Valgrind warnings in mark_as_null_row with materialization+semijoin, STRAIGHT_JOIN, impossible WHERE

Bug #933407 reported by Elena Stepanova
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
MariaDB
Fix Released
High
Sergey Petrunia

Bug Description

==25752== Thread 5:
==25752== Invalid write of size 1
==25752== at 0x832D957: mark_as_null_row(st_table*) (mysql_priv.h:2642)
==25752== by 0x836A845: return_zero_rows(JOIN*, select_result*, List<TABLE_LIST>&, List<Item>&, bool, unsigned long long, char const*, Item*) (sql_select.cc:10437)
==25752== by 0x8356936: JOIN::exec() (sql_select.cc:2160)
==25752== by 0x83590D0: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2931)
==25752== by 0x8350DEA: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:284)
==25752== by 0x82EC2BC: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5151)
==25752== by 0x82E3698: mysql_execute_command(THD*) (sql_parse.cc:2284)
==25752== by 0x82EE8F7: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6152)
==25752== by 0x82E12D8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1228)
==25752== by 0x82E0782: do_command(THD*) (sql_parse.cc:923)
==25752== by 0x82DD708: handle_one_connection (sql_connect.cc:1193)
==25752== by 0x40C9B24: start_thread (in /lib/libpthread-2.11.2.so)
==25752== by 0x42F534D: clone (in /lib/libc-2.11.2.so)
==25752== Address 0x59d0220 is 1,680 bytes inside a block of size 2,956 free'd
==25752== at 0x4026996: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==25752== by 0x87C2E73: _myfree (safemalloc.c:337)
==25752== by 0x87C21D0: free_root (my_alloc.c:366)
==25752== by 0x8373FB5: free_tmp_table(THD*, st_table*) (sql_select.cc:14862)
==25752== by 0x836906A: st_join_table::cleanup() (sql_select.cc:9783)
==25752== by 0x8369A70: JOIN::cleanup(bool) (sql_select.cc:10095)
==25752== by 0x836979C: JOIN::join_free() (sql_select.cc:10015)
==25752== by 0x836A819: return_zero_rows(JOIN*, select_result*, List<TABLE_LIST>&, List<Item>&, bool, unsigned long long, char const*, Item*) (sql_select.cc:10430)
==25752== by 0x8356936: JOIN::exec() (sql_select.cc:2160)
==25752== by 0x83590D0: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2931)
==25752== by 0x8350DEA: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:284)
==25752== by 0x82EC2BC: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5151)
==25752== by 0x82E3698: mysql_execute_command(THD*) (sql_parse.cc:2284)
==25752== by 0x82EE8F7: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6152)
==25752== by 0x82E12D8: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1228)
==25752== by 0x82E0782: do_command(THD*) (sql_parse.cc:923)
==25752==

==25752== Invalid read of size 4
==25752== at 0x832D961: mark_as_null_row(st_table*) (mysql_priv.h:2643)
==25752== by 0x836A845: return_zero_rows(JOIN*, select_result*, List<TABLE_LIST>&, List<Item>&, bool, unsigned long long, char const*, Item*) (sql_select.cc:10437)
,,,

==25752== Invalid read of size 4
==25752== at 0x832D978: mark_as_null_row(st_table*) (mysql_priv.h:2644)
==25752== by 0x836A845: return_zero_rows(JOIN*, select_result*, List<TABLE_LIST>&, List<Item>&, bool, unsigned long long, char const*, Item*) (sql_select.cc:10437)
...

==25752== Invalid write of size 1
==25752== at 0x4028C78: memset (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==25752== by 0x832D99C: mark_as_null_row(st_table*) (mysql_priv.h:2644)
==25752== by 0x836A845: return_zero_rows(JOIN*, select_result*, List<TABLE_LIST>&, List<Item>&, bool, unsigned long long, char const*, Item*) (sql_select.cc:10437)
...

stack trace from bzr version-info
revision-id: <email address hidden>
date: 2012-02-01 17:48:45 -0800
build-date: 2012-02-02 20:40:47 +0400
revno: 3405

Also reproducible on current revno 3421.

EXPLAIN:

id select_type table type possible_keys key key_len ref rows filtered Extra
1 PRIMARY <subquery2> system NULL NULL NULL NULL 1 100.00
1 PRIMARY t1 ALL NULL NULL NULL NULL 2 100.00
2 MATERIALIZED NULL NULL NULL NULL NULL NULL NULL NULL Impossible WHERE
Warnings:
Note 1003 select straight_join min(`test`.`t1`.`a`) AS `MIN(a)` from <materialize> (select `test`.`t1`.`a` from `test`.`t1` where 0) join `test`.`t1` where 1

Full optimizer_switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on
Minimal optimizer_switch: materialization=on,semijoin=on

Test case:

SET optimizer_switch='materialization=on,semijoin=on';

CREATE TABLE t1 ( a INT );
INSERT INTO t1 VALUES (0),(8);

SELECT STRAIGHT_JOIN MIN(a) FROM t1
WHERE a IN (
    SELECT a FROM t1
    WHERE 'condition'='impossible'
  );

Changed in maria:
status: New → In Progress
Changed in maria:
status: In Progress → Fix Committed
Revision history for this message
Elena Stepanova (elenst) wrote :

Fix released with 5.3.5-ga.

Changed in maria:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.