I'll take a look at the result and will also do some randgen testing of your
patch.  This will compare patched and unpatched servers to see if / how many
queries' result sets differ, etc.

Will update the bug as this progresses.  Thanks for the work on this.

On Fri, Jun 25, 2010 at 11:22 PM, Prafulla Tekawade <
<email address hidden>> wrote:

> Here is root cause:
> In drizzled::subselect_single_select_engine::exec,
> We invoke Join::optimize method, it correctly identifies "Impossible WHERE"
> for
> inner subquery (I guess due to "`col_char_not_null_key` IS NULL"
> predicate),
> and once it is identified, Join::optimize returns immediately. The code
> that
> is left to executed is the code that initialises the member variable such
> as
> join_tab.
> and Later in drizzled::subselect_single_select_engine::exec, when we try to
> execute the subquery, qe try access this field leading to seg fault.
>
> Solution:
> Once we have cond_value from Join::optimize, we can check if it is false
> and simply return from that point, skipping other part of
> drizzled::subselect_single_select_engine::exec.
> I've attached this patch.
>
> With this patch, query returns empty set, with warning
> drizzle> show warnings;
>
> +---------+------+---------------------------------------------------------+
> | Level   | Code | Message
> |
>
> +---------+------+---------------------------------------------------------+
> | Warning | 1292 | Truncated incorrect DOUBLE value: '2000-03-23 22:49:30'
> |
>
> +---------+------+---------------------------------------------------------+
> 1 row in set (0 sec)
>
> QA, Can you see if this is expected result ?
> Mysql QEE/Optimizer experts, can you have look at the patch and let me know
> your review comments?
>
> ** Patch added: "Fix for review"
>   http://launchpadlibrarian.net/50931620/drizzle-592473-1.patch
>
> --
> Crash/segfault in drizzled::subselect_single_select_engine::exec
> (this=0x19a7008) at drizzled/item/subselect.cc:2204
> https://bugs.launchpad.net/bugs/592473
> You received this bug notification because you are a direct subscriber
> of the bug.
>
> Status in A Lightweight SQL Database for Cloud and Web: Confirmed
>
> Bug description:
> The randgen test order_by_validator (using subquery_semijoin_drizzle.yy
> grammar) is failing due to this crash.
>
> Proper test-suite test case is coming
>
> Crashing query:
> SELECT DISTINCT MIN(DISTINCT OUTR . `col_bigint_key` ) AS X FROM AA AS OUTR
> WHERE ( OUTR . `col_bigint` , OUTR . `col_int_not_null` ) IN ( SELECT
> DISTINCT INNR . `pk` AS X , INNR . `col_int_key` AS Y FROM CC AS INNR2 LEFT
> JOIN BB AS INNR ON ( INNR2 . `col_char` <> INNR . `col_char` ) WHERE OUTR .
> `col_char_not_null_key` IS NULL  ) AND OUTR . `col_int` IS NULL XOR OUTR .
> `col_char_not_null_key` IS NOT NULL HAVING X >= '2000-03-23 22:49:30' ORDER
> BY OUTR . `col_text_not_null` , OUTR . `pk`
>
>
> Backtrace:
>
> #0  0x0000000000573628 in drizzled::subselect_single_select_engine::exec
> (this=0x19a7008) at drizzled/item/subselect.cc:2204
> #1  0x0000000000575bb8 in drizzled::Item_subselect::exec (this=0x19a6ec8)
> at drizzled/item/subselect.cc:299
> #2  drizzled::Item_in_subselect::exec (this=0x19a6ec8) at
> drizzled/item/subselect.cc:348
> #3  0x0000000000572fd7 in drizzled::Item_in_subselect::val_bool
> (this=0x19a6ec8) at drizzled/item/subselect.cc:907
> #4  0x0000000000550c8c in drizzled::Item_in_optimizer::val_int
> (this=0x1abd128) at drizzled/item/cmpfunc.cc:1597
> #5  0x000000000054901c in drizzled::Item::val_bool (this=0x1abd128) at
> drizzled/item.cc:94
> #6  0x00000000005501f9 in drizzled::Item_cond_and::val_int (this=0x19a7208)
> at drizzled/item/cmpfunc.cc:4203
> #7  0x000000000054ffad in drizzled::Item_cond_xor::val_int (this=0x1a773e0)
> at drizzled/item/cmpfunc.cc:4718
> #8  0x0000000000588584 in drizzled::evaluate_join_record (join=0x1a77b28,
> join_tab=0x1ab1b70, error=<value optimized out>) at drizzled/join.cc:2479
> #9  0x00000000006134ee in drizzled::sub_select (join=0x1a77b28,
> join_tab=0x1ab27e8, end_of_records=<value optimized out>) at
> drizzled/sql_select.cc:3564
> #10 0x00000000006185e0 in drizzled::do_select (join=0x1a77b28,
> fields=0x1a791a0, table=0x0) at drizzled/sql_select.cc:3333
> #11 0x000000000058dfbc in drizzled::Join::exec (this=0x1a77b28) at
> drizzled/join.cc:1689
> #12 0x0000000000614822 in drizzled::mysql_select (session=0x7f2eb814a090,
> rref_pointer_array=<value optimized out>, tables=0x19a5968, wild_num=0,
> fields=<value optimized out>,
>    conds=<value optimized out>, og_num=2, order=0x1a778e0, group=0x0,
> having=0x1a77658, select_options=2147500033, result=0x1a77b08,
> unit=0x7f2eb814aaf8, select_lex=0x7f2eb814ad08)
>    at drizzled/sql_select.cc:427
> #13 0x0000000000615120 in drizzled::handle_select (session=0x7f2eb814a090,
> lex=0x7f2eb814aad8, result=0x1a77b08, setup_tables_done_option=0) at
> drizzled/sql_select.cc:146
> #14 0x000000000060ecd5 in drizzled::execute_sqlcom_select
> (session=0x7f2eb814a090, all_tables=0x19a5968) at drizzled/sql_parse.cc:543
> #15 0x000000000060e94e in mysql_execute_command (session=0x7f2eb814a090,
> inBuf=<value optimized out>, length=<value optimized out>) at
> drizzled/sql_parse.cc:478
> #16 drizzled::mysql_parse (session=0x7f2eb814a090, inBuf=<value optimized
> out>, length=<value optimized out>) at drizzled/sql_parse.cc:733
> #17 0x0000000000610b12 in drizzled::dispatch_command
> (command=drizzled::COM_QUERY, session=0x7f2eb814a090, packet=0x7f2eb8125c91
> "", packet_length=<value optimized out>)
>    at drizzled/sql_parse.cc:223
> #18 0x00000000005de61f in drizzled::Session::executeStatement
> (this=0x7f2eb814a090) at drizzled/session.cc:694
> #19 0x00000000005dffe2 in drizzled::Session::run (this=0x7f2eb814a090) at
> drizzled/session.cc:553
> #20 0x00007f2ecfa39083 in MultiThreadScheduler::runSession (arg=<value
> optimized out>) at ./plugin/multi_thread/multi_thread.h:67
> #21 session_thread (arg=<value optimized out>) at
> plugin/multi_thread/multi_thread.cc:43
> #22 0x00007f2ed38c09ca in start_thread (arg=<value optimized out>) at
> pthread_create.c:300
> #23 0x00007f2ed361e6cd in clone () at
> ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
> #24 0x0000000000000000 in ?? ()
>
> To unsubscribe from this bug, go to:
> https://bugs.launchpad.net/drizzle/+bug/592473/+subscribe
>