Skip to content
/ server Public

MDEV-37510: crash when tracing with max_sel_arg_weight equal to 1#4505

Merged
bsrikanth-mariadb merged 1 commit into11.4from
11.4-MDEV-37510-crash_with_optimizer_max_sel_arg_weight_equal_1
Jan 22, 2026
Merged

MDEV-37510: crash when tracing with max_sel_arg_weight equal to 1#4505
bsrikanth-mariadb merged 1 commit into11.4from
11.4-MDEV-37510-crash_with_optimizer_max_sel_arg_weight_equal_1

Conversation

@bsrikanth-mariadb
Copy link
Contributor

When the optimizer_max_sel_arg_weight is set to 1, a nested query crashed while tracing.

SEL_ARG object has a field named 'field', that is not set when the type is other than KEY_RANGE. But, the field was accessed to store its name, and weight to the trace. This resulted in a crash due to NULL pointer.

Added a check to access field if the type is KEY_RANGE, and if not, just trace the type.

@bsrikanth-mariadb bsrikanth-mariadb force-pushed the 11.4-MDEV-37510-crash_with_optimizer_max_sel_arg_weight_equal_1 branch from 426c6e5 to 6fd75f1 Compare January 1, 2026 02:21
)
)
WHERE t1.c1 NOT IN (5, 6, 7);

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't believe this is the minimal testcase.

Please try to reduce it as much as possible.

Tables need to have two records to avoid the "1-row table is const table" code path.

when one sees

CREATE TABLE t2 (c1 INT, c2 VARCHAR(10), c3 VARCHAR(10) DEFAULT NULL);

one wonders what is DEFAULT NULL there for? It's not needed in any case, please remove it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I just took the above query and removed things that were irrelevant.

Please verify that the below still crashes and if yes , use it:

select * from
t1
JOIN
(
  SELECT c1, c2, c3 FROM t2
  UNION
  SELECT c1, c2, c3 FROM t2
) dt1
ON ((t1.c1 = dt1.c1 OR dt1.c1 IS NULL) AND
    (t1.c2 = dt1.c2 OR dt1.c3 IS NULL));

Copy link
Contributor Author

@bsrikanth-mariadb bsrikanth-mariadb Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, it crashes. So, using it.

sql/opt_range.cc Outdated
{
obj.add("key1_field", key1->field->field_name);
obj.add("key1_weight", (longlong) key1->weight);
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please print key1_weight and key2_weight in any case.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

obj.add("key2_weight", (longlong) key2->weight);
}
else
obj.add("key2_type", (uint) key2->type);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it is non-intuitive which condition the SEL_ARG with key2_type=X was made of...
But I see that SEL_ARG::part might not be set either. Ok, let's not bother and just print 'key2_type'.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am thinking to print type and weight for both key1, and key2. Additionally if key1 type is RANGE then also print the field name. What do you think?

@bsrikanth-mariadb bsrikanth-mariadb force-pushed the 11.4-MDEV-37510-crash_with_optimizer_max_sel_arg_weight_equal_1 branch from 6fd75f1 to d16b655 Compare January 8, 2026 13:22
)
)
WHERE t1.c1 NOT IN (5, 6, 7);

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I just took the above query and removed things that were irrelevant.

Please verify that the below still crashes and if yes , use it:

select * from
t1
JOIN
(
  SELECT c1, c2, c3 FROM t2
  UNION
  SELECT c1, c2, c3 FROM t2
) dt1
ON ((t1.c1 = dt1.c1 OR dt1.c1 IS NULL) AND
    (t1.c2 = dt1.c2 OR dt1.c3 IS NULL));

@bsrikanth-mariadb bsrikanth-mariadb force-pushed the 11.4-MDEV-37510-crash_with_optimizer_max_sel_arg_weight_equal_1 branch 2 times, most recently from ebb86bf to cc2cc8e Compare January 22, 2026 11:31
@spetrunia
Copy link
Member

Hmm

                "key1_type": 2,
                "key2_type": 3,

looks very suspicious.

Copy link
Member

@spetrunia spetrunia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is because

      if (key1->type == SEL_ARG::KEY_RANGE)
        obj.add("key1_field", key1->field->field_name);
      else
        obj.add("key1_type", (uint) key1->type);

      if (key1->type == SEL_ARG::KEY_RANGE) /// <<-- why key1->type?   key2->type !
        obj.add("key2_field", key2->field->field_name);
      else
        obj.add("key2_type", (uint) key2->type);
        

When the optimizer_max_sel_arg_weight is set to 1, a nested query
crashed while tracing.

SEL_ARG object has a field named 'field', that is not set when the
type is other than KEY_RANGE. But, the field was accessed to store
its name, and weight to the trace. This resulted in a crash due to NULL
pointer.

Added a check to access field if the type is KEY_RANGE, and if not, just
trace the type.
@bsrikanth-mariadb bsrikanth-mariadb force-pushed the 11.4-MDEV-37510-crash_with_optimizer_max_sel_arg_weight_equal_1 branch from cc2cc8e to be4e1ec Compare January 22, 2026 12:28
Copy link
Member

@spetrunia spetrunia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks ok now

@bsrikanth-mariadb bsrikanth-mariadb merged commit be4e1ec into 11.4 Jan 22, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

3 participants