Server crashes in CntCloseTable/ha_connect::CloseTable/ha_connect::external_lock

CREATE TABLE t1 (i int) engine=connect;

INSERT INTO t1 VALUES (1),(2);

CREATE FUNCTION f() RETURNS int RETURN (SELECT i FROM t1 limit 1);

DELETE FROM t1 RETURNING f();

#3  <signal handler called>

No locals.

#4  0x00007fea0731a9b8 in ?? ()

No symbol table info available.

#5  0x00007fea13ecd36c in CntCloseTable (g=0x6250000f0100, tdbp=0x7fea0731ab60, nox=true, abort=false) at /10.3/src/storage/connect/connect.cc:549

        rc = 0

#6  0x00007fea13e9ea44 in ha_connect::CloseTable (this=0x61d0001a8710, g=0x6250000f0100) at /10.3/src/storage/connect/ha_connect.cc:2177

        rc = 24704

#7  0x00007fea13eb3c12 in ha_connect::external_lock (this=0x61d0001a8710, thd=0x62a000060270, lock_type=2) at /10.3/src/storage/connect/ha_connect.cc:5011

        sqlcom = 7

        rc = 0

        xcheck = false

        cras = false

        newmode = MODE_ANY

        options = 0x619000074ba0

        g = 0x6250000f0100

        _db_stack_frame_ = {func = 0x560cc0efacc0 "handler::ha_external_lock", file = 0x560cc0ef3cc0 "/10.3/src/sql/handler.cc", level = 2147483657, line = -1, prev = 0x7fea0f51ea60}

        __PRETTY_FUNCTION__ = "virtual int ha_connect::external_lock(THD*, int)"

#8  0x0000560cbf6a675b in handler::ha_external_lock (this=0x61d0001a8710, thd=0x62a000060270, lock_type=2) at /10.3/src/sql/handler.cc:6418

        locker = 0x0

        state = {m_flags = 257026864, m_io_operation = 32746, m_table = 0x41ea3d5a, m_table_share = 0x560cc0f6df20, m_thread = 0x0, m_timer_start = 140643256101600, m_timer = 0x10000c0a10c1c, m_wait = 0x7fea0f51eb00, m_index = 3232207255}

        error = 32746

        _db_stack_frame_ = {func = 0x560cc0f6df20 "unlock_external", file = 0x560cc0f6d440 "/10.3/src/sql/lock.cc", level = 2147483656, line = -1, prev = 0x7fea0f51ebb0}

        __PRETTY_FUNCTION__ = "int handler::ha_external_lock(THD*, int)"

#9  0x0000560cbf984168 in unlock_external (thd=0x62a000060270, table=0x62b000002b30, count=2) at /10.3/src/sql/lock.cc:708

        error = 93

        error_code = 0

        _db_stack_frame_ = {func = 0x560cc0f6da20 "mysql_unlock_tables", file = 0x560cc0f6d440 "/10.3/src/sql/lock.cc", level = 2147483655, line = -1, prev = 0x7fea0f51ece0}

#10 0x0000560cbf981a90 in mysql_unlock_tables (thd=0x62a000060270, sql_lock=0x62b000002af0, free_lock=false) at /10.3/src/sql/lock.cc:429

        errors = true

        org_stage = {m_key = 20, m_name = 0x560cc0b45ce0 "Closing tables", m_flags = 1102416563}

        _db_stack_frame_ = {func = 0x560cc0b93ae0 "close_thread_tables", file = 0x560cc0b93340 "/10.3/src/sql/sql_base.cc", level = 2147483654, line = -1, prev = 0x7fea0f51ede0}

        __PRETTY_FUNCTION__ = "void mysql_unlock_tables(THD*, MYSQL_LOCK*, bool)"

#11 0x0000560cbf9818c7 in mysql_unlock_tables (thd=0x62a000060270, sql_lock=0x62b000002af0) at /10.3/src/sql/lock.cc:413

No locals.

#12 0x0000560cbed77f02 in close_thread_tables (thd=0x62a000060270) at /10.3/src/sql/sql_base.cc:863

        table = 0x0

        _db_stack_frame_ = {func = 0x560cc0be42c0 "mysql_execute_command", file = 0x560cc0be1ca0 "/10.3/src/sql/sql_parse.cc", level = 2147483653, line = -1, prev = 0x7fea0f51f1a0}

        __PRETTY_FUNCTION__ = "void close_thread_tables(THD*)"

#13 0x0000560cbef0a4c7 in mysql_execute_command (thd=0x62a000060270) at /10.3/src/sql/sql_parse.cc:6160

        res = 1

        up_result = 0

        lex = 0x62a000064060

        select_lex = 0x62a0000648b8

        first_table = 0x62b0000003a0

        all_tables = 0x62b0000003a0

        unit = 0x62a000064120

        have_table_map_for_update = false

        rpl_filter = 0x7fea1ccd3e4f <__interceptor_memset(void*, int, __sanitizer::uptr)+191>

        _db_stack_frame_ = {func = 0x560cc0be6ec0 "mysql_parse", file = 0x560cc0be1ca0 "/10.3/src/sql/sql_parse.cc", level = 2147483652, line = -1, prev = 0x7fea0f520540}

        __PRETTY_FUNCTION__ = "int mysql_execute_command(THD*)"

        orig_binlog_format = BINLOG_FORMAT_MIXED

        orig_current_stmt_binlog_format = BINLOG_FORMAT_STMT

#14 0x0000560cbef15f12 in mysql_parse (thd=0x62a000060270, rawbuf=0x62b000000290 "DELETE FROM t1 RETURNING f()", length=28, parser_state=0x7fea0f520860, is_com_multi=false, is_next_command=false) at /10.3/src/sql/sql_parse.cc:7870

        found_semicolon = 0x0

        error = 24880

        lex = 0x62a000064060

        err = false

        _db_stack_frame_ = {func = 0x560cc0be2c40 "dispatch_command", file = 0x560cc0be1ca0 "/10.3/src/sql/sql_parse.cc", level = 2147483651, line = -1, prev = 0x7fea0f520820}

        __PRETTY_FUNCTION__ = "void mysql_parse(THD*, char*, uint, Parser_state*, bool, bool)"

#15 0x0000560cbeeecdef in dispatch_command (command=COM_QUERY, thd=0x62a000060270, packet=0x6290000dc271 "", packet_length=28, is_com_multi=false, is_next_command=false) at /10.3/src/sql/sql_parse.cc:1852

        packet_end = 0x62b0000002ac ""

        parser_state = {m_lip = {lookahead_token = -1, lookahead_yylval = 0x0, m_thd = 0x62a000060270, m_ptr = 0x62b0000002ad "\004", m_tok_start = 0x62b0000002ad "\004", m_tok_end = 0x62b0000002ad "\004", m_end_of_query = 0x62b0000002ac "", m_tok_start_prev = 0x62b0000002ac "", m_buf = 0x62b000000290 "DELETE FROM t1 RETURNING f()", m_buf_length = 28, m_echo = true, m_echo_saved = 11, m_cpp_buf = 0x62b000000310 "DELETE FROM t1 RETURNING f()", m_cpp_ptr = 0x62b00000032c "", m_cpp_tok_start = 0x62b00000032c "", m_cpp_tok_start_prev = 0x62b00000032c "", m_cpp_tok_end = 0x62b00000032c "", m_body_utf8 = 0x0, m_body_utf8_ptr = 0x6250000f3451 "", m_cpp_utf8_processed_ptr = 0x0, next_state = MY_LEX_END, found_semicolon = 0x0, ignore_space = false, stmt_prepare_mode = false, multi_statements = true, yylineno = 1, m_digest = 0x0, in_comment = NO_COMMENT, in_comment_saved = NO_COMMENT, m_cpp_text_start = 0x62b000000329 "f()", m_cpp_text_end = 0x62b00000032a "()", m_underscore_cs = 0x0}, m_yacc = {yacc_yyss = 0x0, yacc_yyvs = 0x0, m_set_signal_info = {m_item = {0x0 <repeats 12 times>}}, m_lock_type = TL_READ_DEFAULT, m_mdl_type = MDL_SHARED_READ}, m_digest_psi = 0x62a000063b38}

        net = 0x62a000060578

        error = false

        do_end_of_statement = true

        _db_stack_frame_ = {func = 0x560cc0be24a0 "do_command", file = 0x560cc0be1ca0 "/10.3/src/sql/sql_parse.cc", level = 2147483650, line = -1, prev = 0x7fea0f5218a0}

        drop_more_results = false

        __PRETTY_FUNCTION__ = "bool dispatch_command(enum_server_command, THD*, char*, uint, bool, bool)"

        res = <optimized out>

#16 0x0000560cbeee9932 in do_command (thd=0x62a000060270) at /10.3/src/sql/sql_parse.cc:1398

        return_value = false

        packet = 0x6290000dc270 "\001"

        packet_length = 29

        net = 0x62a000060578

        command = COM_QUERY

        _db_stack_frame_ = {func = 0x560cc14babe0 "?func", file = 0x560cc14bac20 "?file", level = 2147483649, line = -1, prev = 0x0}

        __PRETTY_FUNCTION__ = "bool do_command(THD*)"

#17 0x0000560cbf2bcf69 in do_handle_one_connection (connect=0x611000008030) at /10.3/src/sql/sql_connect.cc:1403

        create_user = true

        thr_create_utime = 26189012030

        thd = 0x62a000060270

#18 0x0000560cbf2bc823 in handle_one_connection (arg=0x611000008030) at /10.3/src/sql/sql_connect.cc:1308

        connect = 0x611000008030

#19 0x0000560cc08eac8b in pfs_spawn_thread (arg=0x616000009cf0) at /10.3/src/storage/perfschema/pfs.cc:1869

        typed_arg = 0x616000009cf0

        user_arg = 0x611000008030

        user_start_routine = 0x560cbf2bc7ca <handle_one_connection(void*)>

        pfs = 0x7fea172aee80

        klass = 0x6250000004c0

#20 0x00007fea1c427609 in start_thread (arg=<optimized out>) at pthread_create.c:477

        ret = <optimized out>

        pd = <optimized out>

        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140643256115968, -5687333447477620803, 140729393172142, 140729393172143, 94612796103968, 140643256113984, 5676390374573477821, 5676418823524454333}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}

        not_first_call = 0

#21 0x00007fea1c34c133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

No locals.

create database db;

use db;

CREATE TABLE t1 (i int) engine=connect;

INSERT INTO t1 VALUES (1),(2);

CREATE FUNCTION f() RETURNS int RETURN (SELECT i FROM t1 limit 1);

select f() from t1;

create database mysqltest;

use mysqltest;

CREATE TABLE t1 (i int) engine=connect;

INSERT INTO t1 VALUES (1),(2);

CREATE FUNCTION f() RETURNS int RETURN (SELECT i FROM t1 limit 1);

select f() from t1;

220711 17:10:24 [ERROR] mysqld got signal 11 ;

Server version: 10.3.36-MariaDB-debug-log

sql/signal_handler.cc:231(handle_fatal_signal)[0x55d62563feb4]

sigaction.c:0(__restore_rt)[0x7f98566d6420]

connect/connect.cc:425(CntReadNext(_global*, TDB*))[0x7f984e21aacc]

connect/ha_connect.cc:4216(ha_connect::rnd_next(unsigned char*))[0x7f984e1fca0f]

sql/handler.cc:2858(handler::ha_rnd_next(unsigned char*))[0x55d625655980]

sql/records.cc:485(rr_sequential(READ_RECORD*))[0x55d625a51a45]

sql/records.h:70(READ_RECORD::read_record())[0x55d624d35924]

sql/sql_select.cc:19915(sub_select(JOIN*, st_join_table*, bool))[0x55d624fff1de]

sql/sql_select.cc:19434(do_select(JOIN*, Procedure*))[0x55d624ffcf0c]

sql/sql_select.cc:4151(JOIN::exec_inner())[0x55d624f8fa91]

sql/sql_select.cc:3946(JOIN::exec())[0x55d624f8d40e]

sql/sql_select.cc:4356(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55d624f90f0c]

sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55d624f6746d]

sql/sql_parse.cc:6339(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55d624ed81b5]

sql/sql_parse.cc:3870(mysql_execute_command(THD*))[0x55d624ec61f0]

sql/sql_parse.cc:7870(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55d624ee1f12]

sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55d624eb8def]

sql/sql_parse.cc:1398(do_command(THD*))[0x55d624eb5932]

sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x55d625288f69]

sql/sql_connect.cc:1309(handle_one_connection)[0x55d625288823]

perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55d6268b6c8b]

nptl/pthread_create.c:478(start_thread)[0x7f98566ca609]

addr2line: DWARF error: section .debug_info is larger than its filesize! (0x93ef57 vs 0x530ea0)

/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f98565ef133]

Query (0x62b000000290): select f() from t1