Details
Description
poc:
CREATE TABLE v896 ( CONSTRAINT v901 PRIMARY KEY ( v900 , v899 ) , v897 INTEGER , v898 BIGINT , v899 INT , v900 VARCHAR ( 1 ) , CONSTRAINT v902 UNIQUE INDEX v903 ( v897 , v899 ) ) ; |
CREATE VIEW v904 ( v911 ) AS SELECT EXISTS ( SELECT 1 ) FROM ( WITH v906 AS ( SELECT v897 % 27 != 52 FROM ( SELECT 81 , 15 , v897 FROM v896 WHERE v899 = 78 ) AS v905 GROUP BY v897 ) SELECT -1 * -128 FROM ( SELECT DISTINCT v900 , 'x' FROM v896 ) AS v907 NATURAL JOIN v906 AS v908 , v906 AS v909 NATURAL JOIN v906 ) AS v910 NATURAL JOIN v896 ; |
SELECT DISTINCT ( SELECT v911 FROM v904 WHERE ( v911 ) NOT IN ( SELECT 8 < v911 AND v911 = 0 FROM v904 AS v912 NATURAL JOIN v904 WHERE v911 != -2147483648 GROUP BY v911 ) ) * 63 , ( v911 = -128 OR v911 > 'x' ) FROM v904 WHERE v911 = 40 AND ( v911 = 26 OR v911 = -1 OR v911 = -1 ) LIMIT 1 OFFSET 1 ; |
DROP TABLE v896 ; |
INSERT INTO x VALUES ( -32768 ) ; |
output:
SUMMARY: AddressSanitizer: SEGV /sql/item_subselect.cc:2996 in Item_exists_subselect::exists2in_processor(void*)
The full error log is in the attachment.
Attachments
Issue Links
- includes
-
MDEV-28621 group by optimization incorrectly removing subquery where subject buried in a function
-
- Closed
-
-
MDEV-29411 SIGSEGV's st_select_lex_unit::set_limit and st_select_lex::get_offset, and Assertion `!eliminated' failed in Item_subselect::exec on SELECT, UBSAN: member access within null pointer of type 'struct st_select_lex' in st_select_lex_unit::set_limit
-
- Confirmed
-
-
MDEV-30842 Item_subselect::get_cache_parameters and UBSAN member access within null pointer of type 'struct st_select_lex' in Item_subselect::get_cache_parameters on INSERT
-
- Stalled
-
- is duplicated by
-
MDEV-32309 Server crashes at Item_subselect::is_expensive
-
- Closed
-
-
MDEV-32406 Segmentation fault at /mariadb-11.3.0/sql/item_subselect.cc:3114
-
- Closed
-
- relates to
-
MDEV-28437 Assertion `!eliminated' failed in Item_subselect::exec
-
- Closed
-
-
MDEV-28620 Server crash in /sql/item_subselect.cc:812 in Item_subselect::get_cache_parameters(List<Item>&)
-
- Closed
-
-
MDEV-28833 SIGSEGV in Item_field::used_tables on PREPARED STATEMENT with nested SELECT's
-
- Confirmed
-
-
MDEV-28034 SIGSEGV in Item_args::walk_args and libstdc++ __cxa_pure_virtual terminate/SIGABRT in Item::check_type_scalar
-
- Closed
-
-
MDEV-31432 tmp_table field accessed after free
-
- Closed
-
-
MDEV-33126 virtual bool Item_subselect::exec(): Assertion `!eliminated' failed
-
- Closed
-
Looking at
commit 7b43a0d42d0a53197114594694c4704c23318acc
Author: Rex <rex.johnston@mariadb.com>
Date: Tue Jun 27 15:51:10 2023 +1100
MDEV-28622 Item_subselect eliminated flag set but Item still evaluated/used.
Subquery elimination by optimizer not taken into account elsewhere.
Let's simplify the testcase, replace one use "v1" with a reguar table t2:
create table t2 ( i int);
SELECT 1 FROM t2 WHERE i IN (SELECT i + 0 FROM v1 WHERE i = -1 GROUP BY i);
The above works with the patch.
But if I modify the testcase a bit, I still get the same crash:
create table t2 ( i int);
SELECT 1 FROM t2 WHERE i IN (SELECT i + 0 FROM v1 WHERE i = -1 GROUP BY i+1);