Skip to content

Conversation

@bsrikanth-mariadb
Copy link
Contributor

When the optimizer_max_sel_arg_weight is set to 1, a nested query crashed while tracing.

SEL_ARG object has a field named 'field', that is not set when the type is other than KEY_RANGE. But, the field was accessed to store its name, and weight to the trace. This resulted in a crash due to NULL pointer.

Added a check to access field if the type is KEY_RANGE, and if not, just trace the type.

@bsrikanth-mariadb bsrikanth-mariadb force-pushed the 11.4-MDEV-37510-crash_with_optimizer_max_sel_arg_weight_equal_1 branch from 426c6e5 to 6fd75f1 Compare January 1, 2026 02:21
)
)
WHERE t1.c1 NOT IN (5, 6, 7);

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't believe this is the minimal testcase.

Please try to reduce it as much as possible.

Tables need to have two records to avoid the "1-row table is const table" code path.

when one sees

CREATE TABLE t2 (c1 INT, c2 VARCHAR(10), c3 VARCHAR(10) DEFAULT NULL);

one wonders what is DEFAULT NULL there for? It's not needed in any case, please remove it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure

sql/opt_range.cc Outdated
{
obj.add("key1_field", key1->field->field_name);
obj.add("key1_weight", (longlong) key1->weight);
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please print key1_weight and key2_weight in any case.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

sql/opt_range.cc Outdated
obj.add("key2_weight", (longlong) key2->weight);
}
else
obj.add("key2_type", (uint) key2->type);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it is non-intuitive which condition the SEL_ARG with key2_type=X was made of...
But I see that SEL_ARG::part might not be set either. Ok, let's not bother and just print 'key2_type'.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am thinking to print type and weight for both key1, and key2. Additionally if key1 type is RANGE then also print the field name. What do you think?

sql/opt_range.cc Outdated
add("key1_weight", (longlong)key1->weight).
add("key2_weight", (longlong)key2->weight);

if (key1->type == SEL_ARG::KEY_RANGE && key1->field)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AFAIU we rely that key1->field is available for type=KEY_RANGE, so please leave just the KEY_RANGE check.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

When the optimizer_max_sel_arg_weight is set to 1, a nested query
crashed while tracing.

SEL_ARG object has a field named 'field', that is not set when the
type is other than KEY_RANGE. But, the field was accessed to store
its name, and weight to the trace. This resulted in a crash due to NULL
pointer.

Added a check to access field if the type is KEY_RANGE, and if not, just
trace the type.
@bsrikanth-mariadb bsrikanth-mariadb force-pushed the 11.4-MDEV-37510-crash_with_optimizer_max_sel_arg_weight_equal_1 branch from 6fd75f1 to d16b655 Compare January 8, 2026 13:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

4 participants