The following test case, constructed from the reported one, but using neither semijoins nor unions,
crashes the server with the same stack as in the report above:
CREATE TABLE t1 (f2 varchar(1));
INSERT INTO t1 VALUES ('x');
CREATE TABLE t3 (f1 varchar(1), f2 varchar(1));
INSERT INTO t3 VALUES ('e', 'c'), ('c', 'r');
CREATE VIEW v1 AS SELECT f1, MIN(f2) AS f2 FROM t3 GROUP BY f1;
SELECT * FROM t1, t2, v1 WHERE t2.f2=t1.f2 AND t2.f2=v1.f1 AND t2.f2=v1.f2;
The state of the stack at the crash is;
#0 0x00007f7b9ca8b5ec in pthread_kill () from /lib64/libpthread.so.0
#0 0x00007f7b9ca8b5ec in pthread_kill () from /lib64/libpthread.so.0
#1 0x0000000000c27ede in my_write_core (sig=11) at stacktrace.c:426
#2 0x00000000006cba40 in handle_segfault (sig=11) at mysqld.cc:2812
#3 <signal handler called>
#4 0x000000000079119a in store_key::store_key (this=0x1d077c8, thd=0x1be8598, field_arg=0x8f8f8f003179656b, ptr=0x1d09f76 "",
null=0x1d09f75 "", length=36751) at sql_select.h:1227
#5 0x00000000007913bd in store_key_field::store_key_field (this=0x1d077c8, thd=0x1be8598, to_field_arg=0x8f8f8f003179656b,
ptr=0x1d09f76 "", null_ptr_arg=0x1d09f75 "", length=36751, from_field=0x1c9ef60, name_arg=0x1d077b8 "test.t2.f2")
at sql_select.h:1290
#6 0x000000000076c4d9 in get_store_key (thd=0x1be8598, keyuse=0x1caeb28, used_tables=1, key_part=0x1c95f58,
key_buff=0x1d09f75 "", maybe_null=1) at sql_select.cc:7368
#7 0x000000000076c0ba in create_ref_for_key (join=0x1cf9b60, j=0x1d071d8, org_keyuse=0x1caead8,
used_tables=4611686018427387911) at sql_select.cc:7297
#8 0x000000000076b3cb in get_best_combination (join=0x1cf9b60) at sql_select.cc:7063
#9 0x0000000000762cfc in make_join_statistics (join=0x1cf9b60, tables_list=..., conds=0x1cadd20, keyuse_array=0x1cffb10)
at sql_select.cc:3511
#10 0x000000000075a624 in JOIN::optimize (this=0x1cf9b60) at sql_select.cc:1101
#11 0x0000000000760cb0 in mysql_select (thd=0x1be8598, rref_pointer_array=0x1beb118, tables=0x1c6d240, wild_num=1, fields=...,
conds=0x1c6e5a0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0x1cac198,
unit=0x1beaa10, select_lex=0x1beaef8) at sql_select.cc:2872
#12 0x0000000000757d47 in handle_select (thd=0x1be8598, lex=0x1bea970, result=0x1cac198, setup_tables_done_option=0)
at sql_select.cc:283
#13 0x00000000006e8128 in execute_sqlcom_select (thd=0x1be8598, all_tables=0x1c6d240) at sql_parse.cc:5082
#14 0x00000000006df20f in mysql_execute_command (thd=0x1be8598) at sql_parse.cc:2227
#15 0x00000000006eab06 in mysql_parse (thd=0x1be8598,
rawbuf=0x1c6cff0 "SELECT * FROM t1, t2, v1 WHERE t2.f2=t1.f2 AND t2.f2=v1.f1 AND t2.f2=v1.f2", length=74,
found_semicolon=0x7f7b932e7c98) at sql_parse.cc:6083
#16 0x00000000006dcac0 in dispatch_command (command=COM_QUERY, thd=0x1be8598,
packet=0x1c63b89 "SELECT * FROM t1, t2, v1 WHERE t2.f2=t1.f2 AND t2.f2=v1.f1 AND t2.f2=v1.f2", packet_length=74)
at sql_parse.cc:1206
#17 0x00000000006dbe36 in do_command (thd=0x1be8598) at sql_parse.cc:904
#18 0x00000000006d8e4c in handle_one_connection (arg=0x1be8598) at sql_connect.cc:1178
The following test case, constructed from the reported one, but using neither semijoins nor unions,
crashes the server with the same stack as in the report above:
CREATE TABLE t1 (f2 varchar(1));
INSERT INTO t1 VALUES ('x');
CREATE TABLE t2 (f2 varchar(1) , KEY (f2)) ;
INSERT INTO t2 VALUES (NULL),('r');
CREATE TABLE t3 (f1 varchar(1), f2 varchar(1));
INSERT INTO t3 VALUES ('e', 'c'), ('c', 'r');
CREATE VIEW v1 AS SELECT f1, MIN(f2) AS f2 FROM t3 GROUP BY f1;
SELECT * FROM t1, t2, v1 WHERE t2.f2=t1.f2 AND t2.f2=v1.f1 AND t2.f2=v1.f2;
The state of the stack at the crash is;
#0 0x00007f7b9ca8b5ec in pthread_kill () from /lib64/ libpthread. so.0 libpthread. so.0 :store_ key (this=0x1d077c8, thd=0x1be8598, field_arg= 0x8f8f8f0031796 56b, ptr=0x1d09f76 "", field:: store_key_ field (this=0x1d077c8, thd=0x1be8598, to_field_ arg=0x8f8f8f003 179656b, arg=0x1d09f75 "", length=36751, from_field= 0x1c9ef60, name_arg=0x1d077b8 "test.t2.f2") buff=0x1d09f75 "", maybe_null=1) at sql_select.cc:7368 0x1caead8, tables= 461168601842738 7911) at sql_select.cc:7297 combination (join=0x1cf9b60) at sql_select.cc:7063 statistics (join=0x1cf9b60, tables_list=..., conds=0x1cadd20, keyuse_ array=0x1cffb10 ) array=0x1beb118 , tables=0x1c6d240, wild_num=1, fields=..., 0x1c6e5a0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_ options= 2147764736, result=0x1cac198, lex=0x1beaef8) at sql_select.cc:2872 done_option= 0) sqlcom_ select (thd=0x1be8598, all_tables= 0x1c6d240) at sql_parse.cc:5082 command (thd=0x1be8598) at sql_parse.cc:2227 0x1c6cff0 "SELECT * FROM t1, t2, v1 WHERE t2.f2=t1.f2 AND t2.f2=v1.f1 AND t2.f2=v1.f2", length=74, semicolon= 0x7f7b932e7c98) at sql_parse.cc:6083 0x1c63b89 "SELECT * FROM t1, t2, v1 WHERE t2.f2=t1.f2 AND t2.f2=v1.f1 AND t2.f2=v1.f2", packet_length=74) one_connection (arg=0x1be8598) at sql_connect.cc:1178
#0 0x00007f7b9ca8b5ec in pthread_kill () from /lib64/
#1 0x0000000000c27ede in my_write_core (sig=11) at stacktrace.c:426
#2 0x00000000006cba40 in handle_segfault (sig=11) at mysqld.cc:2812
#3 <signal handler called>
#4 0x000000000079119a in store_key:
null=0x1d09f75 "", length=36751) at sql_select.h:1227
#5 0x00000000007913bd in store_key_
ptr=0x1d09f76 "", null_ptr_
at sql_select.h:1290
#6 0x000000000076c4d9 in get_store_key (thd=0x1be8598, keyuse=0x1caeb28, used_tables=1, key_part=0x1c95f58,
key_
#7 0x000000000076c0ba in create_ref_for_key (join=0x1cf9b60, j=0x1d071d8, org_keyuse=
used_
#8 0x000000000076b3cb in get_best_
#9 0x0000000000762cfc in make_join_
at sql_select.cc:3511
#10 0x000000000075a624 in JOIN::optimize (this=0x1cf9b60) at sql_select.cc:1101
#11 0x0000000000760cb0 in mysql_select (thd=0x1be8598, rref_pointer_
conds=
unit=0x1beaa10, select_
#12 0x0000000000757d47 in handle_select (thd=0x1be8598, lex=0x1bea970, result=0x1cac198, setup_tables_
at sql_select.cc:283
#13 0x00000000006e8128 in execute_
#14 0x00000000006df20f in mysql_execute_
#15 0x00000000006eab06 in mysql_parse (thd=0x1be8598,
rawbuf=
found_
#16 0x00000000006dcac0 in dispatch_command (command=COM_QUERY, thd=0x1be8598,
packet=
at sql_parse.cc:1206
#17 0x00000000006dbe36 in do_command (thd=0x1be8598) at sql_parse.cc:904
#18 0x00000000006d8e4c in handle_