[Bug]: CRASH ERROR in oceanbase::sql::ObSqlBitSet<96l, oceanbase::sql::ObExprInfoFlag, true>::has_member(long)

Describe the bug
build master branch with sanity, client lost connection after executing a SQL.

Environment

• OS Version and CPU Arch(uname -a):

Linux c0c380f80f1a 6.5.0-44-generic #44~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Jun 18 14:36:16 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

• OB Version(LD_LIBRARY_PATH=../lib:$LD_LIBRARY_PATH ./observer -V):

observer (OceanBase_CE 4.3.3.0)

REVISION: 1-77368f00e6612c47702fddfb6217f0cf864fb0a8
BUILD_BRANCH: master
BUILD_TIME: Sep 18 2024 12:38:51
BUILD_FLAGS: RelWithDebInfo|Sanity
BUILD_INFO: 

Copyright (c) 2011-present OceanBase Inc.

Fast Reproduce Steps(Required)

1. Execute init.sql.txt
   init.sql.txt

2. Execute error.sql.txt
   error.sql.txt

Expected behavior
no crash

Actual Behavior

CRASH ERROR!!! IP=7fe01deae9fc, RBP=1ad05, sig=6, sig_code=-6, sig_addr=0x1aa53, RLIMIT_CORE=unlimited, timestamp=1726742569336370, tid=109829, tname=T1002_L0_G0, trace_id=Y27110A000A0B-000622769B605B76-0-0, extra_info=(), lbt=0x3de4e858 0x3ddb8177 0x7fe01de5a51f 0x7fe01deae9fc 0x7fe01de5a475 0x7fe01de407f2 0xa0956de 0xc582044 0x1f60cbd2 0x1f4a9f27 0x1f4a9d86 0x1f4a9d86 0x1f4a5a43 0x1f4a645b 0x1f88e008 0x19a94a7d 0x19a91072 0x19b55221 0x1d95f14c 0x1d95e4be 0x19ad7bc8 0x1968524d 0x1966c570 0x196693ec 0x19a91993 0x19b55221 0x1d95f14c 0x1d95e4be 0x19ad7bc8 0x19ad5a60 0x19b77936 0x19b5c15e 0x1d8df413 0x1d913436 0x1d95f15b 0x1d95e4be 0x19ad7bc8 0x1968524d 0x1966c570 0x196693ec 0x19a91993 0x19b55221 0x1d95f14c 0x1d95e4be 0x19ad7bc8 0, SQL_ID=D2B3E062734DC9254A253B8FC7D94A41, SQL_STRING=...

symbolized output:

$ llvm-addr2line-18 -Cfpe /data/db/vendor/ob/ob_fork/build_sanity/src/observer/observer 0xa0956de 0xc582044 0x1f60cbd2 0x1f4a9f27 0x1f4a9d86 0x1f4a9d86 0x1f4a5a43 0x1f4a645b 0x1f88e008 0x19a94a7d 0x19a91072 0x19b55221 0x1d95f14c 0x1d95e4be 0x19ad7bc8 0x1968524d 0x1966c570 0x196693ec 0x19a91993 0x19b55221 0x1d95f14c 0x1d95e4be 0x19ad7bc8 0x19ad5a60 0x19b77936 0x19b5c15e 0x1d8df413 0x1d913436 0x1d95f15b 0x1d95e4be 0x19ad7bc8 0x1968524d 0x1966c570 0x196693ec 0x19a91993 0x19b55221 0x1d95f14c 0x1d95e4be 0x19ad7bc8

memory_sanity_abort at ./build_sanity/deps/oblib/src/lib/./deps/oblib/src/lib/alloc/memory_sanity.cpp:0
oceanbase::sql::ObSqlBitSet<96l, oceanbase::sql::ObExprInfoFlag, true>::has_member(long) const at ./build_sanity/src/rootserver/./src/sql/resolver/expr/ob_raw_expr.h:440 (discriminator 36)
oceanbase::sql::ObRawExpr::has_flag(oceanbase::sql::ObExprInfoFlag) const at ./build_sanity/src/sql/./src/sql/resolver/expr/ob_raw_expr.h:2197
oceanbase::sql::ObRawExpr::postorder_accept(oceanbase::sql::ObRawExprVisitor&) at ./build_sanity/src/sql/./src/sql/resolver/expr/ob_raw_expr.cpp:570 (discriminator 52)
oceanbase::sql::ObRawExpr::postorder_accept(oceanbase::sql::ObRawExprVisitor&) at ./build_sanity/src/sql/./src/sql/resolver/expr/ob_raw_expr.cpp:562 (discriminator 8)
oceanbase::sql::ObRawExpr::postorder_accept(oceanbase::sql::ObRawExprVisitor&) at ./build_sanity/src/sql/./src/sql/resolver/expr/ob_raw_expr.cpp:562 (discriminator 8)
oceanbase::sql::ObRawExprInfoExtractor::analyze(oceanbase::sql::ObRawExpr&) at ./build_sanity/src/sql/./src/sql/resolver/expr/ob_raw_expr_info_extractor.cpp:23
oceanbase::sql::ObRawExpr::formalize(oceanbase::sql::ObSQLSessionInfo const*, bool, oceanbase::sql::ObLocalSessionVar const*, long) at ./build_sanity/src/sql/./src/sql/resolver/expr/ob_raw_expr.cpp:477 (discriminator 2)
oceanbase::sql::ObRawExpr::formalize(oceanbase::sql::ObSQLSessionInfo const*, bool) at ./build_sanity/src/sql/./src/sql/resolver/expr/ob_raw_expr.cpp:459
oceanbase::sql::ObLogPlan::pre_process_quals(oceanbase::common::ObIArray<oceanbase::sql::TableItem*> const&, oceanbase::common::ObIArray<oceanbase::sql::SemiInfo*> const&, oceanbase::common::ObIArray<oceanbase::sql::ObRawExpr*>&) at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:480 (discriminator 30)
oceanbase::sql::ObLogPlan::generate_join_orders() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:294 (discriminator 2)
oceanbase::sql::ObLogPlan::generate_plan_tree() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:6319
oceanbase::sql::ObSelectLogPlan::generate_raw_plan_for_plain_select() at ./build_sanity/src/sql/./src/sql/optimizer/ob_select_log_plan.cpp:4407 (discriminator 52)
oceanbase::sql::ObSelectLogPlan::generate_normal_raw_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_select_log_plan.cpp:4323 (discriminator 6)
oceanbase::sql::ObLogPlan::generate_raw_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:10443 (discriminator 54)
oceanbase::sql::ObJoinOrder::generate_subquery_paths(oceanbase::sql::ObJoinOrder::PathHelper&) at ./build_sanity/src/sql/./src/sql/optimizer/ob_join_order.cpp:8659
oceanbase::sql::ObJoinOrder::generate_normal_subquery_paths() at ./build_sanity/src/sql/./src/sql/optimizer/ob_join_order.cpp:8623 (discriminator 2)
oceanbase::sql::ObJoinOrder::generate_base_paths() at ./build_sanity/src/sql/./src/sql/optimizer/ob_join_order.cpp:7904
oceanbase::sql::ObLogPlan::generate_join_orders() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:346 (discriminator 30)
oceanbase::sql::ObLogPlan::generate_plan_tree() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:6319
oceanbase::sql::ObSelectLogPlan::generate_raw_plan_for_plain_select() at ./build_sanity/src/sql/./src/sql/optimizer/ob_select_log_plan.cpp:4407 (discriminator 52)
oceanbase::sql::ObSelectLogPlan::generate_normal_raw_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_select_log_plan.cpp:4323 (discriminator 6)
oceanbase::sql::ObLogPlan::generate_raw_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:10443 (discriminator 54)
oceanbase::sql::ObLogPlan::generate_subplan_for_query_ref(oceanbase::sql::ObQueryRefRawExpr*, oceanbase::sql::SubPlanInfo*&) at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:2485 (discriminator 8)
oceanbase::sql::ObLogPlan::generate_subplan_filter_info(oceanbase::common::ObIArray<oceanbase::sql::ObRawExpr*> const&, oceanbase::common::ObIArray<oceanbase::sql::ObLogPlan*>&, oceanbase::common::ObIArray<oceanbase::sql::ObQueryRefRawExpr*>&, oceanbase::common::ObIArray<oceanbase::sql::ObExecParamRawExpr*>&, oceanbase::common::ObIArray<oceanbase::sql::ObExecParamRawExpr*>&, oceanbase::common::ObBitSet<256l, oceanbase::common::ModulePageAllocator, false>&, oceanbase::common::ObBitSet<256l, oceanbase::common::ModulePageAllocator, false>&, bool&, bool) at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:8118 (discriminator 28)
oceanbase::sql::ObLogPlan::candi_allocate_subplan_filter(oceanbase::common::ObIArray<oceanbase::sql::ObRawExpr*> const&, oceanbase::common::ObIArray<oceanbase::sql::ObRawExpr*> const*, bool, bool) at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:7750 (discriminator 2)
oceanbase::sql::ObSelectLogPlan::candi_allocate_group_by() at ./build_sanity/src/sql/./src/sql/optimizer/ob_select_log_plan.cpp:95 (discriminator 2)
oceanbase::sql::ObSelectLogPlan::allocate_plan_top() at ./build_sanity/src/sql/./src/sql/optimizer/ob_select_log_plan.cpp:4469
oceanbase::sql::ObSelectLogPlan::generate_raw_plan_for_plain_select() at ./build_sanity/src/sql/./src/sql/optimizer/ob_select_log_plan.cpp:4409 (discriminator 2)
oceanbase::sql::ObSelectLogPlan::generate_normal_raw_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_select_log_plan.cpp:4323 (discriminator 6)
oceanbase::sql::ObLogPlan::generate_raw_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:10443 (discriminator 54)
oceanbase::sql::ObJoinOrder::generate_subquery_paths(oceanbase::sql::ObJoinOrder::PathHelper&) at ./build_sanity/src/sql/./src/sql/optimizer/ob_join_order.cpp:8659
oceanbase::sql::ObJoinOrder::generate_normal_subquery_paths() at ./build_sanity/src/sql/./src/sql/optimizer/ob_join_order.cpp:8623 (discriminator 2)
oceanbase::sql::ObJoinOrder::generate_base_paths() at ./build_sanity/src/sql/./src/sql/optimizer/ob_join_order.cpp:7904
oceanbase::sql::ObLogPlan::generate_join_orders() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:346 (discriminator 30)
oceanbase::sql::ObLogPlan::generate_plan_tree() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:6319
oceanbase::sql::ObSelectLogPlan::generate_raw_plan_for_plain_select() at ./build_sanity/src/sql/./src/sql/optimizer/ob_select_log_plan.cpp:4407 (discriminator 52)
oceanbase::sql::ObSelectLogPlan::generate_normal_raw_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_select_log_plan.cpp:4323 (discriminator 6)
oceanbase::sql::ObLogPlan::generate_raw_plan() at ./build_sanity/src/sql/./src/sql/optimizer/ob_log_plan.cpp:10443 (discriminator 54)

Additional context
when using MySQL shell, if failed to reproduce, execute this before error.sql:

set collation_connection='latin1_bin';

tenant config

CREATE RESOURCE UNIT 4c7g MAX_CPU 4, MIN_CPU 4, MEMORY_SIZE '7G';
create resource pool pool_test unit='4c7g', unit_num=1, zone_list=('zone1' ,'zone2', 'zone3');
create tenant test resource_pool_list=('pool_test'), primary_zone='RANDOM',comment 'test tenant', charset='utf8' set ob_tcp_invited_nodes='%', recyclebin=OFF;

deploy config

user:
  username: root
  key_file: private_key
oceanbase-ce:
  servers:
    - name: server1
      ip: 10.0.10.11
    - name: server2
      ip: 10.0.10.12
    - name: server3
      ip: 10.0.10.13
  server1:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer1
    zone: zone1
  server2:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer2
    zone: zone2
  server3:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer3
    zone: zone3
  tag: latest
  include: obd/observer.include.yaml
  global: 
    # for default system config used by farm, please see tools/deploy/obd/observer.include.yaml
    # You can also specify the configuration directly below (stored locally, switching the working directory and redeploying will still take effect)
    production_mode: false
    devname: eth0
    syslog_level: 'WARN'
    syslog_io_bandwidth_limit: '30M'
    log_disk_size: '40G'
    # diag_syslog_per_error_limit: '4'
    max_syslog_file_count: '4'
    cpu_count: '6'
    datafile_size: '10G'
    datafile_next: '5G'
    datafile_maxsize: '30G'
    root_password: ''
    memory_limit: '9G'
    system_memory: '1G'
obproxy-ce:
  servers:
    - 10.0.10.8
  global:
    listen_port: 10004
    prometheus_listen_port: 10005
    syslog_level: 'WARN'
    home_path: /root/data/obproxy
    root_password: ''
  include: obd/obproxy.include.yaml
  depends:
    - oceanbase-ce

about us

We are the BASS team from the School of Cyber Science and Technology at Beihang University. Our main focus is on system software security, operating systems, and program analysis research, as well as the development of automated program testing frameworks for detecting software defects. Using our self-developed database vulnerability testing tool, we have identified the potential vulnerabilities.

Start by reproducing the crash with init.sql.txt and error.sql.txt, using the reported collation setting if needed. Read src/sql/resolver/expr/ob_raw_expr.h around line 440 and src/sql/resolver/expr/ob_raw_expr.cpp around lines 459-570, then follow ob_raw_expr_info_extractor.cpp and the reported optimizer entry points. Done means the supplied SQL no longer crashes the observer.