Details
-
Bug
-
Status: Closed (View Workflow)
-
Blocker
-
Resolution: Fixed
-
10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL)
Description
10.6.0 1bd4115841ecded24217e5d753ed4d9822b4cffd (Debug) |
mysqld: /test/10.6_dbg/strings/decimal.c:1540: decimal_bin_size: Assertion `scale <= precision' failed.
|
10.6.0 1bd4115841ecded24217e5d753ed4d9822b4cffd (Debug) |
Core was generated by `/test/MD010421-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
|
Program terminated with signal SIGABRT, Aborted.
|
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
|
at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
|
[Current thread is 1 (Thread 0x14e0f0930700 (LWP 3455778))]
|
(gdb) bt
|
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
|
#1 0x0000560cac9ededb in my_write_core (sig=sig@entry=6) at /test/10.6_dbg/mysys/stacktrace.c:424
|
#2 0x0000560cac18ca65 in handle_fatal_signal (sig=6) at /test/10.6_dbg/sql/signal_handler.cc:343
|
#3 <signal handler called>
|
#4 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
|
#5 0x000014e0f9d95859 in __GI_abort () at abort.c:79
|
#6 0x000014e0f9d95729 in __assert_fail_base (fmt=0x14e0f9f2b588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x560cad0c5400 "scale <= precision", file=0x560cad0c5100 "/test/10.6_dbg/strings/decimal.c", line=1540, function=<optimized out>) at assert.c:92
|
#7 0x000014e0f9da6f36 in __GI___assert_fail (assertion=assertion@entry=0x560cad0c5400 "scale <= precision", file=file@entry=0x560cad0c5100 "/test/10.6_dbg/strings/decimal.c", line=line@entry=1540, function=function@entry=0x560cad0c5560 <__PRETTY_FUNCTION__.16163> "decimal_bin_size") at assert.c:101
|
#8 0x0000560caca3adaf in decimal_bin_size (precision=precision@entry=65, scale=<optimized out>) at /test/10.6_dbg/strings/decimal.c:1540
|
#9 0x0000560cac2b9ea0 in my_decimal_get_binary_size (scale=<optimized out>, precision=65) at /test/10.6_dbg/sql/my_decimal.h:334
|
#10 Item_sum_avg::fix_length_and_dec_decimal (this=0x14e09c014e30) at /test/10.6_dbg/sql/item_sum.cc:1961
|
#11 0x0000560cac0a3e40 in Type_handler_decimal_result::Item_sum_avg_fix_length_and_dec (this=<optimized out>, item=<optimized out>) at /test/10.6_dbg/sql/sql_type.cc:4916
|
#12 0x0000560cac2b0672 in Item_sum_avg::fix_length_and_dec (this=0x14e09c014e30) at /test/10.6_dbg/sql/item.h:1099
|
#13 0x0000560cac2b717a in Item_sum_num::fix_fields (this=0x14e09c014e30, thd=0x14e09c000db8, ref=0x14e09c015080) at /test/10.6_dbg/sql/item_sum.cc:1132
|
#14 0x0000560cabe3f3f8 in Item::fix_fields_if_needed (ref=0x14e09c015080, thd=0x14e09c000db8, this=0x14e09c014e30) at /test/10.6_dbg/sql/sql_list.h:199
|
#15 Item::fix_fields_if_needed_for_scalar (ref=0x14e09c015080, thd=0x14e09c000db8, this=0x14e09c014e30) at /test/10.6_dbg/sql/item.h:992
|
#16 setup_fields (thd=0x14e09c000db8, ref_pointer_array=<optimized out>, fields=<optimized out>, column_usage=column_usage@entry=MARK_COLUMNS_READ, sum_func_list=sum_func_list@entry=0x14e09c015d98, pre_fix=0x14e09c014600, allow_sum_func=true) at /test/10.6_dbg/sql/sql_base.cc:7657
|
#17 0x0000560cabf32a2f in JOIN::prepare (this=this@entry=0x14e09c015a70, tables_init=tables_init@entry=0x0, conds_init=conds_init@entry=0x0, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x14e09c014498, unit_arg=0x14e09c004f90) at /test/10.6_dbg/sql/sql_select.cc:1245
|
#18 0x0000560cabf4bbcb in mysql_select (thd=thd@entry=0x14e09c000db8, tables=0x0, fields=@0x14e09c0145e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14e09c015078, last = 0x14e09c015078, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x14e09c015a48, unit=0x14e09c004f90, select_lex=0x14e09c014498) at /test/10.6_dbg/sql/sql_select.cc:4725
|
#19 0x0000560cabf4bf03 in handle_select (thd=thd@entry=0x14e09c000db8, lex=lex@entry=0x14e09c004ec8, result=result@entry=0x14e09c015a48, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_dbg/sql/sql_select.cc:419
|
#20 0x0000560cabebf758 in execute_sqlcom_select (thd=thd@entry=0x14e09c000db8, all_tables=0x0) at /test/10.6_dbg/sql/sql_parse.cc:6231
|
#21 0x0000560cabecc3e3 in mysql_execute_command (thd=thd@entry=0x14e09c000db8) at /test/10.6_dbg/sql/sql_parse.cc:3927
|
#22 0x0000560cabeb88d0 in mysql_parse (thd=thd@entry=0x14e09c000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14e0f092f410) at /test/10.6_dbg/sql/sql_parse.cc:8004
|
#23 0x0000560cabec74d6 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14e09c000db8, packet=packet@entry=0x14e09c00b359 "SELECT AVG(DISTINCT 0.", '0' <repeats 178 times>..., packet_length=packet_length@entry=1099, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_class.h:1331
|
#24 0x0000560cabeca8b1 in do_command (thd=0x14e09c000db8, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_parse.cc:1399
|
#25 0x0000560cac023b42 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x560caec9a538, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410
|
#26 0x0000560cac024147 in handle_one_connection (arg=arg@entry=0x560caec9a538) at /test/10.6_dbg/sql/sql_connect.cc:1312
|
#27 0x0000560cac4d0bef in pfs_spawn_thread (arg=0x560caebcbeb8) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
|
#28 0x000014e0fa2a3609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#29 0x000014e0f9e92293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
10.6.0 1bd4115841ecded24217e5d753ed4d9822b4cffd (Optimized) |
Core was generated by `/test/MD010421-mariadb-10.6.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x00005575fdbfe429 in bin2decimal (from=0x1495c4fdc040 "\200",
|
to=to@entry=0x14965c8e1130, precision=<optimized out>,
|
scale=<optimized out>) at /test/10.6_opt/strings/decimal.c:1412
|
[Current thread is 1 (Thread 0x14965c8e3700 (LWP 682880))]
|
(gdb) bt
|
#0 0x00005575fdbfe429 in bin2decimal (from=0x1495c4fdc040 "\200", to=to@entry=0x14965c8e1130, precision=<optimized out>, scale=<optimized out>) at /test/10.6_opt/strings/decimal.c:1412
|
#1 0x00005575fd6178b7 in binary2my_decimal (scale=<optimized out>, prec=<optimized out>, d=0x14965c8e1130, bin=<optimized out>, mask=30) at /test/10.6_opt/sql/my_decimal.h:349
|
#2 Field_new_decimal::val_decimal (this=<optimized out>, decimal_value=0x14965c8e1130) at /test/10.6_opt/sql/field.cc:3561
|
#3 0x00005575fd7099c4 in Item_sum_sum::add_helper (this=this@entry=0x149600011738, perform_removal=perform_removal@entry=false) at /test/10.6_opt/sql/item_sum.cc:1629
|
#4 0x00005575fd709c7f in Item_sum_sum::add (this=this@entry=0x149600011738) at /test/10.6_opt/sql/item_sum.cc:1601
|
#5 0x00005575fd709ca3 in Item_sum_avg::add (this=0x149600011738) at /test/10.6_opt/sql/item_sum.cc:2025
|
#6 0x00005575fd709d67 in Aggregator_distinct::unique_walk_function (this=0x149600012b30, element=<optimized out>) at /test/10.6_opt/sql/item_sum.cc:1763
|
#7 0x00005575fd709d83 in item_sum_distinct_walk (element=<optimized out>, num_of_dups=<optimized out>, item=<optimized out>) at /test/10.6_opt/sql/item_sum.cc:728
|
#8 0x00005575fdbb0b9a in tree_walk_left_root_right (argument=0x149600012b30, action=0x5575fd709d70 <item_sum_distinct_walk(void*, element_count, void*)>, element=<optimized out>, tree=0x149600013610) at /test/10.6_opt/mysys/tree.c:588
|
#9 tree_walk (tree=tree@entry=0x149600013610, action=action@entry=0x5575fd709d70 <item_sum_distinct_walk(void*, element_count, void*)>, argument=argument@entry=0x149600012b30, visit=visit@entry=left_root_right) at /test/10.6_opt/mysys/tree.c:576
|
#10 0x00005575fd50a7e1 in Unique::walk (this=0x1496000134e8, table=<optimized out>, action=0x5575fd709d70 <item_sum_distinct_walk(void*, element_count, void*)>, walk_action_arg=walk_action_arg@entry=0x149600012b30) at /test/10.6_opt/sql/uniques.cc:654
|
#11 0x00005575fd704093 in Aggregator_distinct::endup (this=0x149600012b30) at /test/10.6_opt/sql/item_sum.cc:1089
|
#12 Aggregator_distinct::endup (this=0x149600012b30) at /test/10.6_opt/sql/item_sum.cc:1037
|
#13 0x00005575fd704e68 in Item_sum_avg::val_str (this=0x149600011738, str=0x14965c8e14f0) at /test/10.6_opt/sql/item_sum.cc:2086
|
#14 0x00005575fd595e48 in Type_handler::Item_send_str (this=<optimized out>, item=<optimized out>, protocol=0x1496000011b8, buf=<optimized out>) at /test/10.6_opt/sql/sql_type.cc:7359
|
#15 0x00005575fd365e34 in Protocol::send_result_set_row (this=this@entry=0x1496000011b8, row_items=row_items@entry=0x149600012718) at /test/10.6_opt/sql/protocol.cc:1331
|
#16 0x00005575fd3d5027 in select_send::send_data (this=0x149600012338, items=@0x149600012718: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x149600012b20, last = 0x149600012b20, elements = 1}, <No data fields>}) at /test/10.6_opt/sql/sql_class.cc:3020
|
#17 0x00005575fd47f56c in select_result_sink::send_data_with_check (u=<optimized out>, sent=<optimized out>, items=@0x149600012718: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x149600012b20, last = 0x149600012b20, elements = 1}, <No data fields>}, this=<optimized out>) at /test/10.6_opt/sql/sql_class.h:5567
|
#18 select_result_sink::send_data_with_check (sent=<optimized out>, u=<optimized out>, items=@0x149600012718: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x149600012b20, last = 0x149600012b20, elements = 1}, <No data fields>}, this=<optimized out>) at /test/10.6_opt/sql/sql_class.h:5557
|
#19 end_send_group (join=0x149600012360, join_tab=<optimized out>, end_of_records=<optimized out>) at /test/10.6_opt/sql/sql_select.cc:22125
|
#20 0x00005575fd48f1ad in do_select (procedure=<optimized out>, join=0x149600012360) at /test/10.6_opt/sql/sql_select.cc:20263
|
#21 JOIN::exec_inner (this=0x149600012360) at /test/10.6_opt/sql/sql_select.cc:4493
|
#22 0x00005575fd48f378 in JOIN::exec (this=this@entry=0x149600012360) at /test/10.6_opt/sql/sql_select.cc:4273
|
#23 0x00005575fd48d2c8 in mysql_select (thd=0x149600000c58, tables=0x0, fields=<optimized out>, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x149600012338, unit=0x149600004c70, select_lex=0x149600010da8) at /test/10.6_opt/sql/sql_select.cc:4749
|
#24 0x00005575fd48dcd7 in handle_select (thd=thd@entry=0x149600000c58, lex=lex@entry=0x149600004ba8, result=result@entry=0x149600012338, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_opt/sql/sql_select.cc:419
|
#25 0x00005575fd41e5c1 in execute_sqlcom_select (thd=0x149600000c58, all_tables=0x0) at /test/10.6_opt/sql/sql_parse.cc:6231
|
#26 0x00005575fd42c069 in mysql_execute_command (thd=0x149600000c58) at /test/10.6_opt/sql/sql_parse.cc:3927
|
#27 0x00005575fd419424 in mysql_parse (thd=0x149600000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:8004
|
#28 0x00005575fd425345 in dispatch_command (command=COM_QUERY, thd=0x149600000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.6_opt/sql/sql_class.h:1331
|
#29 0x00005575fd427390 in do_command (thd=0x149600000c58, blocking=blocking@entry=true) at /test/10.6_opt/sql/sql_parse.cc:1399
|
#30 0x00005575fd529317 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/10.6_opt/sql/sql_connect.cc:1410
|
#31 0x00005575fd52967d in handle_one_connection (arg=arg@entry=0x5575ff5454b8) at /test/10.6_opt/sql/sql_connect.cc:1312
|
#32 0x00005575fd8a9a49 in pfs_spawn_thread (arg=0x5575ff4c12b8) at /test/10.6_opt/storage/perfschema/pfs.cc:2201
|
#33 0x000014966621c609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#34 0x0000149665e0b293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
With thanks ramesh for co-testing.
Attachments
Issue Links
- is duplicated by
-
MDEV-26422 ASAN: global-buffer-overflow in decimal_bin_size on SELECT
- Closed
- relates to
-
MDEV-23444 ASAN dynamic-stack-buffer-overflow or Assertion `precision > 0' failed in decimal_bin_size with div_precision_increment=0
- Confirmed