added a comment - - edited Thank you!
I repeated on 10.3-10.10.
CREATE TABLE t1 (id int );
INSERT INTO t1 VALUES (-1),(0),(84);
SELECT id IN ( SELECT id FROM t1
WINDOW w AS ( ORDER BY
( SELECT 1 FROM t1 WHERE EXISTS ( SELECT id FROM t1 GROUP BY id WINDOW w2 AS ( ORDER BY id) ))
))
FROM t1;
10.3 c7f8cfc9e733517cff4aaa6f
==531075==ERROR: AddressSanitizer: use-after-poison on address 0x62b0000012a8 at pc 0x55f21c771c3c bp 0x7f7d7bde1830 sp 0x7f7d7bde1820
READ of size 8 at 0x62b0000012a8 thread T27
#0 0x55f21c771c3b in base_list_iterator::next() /10.3/src/sql/sql_list.h:430
#1 0x55f21c77dc7c in List_iterator<Item>::operator++(int) /10.3/src/sql/sql_list.h:538
#2 0x55f21ce13411 in subquery_types_allow_materialization /10.3/src/sql/opt_subselect.cc:843
#3 0x55f21ce11a62 in is_materialization_applicable(THD*, Item_in_subselect*, st_select_lex*) /10.3/src/sql/opt_subselect.cc:519
#4 0x55f21ce12aae in check_and_do_in_subquery_rewrites(JOIN*) /10.3/src/sql/opt_subselect.cc:716
#5 0x55f21ca2fe72 in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /10.3/src/sql/sql_select.cc:1272
#6 0x55f21d33b3eb in subselect_single_select_engine::prepare(THD*) /10.3/src/sql/item_subselect.cc:3808
#7 0x55f21d315216 in Item_subselect::fix_fields(THD*, Item**) /10.3/src/sql/item_subselect.cc:282
#8 0x55f21d3381c0 in Item_in_subselect::fix_fields(THD*, Item**) /10.3/src/sql/item_subselect.cc:3471
#9 0x55f21c710792 in Item::fix_fields_if_needed(THD*, Item**) /10.3/src/sql/item.h:829
#10 0x55f21c7107cc in Item::fix_fields_if_needed_for_scalar(THD*, Item**) (/home/alice/am/_depot/m-branch/m3-10.3-bld/sql/mysqld+0xdde7cc)
#11 0x55f21c8282e8 in setup_fields(THD*, Bounds_checked_array<Item*>, List<Item>&, enum_column_usage, List<Item>*, List<Item>*, bool) /10.3/src/sql/sql_base.cc:7542
#12 0x55f21ca2e738 in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /10.3/src/sql/sql_select.cc:1167
#13 0x55f21ca5065d in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.3/src/sql/sql_select.cc:4352
#14 0x55f21ca269cc in handle_select(THD*, LEX*, select_result*, unsigned long) /10.3/src/sql/sql_select.cc:372
#15 0x55f21c9976dc in execute_sqlcom_select /10.3/src/sql/sql_parse.cc:6340
#16 0x55f21c985717 in mysql_execute_command(THD*) /10.3/src/sql/sql_parse.cc:3871
#17 0x55f21c9a1439 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/src/sql/sql_parse.cc:7871
#18 0x55f21c978316 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/src/sql/sql_parse.cc:1852
#19 0x55f21c974e59 in do_command(THD*) /10.3/src/sql/sql_parse.cc:1398
#20 0x55f21cd48ee4 in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1403
#21 0x55f21cd4879e in handle_one_connection /10.3/src/sql/sql_connect.cc:1308
#22 0x55f21e379a16 in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869
#23 0x7f7d925a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
#24 0x7f7d924c6132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
0x62b0000012a8 is located 4264 bytes inside of 24716-byte region [0x62b000000200,0x62b00000628c)
allocated by thread T27 here:
#0 0x7f7d92ef3808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x55f21e4c6a00 in sf_malloc /10.3/src/mysys/safemalloc.c:118
#2 0x55f21e494880 in my_malloc /10.3/src/mysys/my_malloc.c:101
#3 0x55f21e47005c in reset_root_defaults /10.3/src/mysys/my_alloc.c:152
#4 0x55f21c873931 in THD::init_for_queries() /10.3/src/sql/sql_class.cc:1338
#5 0x55f21cd48108 in prepare_new_connection_state(THD*) /10.3/src/sql/sql_connect.cc:1239
#6 0x55f21cd487e8 in thd_prepare_connection(THD*) /10.3/src/sql/sql_connect.cc:1323
#7 0x55f21cd48e0f in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1393
#8 0x55f21cd4879e in handle_one_connection /10.3/src/sql/sql_connect.cc:1308
#9 0x55f21e379a16 in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869
#10 0x7f7d925a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
Thread T27 created by T0 here:
#0 0x7f7d92e20815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
#1 0x55f21e379e07 in spawn_thread_v1 /10.3/src/storage/perfschema/pfs.cc:1919
#2 0x55f21c69a39e in inline_mysql_thread_create /10.3/src/include/mysql/psi/mysql_thread.h:1275
#3 0x55f21c6b3158 in create_thread_to_handle_connection(CONNECT*) /10.3/src/sql/mysqld.cc:6668
#4 0x55f21c6b38f3 in create_new_thread /10.3/src/sql/mysqld.cc:6738
#5 0x55f21c6b4a85 in handle_connections_sockets() /10.3/src/sql/mysqld.cc:6996
#6 0x55f21c6b2449 in mysqld_main(int, char**) /10.3/src/sql/mysqld.cc:6290
#7 0x55f21c698b9c in main /10.3/src/sql/main.cc:25
#8 0x7f7d923cb082 in __libc_start_main ../csu/libc-start.c:308
SUMMARY: AddressSanitizer: use-after-poison /10.3/src/sql/sql_list.h:430 in base_list_iterator::next()
Shadow bytes around the buggy address:
0x0c567fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 03
0x0c567fff8230: f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c567fff8250: 00 00 00 f7 f7[f7]f7 03 f7 00 00 00 00 00 f7 03
0x0c567fff8260: f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff82a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==531075==ABORTING
----------SERVER LOG END-------------
on non-debug - crash after executing the initioal query a few times:
220824 12:43:04 [ERROR] mysqld got signal 11 ;
Server version: 10.6.9-MariaDB
sigaction.c:0(__restore_rt)[0x7f4327074630]
sql/field.h:1383(Field::is_null(long long) const)[0x55955760a5f4]
sql/sql_base.cc:8928(fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool))[0x559557366a33]
sql/sql_union.cc:121(select_unit::send_data(List<Item>&))[0x5595574743d1]
sql/sql_class.cc:4319(select_materialize_with_stats::send_data(List<Item>&))[0x559557372ccd]
sql/sql_select.cc:22527(end_send(JOIN*, st_join_table*, bool))[0x55955740d1cc]
sql/sql_class.h:4370(THD::get_stmt_da())[0x5595573f8b8b]
sql/sql_select.cc:21299(sub_select(JOIN*, st_join_table*, bool))[0x5595573fe6fd]
sql/sql_select.cc:20837(do_select)[0x55955742df8f]
sql/sql_select.cc:4563(JOIN::exec())[0x55955742e393]
sql/item_subselect.cc:5703(subselect_hash_sj_engine::exec())[0x5595576b625b]
sql/item_subselect.cc:859(Item_subselect::exec())[0x5595576a917a]
sql/item_subselect.cc:1984(Item_in_subselect::val_bool())[0x5595576aa224]
sql/item_cmpfunc.cc:1656(Item_in_optimizer::val_int())[0x559557633dde]
sql/item.cc:10087(Item_cache_int::cache_value())[0x559557605407]
sql/item.cc:8851(Item_cache_wrapper::cache())[0x55955761aa34]
sql/sql_type.cc:301(VDec::VDec(Item*))[0x55955753d1db]
sql/sql_type.h:373(Dec_ptr::is_null() const)[0x55955762a5e9]
sql/item_cmpfunc.cc:1781(Item_func_eq::val_int())[0x55955762ab8a]
sql/item_func.cc:745(Item_int_func::val_real())[0x55955765c5b3]
sql/item.cc:8608(Item_direct_ref::val_real())[0x559557604bff]
sql/item_cmpfunc.cc:848(Arg_comparator::compare_real())[0x5595576263b0]
sql/item_cmpfunc.cc:1781(Item_func_eq::val_int())[0x55955762ab8a]
sql/sql_type.cc:5094(Type_handler_int_result::Item_val_bool(Item*) const)[0x559557530560]
sql/item_cmpfunc.cc:5452(Item_cond_or::val_int())[0x559557627c2a]
sql/sql_select.cc:21392(evaluate_join_record(JOIN*, st_join_table*, int))[0x5595573f89c8]
sql/sql_select.cc:21299(sub_select(JOIN*, st_join_table*, bool))[0x5595573fe69f]
sql/sql_select.cc:20837(do_select)[0x55955742df8f]
sql/sql_select.cc:4563(JOIN::exec())[0x55955742e393]
sql/item_subselect.cc:4139(subselect_single_select_engine::exec())[0x5595576aadde]
sql/item_subselect.cc:859(Item_subselect::exec())[0x5595576a917a]
sql/item_subselect.cc:1984(Item_in_subselect::val_bool())[0x5595576aa224]
sql/item_cmpfunc.cc:1656(Item_in_optimizer::val_int())[0x559557633dde]
sql/item.cc:10087(Item_cache_int::cache_value())[0x559557605407]
sql/item.cc:8851(Item_cache_wrapper::cache())[0x55955761ab04]
sql/item_cmpfunc.cc:203(Item_func_not::val_int())[0x55955762632c]
sql/sql_select.cc:21392(evaluate_join_record(JOIN*, st_join_table*, int))[0x5595573f89c8]
sql/sql_select.cc:21299(sub_select(JOIN*, st_join_table*, bool))[0x5595573fe69f]
sql/sql_select.cc:20837(do_select)[0x55955742df8f]
sql/sql_select.cc:4563(JOIN::exec())[0x55955742e393]
sql/item_subselect.cc:4149(subselect_single_select_engine::exec())[0x5595576aac46]
sql/item_subselect.cc:859(Item_subselect::exec())[0x5595576a917a]
sql/item_subselect.cc:1498(Item_singlerow_subselect::val_int())[0x5595576a9d1e]
sql/item_func.cc:1371(Item_func_mul::int_op())[0x55955766272a]
sql/item_func.cc:1107(Item_func_plus::int_op())[0x559557662baa]
sql/item.cc:10087(Item_cache_int::cache_value())[0x559557605407]
sql/item.h:7088(Item_cache::has_value())[0x559557605489]
sql/item_func.cc:1260(Item_func_minus::real_op())[0x55955766222c]
sql/sql_type.cc:5089(Type_handler_real_result::Item_val_bool(Item*) const)[0x559557530530]
sql/item_cmpfunc.cc:203(Item_func_not::val_int())[0x55955762632c]
sql/item.h:1421(Item::to_longlong_hybrid())[0x559557634c32]
sql/item_func.cc:745(Item_int_func::val_real())[0x55955765c5b3]
sql/item_cmpfunc.cc:2322(Item_func_between::val_int_cmp_real())[0x559557635188]
sql/sql_select.cc:21392(evaluate_join_record(JOIN*, st_join_table*, int))[0x5595573f89c8]
sql/sql_select.cc:21299(sub_select(JOIN*, st_join_table*, bool))[0x5595573fe69f]
sql/sql_select.cc:20837(do_select)[0x55955742df8f]
sql/sql_select.cc:4563(JOIN::exec())[0x55955742e393]
sql/sql_select.cc:5043(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55955742c4ee]
sql/sql_select.cc:566(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55955742cd54]
sql/sql_parse.cc:6257(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55955728fc6a]
sql/sql_parse.cc:3946(mysql_execute_command(THD*, bool))[0x5595573ced9c]
sql/sql_parse.cc:8031(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5595573d112b]
sql/sql_parse.cc:1955(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5595573d32e7]
sql/sql_parse.cc:1411(do_command(THD*, bool))[0x5595573d4983]
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x5595574cac47]
sql/sql_connect.cc:1318(handle_one_connection)[0x5595574caee4]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x55955785fcdc]
pthread_create.c:0(start_thread)[0x7f432706cea5]
??:0(__clone)[0x7f4326587b0d]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x7f42e0012460): WITH v1343 AS ( SELECT v1341 FROM ( SELECT v1341 FROM v1340 GROUP BY v1341 ) AS v1342 ) SELECT v1341 FROM v1340 WHERE v1341 BETWEEN FALSE AND ( ( ( v1341 OR NOT v1341 ) BETWEEN ( ( ( NOT ( SELECT FALSE FROM v1340 WHERE ( v1341 , 'x' ) NOT IN ( SELECT ( 'x' = ( v1341 IN ( SELECT v1341 FROM v1340 WHERE v1341 = CASE WHEN v1341 * ( SELECT 90 FROM v1340 AS v1344 WHERE v1341 BETWEEN 31066339.000000 AND 76 WINDOW v1348 AS ( PARTITION BY v1341 ORDER BY ( SELECT DISTINCT 29 FROM v1340 AS v1345 , v1340 AS v1346 , v1340 AS v1347 JOIN v1340 ) DESC RANGE BETWEEN 64903499.000000 FOLLOWING AND 83565757.000000 FOLLOWING ) ) ^ v1341 THEN 'x' ELSE v1341 END / 83 WINDOW v1354 AS ( PARTITION BY v1341 ORDER BY ( SELECT DISTINCT 127 FROM ( SELECT DISTINCT ( ( NOT ( 38309169.000000 AND v1341 = -1 ) ) = 31 AND v1341 = -128 ) % 90 , ( v1341 = 6 OR v1341 > 'x' ) FROM v1340 WHERE EXISTS ( SELECT ( v1341 NOT IN ( v1341 ) AND v1341 NOT IN ( -128 ^ v1341 ) ) , v1341 + v1341 FROM v1340 GROUP BY v1341 HAVING ( v1341 != 79 AND v1341 = v1341 AND ( NOT ( 'x' = 'x' AND FALSE = 45 ) ) AND v1341 LIKE 'x' ) WINDOW v1355 AS ( ORDER BY v1341 - v1341 , ( 0 < v1341 AND v1341 = 0 ) ) ) ) AS v1350 NATURAL JOIN v1340 AS v1351 , v1340 AS v1352 , v1340 AS v1353 JOIN v1340 ) DESC RANGE BETWEEN 90766484.000000 FOLLOWING AND 77472811.000000 FOLLOWING ) ) ) ) , 'x' FROM v1340 ) ) * -1 + 25 ^ 50 - v1341 ) ) ) AND 0 ) )
simplified test case leads to `field->table == table' assertion ( MDEV-28515 )
CREATE TABLE t1 (id int );
INSERT INTO t1 VALUES (-1),(0),(84);
SELECT 1 FROM t1
WINDOW w AS ( ORDER BY
( SELECT 1 FROM t1 WHERE EXISTS ( SELECT id FROM t1 GROUP BY id WINDOW w2 AS ( ORDER BY id) )) );
10.3 c7f8cfc9e733517cff4aaa6f
mysqld: /10.3/src/sql/sql_select.cc:18260: TABLE* create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, ORDER*, bool, bool, ulonglong, ha_rows, const LEX_CSTRING*, bool, bool): Assertion `field->table == table' failed.
220824 15:18:22 [ERROR] mysqld got signal 6 ;
Server version: 10.3.37-MariaDB-debug-log
sql/sql_select.cc:18261(create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool))[0x55b7c0a4c0ed]
sql/sql_select.cc:3478(JOIN::create_postjoin_aggr_table(st_join_table*, List<Item>*, st_order*, bool, bool, bool))[0x55b7c09e2ca8]
sql/sql_select.cc:3077(JOIN::make_aggr_tables_info())[0x55b7c09de5d7]
sql/sql_select.cc:2712(JOIN::optimize_stage2())[0x55b7c09d9f28]
sql/sql_select.cc:2018(JOIN::optimize_inner())[0x55b7c09d2d7c]
sql/sql_select.cc:1534(JOIN::optimize())[0x55b7c09cdfaf]
sql/sql_select.cc:4360(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55b7c09eb689]
sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55b7c09c19cd]
sql/sql_parse.cc:6340(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55b7c09326dd]
sql/sql_parse.cc:3871(mysql_execute_command(THD*))[0x55b7c0920718]
sql/sql_parse.cc:7871(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55b7c093c43a]
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55b7c0913317]
sql/sql_parse.cc:1398(do_command(THD*))[0x55b7c090fe5a]
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x55b7c0ce3ee5]
sql/sql_connect.cc:1309(handle_one_connection)[0x55b7c0ce379f]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55b7c2314a17]
nptl/pthread_create.c:478(start_thread)[0x7fa5133c1609]
addr2line: DWARF error: section .debug_info is larger than its filesize! (0x93ef57 vs 0x530ea0)
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7fa5132e6133]
Query (0x62b000000290): SELECT 1 FROM t1
WINDOW w AS (ORDER BY
(SELECT 1 FROM t1 WHERE EXISTS ( SELECT id FROM t1 GROUP BY id WINDOW w2 AS (ORDER BY id) )) )
Thank you!
I repeated on 10.3-10.10.
))
10.3 c7f8cfc9e733517cff4aaa6f
==531075==ERROR: AddressSanitizer: use-after-poison on address 0x62b0000012a8 at pc 0x55f21c771c3c bp 0x7f7d7bde1830 sp 0x7f7d7bde1820
READ of size 8 at 0x62b0000012a8 thread T27
#0 0x55f21c771c3b in base_list_iterator::next() /10.3/src/sql/sql_list.h:430
#1 0x55f21c77dc7c in List_iterator<Item>::operator++(int) /10.3/src/sql/sql_list.h:538
#2 0x55f21ce13411 in subquery_types_allow_materialization /10.3/src/sql/opt_subselect.cc:843
#3 0x55f21ce11a62 in is_materialization_applicable(THD*, Item_in_subselect*, st_select_lex*) /10.3/src/sql/opt_subselect.cc:519
#4 0x55f21ce12aae in check_and_do_in_subquery_rewrites(JOIN*) /10.3/src/sql/opt_subselect.cc:716
#5 0x55f21ca2fe72 in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /10.3/src/sql/sql_select.cc:1272
#6 0x55f21d33b3eb in subselect_single_select_engine::prepare(THD*) /10.3/src/sql/item_subselect.cc:3808
#7 0x55f21d315216 in Item_subselect::fix_fields(THD*, Item**) /10.3/src/sql/item_subselect.cc:282
#8 0x55f21d3381c0 in Item_in_subselect::fix_fields(THD*, Item**) /10.3/src/sql/item_subselect.cc:3471
#9 0x55f21c710792 in Item::fix_fields_if_needed(THD*, Item**) /10.3/src/sql/item.h:829
#10 0x55f21c7107cc in Item::fix_fields_if_needed_for_scalar(THD*, Item**) (/home/alice/am/_depot/m-branch/m3-10.3-bld/sql/mysqld+0xdde7cc)
#11 0x55f21c8282e8 in setup_fields(THD*, Bounds_checked_array<Item*>, List<Item>&, enum_column_usage, List<Item>*, List<Item>*, bool) /10.3/src/sql/sql_base.cc:7542
#12 0x55f21ca2e738 in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /10.3/src/sql/sql_select.cc:1167
#13 0x55f21ca5065d in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.3/src/sql/sql_select.cc:4352
#14 0x55f21ca269cc in handle_select(THD*, LEX*, select_result*, unsigned long) /10.3/src/sql/sql_select.cc:372
#15 0x55f21c9976dc in execute_sqlcom_select /10.3/src/sql/sql_parse.cc:6340
#16 0x55f21c985717 in mysql_execute_command(THD*) /10.3/src/sql/sql_parse.cc:3871
#17 0x55f21c9a1439 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/src/sql/sql_parse.cc:7871
#18 0x55f21c978316 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/src/sql/sql_parse.cc:1852
#19 0x55f21c974e59 in do_command(THD*) /10.3/src/sql/sql_parse.cc:1398
#20 0x55f21cd48ee4 in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1403
#21 0x55f21cd4879e in handle_one_connection /10.3/src/sql/sql_connect.cc:1308
#22 0x55f21e379a16 in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869
#23 0x7f7d925a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
#24 0x7f7d924c6132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
0x62b0000012a8 is located 4264 bytes inside of 24716-byte region [0x62b000000200,0x62b00000628c)
allocated by thread T27 here:
#0 0x7f7d92ef3808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x55f21e4c6a00 in sf_malloc /10.3/src/mysys/safemalloc.c:118
#2 0x55f21e494880 in my_malloc /10.3/src/mysys/my_malloc.c:101
#3 0x55f21e47005c in reset_root_defaults /10.3/src/mysys/my_alloc.c:152
#4 0x55f21c873931 in THD::init_for_queries() /10.3/src/sql/sql_class.cc:1338
#5 0x55f21cd48108 in prepare_new_connection_state(THD*) /10.3/src/sql/sql_connect.cc:1239
#6 0x55f21cd487e8 in thd_prepare_connection(THD*) /10.3/src/sql/sql_connect.cc:1323
#7 0x55f21cd48e0f in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1393
#8 0x55f21cd4879e in handle_one_connection /10.3/src/sql/sql_connect.cc:1308
#9 0x55f21e379a16 in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869
#10 0x7f7d925a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
Thread T27 created by T0 here:
#0 0x7f7d92e20815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
#1 0x55f21e379e07 in spawn_thread_v1 /10.3/src/storage/perfschema/pfs.cc:1919
#2 0x55f21c69a39e in inline_mysql_thread_create /10.3/src/include/mysql/psi/mysql_thread.h:1275
#3 0x55f21c6b3158 in create_thread_to_handle_connection(CONNECT*) /10.3/src/sql/mysqld.cc:6668
#4 0x55f21c6b38f3 in create_new_thread /10.3/src/sql/mysqld.cc:6738
#5 0x55f21c6b4a85 in handle_connections_sockets() /10.3/src/sql/mysqld.cc:6996
#6 0x55f21c6b2449 in mysqld_main(int, char**) /10.3/src/sql/mysqld.cc:6290
#7 0x55f21c698b9c in main /10.3/src/sql/main.cc:25
#8 0x7f7d923cb082 in __libc_start_main ../csu/libc-start.c:308
SUMMARY: AddressSanitizer: use-after-poison /10.3/src/sql/sql_list.h:430 in base_list_iterator::next()
Shadow bytes around the buggy address:
0x0c567fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 03
0x0c567fff8230: f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c567fff8250: 00 00 00 f7 f7[f7]f7 03 f7 00 00 00 00 00 f7 03
0x0c567fff8260: f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff8290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c567fff82a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==531075==ABORTING
----------SERVER LOG END-------------
on non-debug - crash after executing the initioal query a few times:
220824 12:43:04 [ERROR] mysqld got signal 11 ;
Server version: 10.6.9-MariaDB
sigaction.c:0(__restore_rt)[0x7f4327074630]
sql/field.h:1383(Field::is_null(long long) const)[0x55955760a5f4]
sql/sql_base.cc:8928(fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool))[0x559557366a33]
sql/sql_union.cc:121(select_unit::send_data(List<Item>&))[0x5595574743d1]
sql/sql_class.cc:4319(select_materialize_with_stats::send_data(List<Item>&))[0x559557372ccd]
sql/sql_select.cc:22527(end_send(JOIN*, st_join_table*, bool))[0x55955740d1cc]
sql/sql_class.h:4370(THD::get_stmt_da())[0x5595573f8b8b]
sql/sql_select.cc:21299(sub_select(JOIN*, st_join_table*, bool))[0x5595573fe6fd]
sql/sql_select.cc:20837(do_select)[0x55955742df8f]
sql/sql_select.cc:4563(JOIN::exec())[0x55955742e393]
sql/item_subselect.cc:5703(subselect_hash_sj_engine::exec())[0x5595576b625b]
sql/item_subselect.cc:859(Item_subselect::exec())[0x5595576a917a]
sql/item_subselect.cc:1984(Item_in_subselect::val_bool())[0x5595576aa224]
sql/item_cmpfunc.cc:1656(Item_in_optimizer::val_int())[0x559557633dde]
sql/item.cc:10087(Item_cache_int::cache_value())[0x559557605407]
sql/item.cc:8851(Item_cache_wrapper::cache())[0x55955761aa34]
sql/sql_type.cc:301(VDec::VDec(Item*))[0x55955753d1db]
sql/sql_type.h:373(Dec_ptr::is_null() const)[0x55955762a5e9]
sql/item_cmpfunc.cc:1781(Item_func_eq::val_int())[0x55955762ab8a]
sql/item_func.cc:745(Item_int_func::val_real())[0x55955765c5b3]
sql/item.cc:8608(Item_direct_ref::val_real())[0x559557604bff]
sql/item_cmpfunc.cc:848(Arg_comparator::compare_real())[0x5595576263b0]
sql/item_cmpfunc.cc:1781(Item_func_eq::val_int())[0x55955762ab8a]
sql/sql_type.cc:5094(Type_handler_int_result::Item_val_bool(Item*) const)[0x559557530560]
sql/item_cmpfunc.cc:5452(Item_cond_or::val_int())[0x559557627c2a]
sql/sql_select.cc:21392(evaluate_join_record(JOIN*, st_join_table*, int))[0x5595573f89c8]
sql/sql_select.cc:21299(sub_select(JOIN*, st_join_table*, bool))[0x5595573fe69f]
sql/sql_select.cc:20837(do_select)[0x55955742df8f]
sql/sql_select.cc:4563(JOIN::exec())[0x55955742e393]
sql/item_subselect.cc:4139(subselect_single_select_engine::exec())[0x5595576aadde]
sql/item_subselect.cc:859(Item_subselect::exec())[0x5595576a917a]
sql/item_subselect.cc:1984(Item_in_subselect::val_bool())[0x5595576aa224]
sql/item_cmpfunc.cc:1656(Item_in_optimizer::val_int())[0x559557633dde]
sql/item.cc:10087(Item_cache_int::cache_value())[0x559557605407]
sql/item.cc:8851(Item_cache_wrapper::cache())[0x55955761ab04]
sql/item_cmpfunc.cc:203(Item_func_not::val_int())[0x55955762632c]
sql/sql_select.cc:21392(evaluate_join_record(JOIN*, st_join_table*, int))[0x5595573f89c8]
sql/sql_select.cc:21299(sub_select(JOIN*, st_join_table*, bool))[0x5595573fe69f]
sql/sql_select.cc:20837(do_select)[0x55955742df8f]
sql/sql_select.cc:4563(JOIN::exec())[0x55955742e393]
sql/item_subselect.cc:4149(subselect_single_select_engine::exec())[0x5595576aac46]
sql/item_subselect.cc:859(Item_subselect::exec())[0x5595576a917a]
sql/item_subselect.cc:1498(Item_singlerow_subselect::val_int())[0x5595576a9d1e]
sql/item_func.cc:1371(Item_func_mul::int_op())[0x55955766272a]
sql/item_func.cc:1107(Item_func_plus::int_op())[0x559557662baa]
sql/item.cc:10087(Item_cache_int::cache_value())[0x559557605407]
sql/item.h:7088(Item_cache::has_value())[0x559557605489]
sql/item_func.cc:1260(Item_func_minus::real_op())[0x55955766222c]
sql/sql_type.cc:5089(Type_handler_real_result::Item_val_bool(Item*) const)[0x559557530530]
sql/item_cmpfunc.cc:203(Item_func_not::val_int())[0x55955762632c]
sql/item.h:1421(Item::to_longlong_hybrid())[0x559557634c32]
sql/item_func.cc:745(Item_int_func::val_real())[0x55955765c5b3]
sql/item_cmpfunc.cc:2322(Item_func_between::val_int_cmp_real())[0x559557635188]
sql/sql_select.cc:21392(evaluate_join_record(JOIN*, st_join_table*, int))[0x5595573f89c8]
sql/sql_select.cc:21299(sub_select(JOIN*, st_join_table*, bool))[0x5595573fe69f]
sql/sql_select.cc:20837(do_select)[0x55955742df8f]
sql/sql_select.cc:4563(JOIN::exec())[0x55955742e393]
sql/sql_select.cc:5043(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55955742c4ee]
sql/sql_select.cc:566(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55955742cd54]
sql/sql_parse.cc:6257(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55955728fc6a]
sql/sql_parse.cc:3946(mysql_execute_command(THD*, bool))[0x5595573ced9c]
sql/sql_parse.cc:8031(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5595573d112b]
sql/sql_parse.cc:1955(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5595573d32e7]
sql/sql_parse.cc:1411(do_command(THD*, bool))[0x5595573d4983]
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x5595574cac47]
sql/sql_connect.cc:1318(handle_one_connection)[0x5595574caee4]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x55955785fcdc]
pthread_create.c:0(start_thread)[0x7f432706cea5]
??:0(__clone)[0x7f4326587b0d]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x7f42e0012460): WITH v1343 AS ( SELECT v1341 FROM ( SELECT v1341 FROM v1340 GROUP BY v1341 ) AS v1342 ) SELECT v1341 FROM v1340 WHERE v1341 BETWEEN FALSE AND ( ( ( v1341 OR NOT v1341 ) BETWEEN ( ( ( NOT ( SELECT FALSE FROM v1340 WHERE ( v1341 , 'x' ) NOT IN ( SELECT ( 'x' = ( v1341 IN ( SELECT v1341 FROM v1340 WHERE v1341 = CASE WHEN v1341 * ( SELECT 90 FROM v1340 AS v1344 WHERE v1341 BETWEEN 31066339.000000 AND 76 WINDOW v1348 AS ( PARTITION BY v1341 ORDER BY ( SELECT DISTINCT 29 FROM v1340 AS v1345 , v1340 AS v1346 , v1340 AS v1347 JOIN v1340 ) DESC RANGE BETWEEN 64903499.000000 FOLLOWING AND 83565757.000000 FOLLOWING ) ) ^ v1341 THEN 'x' ELSE v1341 END / 83 WINDOW v1354 AS ( PARTITION BY v1341 ORDER BY ( SELECT DISTINCT 127 FROM ( SELECT DISTINCT ( ( NOT ( 38309169.000000 AND v1341 = -1 ) ) = 31 AND v1341 = -128 ) % 90 , ( v1341 = 6 OR v1341 > 'x' ) FROM v1340 WHERE EXISTS ( SELECT ( v1341 NOT IN ( v1341 ) AND v1341 NOT IN ( -128 ^ v1341 ) ) , v1341 + v1341 FROM v1340 GROUP BY v1341 HAVING ( v1341 != 79 AND v1341 = v1341 AND ( NOT ( 'x' = 'x' AND FALSE = 45 ) ) AND v1341 LIKE 'x' ) WINDOW v1355 AS ( ORDER BY v1341 - v1341 , ( 0 < v1341 AND v1341 = 0 ) ) ) ) AS v1350 NATURAL JOIN v1340 AS v1351 , v1340 AS v1352 , v1340 AS v1353 JOIN v1340 ) DESC RANGE BETWEEN 90766484.000000 FOLLOWING AND 77472811.000000 FOLLOWING ) ) ) ) , 'x' FROM v1340 ) ) * -1 + 25 ^ 50 - v1341 ) ) ) AND 0 ) )
simplified test case leads to `field->table == table' assertion (
MDEV-28515)10.3 c7f8cfc9e733517cff4aaa6f
mysqld: /10.3/src/sql/sql_select.cc:18260: TABLE* create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, ORDER*, bool, bool, ulonglong, ha_rows, const LEX_CSTRING*, bool, bool): Assertion `field->table == table' failed.
220824 15:18:22 [ERROR] mysqld got signal 6 ;
Server version: 10.3.37-MariaDB-debug-log
sql/sql_select.cc:18261(create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool))[0x55b7c0a4c0ed]
sql/sql_select.cc:3478(JOIN::create_postjoin_aggr_table(st_join_table*, List<Item>*, st_order*, bool, bool, bool))[0x55b7c09e2ca8]
sql/sql_select.cc:3077(JOIN::make_aggr_tables_info())[0x55b7c09de5d7]
sql/sql_select.cc:2712(JOIN::optimize_stage2())[0x55b7c09d9f28]
sql/sql_select.cc:2018(JOIN::optimize_inner())[0x55b7c09d2d7c]
sql/sql_select.cc:1534(JOIN::optimize())[0x55b7c09cdfaf]
sql/sql_select.cc:4360(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55b7c09eb689]
sql/sql_select.cc:372(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55b7c09c19cd]
sql/sql_parse.cc:6340(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55b7c09326dd]
sql/sql_parse.cc:3871(mysql_execute_command(THD*))[0x55b7c0920718]
sql/sql_parse.cc:7871(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55b7c093c43a]
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55b7c0913317]
sql/sql_parse.cc:1398(do_command(THD*))[0x55b7c090fe5a]
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x55b7c0ce3ee5]
sql/sql_connect.cc:1309(handle_one_connection)[0x55b7c0ce379f]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55b7c2314a17]
nptl/pthread_create.c:478(start_thread)[0x7fa5133c1609]
addr2line: DWARF error: section .debug_info is larger than its filesize! (0x93ef57 vs 0x530ea0)
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7fa5132e6133]
Query (0x62b000000290): SELECT 1 FROM t1
WINDOW w AS (ORDER BY
(SELECT 1 FROM t1 WHERE EXISTS ( SELECT id FROM t1 GROUP BY id WINDOW w2 AS (ORDER BY id) )) )