Crash in rel_optimizer (sqlsmith)

[monetdb-team]

Date: 2017-02-19 14:26:17 +0100
From: @mlkersten
To: SQL devs <>
Version: 11.17.13 (Jan2014-SP1)
CC: @njnes

Last updated: 2017-03-31 13:28:28 +0200

Comment 25037

Date: 2017-02-19 14:26:17 +0100
From: @mlkersten

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:51.0) Gecko/20100101 Firefox/51.0
Build Identifier:

Another crash in the rel_optimizer

4126for (m = exps->h; m && !fnd; m = m->next) {

0 0x00007fab5e3c00d2 in rel_push_join_down (changes=0x7fab44ce88e8, sql=0x7fab3000d4b0, rel=0x7fab300d86c0)
at /export/scratch1/home/mk/default//package/sql/server/rel_optimizer.c:4126
1 0x00007fab5e3d372c in rewrite_topdown (sql=0x7fab3000d4b0, rel=0x7fab300d86c0, rewriter=0x7fab5e3bfe42 <rel_push_join_down>,
has_changes=0x7fab44ce88e8) at /export/scratch1/home/mk/default//package/sql/server/rel_optimizer.c:8614
2 0x00007fab5e3d380c in rewrite_topdown (sql=0x7fab3000d4b0, rel=0x7fab300dab30, rewriter=0x7fab5e3bfe42 <rel_push_join_down>,
has_changes=0x7fab44ce88e8) at /export/scratch1/home/mk/default//package/sql/server/rel_optimizer.c:8635
3 0x00007fab5e3d380c in rewrite_topdown (sql=0x7fab3000d4b0, rel=0x7fab300df9f0, rewriter=0x7fab5e3bfe42 <rel_push_join_down>,
has_changes=0x7fab44ce88e8) at /export/scratch1/home/mk/default//package/sql/server/rel_optimizer.c:8635
4 0x00007fab5e3d385f in rewrite_topdown (sql=0x7fab3000d4b0, rel=0x7fab300e03d0, rewriter=0x7fab5e3bfe42 <rel_push_join_down>,
has_changes=0x7fab44ce88e8) at /export/scratch1/home/mk/default//package/sql/server/rel_optimizer.c:8643
5 0x00007fab5e3d3e75 in _rel_optimizer (sql=0x7fab3000d4b0, rel=0x7fab300e03d0, level=0)

Reproducible: Always

Steps to Reproduce:

select
subq_0.c1 as c0,
subq_0.c2 as c1
from
(select
ref_25.name as c0,
(select sessiontimeout from sys.sessions)
as c1,
63 as c2,
ref_24.var_id as c3,
ref_25.name as c4,
(select sorted from sys.storage)
as c5
from
sys.idxs as ref_23
inner join sys.netcdf_vardim as ref_24
left join sys.db_user_info as ref_25
on (ref_24.dimpos = ref_25.default_schema )
on (ref_23.id = ref_24.var_id )
right join tmp.objects as ref_26
on (ref_25.name = ref_26.name )
where EXISTS (
select distinct
ref_27.table_id as c0
from
tmp.keys as ref_27
right join tmp.keys as ref_28
on (ref_27.type = ref_28.id )
where ref_27.type is not NULL)) as subq_0
where subq_0.c5 is NULL;

Comment 25040

Date: 2017-02-19 15:38:20 +0100
From: @mlkersten

An easier one to trigger it:

select
ref_0.system as c0,
(select value from sys.environment)
as c1
from
sys.tables as ref_0
where EXISTS (
select distinct
ref_5.id as c0,
ref_5.digits as c1,
ref_6.eclass as c2
from
sys.types as ref_5
inner join sys.types as ref_6
on (ref_5.digits = ref_6.id )
where ref_6.digits is not NULL)
limit 116;

Comment 25041

Date: 2017-02-19 16:33:35 +0100
From: MonetDB Mercurial Repository <>

Changeset de9359d0cdd4 made by Niels Nes niels@cwi.nl in the MonetDB repo, refers to this bug.

For complete details, see http//devmonetdborg/hg/MonetDB?cmd=changeset;node=de9359d0cdd4

Changeset description:

prevent crash in bug #6219 (ie be carefull with missing expression lists)

Comment 25078

Date: 2017-03-02 14:22:53 +0100
From: @njnes

solved the handling of unions