Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 10.9.0
    • N/A
    • N/A
    • None
    • Linux jie-2 5.4.143-1-pve #1 SMP PVE 5.4.143-1 (Tue, 28 Sep 2021 09:10:37 +0200) x86_64 x86_64 x86_64 GNU/Linux

    Description

      PoC:

      CREATE TABLE v0 ( EVENTS NUMERIC AS ( REPLACE ( 'x' , 'x' , v1 IN ( DAYOFMONTH ( v1 BETWEEN 'x' AND CURRENT_USER ) = v1 ) ) ) , v1 TIMESTAMP NOT NULL ) ;
      INSERT IGNORE INTO v0 VALUES ( ( CASE 'x' 'x' = DATE ( CONVERT ( v1 , TIME ) ) * 4206878.000000 WHEN v1 = NULL THEN v1 ELSE v1 END ) , NULL ) ;
      SELECT 'x' IN ( SELECT 'x' FROM v0 COLUMNS NATURAL JOIN v0 WHERE v1 = -1 ) ;
      

      report (compiled with ASAN):

      Thread pointer: 0x62b00015e218
      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong...
      stack_bottom = 0x7f8249047880 thread_stack 0x5fc00
      ??:0(__interceptor_backtrace)[0x7cbadb]
      mysys/stacktrace.c:212(my_print_stacktrace)[0x2a86d37]
      sql/signal_handler.cc:0(handle_fatal_signal)[0x15af5d9]
      sigaction.c:0(__restore_rt)[0x7f826dffa3c0]
      sql/item_cmpfunc.cc:732(Arg_comparator::compare_datetime())[0x16b24b8]
      sql/item_cmpfunc.cc:1763(Item_func_eq::val_int())[0x16be219]
      sql/item_func.cc:753(Item_int_func::val_str(String*))[0x1782642]
      sql/item_strfunc.cc:1204(Item_func_replace::val_str_internal(String*, String*))[0x1866cc6]
      sql/item.cc:6764(Item::save_str_in_field(Field*, bool))[0x164c31e]
      sql/item.cc:6812(Item::save_in_field(Field*, bool))[0x164ce5a]
      sql/table.cc:8761(TABLE::update_virtual_fields(handler*, enum_vcol_update_mode))[0x1072e99]
      ??:0(handler::ha_rnd_next(unsigned char*))[0x15c4e50]
      sql/records.cc:519(rr_sequential(READ_RECORD*))[0x930065]
      sql/sql_select.cc:21092(sub_select(JOIN*, st_join_table*, bool))[0xd4c04e]
      ??:0(JOIN::exec_inner())[0xdc6798]
      sql/sql_select.cc:4528(JOIN::exec())[0xdc344d]
      ??:0(subselect_single_select_engine::exec())[0x1952e44]
      sql/item_subselect.cc:858(Item_subselect::exec())[0x1928ebc]
      sql/item_subselect.cc:1965(Item_in_subselect::val_bool())[0x193469b]
      sql/item_cmpfunc.cc:1638(Item_in_optimizer::val_int())[0x16bcbcb]
      sql/sql_type.cc:7502(Type_handler::Item_send_long(Item*, Protocol*, st_value*) const)[0x13548b2]
      sql/protocol.cc:1328(Protocol::send_result_set_row(List<Item>*))[0x920512]
      sql/sql_class.cc:3060(select_send::send_data(List<Item>&))[0xaf940a]
      sql/sql_select.cc:4615(JOIN::exec_inner())[0xdc7875]
      sql/sql_select.cc:4528(JOIN::exec())[0xdc344d]
      sql/sql_select.cc:5009(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0xd4e4e9]
      sql/sql_select.cc:543(handle_select(THD*, LEX*, select_result*, unsigned long))[0xd4d74c]
      sql/sql_parse.cc:6252(execute_sqlcom_select(THD*, TABLE_LIST*))[0xc74411]
      sql/sql_parse.cc:3943(mysql_execute_command(THD*, bool))[0xc609ca]
      sql/sql_class.h:2734(THD::enter_stage(PSI_stage_info_v1 const*, char const*, char const*, unsigned int))[0xc4a67f]
      sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0xc41baa]
      sql/sql_parse.cc:1404(do_command(THD*, bool))[0xc4b74c]
      sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x111f9f3]
      sql/sql_connect.cc:0(handle_one_connection)[0x111f249]
      perfschema/pfs.cc:2203(pfs_spawn_thread)[0x1f3f9de]
      nptl/pthread_create.c:478(start_thread)[0x7f826dfee609]
      ??:0(clone)[0x7f826dd04163]
       
      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0x62900008c238): SELECT 'x' IN ( SELECT 'x' FROM v0 COLUMNS NATURAL JOIN v0 WHERE v1 = -1 )
      

      Attachments

        Issue Links

          Activity

            alice Alice Sherepa added a comment -

            Thanks! I repeated on 10.2-10.8, this is the same as MDEV-24176.

            220317 16:35:44 [ERROR] mysqld got signal 11 ;
            Server version: 10.2.44-MariaDB-debug-log
             
            sigaction.c:0(__restore_rt)[0x7f347a90c3c0]
            sql/item.h:1531(Item::val_temporal_packed(enum_field_types))[0x562fec92a2cd]
            sql/item_cmpfunc.cc:792(Arg_comparator::compare_temporal(enum_field_types))[0x562fec942272]
            sql/item_cmpfunc.h:105(Arg_comparator::compare_datetime())[0x562fec00f421]
            sql/item_cmpfunc.h:87(Arg_comparator::compare())[0x562fec980826]
            sql/item_cmpfunc.cc:1806(Item_func_eq::val_int())[0x562fec94e7e8]
            sql/item_func.cc:725(Item_int_func::val_str(String*))[0x562fec9c5ff7]
            sql/item_strfunc.cc:1130(Item_func_replace::val_str(String*))[0x562feca4870b]
            sql/item.cc:6441(Item::save_in_field(Field*, bool))[0x562fec8fe2ff]
            sql/table.cc:7827(TABLE::update_virtual_fields(handler*, enum_vcol_update_mode))[0x562fec53ae38]
            sql/handler.cc:2676(handler::ha_rnd_next(unsigned char*))[0x562fec8a7ec1]
            sql/handler.cc:2904(handler::read_first_row(unsigned char*, unsigned int))[0x562fec8ac2f1]
            sql/sql_class.h:5973(handler::ha_read_first_row(unsigned char*, unsigned int))[0x562fec3c3cd6]
            sql/sql_select.cc:19446(join_read_system(st_join_table*))[0x562fec37f227]
            sql/sql_select.cc:19342(join_read_const_table(THD*, st_join_table*, st_position*))[0x562fec37e329]
            sql/sql_select.cc:4175(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x562fec317556]
            sql/sql_select.cc:1597(JOIN::optimize_inner())[0x562fec2fdb8f]
            sql/sql_select.cc:1127(JOIN::optimize())[0x562fec2f8eb6]
            sql/sql_lex.cc:3868(st_select_lex::optimize_unflattened_subqueries(bool))[0x562fec22f7c6]
            sql/opt_subselect.cc:5360(JOIN::optimize_constant_subqueries())[0x562fec6b89f0]
            sql/sql_select.cc:1349(JOIN::optimize_inner())[0x562fec2fb061]
            sql/sql_select.cc:1127(JOIN::optimize())[0x562fec2f8eb6]
            sql/sql_select.cc:3835(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x562fec3145bd]
            sql/sql_select.cc:361(handle_select(THD*, LEX*, select_result*, unsigned long))[0x562fec2f1184]
            sql/sql_parse.cc:6271(execute_sqlcom_select(THD*, TABLE_LIST*))[0x562fec2677ef]
            sql/sql_parse.cc:3582(mysql_execute_command(THD*))[0x562fec254b78]
            sql/sql_parse.cc:7793(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x562fec270d04]
            sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x562fec249f09]
            sql/sql_parse.cc:1381(do_command(THD*))[0x562fec246cd4]
            sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x562fec5d340a]
            sql/sql_connect.cc:1242(handle_one_connection)[0x562fec5d2ccd]
            perfschema/pfs.cc:1871(pfs_spawn_thread)[0x562fed973af4]
            nptl/pthread_create.c:478(start_thread)[0x7f347a900609]
            /lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f347a06e163]
             
            Query (0x62b000000290): SELECT 'x' IN ( SELECT 'x' FROM v0 COLUMNS NATURAL JOIN v0 WHERE v1 = -1 )
            

            alice Alice Sherepa added a comment - Thanks! I repeated on 10.2-10.8, this is the same as MDEV-24176 . 220317 16:35:44 [ERROR] mysqld got signal 11 ; Server version: 10.2.44-MariaDB-debug-log   sigaction.c:0(__restore_rt)[0x7f347a90c3c0] sql/item.h:1531(Item::val_temporal_packed(enum_field_types))[0x562fec92a2cd] sql/item_cmpfunc.cc:792(Arg_comparator::compare_temporal(enum_field_types))[0x562fec942272] sql/item_cmpfunc.h:105(Arg_comparator::compare_datetime())[0x562fec00f421] sql/item_cmpfunc.h:87(Arg_comparator::compare())[0x562fec980826] sql/item_cmpfunc.cc:1806(Item_func_eq::val_int())[0x562fec94e7e8] sql/item_func.cc:725(Item_int_func::val_str(String*))[0x562fec9c5ff7] sql/item_strfunc.cc:1130(Item_func_replace::val_str(String*))[0x562feca4870b] sql/item.cc:6441(Item::save_in_field(Field*, bool))[0x562fec8fe2ff] sql/table.cc:7827(TABLE::update_virtual_fields(handler*, enum_vcol_update_mode))[0x562fec53ae38] sql/handler.cc:2676(handler::ha_rnd_next(unsigned char*))[0x562fec8a7ec1] sql/handler.cc:2904(handler::read_first_row(unsigned char*, unsigned int))[0x562fec8ac2f1] sql/sql_class.h:5973(handler::ha_read_first_row(unsigned char*, unsigned int))[0x562fec3c3cd6] sql/sql_select.cc:19446(join_read_system(st_join_table*))[0x562fec37f227] sql/sql_select.cc:19342(join_read_const_table(THD*, st_join_table*, st_position*))[0x562fec37e329] sql/sql_select.cc:4175(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x562fec317556] sql/sql_select.cc:1597(JOIN::optimize_inner())[0x562fec2fdb8f] sql/sql_select.cc:1127(JOIN::optimize())[0x562fec2f8eb6] sql/sql_lex.cc:3868(st_select_lex::optimize_unflattened_subqueries(bool))[0x562fec22f7c6] sql/opt_subselect.cc:5360(JOIN::optimize_constant_subqueries())[0x562fec6b89f0] sql/sql_select.cc:1349(JOIN::optimize_inner())[0x562fec2fb061] sql/sql_select.cc:1127(JOIN::optimize())[0x562fec2f8eb6] sql/sql_select.cc:3835(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x562fec3145bd] sql/sql_select.cc:361(handle_select(THD*, LEX*, select_result*, unsigned long))[0x562fec2f1184] sql/sql_parse.cc:6271(execute_sqlcom_select(THD*, TABLE_LIST*))[0x562fec2677ef] sql/sql_parse.cc:3582(mysql_execute_command(THD*))[0x562fec254b78] sql/sql_parse.cc:7793(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x562fec270d04] sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x562fec249f09] sql/sql_parse.cc:1381(do_command(THD*))[0x562fec246cd4] sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x562fec5d340a] sql/sql_connect.cc:1242(handle_one_connection)[0x562fec5d2ccd] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x562fed973af4] nptl/pthread_create.c:478(start_thread)[0x7f347a900609] /lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f347a06e163]   Query (0x62b000000290): SELECT 'x' IN ( SELECT 'x' FROM v0 COLUMNS NATURAL JOIN v0 WHERE v1 = -1 )

            People

              Unassigned Unassigned
              fuboat Jingzhou Fu
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.