Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-22744

*SAN: sql/item_xmlfunc.cc:791:43: runtime error: downcast of address ... which does not point to an object of type 'Item_func' note: object is of type 'Item_bool' (on optimized builds)

Details

    Description

      10.5.4>SELECT extractValue('<a>a</a>', '/a[true()]');
      +----------------------------------------+
      | extractValue('<a>a</a>', '/a[true()]') |
      +----------------------------------------+
      | a                                      |
      +----------------------------------------+
      1 row in set (0.003 sec)
      

      Leads to:

      10.5.4 c2a929185c147fc85bbf91e2c537bcdd98f2e680

      /test/10.5_opt/sql/item_xmlfunc.cc:791:43: runtime error: downcast of address 0x62b000087538 which does not point to an object of type 'Item_func'
      0x62b000087538: note: object is of type 'Item_bool'
       00 00 00 00  e8 5d 59 0a f0 55 00 00  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  a0 71 41 10
                    ^~~~~~~~~~~~~~~~~~~~~~~
                    vptr for 'Item_bool'
      

      Setup:

      Compiled with GCC >=7.5.0 and:
          -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF
      Set before execution:
          export ASAN_OPTIONS=quarantine_size_mb=512:atexit=true:detect_invalid_pointer_pairs=1:dump_instruction_bytes=true:abort_on_error=1
      

      Bug confirmed present in:
      MariaDB: 10.4.14 (dbg), 10.4.14 (opt), 10.5.4 (dbg), 10.5.4 (opt)

      Attachments

        Activity

          bar Alexander Barkov added a comment - - edited

          For some reasons this problem is not always repeatable in ASAN builds for versions before 10.5.
          But tracing in gdb shows the problem:

          797	String *Item_nodeset_func_predicate::val_nodeset(String *str)
          798	{
          799	  Item_nodeset_func *nodeset_func= (Item_nodeset_func*) args[0];
          800	  Item_func *comp_func= (Item_func*)args[1];
          801	  uint pos= 0, size;
          802	  prepare(str);
          803	  size= fltend - fltbeg;
          804	  for (MY_XPATH_FLT *flt= fltbeg; flt < fltend; flt++)
          (gdb) p args[1]
          $2 = (Item_bool *) 0x7fff98008580
          

          bar Alexander Barkov added a comment - - edited For some reasons this problem is not always repeatable in ASAN builds for versions before 10.5. But tracing in gdb shows the problem: 797 String *Item_nodeset_func_predicate::val_nodeset(String *str) 798 { 799 Item_nodeset_func *nodeset_func= (Item_nodeset_func*) args[0]; 800 Item_func *comp_func= (Item_func*)args[1]; 801 uint pos= 0, size; 802 prepare(str); 803 size= fltend - fltbeg; 804 for (MY_XPATH_FLT *flt= fltbeg; flt < fltend; flt++) (gdb) p args[1] $2 = (Item_bool *) 0x7fff98008580
          Roel Roel Van de Paar added a comment - - edited

          Confirmed fixed in 10.5.4 with proposed patch! Indeed not reproducible 10.1-10.3. Thanks

          Roel Roel Van de Paar added a comment - - edited Confirmed fixed in 10.5.4 with proposed patch! Indeed not reproducible 10.1-10.3. Thanks

          People

            bar Alexander Barkov
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.