Skip to content

Fixed bug #9070 : Access violation crashes server when a partial (conditional) index with a complex predicate is present on a table under DML load - #9178

Merged
hvlad merged 4 commits into
v5.0-releasefrom
work/gh-9070
Oct 18, 2026
Merged

hvlad merged 4 commits into
v5.0-releasefrom
work/gh-9070

Conversation

@hvlad

@hvlad hvlad commented Oct 1, 2026

Copy link
Copy Markdown
Member

The problem happens when Retrieval::checkIndexCondition() calls optimizer->decomposeBoolean(idx.idx_condition) and injects new nodes into idx_condition tree (see blr_or handling branch). That new nodes created in current request pool. Preparing of next request after release of first one accesses deallocated memory and crashes the server.

…ditional) index with a complex predicate is present on a table under DML load
Comment thread src/jrd/optimizer/Optimizer.cpp Outdated
Comment thread src/jrd/optimizer/Optimizer.cpp Outdated
Comment thread src/jrd/optimizer/Optimizer.cpp Outdated
Comment thread src/jrd/optimizer/Optimizer.cpp Outdated
auto* node = static_cast<BoolExprNode*>(csb->csb_node);

Optimizer opt(tdbb, csb);
node = opt.transformBoolExpr(tdbb, node);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I fail to see the need to create an optimizer instance, as transformBoolExpr() does not seem to use any its state except csb and pool. This looks like unnecessary complication. Instead, transformBoolExpr() could be a module-static routine or even a lambda inside Optimizer::transformBoolean().

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

hvlad and others added 2 commits October 18, 2026 11:05
Co-authored-by: Dmitry Yemanov <dyemanov@users.noreply.github.com>
Comment thread src/jrd/optimizer/Optimizer.cpp Outdated
conjuncts(getPool())
{
}

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AFAIU, the new constructor is no longer needed.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, forgot to remove it.
Btw, is it correct to use csb_pool in transformBoolean() or better to use default pool (as in Optimizer() ctor) ?

@dyemanov dyemanov Oct 18, 2026 •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

During pass1/pass2 (optimization belongs to the latter) it's the same pool, AFAIR. So use whatever you like.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@hvlad
hvlad merged commit d2f417d into v5.0-release Oct 18, 2026
43 of 45 checks passed
hvlad added a commit that referenced this pull request Oct 19, 2026
Fixed bug #9070 : Access violation crashes server when a partial (conditional) index with a complex predicate is present on a table under DML load
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Access violation crashes server when a partial (conditional) index with a complex predicate is present on a table under DML load

2 participants