PoC:
CREATE TABLE v0 AS SELECT NULL AS v1 FROM DUAL ;
|
SELECT * FROM v0 WHERE unhex ( log2 ( nullif ( NULL , 'x' ) ) ) = 'x' OR 'x' ;
|
UPDATE v0 SET v1 = v1 + 86 , v1 = v1 + 2147483647 WHERE ( v1 , v1 ) IN ( ( -128 , -1 ) ) ;
|
UPDATE v0 SET v1 = ( SELECT v1 + 16 FROM v0 HAVING v1 + 57 ) ;
|
Crash Log:
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
To report this bug, see https://mariadb.com/kb/en/reporting-bugs
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.
Server version: 10.7.0-MariaDB
key_buffer_size=134217728
read_buffer_size=131072
max_used_connections=1
max_threads=153
thread_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 467956 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
Thread pointer: 0x62b0000bd218
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f856fd77850 thread_stack 0x5fc00
sanitizer_common/sanitizer_common_interceptors.inc:4203(__interceptor_backtrace.part.0)[0x7f858f623c3e]
mysys/stacktrace.c:213(my_print_stacktrace)[0x55905678c747]
sql/signal_handler.cc:222(handle_fatal_signal)[0x559055754120]
sigaction.c:0(__restore_rt)[0x7f858f00d870]
sql/item.h:5311(Used_tables_and_const_cache::used_tables_and_const_cache_join(Item const*))[0x5590557ff227]
sql/item.cc:7918(Item_ref::fix_fields(THD*, Item**))[0x5590557e66b6]
sql/item_func.cc:347(Item_func::fix_fields(THD*, Item**))[0x5590558e829c]
sql/item.h:1148(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x55905514066d]
sql/item_subselect.cc:3903(subselect_single_select_engine::prepare(THD*))[0x559055a484f6]
sql/item_subselect.cc:295(Item_subselect::fix_fields(THD*, Item**))[0x559055a45d05]
sql/item.h:1148(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x559054e832ed]
sql/sql_update.cc:2077(multi_update::prepare(List<Item>&, st_select_lex_unit*))[0x5590552d58ed]
sql/sql_select.cc:1684(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x559055142817]
sql/sql_select.cc:4967(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x559055186caa]
sql/sql_class.h:4325(THD::is_error() const)[0x5590552e4d8c]
sql/sql_parse.cc:4499(mysql_execute_command(THD*, bool))[0x559054ff4320]
sql/sql_parse.cc:8047(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x559054ff95a1]
sql/sql_parse.cc:1898(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x559054fff60c]
sql/sql_parse.cc:1406(do_command(THD*, bool))[0x55905500473d]
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x5590553bfe57]
sql/sql_connect.cc:1312(handle_one_connection)[0x5590553c033d]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x559055e50c2c]
pthread_create.c:0(start_thread)[0x7f858f003259]
:0(_GI__clone)[0x7f858ebae5e3]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x629000087238): UPDATE v0 SET v1 = ( SELECT v1 + 16 FROM v0 HAVING v1 + 57 )
Connection ID (thread ID): 4
Status: NOT_KILLED
- duplicates
-
MDEV-22464
Server crash on UPDATE with nested subquery
-
-
Closed
- links to
-
{"report":{"fcp":781.1999998092651,"ttfb":209.59999990463257,"pageVisibility":"visible","entityId":102082,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":1,"journeyId":"77e28d79-ade4-48c8-a70e-57fa1abce220","navigationType":0,"readyForUser":849.6999998092651,"redirectCount":0,"resourceLoadedEnd":591,"resourceLoadedStart":216.59999990463257,"resourceTiming":[{"duration":7,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":216.59999990463257,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":216.59999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":223.59999990463257,"responseStart":0,"secureConnectionStart":0},{"duration":7.400000095367432,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2cib/820016/12ta74/494e4c556ecbb29f90a3d3b4f09cb99c/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true&whisper-enabled=true","startTime":216.89999961853027,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":216.89999961853027,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":224.2999997138977,"responseStart":0,"secureConnectionStart":0},{"duration":114.89999961853027,"initiatorType":"script","name":"https://jira.mariadb.org/s/0917945aaa57108d00c5076fea35e069-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":217,"connectEnd":217,"connectStart":217,"domainLookupEnd":217,"domainLookupStart":217,"fetchStart":217,"redirectEnd":0,"redirectStart":0,"requestStart":300,"responseEnd":331.8999996185303,"responseStart":311.09999990463257,"secureConnectionStart":217},{"duration":190.69999980926514,"initiatorType":"script","name":"https://jira.mariadb.org/s/2d8175ec2fa4c816e8023260bd8c1786-CDN/lu2cib/820016/12ta74/494e4c556ecbb29f90a3d3b4f09cb99c/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true&whisper-enabled=true","startTime":217.19999980926514,"connectEnd":217.19999980926514,"connectStart":217.19999980926514,"domainLookupEnd":217.19999980926514,"domainLookupStart":217.19999980926514,"fetchStart":217.19999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":306.69999980926514,"responseEnd":407.8999996185303,"responseStart":330.2999997138977,"secureConnectionStart":217.19999980926514},{"duration":121.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/a9324d6758d385eb45c462685ad88f1d-CDN/lu2cib/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":217.39999961853027,"connectEnd":217.39999961853027,"connectStart":217.39999961853027,"domainLookupEnd":217.39999961853027,"domainLookupStart":217.39999961853027,"fetchStart":217.39999961853027,"redirectEnd":0,"redirectStart":0,"requestStart":308.7999997138977,"responseEnd":338.8999996185303,"responseStart":338.19999980926514,"secureConnectionStart":217.39999961853027},{"duration":108.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":217.5,"connectEnd":313.7999997138977,"connectStart":313.7999997138977,"domainLookupEnd":313.7999997138977,"domainLookupStart":313.7999997138977,"fetchStart":217.5,"redirectEnd":0,"redirectStart":0,"requestStart":314,"responseEnd":326,"responseStart":324.7999997138977,"secureConnectionStart":313.7999997138977},{"duration":109.80000019073486,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":217.69999980926514,"connectEnd":217.69999980926514,"connectStart":217.69999980926514,"domainLookupEnd":217.69999980926514,"domainLookupStart":217.69999980926514,"fetchStart":217.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":314.8999996185303,"responseEnd":327.5,"responseStart":326.2999997138977,"secureConnectionStart":217.69999980926514},{"duration":97.59999990463257,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2cib/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":217.7999997138977,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":217.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":315.3999996185303,"responseStart":0,"secureConnectionStart":0},{"duration":116.09999990463257,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":218,"connectEnd":218,"connectStart":218,"domainLookupEnd":218,"domainLookupStart":218,"fetchStart":218,"redirectEnd":0,"redirectStart":0,"requestStart":321.5,"responseEnd":334.09999990463257,"responseStart":332.59999990463257,"secureConnectionStart":218},{"duration":103.09999990463257,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":218.19999980926514,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":218.19999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":321.2999997138977,"responseStart":0,"secureConnectionStart":0},{"duration":119.59999990463257,"initiatorType":"script","name":"https://jira.mariadb.org/s/5d5e8fe91fbc506585e83ea3b62ccc4b-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":218.2999997138977,"connectEnd":218.2999997138977,"connectStart":218.2999997138977,"domainLookupEnd":218.2999997138977,"domainLookupStart":218.2999997138977,"fetchStart":218.2999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":323.8999996185303,"responseEnd":337.8999996185303,"responseStart":334.2999997138977,"secureConnectionStart":218.2999997138977},{"duration":363.59999990463257,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":227.09999990463257,"connectEnd":227.09999990463257,"connectStart":227.09999990463257,"domainLookupEnd":227.09999990463257,"domainLookupStart":227.09999990463257,"fetchStart":227.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":570,"responseEnd":590.6999998092651,"responseStart":585.5,"secureConnectionStart":227.09999990463257},{"duration":363.30000019073486,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":227.69999980926514,"connectEnd":227.69999980926514,"connectStart":227.69999980926514,"domainLookupEnd":227.69999980926514,"domainLookupStart":227.69999980926514,"fetchStart":227.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":570.0999999046326,"responseEnd":591,"responseStart":586.0999999046326,"secureConnectionStart":227.69999980926514},{"duration":189.30000019073486,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":545.2999997138977,"connectEnd":545.2999997138977,"connectStart":545.2999997138977,"domainLookupEnd":545.2999997138977,"domainLookupStart":545.2999997138977,"fetchStart":545.2999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":696.2999997138977,"responseEnd":734.5999999046326,"responseStart":733.7999997138977,"secureConnectionStart":545.2999997138977},{"duration":141.2000002861023,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":758.7999997138977,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":758.7999997138977,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":900,"responseStart":0,"secureConnectionStart":0},{"duration":146.5,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":781.0999999046326,"connectEnd":781.0999999046326,"connectStart":781.0999999046326,"domainLookupEnd":781.0999999046326,"domainLookupStart":781.0999999046326,"fetchStart":781.0999999046326,"redirectEnd":0,"redirectStart":0,"requestStart":884.0999999046326,"responseEnd":927.5999999046326,"responseStart":926.8999996185303,"secureConnectionStart":781.0999999046326}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":48,"responseStart":209,"responseEnd":227,"domLoading":212,"domInteractive":908,"domContentLoadedEventStart":908,"domContentLoadedEventEnd":950,"domComplete":1421,"loadEventStart":1421,"loadEventEnd":1422,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":888.0999999046326},{"name":"bigPipe.sidebar-id.end","time":889.0999999046326},{"name":"bigPipe.activity-panel-pipe-id.start","time":889.2999997138977},{"name":"bigPipe.activity-panel-pipe-id.end","time":890.1999998092651},{"name":"activityTabFullyLoaded","time":966.2999997138977}],"measures":[],"correlationId":"b9214844086a8","effectiveType":"4g","downlink":9.1,"rtt":0,"serverDuration":98,"dbReadsTimeInMs":11,"dbConnsTimeInMs":19,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}
Thank you!
It seems to be the same as
MDEV-22464, I will add the test case there