Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28087

MariaDB SEGV issue

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 10.9.0, 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL)
    • 10.7.4, 10.3.35, 10.4.25, 10.5.16, 10.6.8, 10.8.3
    • Virtual Columns
    • None
    • Linux jie-2 5.4.143-1-pve #1 SMP PVE 5.4.143-1 (Tue, 28 Sep 2021 09:10:37 +0200) x86_64 x86_64 x86_64 GNU/Linux

    Description

      PoC:

      UNLOCK TABLES; COMMIT; DROP DATABASE IF EXISTS walktreedatabase3424886; CREATE DATABASE IF NOT EXISTS walktreedatabase3424886; USE walktreedatabase3424886;;
      		 
      CREATE TABLE v0 ( v1 INT UNIQUE UNIQUE UNIQUE PRIMARY KEY ) ;
      		 
      SET GLOBAL READ_ONLY = TRUE ;
      		 
      INSERT v0 ( ) VALUES ( 85075355.000000 ) , ( 52251370.000000 ) ;
      		 
      CREATE TABLE v2 ( v3 BIGINT ( 43 ) ) ENGINE = MEMORY ;
      		 
      INSERT IGNORE v2 SET v3 = DEFAULT ;
      		 
      ALTER TABLE v0 ADD ( v4 INT AS ( ( TIME ( CASE DAYNAME ( 'x' ) WHEN 'x' THEN RIGHT ( + '' , 78 ) END ) ) ) VIRTUAL ) ;
      		 
      UPDATE v0 MEMORY SET v1 = v1 ;
      		 
      SELECT * FROM v0 WHERE v1 LIKE 'x' ORDER BY COALESCE ( 'x' ) ;

      report (compiled with ASAN):

      Thread pointer: 0x62b00015e218                                                                                                                                                               
      Attempting backtrace. You can use the following information to find out                                                                                                                      
      where mysqld died. If you see no messages after this, something went                                                                                                                         
      terribly wrong...                                                                                                                                                                            
      stack_bottom = 0x7f8171428880 thread_stack 0x5fc00                                                                                                                                           
      ??:0(__interceptor_backtrace)[0x7cbadb]                                                                                                                                                      
      mysys/stacktrace.c:212(my_print_stacktrace)[0x2a86d37]                                                                                                                                       
      sql/signal_handler.cc:0(handle_fatal_signal)[0x15af5d9]                                                                                                                                      
      sigaction.c:0(__restore_rt)[0x7f8195bc23c0]                                                                                                                                                  
      sql/item_cmpfunc.h:2058(Predicant_to_list_comparator::cmp_arg(Item_args*, unsigned int))[0x16ccaaf]                                                                                          
      ??:0(Item_func_case::str_op(String*))[0x16cd3e2]                                                                                                                                             
      sql/sql_type.cc:5665(Type_handler_string_result::Item_func_hybrid_field_type_get_date(THD*, Item_func_hybrid_field_type*, Temporal::Warn*, st_mysql_time*, date_mode_t) const)[0x131bef1]    
      sql/sql_type.cc:5145(Type_handler::Item_func_hybrid_field_type_get_date_with_warn(THD*, Item_func_hybrid_field_type*, st_mysql_time*, date_mode_t) const)[0x1317054]                         
      sql/sql_type.cc:758(Time::make_from_item(THD*, int*, Item*, Time::Options))[0x12f1254]                                                                                                       
      ??:0(Item_time_typecast::get_date(THD*, st_mysql_time*, date_mode_t))[0x19cfef0]                                                                                                             
      sql/item.cc:363(Item::save_time_in_field(Field*, bool))[0x1601545]                                                                                                                           
      sql/item.cc:6812(Item::save_in_field(Field*, bool))[0x164ce5a]                                                                                                                               
      sql/table.cc:8761(TABLE::update_virtual_fields(handler*, enum_vcol_update_mode))[0x1072e99]                                                                                                  
      ??:0(handler::ha_rnd_next(unsigned char*))[0x15c4e50]                                                                                                                                        
      sql/records.cc:519(rr_sequential(READ_RECORD*))[0x930065]                                                                                                                                    
      sql/sql_select.cc:21092(sub_select(JOIN*, st_join_table*, bool))[0xd4c04e]                                                                                                                   
      ??:0(JOIN::exec_inner())[0xdc6798]                                                                                                                                                           
      sql/sql_select.cc:4528(JOIN::exec())[0xdc344d]                                                                                                                                               
      sql/sql_select.cc:5009(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_
      		 
      select_lex*))[0xd4e4e9]                                                                                                                                                                      
      sql/sql_select.cc:543(handle_select(THD*, LEX*, select_result*, unsigned long))[0xd4d74c]                                                                                                    
      sql/sql_parse.cc:6252(execute_sqlcom_select(THD*, TABLE_LIST*))[0xc74411]                                                                                                                    
      sql/sql_parse.cc:3943(mysql_execute_command(THD*, bool))[0xc609ca]                                                                                                                           
      sql/sql_class.h:2734(THD::enter_stage(PSI_stage_info_v1 const*, char const*, char const*, unsigned int))[0xc4a67f]                                                                           
      sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0xc41baa]                                                                                      
      sql/sql_parse.cc:1404(do_command(THD*, bool))[0xc4b74c]                                                                                                                                      
      sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x111f9f3]
      		 
      sql/sql_connect.cc:0(handle_one_connection)[0x111f249]
      		 
      perfschema/pfs.cc:2203(pfs_spawn_thread)[0x1f3f9de]
      		 
      nptl/pthread_create.c:478(start_thread)[0x7f8195bb6609]
      		 
      ??:0(clone)[0x7f81958cc163]
      		 
       
      		 
      Trying to get some variables.
      		 
      Some pointers may be invalid and cause the dump to abort.
      		 
      Query (0x62900008c238): SELECT * FROM v0 WHERE v1 LIKE 'x' ORDER BY COALESCE ( 'x' )

      Attachments

        Issue Links

          duplicates

          Bug - A problem which impairs or prevents the functions of the product. MDEV-24176 Server crashes after insert in the table with virtual column generated using date_format() and if()

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-26407 Server crashes in Item_func_in::cleanup/Item::cleanup_processor

          • Major - Major loss of function.
          • Closed

          Activity

            alice Alice Sherepa added a comment -

            Thank you!
            Seems to be related to MDEV-26407 also.
            Repeatable on 10.2-10.9

            CREATE TABLE t1 ( v1 INT  PRIMARY KEY );
            		 
            INSERT t1  VALUES (1) , (2) ;
            		 
            ALTER TABLE t1 ADD ( v4 INT AS (cast(case dayname('x') when 'x' then right('',78) end as time))) ;
            		 
            UPDATE t1  SET v1 = v1 ;
            		 
            SELECT * FROM t1 WHERE v1 LIKE 'x' ORDER BY COALESCE ( 'x' ) ;


            Version: '10.2.44-MariaDB-debug-log' 
            220318 18:16:18 [ERROR] mysqld got signal 11 ;
            		 
             
            		 
            Server version: 10.2.44-MariaDB-debug-log
            		 
             
            		 
            sql/item_cmpfunc.cc:3080(Item_func_case::find_item(String*))[0x558195b066fe]
            		 
            sql/item_cmpfunc.cc:3098(Item_func_case::str_op(String*))[0x558195b06d0f]
            		 
            sql/item_func.h:467(Item_func_hybrid_field_type::str_op_with_null_check(String*))[0x558195bb32ab]
            		 
            sql/item_func.cc:1057(Item_func_hybrid_field_type::get_date(st_mysql_time*, unsigned long long))[0x558195b736e8]
            		 
            sql/item.h:1462(Item::get_time(st_mysql_time*))[0x558195ad3d8d]
            		 
            sql/item_func.h:174(Item_func::get_arg0_time(st_mysql_time*))[0x558195cb31fa]
            		 
            sql/item_timefunc.cc:2609(Item_time_typecast::get_date(st_mysql_time*, unsigned long long))[0x558195cac811]
            		 
            sql/item.h:1462(Item::get_time(st_mysql_time*))[0x558195ad3d8d]
            		 
            sql/item.cc:436(Item::save_time_in_field(Field*))[0x558195a7a669]
            		 
            sql/item_timefunc.h:567(Item_temporal_func::save_in_field(Field*, bool))[0x558195975b2c]
            		 
            sql/table.cc:7827(TABLE::update_virtual_fields(handler*, enum_vcol_update_mode))[0x5581956e4e38]
            		 
            sql/handler.cc:2676(handler::ha_rnd_next(unsigned char*))[0x558195a51ec1]
            		 
            sql/records.cc:492(rr_sequential(READ_RECORD*))[0x558195e019e8]
            		 
            sql/sql_select.cc:19840(join_init_read_record(st_join_table*))[0x55819552c150]
            		 
            sql/sql_select.cc:18905(sub_select(JOIN*, st_join_table*, bool))[0x5581955255e8]
            		 
            sql/sql_select.cc:18451(do_select(JOIN*, Procedure*))[0x55819552384a]
            		 
            sql/sql_select.cc:3651(JOIN::exec_inner())[0x5581954bd40f]
            		 
            sql/sql_select.cc:3447(JOIN::exec())[0x5581954baf26]
            		 
            sql/sql_select.cc:3851(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5581954be7a9]
            		 
            sql/sql_select.cc:361(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55819549b184]
            		 
            sql/sql_parse.cc:6271(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5581954117ef]
            		 
            sql/sql_parse.cc:3582(mysql_execute_command(THD*))[0x5581953feb78]
            		 
            sql/sql_parse.cc:7793(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55819541ad04]
            		 
            sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5581953f3f09]
            		 
            sql/sql_parse.cc:1381(do_command(THD*))[0x5581953f0cd4]
            		 
            sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x55819577d40a]
            		 
            sql/sql_connect.cc:1242(handle_one_connection)[0x55819577cccd]
            		 
            perfschema/pfs.cc:1871(pfs_spawn_thread)[0x558196b1daf4]
            		 
            nptl/pthread_create.c:478(start_thread)[0x7f892290e609]
            		 
            /lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f892207c163]
            		 
             
            		 
            Query (0x62b000000290): SELECT * FROM t1 WHERE v1 LIKE 'x' ORDER BY COALESCE ( 'x' )

            alice Alice Sherepa added a comment - Thank you! Seems to be related to MDEV-26407 also. Repeatable on 10.2-10.9 CREATE TABLE t1 ( v1 INT PRIMARY KEY ); INSERT t1 VALUES (1) , (2) ; ALTER TABLE t1 ADD ( v4 INT AS ( cast ( case dayname( 'x' ) when 'x' then right ( '' ,78) end as time ))) ; UPDATE t1 SET v1 = v1 ; SELECT * FROM t1 WHERE v1 LIKE 'x' ORDER BY COALESCE ( 'x' ) ; Version: '10.2.44-MariaDB-debug-log' 220318 18:16:18 [ERROR] mysqld got signal 11 ;   Server version: 10.2.44-MariaDB-debug-log   sql/item_cmpfunc.cc:3080(Item_func_case::find_item(String*))[0x558195b066fe] sql/item_cmpfunc.cc:3098(Item_func_case::str_op(String*))[0x558195b06d0f] sql/item_func.h:467(Item_func_hybrid_field_type::str_op_with_null_check(String*))[0x558195bb32ab] sql/item_func.cc:1057(Item_func_hybrid_field_type::get_date(st_mysql_time*, unsigned long long))[0x558195b736e8] sql/item.h:1462(Item::get_time(st_mysql_time*))[0x558195ad3d8d] sql/item_func.h:174(Item_func::get_arg0_time(st_mysql_time*))[0x558195cb31fa] sql/item_timefunc.cc:2609(Item_time_typecast::get_date(st_mysql_time*, unsigned long long))[0x558195cac811] sql/item.h:1462(Item::get_time(st_mysql_time*))[0x558195ad3d8d] sql/item.cc:436(Item::save_time_in_field(Field*))[0x558195a7a669] sql/item_timefunc.h:567(Item_temporal_func::save_in_field(Field*, bool))[0x558195975b2c] sql/table.cc:7827(TABLE::update_virtual_fields(handler*, enum_vcol_update_mode))[0x5581956e4e38] sql/handler.cc:2676(handler::ha_rnd_next(unsigned char*))[0x558195a51ec1] sql/records.cc:492(rr_sequential(READ_RECORD*))[0x558195e019e8] sql/sql_select.cc:19840(join_init_read_record(st_join_table*))[0x55819552c150] sql/sql_select.cc:18905(sub_select(JOIN*, st_join_table*, bool))[0x5581955255e8] sql/sql_select.cc:18451(do_select(JOIN*, Procedure*))[0x55819552384a] sql/sql_select.cc:3651(JOIN::exec_inner())[0x5581954bd40f] sql/sql_select.cc:3447(JOIN::exec())[0x5581954baf26] sql/sql_select.cc:3851(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5581954be7a9] sql/sql_select.cc:361(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55819549b184] sql/sql_parse.cc:6271(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5581954117ef] sql/sql_parse.cc:3582(mysql_execute_command(THD*))[0x5581953feb78] sql/sql_parse.cc:7793(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55819541ad04] sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5581953f3f09] sql/sql_parse.cc:1381(do_command(THD*))[0x5581953f0cd4] sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x55819577d40a] sql/sql_connect.cc:1242(handle_one_connection)[0x55819577cccd] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x558196b1daf4] nptl/pthread_create.c:478(start_thread)[0x7f892290e609] /lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f892207c163]   Query (0x62b000000290): SELECT * FROM t1 WHERE v1 LIKE 'x' ORDER BY COALESCE ( 'x' )

            People

              serg Sergei Golubchik
              fuboat Jingzhou Fu
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.