Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TiDB crashes when building query plan for INSERT with subquery SELECT #46083

Closed
SteveLeungYL opened this issue Aug 14, 2023 · 0 comments · Fixed by #46092
Closed

TiDB crashes when building query plan for INSERT with subquery SELECT #46083

SteveLeungYL opened this issue Aug 14, 2023 · 0 comments · Fixed by #46092
Labels

Comments

@SteveLeungYL
Copy link

Bug Report

1. Minimal reproduce step (Required)

  1. Compile the TiDB using the source repository: link
  2. Check out with the latest master version: 6ab8a378342, also tested with released version: v7.3.0(40b72e7a9a).
  3. Compile the TiDB server using go1.21.0. Use make in the repo root directory.
  4. Launch TiDB server using command:
./tidb-server -P 8000 -socket /tmp/mysql_0.sql -path $(pwd)/db_data
  1. Connect to the server using mysql client:
mysql -h 127.0.0.1 -P 8000 -u root --socket /tmp/mysql_0.sql
  1. Input the PoC Query to trigger the crash of the server.
drop database test123;
create database test123;
use test123;
CREATE TEMPORARY TABLE v0(v1 int);
INSERT INTO v0 WITH ta2 AS (TABLE v0) TABLE ta2 FOR UPDATE OF ta2;

2. What did you expect to see? (Required)

The TiDB Server should continue running.

3. What did you see instead (Required)

The TiDB-server crashes and then returns error:

tidb> INSERT INTO v0 WITH ta2 AS (TABLE v0) TABLE ta2 FOR UPDATE OF ta2;
ERROR 1105 (HY000): runtime error: invalid memory address or nil pointer dereference

Here is a more detailed stack trace captured by GDB, from version: v7.3.0(40b72e7a9a).

#0  0x0000000003f4d4d4 in github.com/pingcap/tidb/planner/core.(*PlanBuilder).buildSelect (b=0x401092e000, ctx=..., sel=0x40115b1680, p=..., err=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/planner/core/logical_plan_builder.go:4433
#1  0x0000000003fc733c in github.com/pingcap/tidb/planner/core.(*PlanBuilder).Build (b=<optimized out>, ctx=...,
    node=<error reading variable: access outside bounds of object referenced via synthetic pointer>, ~r0=..., ~r1=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/planner/core/planbuilder.go:853
#2  0x0000000003fe7ebc in github.com/pingcap/tidb/planner/core.(*PlanBuilder).buildSelectPlanOfInsert (b=0x401092e000, ctx=..., insert=0x40105565a0,
    insertPlan=0x4011d00340, ~r0=..., ~r0=...) at /home/tidb/go_projects/src/github.com/tidb/tidb/planner/core/planbuilder.go:4263
#3  0x0000000003fe5d08 in github.com/pingcap/tidb/planner/core.(*PlanBuilder).buildInsert (b=0x401092e000, ctx=..., insert=0x40105565a0, ~r0=..., ~r1=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/planner/core/planbuilder.go:3963
#4  0x0000000003fc70f4 in github.com/pingcap/tidb/planner/core.(*PlanBuilder).Build (b=<optimized out>, ctx=...,
    node=<error reading variable: access outside bounds of object referenced via synthetic pointer>, ~r0=..., ~r1=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/planner/core/planbuilder.go:832
#5  0x0000000004147a18 in github.com/pingcap/tidb/planner.buildLogicalPlan (ctx=...,
    sctx=<error reading variable: access outside bounds of object referenced via synthetic pointer>, node=..., builder=0x401092e000, ~r0=..., ~r1=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/planner/optimize.go:559
#6  0x0000000004146d74 in github.com/pingcap/tidb/planner.optimize (ctx=...,
    sctx=<error reading variable: access outside bounds of object referenced via synthetic pointer>,
    node=<error reading variable: access outside bounds of object referenced via synthetic pointer>, is=..., ~r0=..., ~r0=..., ~r1=..., ~r1=..., ~r2=<optimized out>,
    ~r2=<optimized out>, ~r3=..., ~r3=...) at /home/tidb/go_projects/src/github.com/tidb/tidb/planner/optimize.go:479
#7  0x0000000004145680 in github.com/pingcap/tidb/planner.Optimize (ctx=...,
    sctx=<error reading variable: access outside bounds of object referenced via synthetic pointer>,
    node=<error reading variable: access outside bounds of object referenced via synthetic pointer>, is=..., plan=..., slice=..., retErr=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/planner/optimize.go:337
#8  0x0000000004587fc4 in github.com/pingcap/tidb/executor.(*Compiler).Compile (c=0x4000a1e950,
    ctx=<error reading variable: access outside bounds of object referenced via synthetic pointer>,
    stmtNode=<error reading variable: access outside bounds of object referenced via synthetic pointer>, ~b0=<optimized out>, ~b0=<optimized out>, err=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/executor/compiler.go:98
#9  0x000000000477dc1c in github.com/pingcap/tidb/session.(*session).ExecuteStmt (s=0x4000156000,
    ctx=<error reading variable: access outside bounds of object referenced via synthetic pointer>,
    stmtNode=<error reading variable: access outside bounds of object referenced via synthetic pointer>, ~r0=..., ~r0=..., ~r1=..., ~r1=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/session/session.go:2225
#10 0x00000000048151f4 in github.com/pingcap/tidb/server.(*TiDBContext).ExecuteStmt (tc=0x401178a780, ctx=...,
    stmt=<error reading variable: access outside bounds of object referenced via synthetic pointer>, ~r0=..., ~r1=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/server/driver_tidb.go:291
#11 0x000000000480d0f4 in github.com/pingcap/tidb/server.(*clientConn).handleStmt (cc=0x40117c2c00,
    ctx=<error reading variable: access outside bounds of object referenced via synthetic pointer>, stmt=..., warns=..., lastStmt=true, ~r0=<optimized out>,
    ~r0=<optimized out>, ~r1=..., ~r1=...) at /home/tidb/go_projects/src/github.com/tidb/tidb/server/conn.go:1993
#12 0x000000000480b74c in github.com/pingcap/tidb/server.(*clientConn).handleQuery (cc=0x40117c2c00, ctx=..., sql=..., err=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/server/conn.go:1784
#13 0x00000000048081f8 in github.com/pingcap/tidb/server.(*clientConn).dispatch (cc=0x40117c2c00,
    ctx=<error reading variable: access outside bounds of object referenced via synthetic pointer>, data=..., ~r0=..., ~r0=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/server/conn.go:1271
#14 0x0000000004805948 in github.com/pingcap/tidb/server.(*clientConn).Run (cc=0x40117c2c00, ctx=...)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/server/conn.go:1050
#15 0x0000000004834bfc in github.com/pingcap/tidb/server.(*Server).onConn (s=0x4000dfd000, conn=0x40117c2c00)
    at /home/tidb/go_projects/src/github.com/tidb/tidb/server/server.go:662
#16 0x00000000048335ec in github.com/pingcap/tidb/server.(*Server).startNetworkListener.func2 () at /home/tidb/go_projects/src/github.com/tidb/tidb/server/server.go:478
#17 0x0000000001bd5d94 in runtime.goexit () at /usr/local/go/src/runtime/asm_arm64.s:1197

4. What is your TiDB version? (Required)

+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| tidb_version() |
+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Release Version: v7.3.0
Edition: Community
Git Commit Hash: 40b72e7
Git Branch: HEAD
UTC Build Time: 2023-08-14 16:03:07
GoVersion: go1.21.0
Race Enabled: false
Check Table Before Drop: false
Store: unistore |
+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

@SteveLeungYL SteveLeungYL added the type/bug The issue is confirmed as a bug. label Aug 14, 2023
@ti-chi-bot ti-chi-bot bot added may-affects-5.2 This bug maybe affects 5.2.x versions. may-affects-5.3 This bug maybe affects 5.3.x versions. may-affects-5.4 This bug maybe affects 5.4.x versions. may-affects-6.1 may-affects-6.5 may-affects-7.1 labels Aug 14, 2023
@winoros winoros added affects-6.5 affects-7.1 and removed may-affects-5.2 This bug maybe affects 5.2.x versions. may-affects-5.3 This bug maybe affects 5.3.x versions. may-affects-5.4 This bug maybe affects 5.4.x versions. may-affects-6.1 may-affects-6.5 may-affects-7.1 labels Aug 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants