Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tidb panic:invalid memory address or nil pointer dereference #30426

Closed
vivid392845427 opened this issue Dec 6, 2021 · 5 comments
Closed

tidb panic:invalid memory address or nil pointer dereference #30426

vivid392845427 opened this issue Dec 6, 2021 · 5 comments
Assignees
Labels
affects-5.1 This bug affects 5.1.x versions. affects-5.2 This bug affects 5.2.x versions. affects-5.3 This bug affects 5.3.x versions. severity/major sig/execution SIG execution type/bug The issue is confirmed as a bug.

Comments

@vivid392845427
Copy link

vivid392845427 commented Dec 6, 2021

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

#30412
another scenario:

tiup playground --db.binpath /path/to/latest/tidb-server &
mysql -u root -P4000 -h127.0.0.1

create database testdb;
use testdb;
CREATE TABLE `t_rxrf9c` (
  `c_u3bwg` int(11) NOT NULL,
  `c_a_p8b` int(11) DEFAULT NULL,
  `c_09ew1d` double NOT NULL,
  `c_wylqr` int(11) DEFAULT NULL,
  PRIMARY KEY (`c_09ew1d`,`c_u3bwg`) /*T![clustered_index] NONCLUSTERED */
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin;

INSERT INTO `t_rxrf9c` VALUES (6,24,53.56,59);

 CREATE TABLE `t_xkzvqb` (
  `c_0q_i3b` int(11) DEFAULT NULL,
  `c__ckpid` int(11) DEFAULT NULL,
  `c_s4e7jc` double DEFAULT NULL,
  `c_k_dsxd` text DEFAULT NULL,
  `c_ofdx2c` double NOT NULL,
  `c__9zs7d` int(11) DEFAULT NULL,
  PRIMARY KEY (`c_ofdx2c`) /*T![clustered_index] NONCLUSTERED */
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin;

INSERT INTO `t_xkzvqb` VALUES (36,59,3.26,'li53c',83.25,6);

CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`%` SQL SECURITY DEFINER VIEW `t_f32hfd` (`c0`, `c1`, `c2`, `c3`, `c4`, `c5`, `c7`) AS SELECT DISTINCT `ref_2`.`c_wylqr` AS `c0`,`subq_0`.`c5` AS `c1`,CUME_DIST() OVER (PARTITION BY `ref_1`.`c__9zs7d` ORDER BY `subq_0`.`c1`,`ref_1`.`c__9zs7d`) AS `c2`,`subq_0`.`c1` AS `c3`,CASE WHEN `subq_1`.`c2` NOT LIKE _UTF8MB4'nf%zyd' THEN (_UTF8MB4'6ddkrb' OR `ref_1`.`c_k_dsxd`) ELSE `subq_1`.`c2` END AS `c4`,NULLIF(CASE WHEN `subq_0`.`c1`>=`subq_1`.`c4` THEN `subq_1`.`c1` ELSE `subq_1`.`c5` END, `subq_1`.`c3`) AS `c5`,(`ref_1`.`c__ckpid`*COALESCE(`ref_1`.`c__ckpid`, `ref_1`.`c__ckpid`)) AS `c7` FROM ((SELECT `ref_0`.`c_09ew1d` AS `c0`,`ref_0`.`c_u3bwg` AS `c1`,`ref_0`.`c_09ew1d` AS `c2`,`ref_0`.`c_09ew1d` AS `c3`,`ref_0`.`c_u3bwg` AS `c4`,`ref_0`.`c_a_p8b` AS `c5` FROM `testdb`.`t_rxrf9c` AS `ref_0` WHERE (`ref_0`.`c_wylqr`!=`ref_0`.`c_u3bwg`) OR (`ref_0`.`c_a_p8b`>`ref_0`.`c_a_p8b`)) AS `subq_0` JOIN `testdb`.`t_xkzvqb` AS `ref_1`) JOIN (`testdb`.`t_rxrf9c` AS `ref_2` LEFT JOIN (SELECT `ref_3`.`c_0q_i3b` AS `c0`,`ref_3`.`c__ckpid` AS `c1`,`ref_3`.`c_k_dsxd` AS `c2`,`ref_3`.`c_0q_i3b` AS `c3`,`ref_3`.`c_0q_i3b` AS `c4`,`ref_3`.`c__9zs7d` AS `c5`,`ref_3`.`c_ofdx2c` AS `c6` FROM `testdb`.`t_xkzvqb` AS `ref_3` WHERE `ref_3`.`c_0q_i3b` BETWEEN `ref_3`.`c__9zs7d` AND `ref_3`.`c__ckpid`) AS `subq_1` ON (`ref_2`.`c_wylqr`=`subq_1`.`c0`)) ON (`ref_1`.`c_0q_i3b`=`ref_2`.`c_u3bwg`) WHERE (`ref_1`.`c_k_dsxd` OR `ref_1`.`c_k_dsxd`) LIKE _UTF8MB4'3x__';

analyze table t_rxrf9c,t_xkzvqb;
insert into t_rxrf9c values (41, case when EXISTS (     select distinct         ref_0.c2 as c2       from         t_f32hfd as ref_0       ) then 1 else 0 end   , 74.4, 31); 

2. What did you expect to see? (Required)

insert success

3. What did you see instead (Required)

mysql> insert into t_rxrf9c values (41, case when EXISTS (     select distinct         ref_0.c2 as c2       from         t_f32hfd as ref_0       ) then 1 else 0 end   , 74.4, 31);
ERROR 1105 (HY000): runtime error: invalid memory address or nil pointer dereference

tidb log:
[2021/12/06 03:17:45.162 +00:00] [ERROR] [conn.go:1019] ["connection running loop panic"] [conn=757] [lastSQL="insert into t_rxrf9c values\n(41, case when EXISTS (\n    select distinct\n        ref_0.c2 as c2\n      from\n        t_f32hfd as ref_0\n      ) then 1 else 0 end\n  , 74.4, 31)"] [err="runtime error: invalid memory address or nil pointer dereference"] [stack="goroutine 39615 [running]:\ngithub.com/pingcap/tidb/server.(*clientConn).Run.func1(0x42cd870, 0xc001f11ef0, 0xc00138b2c0)\n\t/home/gopath/src/github.com/pingcap/tidb/server/conn.go:1017 +0xf5\npanic(0x3911da0, 0x5a4b580)\n\t/usr/local/go/src/runtime/panic.go:965 +0x1b9\ngithub.com/pingcap/tidb/util/chunk.(*Chunk).NumRows(...)\n\t/home/gopath/src/github.com/pingcap/tidb/util/chunk/chunk.go:335\ngithub.com/pingcap/tidb/executor.(*vecGroupChecker).splitIntoGroups(0xc00220b950, 0x0, 0x427a340, 0xc00296b6f8, 0x427a340)\n\t/home/gopath/src/github.com/pingcap/tidb/executor/aggregate.go:1457 +0x37\ngithub.com/pingcap/tidb/executor.(*PipelinedWindowExec).getRowsInPartition(0xc00083bd40, 0x42cd870, 0xc002de7530, 0x0, 0x0)\n\t/home/gopath/src/github.com/pingcap/tidb/executor/pipelined_window.go:189 +0x2b2\ngithub.com/pingcap/tidb/executor.(*PipelinedWindowExec).Next(0xc00083bd40, 0x42cd870, 0xc002de7530, 0xc002a74410, 0x8, 0x4)\n\t/home/gopath/src/github.com/pingcap/tidb/executor/pipelined_window.go:125 +0x43c\ngithub.com/pingcap/tidb/executor.Next(0x42cd870, 0xc002de7530, 0x42d2e40, 0xc00083bd40, 0xc002a74410, 0x0, 0x0)\n\t/home/gopath/src/github.com/pingcap/tidb/executor/executor.go:286 +0x2de\ngithub.com/pingcap/tidb/executor.init.2.func1(0x42cd870, 0xc002de7530, 0x43115f0, 0xc000d9aee0, 0x430d178, 0xc00125c930, 0x4318178, 0xc002d48800, 0x0, 0x0, ...)\n\t/home/gopath/src/github.com/pingcap/tidb/executor/executor.go:1213 +0x509\ngithub.com/pingcap/tidb/planner/core.(*expressionRewriter).handleExistSubquery(0xc00297dee0, 0x42cd870, 0xc002de7530, 0xc002d719e0, 0x0, 0x0, 0x7f08d80ece00)\n\t/home/gopath/src/github.com/pingcap/tidb/planner/core/expression_rewriter.go:817 +0x9ae\ngithub.com/pingcap/tidb/planner/core.(*expressionRewriter).Enter(0xc00297dee0, 0x42e55e0, 0xc002d719e0, 0xc00211bd08, 0x8, 0x8)\n\t/home/gopath/src/github.com/pingcap/tidb/planner/core/expression_rewriter.go:373 +0x908\ngithub.com/pingcap/tidb/parser/ast.(*ExistsSubqueryExpr).Accept(0xc002d719e0, 0x42a91f8, 0xc00297dee0, 0x42e7098, 0xc002836380, 0xc00211bd00)\n\t/home/gopath/src/github.com/pingcap/tidb/parser/ast/expressions.go:669 +0x4b\ngithub.com/pingcap/tidb/parser/ast.(*WhenClause).Accept(0xc002836380, 0x42a91f8, 0xc00297dee0, 0x42e4b30, 0xc00243dce0, 0xc00211bd00)\n\t/home/gopath/src/github.com/pingcap/tidb/parser/ast/expressions.go:256 +0xa2\ngithub.com/pingcap/tidb/parser/ast.(*CaseExpr).Accept(0xc00243dce0, 0x42a91f8, 0xc00297dee0, 0x4315038, 0xc00297de10, 0xc001b61a28)\n\t/home/gopath/src/github.com/pingcap/tidb/parser/ast/expressions.go:345 +0xf2\ngithub.com/pingcap/tidb/planner/core.(*PlanBuilder).rewriteExprNode(0xc000716000, 0xc00297dee0, 0x42fd2f8, 0xc00243dce0, 0xc00297de01, 0x0, 0x0, 0x0, 0x0, 0x0, ...)\n\t/home/gopath/src/github.com/pingcap/tidb/planner/core/expression_rewriter.go:199 +0x9c\ngithub.com/pingcap/tidb/planner/core.(*PlanBuilder).rewriteWithPreprocess(0xc000716000, 0x42cd870, 0xc002de7530, 0x42fd2f8, 0xc00243dce0, 0x4315038, 0xc00297de10, 0x0, 0x0, 0x1, ...)\n\t/home/gopath/src/github.com/pingcap/tidb/planner/core/expression_rewriter.go:145 +0x14c\ngithub.com/pingcap/tidb/planner/core.(*PlanBuilder).buildValuesListOfInsert(0xc000716000, 0x42cd870, 0xc002de7530, 0xc00297dc70, 0xc0024c3e00, 0xc00297de10, 0xc00281f370, 0x0, 0x0)\n\t/home/gopath/src/github.com/pingcap/tidb/planner/core/planbuilder.go:3315 +0xa8d\ngithub.com/pingcap/tidb/planner/core.(*PlanBuilder).buildInsert(0xc000716000, 0x42cd870, 0xc002de7530, 0xc00297dc70, 0xc00967fd16, 0x967fd1600000002, 0x61ad80d9, 0xc001b621d0)\n\t/home/gopath/src/github.com/pingcap/tidb/planner/core/planbuilder.go:3075 +0x918\ngithub.com/pingcap/tidb/planner/core.(*PlanBuilder).Build(0xc000716000, 0x42cd870, 0xc002de7530, 0x42e5bc8, 0xc00297dc70, 0xc002de77d0, 0xc000716000, 0xc002cc8380, 0x1)\n\t/home/gopath/src/github.com/pingcap/tidb/planner/core/planbuilder.go:699 +0x7b6\ngithub.com/pingcap/tidb/planner.optimize(0x42cd870, 0xc002de7530, 0x4318178, 0xc002d48800, 0x42e5bc8, 0xc00297dc70, 0x430d178, 0xc00125c930, 0x0, 0x0, ...)\n\t/home/gopath/src/github.com/pingcap/tidb/planner/optimize.go:339 +0x2ba\ngithub.com/pingcap/tidb/planner.Optimize(0x42c"]

4. What is your TiDB version? (Required)


Release Version: v5.4.0-alpha-312-ge3e2e8d
Edition: Community
Git Commit Hash: e3e2e8d946f445a815b2002fa2ad9d0286c18ddb
Git Branch: master
UTC Build Time: 2021-12-06 02:28:25
GoVersion: go1.16.3
Race Enabled: false
TiKV Min Version: v3.0.0-60965b006877ca7234adaced7890d7b029ed1306
Check Table Before Drop: false
@vivid392845427 vivid392845427 added type/bug The issue is confirmed as a bug. severity/major labels Dec 6, 2021
@vivid392845427 vivid392845427 changed the title tidb panic:invalid memory address or nil pointer dereference tidb panic:invalid memory address or nil pointer dereference Dec 6, 2021
@zyguan zyguan added the sig/planner SIG: Planner label Dec 6, 2021
@zyguan
Copy link
Contributor

zyguan commented Dec 6, 2021

The complete reproduce steps:

DROP TABLE IF EXISTS `t_rxrf9c`;
CREATE TABLE `t_rxrf9c` (`c_u3bwg` int(11) NOT NULL,`c_a_p8b` int(11) DEFAULT NULL,`c_09ew1d` double NOT NULL,`c_wylqr` int(11) DEFAULT NULL,PRIMARY KEY (`c_09ew1d`,`c_u3bwg`) /*T![clustered_index] NONCLUSTERED */) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin;
INSERT INTO `t_rxrf9c` VALUES (6,24,53.56,59);

DROP TABLE IF EXISTS `t_xkzvqb`;
CREATE TABLE `t_xkzvqb` (`c_0q_i3b` int(11) DEFAULT NULL,`c__ckpid` int(11) DEFAULT NULL,`c_s4e7jc` double DEFAULT NULL,`c_k_dsxd` text DEFAULT NULL,`c_ofdx2c` double NOT NULL,`c__9zs7d` int(11) DEFAULT NULL,PRIMARY KEY (`c_ofdx2c`) /*T![clustered_index] NONCLUSTERED */) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin;
INSERT INTO `t_xkzvqb` VALUES (36,59,3.26,'li53c',83.25,6);

DROP VIEW IF EXISTS `t_f32hfd`;
CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`%` SQL SECURITY DEFINER VIEW `t_f32hfd` (`c0`, `c1`, `c2`, `c3`, `c4`, `c5`, `c7`) AS SELECT DISTINCT `ref_2`.`c_wylqr` AS `c0`,`subq_0`.`c5` AS `c1`,CUME_DIST() OVER (PARTITION BY `ref_1`.`c__9zs7d` ORDER BY `subq_0`.`c1`,`ref_1`.`c__9zs7d`) AS `c2`,`subq_0`.`c1` AS `c3`,CASE WHEN `subq_1`.`c2` NOT LIKE _UTF8MB4'nf%zyd' THEN (_UTF8MB4'6ddkrb' OR `ref_1`.`c_k_dsxd`) ELSE `subq_1`.`c2` END AS `c4`,NULLIF(CASE WHEN `subq_0`.`c1`>=`subq_1`.`c4` THEN `subq_1`.`c1` ELSE `subq_1`.`c5` END, `subq_1`.`c3`) AS `c5`,(`ref_1`.`c__ckpid`*COALESCE(`ref_1`.`c__ckpid`, `ref_1`.`c__ckpid`)) AS `c7` FROM ((SELECT `ref_0`.`c_09ew1d` AS `c0`,`ref_0`.`c_u3bwg` AS `c1`,`ref_0`.`c_09ew1d` AS `c2`,`ref_0`.`c_09ew1d` AS `c3`,`ref_0`.`c_u3bwg` AS `c4`,`ref_0`.`c_a_p8b` AS `c5` FROM `t_rxrf9c` AS `ref_0` WHERE (`ref_0`.`c_wylqr`!=`ref_0`.`c_u3bwg`) OR (`ref_0`.`c_a_p8b`>`ref_0`.`c_a_p8b`)) AS `subq_0` JOIN `t_xkzvqb` AS `ref_1`) JOIN (`t_rxrf9c` AS `ref_2` LEFT JOIN (SELECT `ref_3`.`c_0q_i3b` AS `c0`,`ref_3`.`c__ckpid` AS `c1`,`ref_3`.`c_k_dsxd` AS `c2`,`ref_3`.`c_0q_i3b` AS `c3`,`ref_3`.`c_0q_i3b` AS `c4`,`ref_3`.`c__9zs7d` AS `c5`,`ref_3`.`c_ofdx2c` AS `c6` FROM `t_xkzvqb` AS `ref_3` WHERE `ref_3`.`c_0q_i3b` BETWEEN `ref_3`.`c__9zs7d` AND `ref_3`.`c__ckpid`) AS `subq_1` ON (`ref_2`.`c_wylqr`=`subq_1`.`c0`)) ON (`ref_1`.`c_0q_i3b`=`ref_2`.`c_u3bwg`) WHERE (`ref_1`.`c_k_dsxd` OR `ref_1`.`c_k_dsxd`) LIKE _UTF8MB4'3x__';

analyze table t_xkzvqb, t_rxrf9c; -- required
insert into t_rxrf9c values (41, case when EXISTS (select distinct ref_0.c2 as c2 from t_f32hfd as ref_0) then 1 else 0 end, 74.4, 31);

and the panic stack:

github.com/pingcap/tidb/server.(*clientConn).Run.func1()
        /home/zyguan/src/pingcap/tidb/server/conn.go:1017 +0x8f
panic({0x358e000, 0x56ea4c0})
        /usr/lib/go/src/runtime/panic.go:1038 +0x215
github.com/pingcap/tidb/executor.(*vecGroupChecker).splitIntoGroups(0x3e8dde0, 0xc0023592c0)
        /home/zyguan/src/pingcap/tidb/executor/aggregate.go:1457 +0x26
github.com/pingcap/tidb/executor.(*PipelinedWindowExec).getRowsInPartition(0xc001984ea0, {0x3ede010, 0xc001d99bc0})
        /home/zyguan/src/pingcap/tidb/executor/pipelined_window.go:189 +0xaf
github.com/pingcap/tidb/executor.(*PipelinedWindowExec).Next(0xc001984ea0, {0x3ede010, 0xc001d99bc0}, 0xc001b96a50)
        /home/zyguan/src/pingcap/tidb/executor/pipelined_window.go:125 +0xce
github.com/pingcap/tidb/executor.Next({0x3ede010, 0xc001d99bc0}, {0x3ee76a0, 0xc001984ea0}, 0xc001b96a50)
        /home/zyguan/src/pingcap/tidb/executor/executor.go:286 +0x4a2
github.com/pingcap/tidb/executor.init.1.func1({0x3ede010, 0xc001d99bc0}, {0x3f51400, 0xc001153ea0}, {0x3f47b98, 0xc000cd0a10}, {0x3f5bd58, 0xc001567400})
        /home/zyguan/src/pingcap/tidb/executor/executor.go:1213 +0x645
github.com/pingcap/tidb/planner/core.(*expressionRewriter).handleExistSubquery(0xc0018788f0, {0x3ede010, 0xc001d99bc0}, 0xc00187a480)
        /home/zyguan/src/pingcap/tidb/planner/core/expression_rewriter.go:817 +0x784
github.com/pingcap/tidb/planner/core.(*expressionRewriter).Enter(0xc0018788f0, {0x3ef0958, 0xc00187a480})
        /home/zyguan/src/pingcap/tidb/planner/core/expression_rewriter.go:373 +0x591
github.com/pingcap/tidb/parser/ast.(*ExistsSubqueryExpr).Accept(0xc0018788f0, {0x3ea6c20, 0xc0018788f0})
        /home/zyguan/src/pingcap/tidb/parser/ast/expressions.go:669 +0x38
github.com/pingcap/tidb/parser/ast.(*WhenClause).Accept(0xc0018788f0, {0x3ea6c20, 0xc0018788f0})
        /home/zyguan/src/pingcap/tidb/parser/ast/expressions.go:256 +0x75
github.com/pingcap/tidb/parser/ast.(*CaseExpr).Accept(0xc001878820, {0x3ea6c20, 0xc0018788f0})
        /home/zyguan/src/pingcap/tidb/parser/ast/expressions.go:345 +0x165
github.com/pingcap/tidb/planner/core.(*PlanBuilder).rewriteExprNode(0xc00251bba0, 0xc0018788f0, {0x3f28a78, 0xc00187e160}, 0x1)
        /home/zyguan/src/pingcap/tidb/planner/core/expression_rewriter.go:199 +0x11a
github.com/pingcap/tidb/planner/core.(*PlanBuilder).rewriteWithPreprocess(0xc00251bba0, {0x3ede010, 0xc001d99bc0}, {0x3f28a78, 0xc00187e160}, {0x3f55e58, 0xc001878820}, 0x0, 0x0, 0x1, ...)
        /home/zyguan/src/pingcap/tidb/planner/core/expression_rewriter.go:145 +0x173
github.com/pingcap/tidb/planner/core.(*PlanBuilder).buildValuesListOfInsert(0xc00251bba0, {0x3ede010, 0xc001d99bc0}, 0xc001878680, 0xc002289b00, 0xc001878820, 0x0)
        /home/zyguan/src/pingcap/tidb/planner/core/planbuilder.go:3315 +0x931
github.com/pingcap/tidb/planner/core.(*PlanBuilder).buildInsert(0xc00251bba0, {0x3ede010, 0xc001d99bc0}, 0xc001878680)
        /home/zyguan/src/pingcap/tidb/planner/core/planbuilder.go:3075 +0xede
github.com/pingcap/tidb/planner/core.(*PlanBuilder).Build(0xc00251bba0, {0x3ede010, 0xc001d99bc0}, {0x3ef0f40, 0xc001878680})
        /home/zyguan/src/pingcap/tidb/planner/core/planbuilder.go:699 +0x2a5
github.com/pingcap/tidb/planner.optimize({0x3ede010, 0xc001d99bc0}, {0x3f5bd58, 0xc001567400}, {0x3ef0f40, 0xc001878680}, {0x3f47b98, 0xc000cd0a10})
        /home/zyguan/src/pingcap/tidb/planner/optimize.go:339 +0x291
github.com/pingcap/tidb/planner.Optimize({0x3ede010, 0xc001d99bc0}, {0x3f5bd58, 0xc001567400}, {0x3ef0f40, 0xc001878680}, {0x3f47b98, 0xc000cd0a10})
        /home/zyguan/src/pingcap/tidb/planner/optimize.go:222 +0x8d1
...

@yudongusa
Copy link

@AilinKid seems a similar issue to #30501 , please help to verify if this is a duplicated issue.

@AilinKid
Copy link
Contributor

@AilinKid seems a similar issue to #30501 , please help to verify if this is a duplicated issue.

seems that they are not the same problem, i will take a look

@AilinKid
Copy link
Contributor

AilinKid commented Dec 15, 2021

it has been fixed by #30418 with respect to pipeline window

@github-actions
Copy link

Please check whether the issue should be labeled with 'affects-x.y' or 'fixes-x.y.z', and then remove 'needs-more-info' label.

@winoros winoros added sig/execution SIG execution and removed sig/planner SIG: Planner labels Dec 15, 2021
@ti-chi-bot ti-chi-bot added affects-5.1 This bug affects 5.1.x versions. affects-5.2 This bug affects 5.2.x versions. affects-5.3 This bug affects 5.3.x versions. labels Jul 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
affects-5.1 This bug affects 5.1.x versions. affects-5.2 This bug affects 5.2.x versions. affects-5.3 This bug affects 5.3.x versions. severity/major sig/execution SIG execution type/bug The issue is confirmed as a bug.
Projects
None yet
Development

No branches or pull requests

7 participants