Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28034

SIGSEGV in Item_args::walk_args and libstdc++ __cxa_pure_virtual terminate/SIGABRT in Item::check_type_scalar

    XMLWordPrintable

    Details

      Description

      Seems related to MDEV-27920.
      Interestingly, only 10.2 optimized does not crash, so it is a regression of sorts. It would be interesting to find out why that version does not crash.

      # Important note: This bug can only be reproduced by a C-based client, like pquery. CLI replay will not reproduce the bug
      CREATE TABLE t (c INT,c2 CHAR AS (CONCAT ('',DAYNAME ('')))) COLLATE utf8_bin ENGINE=InnoDB;
      SELECT * FROM t WHERE c2='2010-10-01 00:00:00' LIMIT 2;
      INSERT INTO t SET c=CONCAT (REPEAT ('',0),'','');
      

      Leads to:

      10.9.0 4a2a9c02cd6611ef36bbb735c2b483dbc83580d4 (Optimized)

      Core was generated by `/test/MD260222-mariadb-10.9.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      [Current thread is 1 (Thread 0x14c3600c9700 (LWP 3506817))]
      (gdb) bt
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #1  0x000014c362e48859 in __GI_abort () at abort.c:79
      #2  0x000014c363207911 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
      #3  0x000014c36321338c in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
      #4  0x000014c3632133f7 in std::terminate() () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
      #5  0x000014c363214155 in __cxa_pure_virtual () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
      #6  0x0000557e4718b901 in Item::check_type_scalar (this=this@entry=0x14c2c4012d28, opname=@0x14c3600c7520: {str = 0x557e479c1046 "concat", length = 6}) at /test/10.9_opt/sql/item.cc:1121
      #7  0x0000557e471df1e0 in Item_func::check_argument_types_scalar (this=0x14c2c401d2f0, start=<optimized out>, end=<optimized out>) at /test/10.9_opt/sql/item_func.cc:271
      #8  0x0000557e471d95d1 in Item_func::fix_fields (ref=<optimized out>, thd=0x14c2c4000c58, this=0x14c2c401d2f0) at /test/10.9_opt/sql/item_func.cc:357
      #9  Item_func::fix_fields (this=this@entry=0x14c2c401d2f0, thd=thd@entry=0x14c2c4000c58, ref=<optimized out>) at /test/10.9_opt/sql/item_func.cc:314
      #10 0x0000557e4720ed56 in Item_str_func::fix_fields (this=0x14c2c401d2f0, thd=0x14c2c4000c58, ref=<optimized out>) at /test/10.9_opt/sql/item_strfunc.cc:127
      #11 0x0000557e47005683 in fix_vcol_expr (thd=0x14c2c4000c58, vcol=0x14c2c401d3b8) at /test/10.9_opt/sql/table.cc:3596
      #12 0x0000557e46eb2677 in TABLE::fix_vcol_exprs (this=0x14c2c40178b8, thd=0x14c2c4000c58) at /test/10.9_opt/sql/sql_base.cc:5442
      #13 0x0000557e46eb2b9e in fix_all_session_vcol_exprs (tables=0x14c2c40109c8, thd=0x14c2c4000c58) at /test/10.9_opt/sql/sql_base.cc:5478
      #14 lock_tables (thd=thd@entry=0x14c2c4000c58, tables=0x14c2c40109c8, count=<optimized out>, flags=flags@entry=0) at /test/10.9_opt/sql/sql_base.cc:5662
      #15 0x0000557e46eb43e2 in open_and_lock_tables (thd=thd@entry=0x14c2c4000c58, options=<optimized out>, tables=<optimized out>, tables@entry=0x14c2c40109c8, derived=derived@entry=true, flags=flags@entry=0, prelocking_strategy=<optimized out>) at /test/10.9_opt/sql/sql_base.cc:5274
      #16 0x0000557e46ee9b2a in open_and_lock_tables (flags=<optimized out>, derived=<optimized out>, tables=<optimized out>, thd=<optimized out>) at /test/10.9_opt/sql/sql_base.h:509
      #17 open_and_lock_for_insert_delayed (table_list=<optimized out>, thd=<optimized out>) at /test/10.9_opt/sql/sql_insert.cc:628
      #18 mysql_insert (thd=thd@entry=0x14c2c4000c58, table_list=0x14c2c40109c8, fields=@0x14c2c4005d60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14c2c4011628, last = 0x14c2c4011628, elements = 1}, <No data fields>}, values_list=@0x14c2c4005da8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14c2c40110c8, last = 0x14c2c40110c8, elements = 1}, <No data fields>}, update_fields=@0x14c2c4005d90: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x557e480c83b0 <end_of_list>, last = 0x14c2c4005d90, elements = 0}, <No data fields>}, update_values=@0x14c2c4005d78: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x557e480c83b0 <end_of_list>, last = 0x14c2c4005d78, elements = 0}, <No data fields>}, duplic=<optimized out>, ignore=<optimized out>, result=<optimized out>) at /test/10.9_opt/sql/sql_insert.cc:753
      #19 0x0000557e46f255cf in mysql_execute_command (thd=0x14c2c4000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.9_opt/sql/sql_parse.cc:4562
      #20 0x0000557e46f14e26 in mysql_parse (thd=0x14c2c4000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.9_opt/sql/sql_parse.cc:8027
      #21 0x0000557e46f20fd5 in dispatch_command (command=COM_QUERY, thd=0x14c2c4000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.9_opt/sql/sql_class.h:1362
      #22 0x0000557e46f231c7 in do_command (thd=0x14c2c4000c58, blocking=blocking@entry=true) at /test/10.9_opt/sql/sql_parse.cc:1402
      #23 0x0000557e47042b47 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/10.9_opt/sql/sql_connect.cc:1418
      #24 0x0000557e47042e8d in handle_one_connection (arg=arg@entry=0x557e4a201b88) at /test/10.9_opt/sql/sql_connect.cc:1312
      #25 0x0000557e473bc631 in pfs_spawn_thread (arg=0x557e4a1b9908) at /test/10.9_opt/storage/perfschema/pfs.cc:2201
      #26 0x000014c363359609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #27 0x000014c362f45163 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.9.0 4a2a9c02cd6611ef36bbb735c2b483dbc83580d4 (Debug)

      Core was generated by `/test/MD260222-mariadb-10.9.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005556522235f9 in Item_args::walk_args (arg=0x0, walk_subquery=false, 
          processor=<optimized out>, this=0x148c000277f0)
          at /test/10.9_dbg/sql/item.h:2741
      [Current thread is 1 (Thread 0x148c7815b700 (LWP 1143402))]
      (gdb) bt
      #0  0x00005556522235f9 in Item_args::walk_args (arg=0x0, walk_subquery=false, processor=<optimized out>, this=0x148c000277f0) at /test/10.9_dbg/sql/item.h:2741
      #1  Item_func_or_sum::walk (this=0x148c00027780, processor=<optimized out>, walk_subquery=false, arg=0x0) at /test/10.9_dbg/sql/item.h:5437
      #2  0x0000555652466ec3 in fix_session_vcol_expr (thd=thd@entry=0x148c00000db8, vcol=0x148c00027848) at /test/10.9_dbg/sql/table.cc:3622
      #3  0x00005556522a7608 in TABLE::fix_vcol_exprs (this=0x148c0001f6a8, thd=thd@entry=0x148c00000db8) at /test/10.9_dbg/sql/sql_base.cc:5442
      #4  0x00005556522a7cd8 in fix_all_session_vcol_exprs (tables=0x148c00013ee8, thd=0x148c00000db8) at /test/10.9_dbg/sql/sql_base.cc:5478
      #5  lock_tables (thd=thd@entry=0x148c00000db8, tables=0x148c00013ee8, count=<optimized out>, flags=flags@entry=0) at /test/10.9_dbg/sql/sql_base.cc:5662
      #6  0x00005556522a9ab9 in open_and_lock_tables (thd=thd@entry=0x148c00000db8, options=<optimized out>, tables=<optimized out>, tables@entry=0x148c00013ee8, derived=derived@entry=true, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x148c78159cb0) at /test/10.9_dbg/sql/sql_base.cc:5274
      #7  0x00005556522f92e4 in open_and_lock_tables (flags=0, derived=true, tables=0x148c00013ee8, thd=0x148c00000db8) at /test/10.9_dbg/sql/sql_base.h:509
      #8  mysql_insert (thd=thd@entry=0x148c00000db8, table_list=0x148c00013ee8, fields=@0x148c00006080: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x148c00014b48, last = 0x148c00014b48, elements = 1}, <No data fields>}, values_list=@0x148c000060c8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x148c000145e8, last = 0x148c000145e8, elements = 1}, <No data fields>}, update_fields=@0x148c000060b0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55565398f9a0 <end_of_list>, last = 0x148c000060b0, elements = 0}, <No data fields>}, update_values=@0x148c00006098: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55565398f9a0 <end_of_list>, last = 0x148c00006098, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.9_dbg/sql/sql_insert.cc:758
      #9  0x0000555652341958 in mysql_execute_command (thd=thd@entry=0x148c00000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.9_dbg/sql/sql_parse.cc:4562
      #10 0x000055565232c343 in mysql_parse (thd=thd@entry=0x148c00000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148c7815a400) at /test/10.9_dbg/sql/sql_parse.cc:8027
      #11 0x000055565233afdf in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x148c00000db8, packet=packet@entry=0x148c0000b889 "INSERT INTO t SET c=CONCAT (REPEAT ('',0),'','');", packet_length=packet_length@entry=49, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_class.h:1362
      #12 0x000055565233e426 in do_command (thd=0x148c00000db8, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_parse.cc:1402
      #13 0x00005556524b9036 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5556569548a8, put_in_cache=put_in_cache@entry=true) at /test/10.9_dbg/sql/sql_connect.cc:1418
      #14 0x00005556524b963b in handle_one_connection (arg=arg@entry=0x5556569548a8) at /test/10.9_dbg/sql/sql_connect.cc:1312
      #15 0x000055565293fd23 in pfs_spawn_thread (arg=0x555656897328) at /test/10.9_dbg/storage/perfschema/pfs.cc:2201
      #16 0x0000148c828cc609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #17 0x0000148c824b8163 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.2.44 (dbg), 10.3.35 (dbg), 10.3.35 (opt), 10.4.25 (dbg), 10.4.25 (opt), 10.5.16 (dbg), 10.5.16 (opt), 10.6.8 (dbg), 10.6.8 (opt), 10.7.4 (dbg), 10.7.4 (opt), 10.8.3 (dbg), 10.8.3 (opt), 10.9.0 (dbg), 10.9.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.44 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.37 (dbg), 5.7.37 (opt), 8.0.28 (dbg), 8.0.28 (opt)

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              nikitamalyavin Nikita Malyavin
              Reporter:
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:

                  Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.