sql_select.cc:15167
#11 0x0833d709 in do_select (join=0xa162fe08, fields=0xa82bcdc, table=0x0, procedure=0x0) at sql_select.cc:14785
#12 0x08321f61 in JOIN::exec (this=0xa162fe08) at sql_select.cc:2679
#13 0x0832278e in mysql_select (thd=0xa82a208, rref_pointer_array=0xa82bd84, tables=0xa1613d70, wild_num=1, fields=..., conds=0xa1614ff8, og_num=0,
    order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xa162db70, unit=0xa82b968, select_lex=0xa82bc48)
    at sql_select.cc:2900
#14 0x0831a55f in handle_select (thd=0xa82a208, lex=0xa82b90c, result=0xa162db70, setup_tables_done_option=0) at sql_select.cc:283
#15 0x082b4d18 in execute_sqlcom_select (thd=0xa82a208, all_tables=0xa1613d70) at sql_parse.cc:5112
#16 0x082abad5 in mysql_execute_command (thd=0xa82a208) at sql_parse.cc:2250
#17 0x082b7347 in mysql_parse (thd=0xa82a208, rawbuf=0xa1613bb0 "SELECT *\nFROM t3\nLEFT JOIN v5\nON ( t3.a = v5.a )\nWHERE t3.b IN ( SELECT b FROM t4 )",
    length=83, found_semicolon=0xa1573228) at sql_parse.cc:6112
#18 0x082a9724 in dispatch_command (command=COM_QUERY, thd=0xa82a208, packet=0xa8828d9 "", packet_length=83) at sql_parse.cc:1221
#19 0x082a8b7f in do_command (thd=0xa82a208) at sql_parse.cc:916
#20 0x082a5b63 in handle_one_connection (arg=0xa82a208) at sql_connect.cc:1191
#21 0x00821919 in start_thread () from /lib/libpthread.so.0
#22 0x0076acce in clone () from /lib/libc.so.6

minimal switch: derived_merge=on,semijoin=on

full switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=off,derived_merge=on,derived_with_keys=off,firstmatch=off,loosescan=off,materialization=off,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=off,semijoin_with_cache=off,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on

explain:

id select_type table type possible_keys key key_len ref rows Extra
1 PRIMARY t3 system NULL NULL NULL NULL 1
1 PRIMARY t1 ALL NULL NULL NULL NULL 0 Using where; Start temporary
1 PRIMARY <derived4> ALL NULL NULL NULL NULL 2
1 PRIMARY t4 ALL NULL NULL NULL NULL 1 Using where; End temporary; Using join buffer (flat, BNL join)
4 DERIVED t2 ALL NULL NULL NULL NULL 1

bzr version-info
revision-id: <email address hidden>
date: 2011-10-24 12:54:28 -0700
build-date: 2011-10-25 12:05:43 +0300
revno: 3249
branch-nick: maria-5.3

test case:

--source include/have_innodb.inc
CREATE TABLE t1 ( a varchar(1) );

CREATE TABLE t2 ( b varchar(1) ) ENGINE=InnoDB;

CREATE TABLE t3 ( a varchar(1), b varchar(1) );
INSERT INTO t3 VALUES ('c','c');

CREATE TABLE t4 ( b varchar(1) ) ENGINE=InnoDB;

CREATE ALGORITHM=TEMPTABLE VIEW v2 AS SELECT * FROM t2;
CREATE VIEW v5 AS SELECT t1.* FROM t1, v2 ;

SET SESSION optimizer_switch='derived_merge=on,semijoin=on';

SELECT *
FROM t3
LEFT JOIN v5
ON ( t3.a = v5.a )
WHERE t3.b IN ( SELECT b FROM t4 );

[Philip Stoev (pstoev-askmonty)]

valgrind:

==11013== Thread 20:
==11013== Invalid read of size 2
==11013== at 0x4007A0E: memcpy (mc_replace_strmem.c:635)
==11013== by 0x82F2380: JOIN_CACHE::write_record_data(unsigned char*, bool*) (sql_join_cache.cc:1421)
==11013== by 0x82F2631: JOIN_CACHE::put_record() (sql_join_cache.cc:1530)
==11013== by 0x833DAF7: sub_select_cache(JOIN*, st_join_table*, bool) (sql_select.cc:14916)
==11013== by 0x833E8C8: evaluate_null_complemented_join_record(JOIN*, st_join_table*) (sql_select.cc:15434)
==11013== by 0x833E05E: sub_select(JOIN*, st_join_table*, bool) (sql_select.cc:15167)
==11013== by 0x833D708: do_select(JOIN*, List<Item>*, st_table*, Procedure*) (sql_select.cc:14785)
==11013== by 0x8321F60: JOIN::exec() (sql_select.cc:2679)
==11013== by 0x832278D: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, un
signed long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2900)
==11013== by 0x831A55E: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:283)
==11013== by 0x82B4D17: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5112)
==11013== by 0x82ABAD4: mysql_execute_command(THD*) (sql_parse.cc:2250)
==11013== by 0x82B7346: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6112)
==11013== by 0x82A9723: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1221)
==11013== by 0x82A8B7E: do_command(THD*) (sql_parse.cc:916)
==11013== by 0x82A5B62: handle_one_connection (sql_connect.cc:1191)