Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28619

Server crash in /sql/sql_window.cc:3033 in Window_funcs_sort::setup(THD*, SQL_SELECT*, List_iterator<Item_window_func>&, st_join_table*)

Details

    • Bug
    • Status: Stalled (View Workflow)
    • Critical
    • Resolution: Unresolved
    • 10.3.35, 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL)
    • 10.5, 10.6, 10.11
    • ubuntu 18.04

    Description

      poc:

      CREATE TABLE v983 ( v984 FLOAT NOT NULL ) ;
       INSERT INTO v983 ( v984 ) VALUES ( 52 ) ;
       UPDATE v983 SET v984 = 46 WHERE v984 = 26 ;
       INSERT INTO v983 ( v984 ) VALUES ( 0 ) , ( 0 ) ;
       WITH v986 AS ( SELECT v984 FROM ( SELECT v984 FROM v983 GROUP BY v984 ) AS v985 ) SELECT v984 FROM v986 WHERE v984 BETWEEN FALSE AND ( ( ( v984 OR NOT v984 ) BETWEEN ( ( ( v984 = ( ( ( ( v984 , v984 ) NOT IN ( SELECT ( 'x' = ( v984 IN ( SELECT v984 FROM ( SELECT v984 FROM ( SELECT DISTINCT ( ( NOT ( 41280532.000000 AND v984 = 9 ) ) = -128 AND v984 = -1 ) % 2147483647 , ( v984 = 71 OR v984 > 'x' ) FROM v983 WHERE v984 = 66 AND ( v984 = 10 OR v984 = 0 OR v984 = 22760412.000000 ) ) AS v987 NATURAL JOIN v983 WHERE v984 BETWEEN FALSE AND ( ( 69654023.000000 = 79 OR 'x' * 35 = 55 ) NOT LIKE 'x' ) ) AS v988 NATURAL JOIN v983 AS v989 UNION SELECT 50 FROM v983 ORDER BY LAST_VALUE ( ( NOT ( v984 * 72 = 10 * NULL ) ) ) OVER x DESC ) ) ) , 'x' FROM v983 ) ) = 'x' * NULL ) IN ( SELECT v984 FROM v983 ) ) < 'x' ) ) ) AND 66525661.000000 ) ) ;
      

      output:
      SUMMARY: AddressSanitizer: SEGV /sql/sql_window.cc:3033 in Window_funcs_sort::setup(THD*, SQL_SELECT*, List_iterator<Item_window_func>&, st_join_table*)

      The full error log is in the attachment.

      Attachments

        Issue Links

          Activity

            danblack Daniel Black added a comment -

            Confirmed on 10.3.35+c9b5a05341d7342db5f369493ea200b5fb9db243 for the CTE. UPDATE is a noop and not needed for reproduction case..

            danblack Daniel Black added a comment - Confirmed on 10.3.35+c9b5a05341d7342db5f369493ea200b5fb9db243 for the CTE. UPDATE is a noop and not needed for reproduction case..
            alice Alice Sherepa added a comment -

             SELECT 1 IN (SELECT 1 a UNION SELECT 5 ORDER BY LAST_VALUE (a) OVER XXX);
            

            bb-10.2-release 0ba528fe56f6c637d9fbc9d177a

            220519 10:16:20 [ERROR] mysqld got signal 11 ;
             
            Server version: 10.2.44-MariaDB-debug-log
             
            mysys/stacktrace.c:172(my_print_stacktrace)[0x55fe57919fc0]
            sql/signal_handler.cc:221(handle_fatal_signal)[0x55fe566506f0]
            sql/sql_window.cc:2892(Window_funcs_sort::setup(THD*, SQL_SELECT*, List_iterator<Item_window_func>&, st_join_table*))[0x55fe564ba03c]
            sql/sql_window.cc:2972(Window_funcs_computation::setup(THD*, List<Item_window_func>*, st_join_table*))[0x55fe564ba962]
            sql/sql_select.cc:2940(JOIN::make_aggr_tables_info())[0x55fe560a16b6]
            sql/sql_select.cc:2259(JOIN::optimize_inner())[0x55fe56099d41]
            sql/sql_select.cc:1127(JOIN::optimize())[0x55fe5608e504]
            sql/sql_select.cc:3835(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55fe560a9988]
            sql/sql_union.cc:1198(st_select_lex_unit::exec())[0x55fe56277a6c]
            sql/item_subselect.cc:4047(subselect_union_engine::exec())[0x55fe5686341f]
            sql/item_subselect.cc:771(Item_subselect::exec())[0x55fe56841aa8]
            sql/item_subselect.cc:951(Item_in_subselect::exec())[0x55fe56842f86]
            sql/item_subselect.cc:1873(Item_in_subselect::val_bool())[0x55fe5684c1f6]
            sql/item.h:1278(Item::val_bool_result())[0x55fe55dba316]
            sql/item_cmpfunc.cc:1680(Item_in_optimizer::val_int())[0x55fe56708db2]
            sql/item.cc:6991(Item::send(Protocol*, String*))[0x55fe566bf74f]
            sql/protocol.cc:993(Protocol::send_result_set_row(List<Item>*))[0x55fe55daeab3]
            sql/sql_class.cc:2854(select_send::send_data(List<Item>&))[0x55fe55f2580f]
            sql/sql_select.cc:3526(JOIN::exec_inner())[0x55fe560a7613]
            sql/sql_select.cc:3447(JOIN::exec())[0x55fe560a6496]
            sql/sql_select.cc:3851(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55fe560a9b67]
            sql/sql_select.cc:361(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55fe560865e6]
            sql/sql_parse.cc:6271(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55fe55ff95ae]
            sql/sql_parse.cc:3582(mysql_execute_command(THD*))[0x55fe55fe4d35]
            sql/sql_parse.cc:7793(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55fe560028cc]
            sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55fe55fd9919]
            sql/sql_parse.cc:1381(do_command(THD*))[0x55fe55fd634a]
            sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x55fe56383222]
            sql/sql_connect.cc:1242(handle_one_connection)[0x55fe56382ae3]
            perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55fe5781e796]
            nptl/pthread_create.c:487(start_thread)[0x7f51b54ebfa3]
            x86_64/clone.S:97(clone)[0x7f51b4892eff]
             
            Query (0x62b000000410): SELECT 1 IN (SELECT 1 a UNION SELECT 5 ORDER BY LAST_VALUE (a) OVER XXX)
            
            

            alice Alice Sherepa added a comment - SELECT 1 IN ( SELECT 1 a UNION SELECT 5 ORDER BY LAST_VALUE (a) OVER XXX); bb-10.2-release 0ba528fe56f6c637d9fbc9d177a 220519 10:16:20 [ERROR] mysqld got signal 11 ;   Server version: 10.2.44-MariaDB-debug-log   mysys/stacktrace.c:172(my_print_stacktrace)[0x55fe57919fc0] sql/signal_handler.cc:221(handle_fatal_signal)[0x55fe566506f0] sql/sql_window.cc:2892(Window_funcs_sort::setup(THD*, SQL_SELECT*, List_iterator<Item_window_func>&, st_join_table*))[0x55fe564ba03c] sql/sql_window.cc:2972(Window_funcs_computation::setup(THD*, List<Item_window_func>*, st_join_table*))[0x55fe564ba962] sql/sql_select.cc:2940(JOIN::make_aggr_tables_info())[0x55fe560a16b6] sql/sql_select.cc:2259(JOIN::optimize_inner())[0x55fe56099d41] sql/sql_select.cc:1127(JOIN::optimize())[0x55fe5608e504] sql/sql_select.cc:3835(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55fe560a9988] sql/sql_union.cc:1198(st_select_lex_unit::exec())[0x55fe56277a6c] sql/item_subselect.cc:4047(subselect_union_engine::exec())[0x55fe5686341f] sql/item_subselect.cc:771(Item_subselect::exec())[0x55fe56841aa8] sql/item_subselect.cc:951(Item_in_subselect::exec())[0x55fe56842f86] sql/item_subselect.cc:1873(Item_in_subselect::val_bool())[0x55fe5684c1f6] sql/item.h:1278(Item::val_bool_result())[0x55fe55dba316] sql/item_cmpfunc.cc:1680(Item_in_optimizer::val_int())[0x55fe56708db2] sql/item.cc:6991(Item::send(Protocol*, String*))[0x55fe566bf74f] sql/protocol.cc:993(Protocol::send_result_set_row(List<Item>*))[0x55fe55daeab3] sql/sql_class.cc:2854(select_send::send_data(List<Item>&))[0x55fe55f2580f] sql/sql_select.cc:3526(JOIN::exec_inner())[0x55fe560a7613] sql/sql_select.cc:3447(JOIN::exec())[0x55fe560a6496] sql/sql_select.cc:3851(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55fe560a9b67] sql/sql_select.cc:361(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55fe560865e6] sql/sql_parse.cc:6271(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55fe55ff95ae] sql/sql_parse.cc:3582(mysql_execute_command(THD*))[0x55fe55fe4d35] sql/sql_parse.cc:7793(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55fe560028cc] sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55fe55fd9919] sql/sql_parse.cc:1381(do_command(THD*))[0x55fe55fd634a] sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x55fe56383222] sql/sql_connect.cc:1242(handle_one_connection)[0x55fe56382ae3] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55fe5781e796] nptl/pthread_create.c:487(start_thread)[0x7f51b54ebfa3] x86_64/clone.S:97(clone)[0x7f51b4892eff]   Query (0x62b000000410): SELECT 1 IN (SELECT 1 a UNION SELECT 5 ORDER BY LAST_VALUE (a) OVER XXX)
            igor Igor Babaev added a comment -

            Some observations:

            The query

            SELECT 1 a UNION SELECT 5 ORDER BY LAST_VALUE (a) OVER XXX;
            

            returns the expected error message

            ERROR 4009 (HY000): Window specification with name 'XXX' is not defined
            

            The query

            SELECT 1 a UNION SELECT 5 ORDER BY z;
            

            also returns the expected error message

            Unknown column 'z' in 'order clause'
            

            At the same time the query

            SELECT 1 IN (SELECT 1 a UNION SELECT 5 ORDER BY z);
            

            does not return such message. Instead it returns a result set

            MariaDB [test]>  SELECT 1 IN (SELECT 1 a UNION SELECT 5 ORDER BY z);
            +---------------------------------------------+
            | 1 IN (SELECT 1 a UNION SELECT 5 ORDER BY z) |
            +---------------------------------------------+
            |                                           1 |
            +---------------------------------------------+
            

            It looks like there are no name resolutions in global ORDER BY lists of IN subqueries.

            igor Igor Babaev added a comment - Some observations: The query SELECT 1 a UNION SELECT 5 ORDER BY LAST_VALUE (a) OVER XXX; returns the expected error message ERROR 4009 (HY000): Window specification with name 'XXX' is not defined The query SELECT 1 a UNION SELECT 5 ORDER BY z; also returns the expected error message Unknown column 'z' in 'order clause' At the same time the query SELECT 1 IN ( SELECT 1 a UNION SELECT 5 ORDER BY z); does not return such message. Instead it returns a result set MariaDB [test]> SELECT 1 IN (SELECT 1 a UNION SELECT 5 ORDER BY z); +---------------------------------------------+ | 1 IN (SELECT 1 a UNION SELECT 5 ORDER BY z) | +---------------------------------------------+ | 1 | +---------------------------------------------+ It looks like there are no name resolutions in global ORDER BY lists of IN subqueries.
            igor Igor Babaev added a comment -

            See my comment in MDEV

            igor Igor Babaev added a comment - See my comment in MDEV

            People

              sanja Oleksandr Byelkin
              nobody Shihao Wen
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.