Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28903

SIGSEGV in Item::save_decimal_in_field on UPDATE

    XMLWordPrintable

    Details

      Description

      CREATE TABLE t (c INT) ENGINE=InnoDB;
      INSERT INTO t (c) VALUES (1);
      UPDATE t SET c=1 WHERE c IN (SELECT 1 IN (SELECT 1) AS d FROM t ORDER BY 1 + AVG(c) OVER (ORDER BY c));
      

      Leads to:

      10.3.36 9d10b7107cf022b939dc61cedf8fc8985443c880 (Optimized)

      Core was generated by `/test/MD310522-mariadb-10.3.36-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  Item::save_decimal_in_field (this=0x14c1bc012788, field=0x0, 
          no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:6995
      [Current thread is 1 (Thread 0x14c21c157700 (LWP 172503))]
      (gdb) bt
      #0  Item::save_decimal_in_field (this=0x14c1bc012788, field=0x0, no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:6995
      #1  0x000055fa50605a87 in Item::save_in_field (this=0x14c1bc012788, field=0x0, no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:7012
      #2  0x000055fa50556392 in save_window_function_values (rowid_buf=0x14c1bc01ea68 "\370\366\002\274\301\024", tbl=0x14c1bc027200, window_functions=@0x14c1bc0241f8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14c1bc024218, last = 0x14c1bc024218, elements = 1}, <No data fields>}) at /test/10.3_opt/sql/sql_window.cc:2769
      #3  compute_window_func (thd=0x14c1bc000c48, window_functions=@0x14c1bc0241f8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14c1bc024218, last = 0x14c1bc024218, elements = 1}, <No data fields>}, cursor_managers=@0x14c21c154940: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14c1bc02c718, last = 0x14c1bc02c718, elements = 1}, <No data fields>}, tbl=0x14c1bc027200, filesort_result=<optimized out>) at /test/10.3_opt/sql/sql_window.cc:2921
      #4  0x000055fa50556765 in Window_func_runner::exec (this=this@entry=0x14c1bc0241f0, thd=thd@entry=0x14c1bc000c48, tbl=0x14c1bc027200, filesort_result=0x14c1bc018e50) at /test/10.3_opt/sql/sql_window.cc:3024
      #5  0x000055fa50556896 in Window_funcs_sort::exec (this=0x14c1bc0241e8, join=join@entry=0x14c1bc013580, keep_filesort_result=<optimized out>) at /test/10.3_opt/sql/sql_window.cc:3052
      #6  0x000055fa50557375 in Window_funcs_computation::exec (this=0x14c1bc0241c8, join=join@entry=0x14c1bc013580, keep_last_filesort_result=keep_last_filesort_result@entry=true) at /test/10.3_opt/sql/sql_window.cc:3179
      #7  0x000055fa5046b16e in AGGR_OP::end_send (this=0x14c1bc023f68) at /test/10.3_opt/sql/sql_select.cc:28035
      #8  0x000055fa5046b4a0 in sub_select_postjoin_aggr (join=0x14c1bc013580, join_tab=0x14c1bc023380, end_of_records=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:19601
      #9  0x000055fa50470536 in do_select (procedure=<optimized out>, join=0x14c1bc013580) at /test/10.3_opt/sql/sql_select.cc:19425
      #10 JOIN::exec_inner (this=this@entry=0x14c1bc013580) at /test/10.3_opt/sql/sql_select.cc:4151
      #11 0x000055fa504709d6 in JOIN::exec (this=0x14c1bc013580) at /test/10.3_opt/sql/sql_select.cc:3945
      #12 0x000055fa505305da in join_tab_execution_startup (tab=tab@entry=0x14c1bc02aa88) at /test/10.3_opt/sql/opt_subselect.cc:5421
      #13 0x000055fa504474d5 in sub_select (end_of_records=false, join_tab=0x14c1bc02aa88, join=0x14c1bc012eb0) at /test/10.3_opt/sql/sql_select.cc:19873
      #14 sub_select (join=0x14c1bc012eb0, join_tab=0x14c1bc02aa88, end_of_records=false) at /test/10.3_opt/sql/sql_select.cc:19820
      #15 0x000055fa504396c3 in evaluate_join_record (join=join@entry=0x14c1bc012eb0, join_tab=join_tab@entry=0x14c1bc02a6f8, error=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:20112
      #16 0x000055fa50447513 in sub_select (end_of_records=false, join_tab=0x14c1bc02a6f8, join=0x14c1bc012eb0) at /test/10.3_opt/sql/sql_select.cc:19885
      #17 sub_select (join=0x14c1bc012eb0, join_tab=0x14c1bc02a6f8, end_of_records=false) at /test/10.3_opt/sql/sql_select.cc:19820
      #18 0x000055fa50470655 in do_select (procedure=<optimized out>, join=0x14c1bc012eb0) at /test/10.3_opt/sql/sql_select.cc:19423
      #19 JOIN::exec_inner (this=this@entry=0x14c1bc012eb0) at /test/10.3_opt/sql/sql_select.cc:4151
      #20 0x000055fa504709d6 in JOIN::exec (this=this@entry=0x14c1bc012eb0) at /test/10.3_opt/sql/sql_select.cc:3945
      #21 0x000055fa50470b72 in mysql_select (thd=thd@entry=0x14c1bc000c48, tables=tables@entry=0x14c1bc00f640, wild_num=0, fields=@0x14c21c154d70: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55fa5127c910 <end_of_list>, last = 0x14c21c154d70, elements = 0}, <No data fields>}, conds=conds@entry=0x14c1bc012990, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14c1bc012da0, unit=0x14c1bc0047a0, select_lex=0x14c1bc004f38) at /test/10.3_opt/sql/sql_select.cc:4354
      #22 0x000055fa504bef55 in mysql_multi_update (thd=thd@entry=0x14c1bc000c48, table_list=0x14c1bc00f640, fields=fields@entry=0x14c1bc005060, values=values@entry=0x14c1bc005590, conds=0x14c1bc012990, options=0, handle_duplicates=DUP_ERROR, ignore=false, unit=0x14c1bc0047a0, select_lex=0x14c1bc004f38, result=0x14c21c154f40) at /test/10.3_opt/sql/sql_update.cc:1824
      #23 0x000055fa50411250 in mysql_execute_command (thd=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:4419
      #24 0x000055fa50416a82 in mysql_parse (thd=0x14c1bc000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:7870
      #25 0x000055fa5041885d in dispatch_command (command=COM_QUERY, thd=0x14c1bc000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_class.h:1152
      #26 0x000055fa5041a21d in do_command (thd=0x14c1bc000c48) at /test/10.3_opt/sql/sql_parse.cc:1398
      #27 0x000055fa504f836e in do_handle_one_connection (connect=<optimized out>) at /test/10.3_opt/sql/sql_connect.cc:1403
      #28 0x000055fa504f83ed in handle_one_connection (arg=<optimized out>) at /test/10.3_opt/sql/sql_connect.cc:1308
      #29 0x000014c21f059609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #30 0x000014c21ef7e133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.3.36 9d10b7107cf022b939dc61cedf8fc8985443c880 (Debug)

      Core was generated by `/test/MD310522-mariadb-10.3.36-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  Item::save_decimal_in_field (this=0x147ccc012788, field=0x0, 
          no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:6995
      [Current thread is 1 (Thread 0x147d0810a700 (LWP 172298))]
      (gdb) bt
      #0  Item::save_decimal_in_field (this=0x147ccc012788, field=0x0, no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:6995
      #1  0x00005592e906ea87 in Item::save_in_field (this=0x147ccc012788, field=0x0, no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:7012
      #2  0x00005592e8fbf392 in save_window_function_values (rowid_buf=0x147ccc016e58 "\370\366\002\314|\024", tbl=0x147ccc027200, window_functions=@0x147ccc0241f8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x147ccc024218, last = 0x147ccc024218, elements = 1}, <No data fields>}) at /test/10.3_opt/sql/sql_window.cc:2769
      #3  compute_window_func (thd=0x147ccc000c48, window_functions=@0x147ccc0241f8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x147ccc024218, last = 0x147ccc024218, elements = 1}, <No data fields>}, cursor_managers=@0x147d08107940: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x147ccc02c718, last = 0x147ccc02c718, elements = 1}, <No data fields>}, tbl=0x147ccc027200, filesort_result=<optimized out>) at /test/10.3_opt/sql/sql_window.cc:2921
      #4  0x00005592e8fbf765 in Window_func_runner::exec (this=this@entry=0x147ccc0241f0, thd=thd@entry=0x147ccc000c48, tbl=0x147ccc027200, filesort_result=0x147ccc018e50) at /test/10.3_opt/sql/sql_window.cc:3024
      #5  0x00005592e8fbf896 in Window_funcs_sort::exec (this=0x147ccc0241e8, join=join@entry=0x147ccc013580, keep_filesort_result=<optimized out>) at /test/10.3_opt/sql/sql_window.cc:3052
      #6  0x00005592e8fc0375 in Window_funcs_computation::exec (this=0x147ccc0241c8, join=join@entry=0x147ccc013580, keep_last_filesort_result=keep_last_filesort_result@entry=true) at /test/10.3_opt/sql/sql_window.cc:3179
      #7  0x00005592e8ed416e in AGGR_OP::end_send (this=0x147ccc023f68) at /test/10.3_opt/sql/sql_select.cc:28035
      #8  0x00005592e8ed44a0 in sub_select_postjoin_aggr (join=0x147ccc013580, join_tab=0x147ccc023380, end_of_records=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:19601
      #9  0x00005592e8ed9536 in do_select (procedure=<optimized out>, join=0x147ccc013580) at /test/10.3_opt/sql/sql_select.cc:19425
      #10 JOIN::exec_inner (this=this@entry=0x147ccc013580) at /test/10.3_opt/sql/sql_select.cc:4151
      #11 0x00005592e8ed99d6 in JOIN::exec (this=0x147ccc013580) at /test/10.3_opt/sql/sql_select.cc:3945
      #12 0x00005592e8f995da in join_tab_execution_startup (tab=tab@entry=0x147ccc02aa88) at /test/10.3_opt/sql/opt_subselect.cc:5421
      #13 0x00005592e8eb04d5 in sub_select (end_of_records=false, join_tab=0x147ccc02aa88, join=0x147ccc012eb0) at /test/10.3_opt/sql/sql_select.cc:19873
      #14 sub_select (join=0x147ccc012eb0, join_tab=0x147ccc02aa88, end_of_records=false) at /test/10.3_opt/sql/sql_select.cc:19820
      #15 0x00005592e8ea26c3 in evaluate_join_record (join=join@entry=0x147ccc012eb0, join_tab=join_tab@entry=0x147ccc02a6f8, error=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:20112
      #16 0x00005592e8eb0513 in sub_select (end_of_records=false, join_tab=0x147ccc02a6f8, join=0x147ccc012eb0) at /test/10.3_opt/sql/sql_select.cc:19885
      #17 sub_select (join=0x147ccc012eb0, join_tab=0x147ccc02a6f8, end_of_records=false) at /test/10.3_opt/sql/sql_select.cc:19820
      #18 0x00005592e8ed9655 in do_select (procedure=<optimized out>, join=0x147ccc012eb0) at /test/10.3_opt/sql/sql_select.cc:19423
      #19 JOIN::exec_inner (this=this@entry=0x147ccc012eb0) at /test/10.3_opt/sql/sql_select.cc:4151
      #20 0x00005592e8ed99d6 in JOIN::exec (this=this@entry=0x147ccc012eb0) at /test/10.3_opt/sql/sql_select.cc:3945
      #21 0x00005592e8ed9b72 in mysql_select (thd=thd@entry=0x147ccc000c48, tables=tables@entry=0x147ccc00f640, wild_num=0, fields=@0x147d08107d70: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5592e9ce5910 <end_of_list>, last = 0x147d08107d70, elements = 0}, <No data fields>}, conds=conds@entry=0x147ccc012990, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x147ccc012da0, unit=0x147ccc0047a0, select_lex=0x147ccc004f38) at /test/10.3_opt/sql/sql_select.cc:4354
      #22 0x00005592e8f27f55 in mysql_multi_update (thd=thd@entry=0x147ccc000c48, table_list=0x147ccc00f640, fields=fields@entry=0x147ccc005060, values=values@entry=0x147ccc005590, conds=0x147ccc012990, options=0, handle_duplicates=DUP_ERROR, ignore=false, unit=0x147ccc0047a0, select_lex=0x147ccc004f38, result=0x147d08107f40) at /test/10.3_opt/sql/sql_update.cc:1824
      #23 0x00005592e8e7a250 in mysql_execute_command (thd=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:4419
      #24 0x00005592e8e7fa82 in mysql_parse (thd=0x147ccc000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:7870
      #25 0x00005592e8e8185d in dispatch_command (command=COM_QUERY, thd=0x147ccc000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_class.h:1152
      #26 0x00005592e8e8321d in do_command (thd=0x147ccc000c48) at /test/10.3_opt/sql/sql_parse.cc:1398
      #27 0x00005592e8f6136e in do_handle_one_connection (connect=<optimized out>) at /test/10.3_opt/sql/sql_connect.cc:1403
      #28 0x00005592e8f613ed in handle_one_connection (arg=<optimized out>) at /test/10.3_opt/sql/sql_connect.cc:1308
      #29 0x0000147d2e8b0609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #30 0x0000147d2e7d5133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.3.36 (dbg), 10.3.36 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.4.26 (dbg), 10.4.26 (opt), 10.5.17 (dbg), 10.5.17 (opt), 10.6.9 (dbg), 10.6.9 (opt), 10.7.5 (dbg), 10.7.5 (opt), 10.8.4 (dbg), 10.8.4 (opt), 10.9.2 (dbg), 10.9.2 (opt), 10.10.0 (dbg), 10.10.0 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

      SIGSEGV|Item::save_decimal_in_field|Item::save_in_field|save_window_function_values|compute_window_func
      

        Attachments

          Activity

            People

            Assignee:
            psergei Sergei Petrunia
            Reporter:
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated:

                Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.