Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-29605

SIGSEGV in spider_db_ping, ASAN heap-use-after-free in spider_db_ping and UBSAN dynamic-type-mismatch in spider_db_ping on CREATE TABLE

Details

    Description

      Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue.
      Possibly also related/similar to MDEV-28683.

      SET sql_mode='';
      INSTALL PLUGIN Spider SONAME 'ha_spider.so';
      CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
      CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
      CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
      SET GLOBAL init_connect='dummy';
      CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
      XA START 'a';
      INSERT INTO t VALUES (1);
      SHOW CREATE TABLE t0;
      SELECT * FROM t0 JOIN t0 a ON a=a;
      INSERT INTO t0 VALUES (1);
      

      Leads to:

      10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)

      Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, 
          conn=conn@entry=0x1488f408b3b8, link_idx=0)
          at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
      [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
      (gdb) bt
      #0  0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
      #1  0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
      #2  0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
      #3  0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
      #4  0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
      #5  0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
      #6  0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
      #7  0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
      #8  0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
      #9  0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
      #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
      #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
      #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
      #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
      #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
      #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
      #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

      Attachments

        Issue Links

          Activity

            Roel Roel Van de Paar created issue -
            Roel Roel Van de Paar made changes -
            Field Original Value New Value
            Summary SIGSEGV in spider_db_ping SIGSEGV in spider_db_ping on INSERT
            Roel Roel Van de Paar made changes -
            Roel Roel Van de Paar made changes -
            Description Whilst the bug here comes very close to MDEV-29583, there are some differences so logging as a separate issue.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:

            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230

            warning: Source file is more recent than executable.
            230 if (spider->wide_handler->trx->thd)
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}

            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Whilst the bug here comes close to MDEV-29583, there are some differences so logging as a separate issue.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:

            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230

            warning: Source file is more recent than executable.
            230 if (spider->wide_handler->trx->thd)
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}

            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Roel Roel Van de Paar made changes -
            Description Whilst the bug here comes close to MDEV-29583, there are some differences so logging as a separate issue.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:

            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230

            warning: Source file is more recent than executable.
            230 if (spider->wide_handler->trx->thd)
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}

            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:

            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230

            warning: Source file is more recent than executable.
            230 if (spider->wide_handler->trx->thd)
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}

            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Roel Roel Van de Paar made changes -
            Description Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:

            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230

            warning: Source file is more recent than executable.
            230 if (spider->wide_handler->trx->thd)
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}

            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:

            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            warning: Source file is more recent than executable.
            230 if (spider->wide_handler->trx->thd)
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}

            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Roel Roel Van de Paar made changes -
            Roel Roel Van de Paar made changes -
            Description Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:

            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            warning: Source file is more recent than executable.
            230 if (spider->wide_handler->trx->thd)
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}

            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue. Possibly also related/similar to MDEV-28683.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:

            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            warning: Source file is more recent than executable.
            230 if (spider->wide_handler->trx->thd)
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}

            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Roel Roel Van de Paar made changes -
            Description Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue. Possibly also related/similar to MDEV-28683.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:

            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            warning: Source file is more recent than executable.
            230 if (spider->wide_handler->trx->thd)
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}

            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue. Possibly also related/similar to MDEV-28683.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:
            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}


            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Roel Roel Van de Paar made changes -
            Roel Roel Van de Paar made changes -
            Description Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue. Possibly also related/similar to MDEV-28683.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:
            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}


            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Whilst the bug here comes close to MDEV-29583, there are some differences, so logging as a separate issue.
            Possibly also related/similar to MDEV-28683.
            {code:sql}
            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            SELECT * FROM t0 JOIN t0 a ON a=a;
            INSERT INTO t0 VALUES (1);
            {code}

            Leads to:
            {noformat:title=10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)}
            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140,
                conn=conn@entry=0x1488f408b3b8, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            [Current thread is 1 (Thread 0x148942675700 (LWP 1672792))]
            (gdb) bt
            #0 0x00001489425226ca in spider_db_ping (spider=0x1488f40df140, conn=conn@entry=0x1488f408b3b8, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1 0x000014894252292b in spider_db_conn_queue_action (conn=conn@entry=0x1488f408b3b8) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2 0x000014894252afa5 in spider_db_before_query (conn=conn@entry=0x1488f408b3b8, need_mon=need_mon@entry=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3 0x000014894252b701 in spider_db_set_names_internal (trx=0x1488f404c6c8, share=0x1488f40ae048, conn=conn@entry=0x1488f408b3b8, all_link_idx=0, need_mon=0x1488f40d2590) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:813
            #4 0x000014894252ba5d in spider_db_set_names (spider=spider@entry=0x1488f40ad500, conn=conn@entry=0x1488f408b3b8, link_idx=link_idx@entry=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:857
            #5 0x0000148942532cfd in spider_db_bulk_insert (spider=spider@entry=0x1488f40ad500, table=0x1488f40acce8, copy_info=copy_info@entry=0x1488f40ad8f0, bulk_end=bulk_end@entry=false) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:5505
            #6 0x00001489425abfb4 in ha_spider::write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/storage/spider/ha_spider.cc:7997
            #7 0x00005557c1dfd2ff in handler::ha_write_row (this=0x1488f40ad500, buf=0x1488f40ad0e8 "\375\001") at /test/10.11_dbg/sql/handler.cc:7576
            #8 0x00005557c1ab924a in write_record (thd=thd@entry=0x1488f4000d48, table=table@entry=0x1488f40acce8, info=info@entry=0x148942673b20, sink=sink@entry=0x0) at /test/10.11_dbg/sql/sql_insert.cc:2191
            #9 0x00005557c1ac4885 in mysql_insert (thd=thd@entry=0x1488f4000d48, table_list=<optimized out>, fields=@0x1488f4005e38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e38, elements = 0}, <No data fields>}, values_list=@0x1488f4005e80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1488f4013ee8, last = 0x1488f4013ee8, elements = 1}, <No data fields>}, update_fields=@0x1488f4005e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e68, elements = 0}, <No data fields>}, update_values=@0x1488f4005e50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5557c30d0be0 <end_of_list>, last = 0x1488f4005e50, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.11_dbg/sql/sql_insert.cc:1146
            #10 0x00005557c1b07aa0 in mysql_execute_command (thd=thd@entry=0x1488f4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:4563
            #11 0x00005557c1af403c in mysql_parse (thd=thd@entry=0x1488f4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x148942674330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #12 0x00005557c1b0166d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1488f4000d48, packet=packet@entry=0x1488f400aed9 "INSERT INTO t0 VALUES (1)", packet_length=packet_length@entry=25, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #13 0x00005557c1b03d97 in do_command (thd=0x1488f4000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #14 0x00005557c1c67fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5557c49a7fa8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #15 0x00005557c1c684c3 in handle_one_connection (arg=0x5557c49a7fa8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #16 0x000014895f157609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #17 0x000014895ed43133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            {noformat}


            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.5.18 (dbg), 10.6.10 (dbg), 10.7.6 (dbg), 10.8.5 (dbg), 10.9.3 (dbg), 10.10.2 (dbg), 10.11.0 (dbg)

            Bug (or feature/syntax) confirmed not present in:
            MariaDB: 10.4.27 (opt), 10.5.18 (opt), 10.6.10 (opt), 10.7.6 (opt), 10.8.5 (opt), 10.9.3 (opt), 10.10.2 (opt), 10.11.0 (opt)
            MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
            Roel Roel Van de Paar added a comment - - edited

            Additional interesting and shorter testcase, with slightly different stack:

            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            SET unique_checks=0,foreign_key_checks=0,autocommit=0;
            SET GLOBAL init_connect="dummy";
            CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1;
            

            Leads to:

            10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)

            Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0  0x000014baa23056ca in spider_db_ping (spider=0x14ba54073f70, 
                conn=conn@entry=0x14ba54082a78, link_idx=0)
                at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            [Current thread is 1 (Thread 0x14bab00ac700 (LWP 1722759))]
            (gdb) bt
            #0  0x000014baa23056ca in spider_db_ping (spider=0x14ba54073f70, conn=conn@entry=0x14ba54082a78, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230
            #1  0x000014baa230592b in spider_db_conn_queue_action (conn=conn@entry=0x14ba54082a78) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277
            #2  0x000014baa230dfa5 in spider_db_before_query (conn=conn@entry=0x14ba54082a78, need_mon=need_mon@entry=0x14bab00aa24c) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586
            #3  0x000014baa230e4e3 in spider_db_query (conn=0x14ba54082a78, query=query@entry=0x14baa23d0b48 "commit", length=length@entry=6, quick_mode=quick_mode@entry=-1, need_mon=need_mon@entry=0x14bab00aa24c) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:653
            #4  0x000014baa2398d75 in spider_db_mbase::commit (this=0x14ba540836e0, need_mon=0x14bab00aa24c) at /test/10.11_dbg/storage/spider/spd_db_mysql.cc:2555
            #5  0x000014baa230701b in spider_db_commit (conn=conn@entry=0x14ba54082a78) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:1132
            #6  0x000014baa230050f in spider_commit (hton=0x14ba54038f18, thd=0x14ba54000d48, all=<optimized out>) at /test/10.11_dbg/storage/spider/spd_trx.cc:3179
            #7  0x0000561e66bd4cc1 in commit_one_phase_2 (thd=thd@entry=0x14ba54000d48, all=all@entry=true, trans=trans@entry=0x14ba54004718, is_real_trans=true) at /test/10.11_dbg/sql/handler.cc:2068
            #8  0x0000561e66bd4e9a in ha_commit_one_phase (thd=thd@entry=0x14ba54000d48, all=all@entry=true) at /test/10.11_dbg/sql/handler.cc:2021
            #9  0x0000561e66be7031 in ha_commit_trans (thd=thd@entry=0x14ba54000d48, all=all@entry=true) at /test/10.11_dbg/sql/handler.cc:1815
            #10 0x0000561e66a60c2b in trans_commit_implicit (thd=thd@entry=0x14ba54000d48) at /test/10.11_dbg/sql/transaction.cc:329
            #11 0x0000561e668f05ee in mysql_execute_command (thd=thd@entry=0x14ba54000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:6096
            #12 0x0000561e668d803c in mysql_parse (thd=thd@entry=0x14ba54000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14bab00ab330) at /test/10.11_dbg/sql/sql_parse.cc:8037
            #13 0x0000561e668e566d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14ba54000d48, packet=packet@entry=0x14ba5400aed9 "CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER \"mysql\",srv \"srv\",TABLE \"t\"' AS SELECT 1", packet_length=packet_length@entry=86, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
            #14 0x0000561e668e7d97 in do_command (thd=0x14ba54000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
            #15 0x0000561e66a4bfb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x561e68ef08f8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
            #16 0x0000561e66a4c4c3 in handle_one_connection (arg=0x561e68ef08f8) at /test/10.11_dbg/sql/sql_connect.cc:1318
            #17 0x000014bac7938609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #18 0x000014bac7524133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            

            Bug confirmed present in:
            MariaDB: 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.6.10 (dbg), 10.6.10 (opt), 10.7.6 (dbg), 10.7.6 (opt), 10.8.5 (dbg), 10.8.5 (opt), 10.9.3 (dbg), 10.9.3 (opt), 10.10.0 (dbg), 10.10.0 (opt), 10.10.2 (dbg), 10.10.2 (opt), 10.11.0 (dbg), 10.11.0 (opt)

            Roel Roel Van de Paar added a comment - - edited Additional interesting and shorter testcase, with slightly different stack: INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; CREATE USER Spider@localhost IDENTIFIED BY 'PWD0' ; CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock' , DATABASE 'test' , user 'Spider' , PASSWORD 'PWD0' ); SET unique_checks=0,foreign_key_checks=0,autocommit=0; SET GLOBAL init_connect= "dummy" ; CREATE TABLE t ENGINE=Spider COMMENT= 'WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1; Leads to: 10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug) Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000014baa23056ca in spider_db_ping (spider=0x14ba54073f70, conn=conn@entry=0x14ba54082a78, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230 [Current thread is 1 (Thread 0x14bab00ac700 (LWP 1722759))] (gdb) bt #0 0x000014baa23056ca in spider_db_ping (spider=0x14ba54073f70, conn=conn@entry=0x14ba54082a78, link_idx=0) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:230 #1 0x000014baa230592b in spider_db_conn_queue_action (conn=conn@entry=0x14ba54082a78) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:277 #2 0x000014baa230dfa5 in spider_db_before_query (conn=conn@entry=0x14ba54082a78, need_mon=need_mon@entry=0x14bab00aa24c) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:586 #3 0x000014baa230e4e3 in spider_db_query (conn=0x14ba54082a78, query=query@entry=0x14baa23d0b48 "commit", length=length@entry=6, quick_mode=quick_mode@entry=-1, need_mon=need_mon@entry=0x14bab00aa24c) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:653 #4 0x000014baa2398d75 in spider_db_mbase::commit (this=0x14ba540836e0, need_mon=0x14bab00aa24c) at /test/10.11_dbg/storage/spider/spd_db_mysql.cc:2555 #5 0x000014baa230701b in spider_db_commit (conn=conn@entry=0x14ba54082a78) at /test/10.11_dbg/storage/spider/spd_db_conn.cc:1132 #6 0x000014baa230050f in spider_commit (hton=0x14ba54038f18, thd=0x14ba54000d48, all=<optimized out>) at /test/10.11_dbg/storage/spider/spd_trx.cc:3179 #7 0x0000561e66bd4cc1 in commit_one_phase_2 (thd=thd@entry=0x14ba54000d48, all=all@entry=true, trans=trans@entry=0x14ba54004718, is_real_trans=true) at /test/10.11_dbg/sql/handler.cc:2068 #8 0x0000561e66bd4e9a in ha_commit_one_phase (thd=thd@entry=0x14ba54000d48, all=all@entry=true) at /test/10.11_dbg/sql/handler.cc:2021 #9 0x0000561e66be7031 in ha_commit_trans (thd=thd@entry=0x14ba54000d48, all=all@entry=true) at /test/10.11_dbg/sql/handler.cc:1815 #10 0x0000561e66a60c2b in trans_commit_implicit (thd=thd@entry=0x14ba54000d48) at /test/10.11_dbg/sql/transaction.cc:329 #11 0x0000561e668f05ee in mysql_execute_command (thd=thd@entry=0x14ba54000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:6096 #12 0x0000561e668d803c in mysql_parse (thd=thd@entry=0x14ba54000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14bab00ab330) at /test/10.11_dbg/sql/sql_parse.cc:8037 #13 0x0000561e668e566d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14ba54000d48, packet=packet@entry=0x14ba5400aed9 "CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER \"mysql\",srv \"srv\",TABLE \"t\"' AS SELECT 1", packet_length=packet_length@entry=86, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345 #14 0x0000561e668e7d97 in do_command (thd=0x14ba54000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407 #15 0x0000561e66a4bfb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x561e68ef08f8, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416 #16 0x0000561e66a4c4c3 in handle_one_connection (arg=0x561e68ef08f8) at /test/10.11_dbg/sql/sql_connect.cc:1318 #17 0x000014bac7938609 in start_thread (arg=<optimized out>) at pthread_create.c:477 #18 0x000014bac7524133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Bug confirmed present in: MariaDB: 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.6.10 (dbg), 10.6.10 (opt), 10.7.6 (dbg), 10.7.6 (opt), 10.8.5 (dbg), 10.8.5 (opt), 10.9.3 (dbg), 10.9.3 (opt), 10.10.0 (dbg), 10.10.0 (opt), 10.10.2 (dbg), 10.10.2 (opt), 10.11.0 (dbg), 10.11.0 (opt)
            Roel Roel Van de Paar made changes -
            Status Open [ 1 ] Confirmed [ 10101 ]
            ycp Yuchen Pei made changes -
            julien.fritsch Julien Fritsch made changes -
            Fix Version/s 10.7 [ 24805 ]
            julien.fritsch Julien Fritsch made changes -
            Fix Version/s 10.8 [ 26121 ]
            ycp Yuchen Pei made changes -
            Assignee Nayuta Yanagisawa [ JIRAUSER47117 ] Yuchen Pei [ JIRAUSER52627 ]
            julien.fritsch Julien Fritsch made changes -
            Fix Version/s 10.9 [ 26905 ]
            Fix Version/s 10.10 [ 27530 ]
            Roel Roel Van de Paar made changes -
            Labels affects-tests
            Roel Roel Van de Paar made changes -
            Priority Major [ 3 ] Critical [ 2 ]

            I am raising the priority of this ticket as I am seeing this a lot in the runs (3% of tests are stopped short by this crash).

            Roel Roel Van de Paar added a comment - I am raising the priority of this ticket as I am seeing this a lot in the runs (3% of tests are stopped short by this crash).
            Roel Roel Van de Paar made changes -
            Fix Version/s 11.4 [ 29301 ]
            Affects Version/s 11.4 [ 29301 ]
            ycp Yuchen Pei added a comment - - edited

            I could not reproduce the original case (see below) at 10.5 235f33e3606b79c5e3b75f4cfd1ca6d92320e9a2 ubasan. I get a hanging with the case in the first comment. Same goes when both ubsan and asan are turned off.

            SET sql_mode='';
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            set spider_same_server_link= 1;
            evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql
            OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
            CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            SET GLOBAL init_connect='dummy';
            CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            XA START 'a';
            --error 1440
            INSERT INTO t VALUES (1);
            SHOW CREATE TABLE t0;
            --error 1052
            SELECT * FROM t0 JOIN t0 a ON a=a;
            --error 1440
            INSERT INTO t0 VALUES (1);
            drop server srv;

            The hang looks familiar, and it happens at the data node when executing "show table status from `test` like 't'":

             7 in MDL_wait::timed_wait of /home/ycp/source/mariadb-server/10.5/src/sql/mdl.cc:1210
             8 in MDL_context::acquire_lock of /home/ycp/source/mariadb-server/10.5/src/sql/mdl.cc:2389
             9 in open_table_get_mdl_lock of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:1567
            10 in open_table of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:1837
            11 in open_and_process_table of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:3819
            12 in open_tables of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:4303
            13 in open_tables of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.h:264
            14 in open_normal_and_derived_tables of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:5314
            15 in open_tables_only_view_structure of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:5365
            16 in fill_schema_table_by_open of /home/ycp/source/mariadb-server/10.5/src/sql/sql_show.cc:4650
            17 in get_all_tables of /home/ycp/source/mariadb-server/10.5/src/sql/sql_show.cc:5338
            18 in get_schema_tables_result of /home/ycp/source/mariadb-server/10.5/src/sql/sql_show.cc:9012
            19 in JOIN::exec_inner of /home/ycp/source/mariadb-server/10.5/src/sql/sql_select.cc:4614
            20 in JOIN::exec of /home/ycp/source/mariadb-server/10.5/src/sql/sql_select.cc:4437
            21 in mysql_select of /home/ycp/source/mariadb-server/10.5/src/sql/sql_select.cc:4914

            ycp Yuchen Pei added a comment - - edited I could not reproduce the original case (see below) at 10.5 235f33e3606b79c5e3b75f4cfd1ca6d92320e9a2 ubasan. I get a hanging with the case in the first comment. Same goes when both ubsan and asan are turned off. SET sql_mode= '' ; INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; set spider_same_server_link= 1; evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql OPTIONS (SOCKET "$MASTER_1_MYSOCK" , DATABASE 'test' , user 'root' ); CREATE TABLE t (a INT ) ENGINE=Spider COMMENT= 'WRAPPER "mysql",srv "srv",TABLE "t"' ; SET GLOBAL init_connect= 'dummy' ; CREATE TABLE t0 (a INT ) ENGINE=Spider COMMENT= 'WRAPPER "mysql",srv "srv",TABLE "t"' ; XA START 'a' ; --error 1440 INSERT INTO t VALUES (1); SHOW CREATE TABLE t0; --error 1052 SELECT * FROM t0 JOIN t0 a ON a=a; --error 1440 INSERT INTO t0 VALUES (1); drop server srv; The hang looks familiar, and it happens at the data node when executing "show table status from `test` like 't'" : 7 in MDL_wait::timed_wait of /home/ycp/source/mariadb-server/10.5/src/sql/mdl.cc:1210 8 in MDL_context::acquire_lock of /home/ycp/source/mariadb-server/10.5/src/sql/mdl.cc:2389 9 in open_table_get_mdl_lock of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:1567 10 in open_table of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:1837 11 in open_and_process_table of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:3819 12 in open_tables of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:4303 13 in open_tables of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.h:264 14 in open_normal_and_derived_tables of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:5314 15 in open_tables_only_view_structure of /home/ycp/source/mariadb-server/10.5/src/sql/sql_base.cc:5365 16 in fill_schema_table_by_open of /home/ycp/source/mariadb-server/10.5/src/sql/sql_show.cc:4650 17 in get_all_tables of /home/ycp/source/mariadb-server/10.5/src/sql/sql_show.cc:5338 18 in get_schema_tables_result of /home/ycp/source/mariadb-server/10.5/src/sql/sql_show.cc:9012 19 in JOIN::exec_inner of /home/ycp/source/mariadb-server/10.5/src/sql/sql_select.cc:4614 20 in JOIN::exec of /home/ycp/source/mariadb-server/10.5/src/sql/sql_select.cc:4437 21 in mysql_select of /home/ycp/source/mariadb-server/10.5/src/sql/sql_select.cc:4914
            Roel Roel Van de Paar made changes -
            Labels affects-tests affects-tests hang
            julien.fritsch Julien Fritsch made changes -
            Fix Version/s 10.11 [ 27614 ]
            julien.fritsch Julien Fritsch made changes -
            Fix Version/s 11.2 [ 28603 ]
            julien.fritsch Julien Fritsch made changes -
            Fix Version/s 10.4 [ 22408 ]

            The bug now produces somewhat different outcomes. On a 11.2 debug build from 14 Oct 24 we see, for the original testcase:

            CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug)

            11.2.6-dbg>SET sql_mode='';
            Query OK, 0 rows affected (0.000 sec)
             
            11.2.6-dbg>INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            Query OK, 0 rows affected (0.646 sec)
             
            11.2.6-dbg>CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            Query OK, 0 rows affected (0.001 sec)
             
            11.2.6-dbg>CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            Query OK, 0 rows affected (0.001 sec)
             
            11.2.6-dbg>CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            Query OK, 0 rows affected (0.006 sec)
             
            11.2.6-dbg>SET GLOBAL init_connect='dummy';
            Query OK, 0 rows affected (0.000 sec)
             
            11.2.6-dbg>CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"';
            Query OK, 0 rows affected (0.004 sec)
             
            11.2.6-dbg>XA START 'a';
            Query OK, 0 rows affected (0.000 sec)
             
            11.2.6-dbg>INSERT INTO t VALUES (1);
            ERROR 1160 (08S01): Got an error writing communication packets
            11.2.6-dbg>SHOW CREATE TABLE t0;
            +-------+---------------------------------------------------------------------------------------------------------------------------------------------------------------+
            | Table | Create Table                                                                                                                                                  |
            +-------+---------------------------------------------------------------------------------------------------------------------------------------------------------------+
            | t0    | CREATE TABLE `t0` (
              `a` int(11) DEFAULT NULL
            ) ENGINE=SPIDER DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' |
            +-------+---------------------------------------------------------------------------------------------------------------------------------------------------------------+
            1 row in set, 1 warning (0.000 sec)
             
            11.2.6-dbg>SELECT * FROM t0 JOIN t0 a ON a=a;
            ERROR 1052 (23000): Column 'a' in on clause is ambiguous
            11.2.6-dbg>INSERT INTO t0 VALUES (1);
            ERROR 12701 (HY000): Remote MariaDB server has gone away
            11.2.6-dbg>exit
            

            Note the 1160, 1052 and 12701 errors. The server no longer crashes, the CLI connection only drops on the INSERT.

            For the second testcase we get:

            CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug)

            11.2.6-dbg>INSTALL PLUGIN Spider SONAME 'ha_spider.so';
             
            Query OK, 0 rows affected (0.591 sec)
             
            11.2.6-dbg>CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            Query OK, 0 rows affected (0.001 sec)
             
            11.2.6-dbg>CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            Query OK, 0 rows affected (0.001 sec)
             
            11.2.6-dbg>SET unique_checks=0,foreign_key_checks=0,autocommit=0;
            Query OK, 0 rows affected (0.000 sec)
             
            11.2.6-dbg>SET GLOBAL init_connect="dummy";
            Query OK, 0 rows affected (0.000 sec)
             
            11.2.6-dbg>CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1;
            ERROR 1160 (08S01): Got an error writing communication packets
            

            So it seems there are still issues, but no longer a SIGSEGV in spider_db_ping.

            I suspect the SIGSEGV is still there though; I will de-filter the SIGSEGV, see if it happens again and report here if it does.

            Roel Roel Van de Paar added a comment - The bug now produces somewhat different outcomes. On a 11.2 debug build from 14 Oct 24 we see, for the original testcase: CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug) 11.2.6-dbg>SET sql_mode=''; Query OK, 0 rows affected (0.000 sec)   11.2.6-dbg>INSTALL PLUGIN Spider SONAME 'ha_spider.so'; Query OK, 0 rows affected (0.646 sec)   11.2.6-dbg>CREATE USER Spider@localhost IDENTIFIED BY 'PWD0'; Query OK, 0 rows affected (0.001 sec)   11.2.6-dbg>CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0'); Query OK, 0 rows affected (0.001 sec)   11.2.6-dbg>CREATE TABLE t (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"'; Query OK, 0 rows affected (0.006 sec)   11.2.6-dbg>SET GLOBAL init_connect='dummy'; Query OK, 0 rows affected (0.000 sec)   11.2.6-dbg>CREATE TABLE t0 (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"'; Query OK, 0 rows affected (0.004 sec)   11.2.6-dbg>XA START 'a'; Query OK, 0 rows affected (0.000 sec)   11.2.6-dbg>INSERT INTO t VALUES (1); ERROR 1160 (08S01): Got an error writing communication packets 11.2.6-dbg>SHOW CREATE TABLE t0; +-------+---------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Table | Create Table | +-------+---------------------------------------------------------------------------------------------------------------------------------------------------------------+ | t0 | CREATE TABLE `t0` ( `a` int(11) DEFAULT NULL ) ENGINE=SPIDER DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' | +-------+---------------------------------------------------------------------------------------------------------------------------------------------------------------+ 1 row in set, 1 warning (0.000 sec)   11.2.6-dbg>SELECT * FROM t0 JOIN t0 a ON a=a; ERROR 1052 (23000): Column 'a' in on clause is ambiguous 11.2.6-dbg>INSERT INTO t0 VALUES (1); ERROR 12701 (HY000): Remote MariaDB server has gone away 11.2.6-dbg>exit Note the 1160, 1052 and 12701 errors. The server no longer crashes, the CLI connection only drops on the INSERT. For the second testcase we get: CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug) 11.2.6-dbg>INSTALL PLUGIN Spider SONAME 'ha_spider.so';   Query OK, 0 rows affected (0.591 sec)   11.2.6-dbg>CREATE USER Spider@localhost IDENTIFIED BY 'PWD0'; Query OK, 0 rows affected (0.001 sec)   11.2.6-dbg>CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0'); Query OK, 0 rows affected (0.001 sec)   11.2.6-dbg>SET unique_checks=0,foreign_key_checks=0,autocommit=0; Query OK, 0 rows affected (0.000 sec)   11.2.6-dbg>SET GLOBAL init_connect="dummy"; Query OK, 0 rows affected (0.000 sec)   11.2.6-dbg>CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1; ERROR 1160 (08S01): Got an error writing communication packets So it seems there are still issues, but no longer a SIGSEGV in spider_db_ping. I suspect the SIGSEGV is still there though; I will de-filter the SIGSEGV, see if it happens again and report here if it does.
            julien.fritsch Julien Fritsch made changes -
            Fix Version/s 11.2(EOL) [ 28603 ]
            ycp Yuchen Pei added a comment - - edited

            Roel: thanks for the update. Is there an mtr case?

            Meanwhile I will work on fixing the hanging not segv, which can be reproduced with a simplified case below:

            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            set spider_same_server_link= 1;
            evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql
            OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
            # hang at 10.5 24e5d564005904bc589fc869ea2f913eec8e6c3a
            # error 1205 at 11.4 4c9fd4f45b2be8f446777bf470e9352cd3e7c092
            CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1;
            drop server srv;
            

            In 11.4 the hanging is replaced by a lock wait timeout error:

            mysqltest: At line 7: query 'CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1' failed: ER_LOCK_WAIT_TIMEOUT (1205): Lock wait timeout exceeded; try restarting transaction
            

            This suggests MDEV-29676, i.e. deadlock caused by self-referencing spider tables.

            Update 2025-01-07: split the hanging issue to MDEV-35781

            ycp Yuchen Pei added a comment - - edited Roel : thanks for the update. Is there an mtr case? Meanwhile I will work on fixing the hanging not segv, which can be reproduced with a simplified case below: INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; set spider_same_server_link= 1; evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql OPTIONS (SOCKET "$MASTER_1_MYSOCK" , DATABASE 'test' , user 'root' ); # hang at 10.5 24e5d564005904bc589fc869ea2f913eec8e6c3a # error 1205 at 11.4 4c9fd4f45b2be8f446777bf470e9352cd3e7c092 CREATE TABLE t ENGINE=Spider COMMENT= 'WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1; drop server srv; In 11.4 the hanging is replaced by a lock wait timeout error: mysqltest: At line 7: query 'CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1' failed: ER_LOCK_WAIT_TIMEOUT (1205): Lock wait timeout exceeded; try restarting transaction This suggests MDEV-29676 , i.e. deadlock caused by self-referencing spider tables. Update 2025-01-07: split the hanging issue to MDEV-35781
            Roel Roel Van de Paar made changes -
            Priority Critical [ 2 ] Major [ 3 ]
            ycp Yuchen Pei made changes -
            Roel Roel Van de Paar made changes -
            Labels affects-tests hang hang

            Whereas previously in 11.2 the second t/c would no longer SIGSEGV, all current maintained versions do.

            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            CREATE USER Spider@localhost IDENTIFIED BY 'PWD0';
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'Spider',PASSWORD 'PWD0');
            SET unique_checks=0,foreign_key_checks=0,autocommit=0;
            SET GLOBAL init_connect="dummy";
            CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1;
            

            Leads to:

            CS 11.4.5 9e7762e718b5f39bc38cebfabc3ff4cb57b1cc68 (Debug)

            Core was generated by `/test/MD191224-mariadb-11.4.5-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0  0x00001482309013fe in spider_db_ping (spider=0x1481d4056bb0, conn=0x1481d41bf2c8, link_idx=0)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:210
             
            [Current thread is 1 (LWP 3673310)]
            (gdb) bt
            #0  0x00001482309013fe in spider_db_ping (spider=0x1481d4056bb0, conn=0x1481d41bf2c8, link_idx=0)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:210
            #1  0x00001482309016f1 in spider_db_conn_queue_action (conn=0x1481d41bf2c8)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:256
            #2  0x0000148230902e43 in spider_db_before_query (conn=0x1481d41bf2c8, need_mon=0x148230f656ec)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:556
            #3  0x0000148230905729 in spider_db_query (conn=0x1481d41bf2c8, query=0x1482309c64d3 "commit", length=6, quick_mode=-1, need_mon=0x148230f656ec)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:625
            #4  0x000014823099a314 in spider_db_query_with_lock (conn=0x1481d41bf2c8, query=0x1482309c64d3 "commit", len=6, need_mon=0x148230f656ec)at /test/11.4_dbg/storage/spider/spd_db_mysql.cc:2499
            #5  0x000014823099a60a in spider_db_mbase::commit (this=0x1481d4018fe0, need_mon=0x148230f656ec)at /test/11.4_dbg/storage/spider/spd_db_mysql.cc:2546
            #6  0x000014823090744d in spider_db_commit (conn=0x1481d41bf2c8)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:1070
            #7  0x00001482308fe8cd in spider_commit (hton=0x1481d403d148, thd=0x1481d4000d58, all=true)at /test/11.4_dbg/storage/spider/spd_trx.cc:3114
            #8  0x0000560f6ec5ec2b in commit_one_phase_2 (thd=0x1481d4000d58, all=true, trans=0x1481d4004848, is_real_trans=true)at /test/11.4_dbg/sql/handler.cc:2198
            #9  0x0000560f6ec5f33c in ha_commit_one_phase (thd=0x1481d4000d58, all=true)at /test/11.4_dbg/sql/handler.cc:2151
            #10 0x0000560f6ec5d88f in ha_commit_trans (thd=0x1481d4000d58, all=true)at /test/11.4_dbg/sql/handler.cc:1945
            #11 0x0000560f6ea4aa79 in trans_commit_implicit (thd=0x1481d4000d58)at /test/11.4_dbg/sql/transaction.cc:338
            #12 0x0000560f6e85d977 in mysql_execute_command (thd=0x1481d4000d58, is_called_from_prepared_stmt=false) at /test/11.4_dbg/sql/sql_parse.cc:5990
            #13 0x0000560f6e84c5b4 in mysql_parse (thd=0x1481d4000d58, rawbuf=0x1481d401a730 "CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER \"mysql\",srv \"srv\",TABLE \"t\"' AS SELECT 1", length=86, parser_state=0x148230f67a30) at /test/11.4_dbg/sql/sql_parse.cc:7898
            #14 0x0000560f6e849b04 in dispatch_command (command=COM_QUERY, thd=0x1481d4000d58, packet=0x1481d400aff9 "CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER \"mysql\",srv \"srv\",TABLE \"t\"' AS SELECT 1", packet_length=86, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1906
            #15 0x0000560f6e84d163 in do_command (thd=0x1481d4000d58, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1419
            #16 0x0000560f6ea2dfc9 in do_handle_one_connection (connect=0x560f727205b8, put_in_cache=true) at /test/11.4_dbg/sql/sql_connect.cc:1408
            #17 0x0000560f6ea2dd62 in handle_one_connection (arg=0x560f726aaec8)at /test/11.4_dbg/sql/sql_connect.cc:1320
            #18 0x000014823349ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
            #19 0x0000148233529c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
            

            Bug confirmed present in:
            MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)

            Roel Roel Van de Paar added a comment - Whereas previously in 11.2 the second t/c would no longer SIGSEGV, all current maintained versions do. INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; CREATE USER Spider@localhost IDENTIFIED BY 'PWD0' ; CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock' , DATABASE 'test' , user 'Spider' , PASSWORD 'PWD0' ); SET unique_checks=0,foreign_key_checks=0,autocommit=0; SET GLOBAL init_connect= "dummy" ; CREATE TABLE t ENGINE=Spider COMMENT= 'WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1; Leads to: CS 11.4.5 9e7762e718b5f39bc38cebfabc3ff4cb57b1cc68 (Debug) Core was generated by `/test/MD191224-mariadb-11.4.5-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00001482309013fe in spider_db_ping (spider=0x1481d4056bb0, conn=0x1481d41bf2c8, link_idx=0)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:210   [Current thread is 1 (LWP 3673310)] (gdb) bt #0 0x00001482309013fe in spider_db_ping (spider=0x1481d4056bb0, conn=0x1481d41bf2c8, link_idx=0)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:210 #1 0x00001482309016f1 in spider_db_conn_queue_action (conn=0x1481d41bf2c8)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:256 #2 0x0000148230902e43 in spider_db_before_query (conn=0x1481d41bf2c8, need_mon=0x148230f656ec)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:556 #3 0x0000148230905729 in spider_db_query (conn=0x1481d41bf2c8, query=0x1482309c64d3 "commit", length=6, quick_mode=-1, need_mon=0x148230f656ec)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:625 #4 0x000014823099a314 in spider_db_query_with_lock (conn=0x1481d41bf2c8, query=0x1482309c64d3 "commit", len=6, need_mon=0x148230f656ec)at /test/11.4_dbg/storage/spider/spd_db_mysql.cc:2499 #5 0x000014823099a60a in spider_db_mbase::commit (this=0x1481d4018fe0, need_mon=0x148230f656ec)at /test/11.4_dbg/storage/spider/spd_db_mysql.cc:2546 #6 0x000014823090744d in spider_db_commit (conn=0x1481d41bf2c8)at /test/11.4_dbg/storage/spider/spd_db_conn.cc:1070 #7 0x00001482308fe8cd in spider_commit (hton=0x1481d403d148, thd=0x1481d4000d58, all=true)at /test/11.4_dbg/storage/spider/spd_trx.cc:3114 #8 0x0000560f6ec5ec2b in commit_one_phase_2 (thd=0x1481d4000d58, all=true, trans=0x1481d4004848, is_real_trans=true)at /test/11.4_dbg/sql/handler.cc:2198 #9 0x0000560f6ec5f33c in ha_commit_one_phase (thd=0x1481d4000d58, all=true)at /test/11.4_dbg/sql/handler.cc:2151 #10 0x0000560f6ec5d88f in ha_commit_trans (thd=0x1481d4000d58, all=true)at /test/11.4_dbg/sql/handler.cc:1945 #11 0x0000560f6ea4aa79 in trans_commit_implicit (thd=0x1481d4000d58)at /test/11.4_dbg/sql/transaction.cc:338 #12 0x0000560f6e85d977 in mysql_execute_command (thd=0x1481d4000d58, is_called_from_prepared_stmt=false) at /test/11.4_dbg/sql/sql_parse.cc:5990 #13 0x0000560f6e84c5b4 in mysql_parse (thd=0x1481d4000d58, rawbuf=0x1481d401a730 "CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER \"mysql\",srv \"srv\",TABLE \"t\"' AS SELECT 1", length=86, parser_state=0x148230f67a30) at /test/11.4_dbg/sql/sql_parse.cc:7898 #14 0x0000560f6e849b04 in dispatch_command (command=COM_QUERY, thd=0x1481d4000d58, packet=0x1481d400aff9 "CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER \"mysql\",srv \"srv\",TABLE \"t\"' AS SELECT 1", packet_length=86, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1906 #15 0x0000560f6e84d163 in do_command (thd=0x1481d4000d58, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1419 #16 0x0000560f6ea2dfc9 in do_handle_one_connection (connect=0x560f727205b8, put_in_cache=true) at /test/11.4_dbg/sql/sql_connect.cc:1408 #17 0x0000560f6ea2dd62 in handle_one_connection (arg=0x560f726aaec8)at /test/11.4_dbg/sql/sql_connect.cc:1320 #18 0x000014823349ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447 #19 0x0000148233529c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 Bug confirmed present in: MariaDB: 10.5.28 (dbg), 10.5.28 (opt), 10.6.21 (dbg), 10.6.21 (opt), 10.11.11 (dbg), 10.11.11 (opt), 11.4.5 (dbg), 11.4.5 (opt), 11.7.1 (dbg), 11.7.1 (opt), 11.8.0 (dbg), 11.8.0 (opt)
            Roel Roel Van de Paar made changes -
            Affects Version/s 11.7 [ 29815 ]
            Affects Version/s 11.8 [ 29921 ]
            Roel Roel Van de Paar made changes -
            Fix Version/s 11.7 [ 29815 ]
            Roel Roel Van de Paar made changes -
            Labels hang UBSAN hang
            Roel Roel Van de Paar added a comment - - edited

            Using a UBASAN clang build, with the second t/c leads to:

            CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)

            2025-01-10 10:41:58 0 [Note] /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd: ready for connections.
            Version: '11.8.0-MariaDB-debug'  socket: '/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/socket.sock'  port: 10348  MariaDB Server
            2025-01-10 10:44:05 7 [Warning] Aborted connection 7 to db: 'unconnected' user: 'Spider' host: 'localhost' (init_connect command failed)
            2025-01-10 10:44:05 7 [Warning] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dummy' at line 1
            2025-01-10 10:44:05 8 [Warning] Aborted connection 8 to db: 'unconnected' user: 'Spider' host: 'localhost' (init_connect command failed)
            2025-01-10 10:44:05 8 [Warning] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dummy' at line 1
            2025-01-10 10:44:05 9 [Warning] Aborted connection 9 to db: 'unconnected' user: 'Spider' host: 'localhost' (init_connect command failed)
            2025-01-10 10:44:05 9 [Warning] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dummy' at line 1
            2025-01-10 10:44:05 10 [Warning] Aborted connection 10 to db: 'unconnected' user: 'Spider' host: 'localhost' (init_connect command failed)
            2025-01-10 10:44:05 10 [Warning] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dummy' at line 1
            2025-01-10 10:44:05 11 [Warning] Aborted connection 11 to db: 'unconnected' user: 'Spider' host: 'localhost' (init_connect command failed)
            2025-01-10 10:44:05 11 [Warning] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dummy' at line 1
            /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:210:15: runtime error: member access within address 0x51f0000eb6b8 which does not point to an object of type 'ha_spider'
            0x51f0000eb6b8: note: object is of type 'handler'
             be be be be  10 dd ea 09 ec 55 00 00  b8 00 0b 00 c0 51 00 00  98 b9 1e 00 90 51 00 00  9a 0c 6a 95
                          ^~~~~~~~~~~~~~~~~~~~~~~
                          vptr for 'handler'
                #0 0x1482b40a64f5 in spider_db_ping(ha_spider*, st_spider_conn*, int) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:210:15
                #1 0x1482b40a834d in spider_db_conn_queue_action(st_spider_conn*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:256:24
                #2 0x1482b40bbef7 in spider_db_before_query(st_spider_conn*, int*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:556:20
                #3 0x1482b40d7620 in spider_db_query(st_spider_conn*, char const*, unsigned int, int, int*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:625:20
                #4 0x1482b471e195 in spider_db_query_with_lock(st_spider_conn*, char const*, unsigned int, int*) /test/11.8_dbg_san/storage/spider/spd_db_mysql.cc:2501:7
                #5 0x1482b471facb in spider_db_mbase::commit(int*) /test/11.8_dbg_san/storage/spider/spd_db_mysql.cc:2548:3
                #6 0x1482b40ef1e4 in spider_db_commit(st_spider_conn*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:1070:37
                #7 0x1482b4083ed8 in spider_commit(THD*, bool) /test/11.8_dbg_san/storage/spider/spd_trx.cc:3112:32
                #8 0x55ec0418e01b in commit_one_phase_2(THD*, bool, THD_TRANS*, bool) /test/11.8_dbg_san/sql/handler.cc:2218:17
                #9 0x55ec0419369d in ha_commit_one_phase(THD*, bool) /test/11.8_dbg_san/sql/handler.cc:2160:8
                #10 0x55ec04184352 in ha_commit_trans(THD*, bool) /test/11.8_dbg_san/sql/handler.cc:1954:12
                #11 0x55ec02e0952f in trans_commit_implicit(THD*) /test/11.8_dbg_san/sql/transaction.cc:333:10
                #12 0x55ec01c4f338 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:5993:7
                #13 0x55ec01ba7ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
                #14 0x55ec01b88db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
                #15 0x55ec01bb1e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
                #16 0x55ec02d14556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
                #17 0x55ec02d12d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
                #18 0x55ec00d5b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
                #19 0x1482e2a9ca93 in start_thread nptl/pthread_create.c:447:8
                #20 0x1482e2b29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
             
            SUMMARY: UndefinedBehaviorSanitizer: dynamic-type-mismatch /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:210:15 
            

            CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang)

            ==1220788==ERROR: AddressSanitizer: heap-use-after-free on address 0x51f0000ec0d8 at pc 0x1482b40a6566 bp 0x1482b62f18f0 sp 0x1482b62f18e8
            READ of size 8 at 0x51f0000ec0d8 thread T12
                #0 0x1482b40a6565 in spider_db_ping(ha_spider*, st_spider_conn*, int) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:210:15
                #1 0x1482b40a834d in spider_db_conn_queue_action(st_spider_conn*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:256:24
                #2 0x1482b40bbef7 in spider_db_before_query(st_spider_conn*, int*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:556:20
                #3 0x1482b40d7620 in spider_db_query(st_spider_conn*, char const*, unsigned int, int, int*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:625:20
                #4 0x1482b471e195 in spider_db_query_with_lock(st_spider_conn*, char const*, unsigned int, int*) /test/11.8_dbg_san/storage/spider/spd_db_mysql.cc:2501:7
                #5 0x1482b471facb in spider_db_mbase::commit(int*) /test/11.8_dbg_san/storage/spider/spd_db_mysql.cc:2548:3
                #6 0x1482b40ef1e4 in spider_db_commit(st_spider_conn*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:1070:37
                #7 0x1482b4083ed8 in spider_commit(THD*, bool) /test/11.8_dbg_san/storage/spider/spd_trx.cc:3112:32
                #8 0x55ec0418e01b in commit_one_phase_2(THD*, bool, THD_TRANS*, bool) /test/11.8_dbg_san/sql/handler.cc:2218:17
                #9 0x55ec0419369d in ha_commit_one_phase(THD*, bool) /test/11.8_dbg_san/sql/handler.cc:2160:8
                #10 0x55ec04184352 in ha_commit_trans(THD*, bool) /test/11.8_dbg_san/sql/handler.cc:1954:12
                #11 0x55ec02e0952f in trans_commit_implicit(THD*) /test/11.8_dbg_san/sql/transaction.cc:333:10
                #12 0x55ec01c4f338 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:5993:7
                #13 0x55ec01ba7ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
                #14 0x55ec01b88db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
                #15 0x55ec01bb1e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
                #16 0x55ec02d14556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
                #17 0x55ec02d12d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
                #18 0x55ec00d5b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
                #19 0x1482e2a9ca93 in start_thread nptl/pthread_create.c:447:8
                #20 0x1482e2b29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
             
            0x51f0000ec0d8 is located 2648 bytes inside of 3048-byte region [0x51f0000eb680,0x51f0000ec268)
            freed by thread T12 here:
                #0 0x55ec00d5d87a in free (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd+0x42ae87a) (BuildId: 6806f131f56caa3fd079d953e4400ba5ec496093)
                #1 0x55ec07d45431 in my_free /test/11.8_dbg_san/mysys/my_malloc.c:221:3
                #2 0x55ec07ce3dea in root_free /test/11.8_dbg_san/mysys/my_alloc.c:77:5
                #3 0x55ec07ce66c3 in free_root /test/11.8_dbg_san/mysys/my_alloc.c:502:7
                #4 0x55ec02a1f3fe in closefrm(TABLE*) /test/11.8_dbg_san/sql/table.cc:4851:3
                #5 0x55ec03717647 in intern_close_table(TABLE*) /test/11.8_dbg_san/sql/table_cache.cc:230:3
                #6 0x55ec0371a07d in tc_remove_table(TABLE*) /test/11.8_dbg_san/sql/table_cache.cc:268:3
                #7 0x55ec0371ee7d in tc_release_table(TABLE*) /test/11.8_dbg_san/sql/table_cache.cc:461:5
                #8 0x55ec0152212f in close_thread_table(THD*, TABLE**) /test/11.8_dbg_san/sql/sql_base.cc:1051:3
                #9 0x55ec01532b6b in drop_open_table(THD*, TABLE*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*) /test/11.8_dbg_san/sql/sql_base.cc:1460:5
                #10 0x55ec019681e2 in select_create::abort_result_set() /test/11.8_dbg_san/sql/sql_insert.cc:5411:5
                #11 0x55ec0195986a in select_create::send_eof() /test/11.8_dbg_san/sql/sql_insert.cc:5191:5
                #12 0x55ec020e07c9 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:4919:30
                #13 0x55ec020dc56a in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4820:8
                #14 0x55ec01f7aa79 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_dbg_san/sql/sql_select.cc:5353:21
                #15 0x55ec01f76137 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10
                #16 0x55ec02740362 in Sql_cmd_create_table_like::execute(THD*) /test/11.8_dbg_san/sql/sql_table.cc:13377:20
                #17 0x55ec01c4ad67 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:5872:26
                #18 0x55ec01ba7ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
                #19 0x55ec01b88db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
                #20 0x55ec01bb1e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
                #21 0x55ec02d14556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
                #22 0x55ec02d12d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
                #23 0x55ec00d5b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
             
            previously allocated by thread T12 here:
                #0 0x55ec00d5db13 in malloc (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd+0x42aeb13) (BuildId: 6806f131f56caa3fd079d953e4400ba5ec496093)
                #1 0x55ec07d4415e in my_malloc /test/11.8_dbg_san/mysys/my_malloc.c:93:29
                #2 0x55ec07ce2b2e in root_alloc /test/11.8_dbg_san/mysys/my_alloc.c:66:10
                #3 0x55ec07ce4f32 in alloc_root /test/11.8_dbg_san/mysys/my_alloc.c:333:29
                #4 0x1482b40698a0 in Sql_alloc::operator new(unsigned long, st_mem_root*) /test/11.8_dbg_san/sql/sql_alloc.h:37:12
                #5 0x1482b43fa171 in spider_create_handler(handlerton*, TABLE_SHARE*, st_mem_root*) /test/11.8_dbg_san/storage/spider/spd_table.cc:6190:3
                #6 0x55ec041568ae in get_new_handler(TABLE_SHARE*, st_mem_root*, handlerton*) /test/11.8_dbg_san/sql/handler.cc:387:16
                #7 0x55ec02a06952 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.8_dbg_san/sql/table.cc:4338:27
                #8 0x55ec01541f99 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.8_dbg_san/sql/sql_base.cc:2239:12
                #9 0x55ec01943de7 in select_create::create_table_from_items(THD*, List<Item>*, st_mysql_lock**) /test/11.8_dbg_san/sql/sql_insert.cc:4759:11
                #10 0x55ec0194bf52 in select_create::prepare(List<Item>&, st_select_lex_unit*) /test/11.8_dbg_san/sql/sql_insert.cc:4916:16
                #11 0x55ec01fab2ac in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /test/11.8_dbg_san/sql/sql_select.cc:1857:39
                #12 0x55ec01f79bbb in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_dbg_san/sql/sql_select.cc:5328:21
                #13 0x55ec01f76137 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10
                #14 0x55ec02740362 in Sql_cmd_create_table_like::execute(THD*) /test/11.8_dbg_san/sql/sql_table.cc:13377:20
                #15 0x55ec01c4ad67 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:5872:26
                #16 0x55ec01ba7ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18
                #17 0x55ec01b88db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7
                #18 0x55ec01bb1e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17
                #19 0x55ec02d14556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11
                #20 0x55ec02d12d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5
                #21 0x55ec00d5b5fc in asan_thread_start(void*) asan_interceptors.cpp.o
             
            Thread T12 created by T0 here:
                #0 0x55ec00d43485 in pthread_create (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd+0x4294485) (BuildId: 6806f131f56caa3fd079d953e4400ba5ec496093)
                #1 0x55ec00dc624d in create_thread_to_handle_connection(CONNECT*) /test/11.8_dbg_san/sql/mysqld.cc:6266:19
                #2 0x55ec00dc7637 in create_new_thread(CONNECT*) /test/11.8_dbg_san/sql/mysqld.cc:6328:3
                #3 0x55ec00dc79b4 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.8_dbg_san/sql/mysqld.cc:6390:5
                #4 0x55ec00dc925a in handle_connections_sockets() /test/11.8_dbg_san/sql/mysqld.cc:6502:9
                #5 0x55ec00dc4a5f in run_main_loop() /test/11.8_dbg_san/sql/mysqld.cc:5744:3
                #6 0x55ec00db53e5 in mysqld_main(int, char**) /test/11.8_dbg_san/sql/mysqld.cc:6167:3
                #7 0x55ec00d9e4f3 in main /test/11.8_dbg_san/sql/main.cc:34:10
                #8 0x1482e2a2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
                #9 0x1482e2a2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
                #10 0x55ec00cc2cc4 in _start (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd+0x4213cc4) (BuildId: 6806f131f56caa3fd079d953e4400ba5ec496093)
             
            SUMMARY: AddressSanitizer: heap-use-after-free /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:210:15 in spider_db_ping(ha_spider*, st_spider_conn*, int)
            Shadow bytes around the buggy address:
              0x51f0000ebe00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x51f0000ebe80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x51f0000ebf00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x51f0000ebf80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x51f0000ec000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
            =>0x51f0000ec080: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
              0x51f0000ec100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x51f0000ec180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x51f0000ec200: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
              0x51f0000ec280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
              0x51f0000ec300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
            Shadow byte legend (one shadow byte represents 8 application bytes):
              Addressable:           00
              Partially addressable: 01 02 03 04 05 06 07 
              Heap left redzone:       fa
              Freed heap region:       fd
              Stack left redzone:      f1
              Stack mid redzone:       f2
              Stack right redzone:     f3
              Stack after return:      f5
              Stack use after scope:   f8
              Global redzone:          f9
              Global init order:       f6
              Poisoned by user:        f7
              Container overflow:      fc
              Array cookie:            ac
              Intra object redzone:    bb
              ASan internal:           fe
              Left alloca redzone:     ca
              Right alloca redzone:    cb
            ==1220788==ABORTING
            250110 10:44:05 [ERROR] mysqld got signal 6 ;
            Sorry, we probably made a mistake, and this is a bug.
             
            Your assistance in bug reporting will enable us to fix this for the next release.
            To report this bug, see https://mariadb.com/kb/en/reporting-bugs
             
            We will try our best to scrape up some info that will hopefully help
            diagnose the problem, but since we have already crashed, 
            something is definitely wrong and this may fail.
             
            Server version: 11.8.0-MariaDB-debug source revision: 7734c85c31c9e292ef1133115fba2f7edd71dd51
            key_buffer_size=134217728
            read_buffer_size=131072
            max_used_connections=2
            max_threads=10002
            thread_count=4
            It is possible that mysqld could use up to 
            key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 22168263 K  bytes of memory
            Hope that's ok; if not, decrease some variables in the equation.
             
            Thread pointer: 0x52b000165218
            Attempting backtrace. You can use the following information to find out
            where mysqld died. If you see no messages after this, something went
            terribly wrong...
            stack_bottom = 0x1482b6302000 thread_stack 0xb00000
            /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(___interceptor_backtrace+0x4a)[0x55ec00d075da]
            /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(my_print_stacktrace+0x144)[0x55ec07d5bdec]
            sql/signal_handler.cc:247(handle_fatal_signal)[0x55ec041517fd]
            libc_sigaction.c:0(__restore_rt)[0x1482e2a45320]
            nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x1482e2a9eb1c]
            posix/raise.c:27(__GI_raise)[0x1482e2a4526e]
            stdlib/abort.c:81(__GI_abort)[0x1482e2a288ff]
            /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(+0x42d50ab)[0x55ec00d840ab]
            /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(+0x42d3235)[0x55ec00d82235]
            /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(+0x42b395f)[0x55ec00d6295f]
            /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(+0x42b69e5)[0x55ec00d659e5]
            /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(__asan_report_load8+0x2c)[0x55ec00d6674c]
            spider/spd_db_conn.cc:0(spider_db_ping(ha_spider*, st_spider_conn*, int))[0x1482b40a6566]
            spider/spd_db_conn.cc:256(spider_db_conn_queue_action(st_spider_conn*))[0x1482b40a834e]
            spider/spd_db_conn.cc:556(spider_db_before_query(st_spider_conn*, int*))[0x1482b40bbef8]
            spider/spd_db_conn.cc:625(spider_db_query(st_spider_conn*, char const*, unsigned int, int, int*))[0x1482b40d7621]
            spider/spd_db_mysql.cc:2501(spider_db_query_with_lock(st_spider_conn*, char const*, unsigned int, int*))[0x1482b471e196]
            spider/spd_db_mysql.cc:2548(spider_db_mbase::commit(int*))[0x1482b471facc]
            spider/spd_db_conn.cc:1070(spider_db_commit(st_spider_conn*))[0x1482b40ef1e5]
            spider/spd_trx.cc:3112(spider_commit(THD*, bool))[0x1482b4083ed9]
            sql/handler.cc:2218(commit_one_phase_2(THD*, bool, THD_TRANS*, bool))[0x55ec0418e01c]
            sql/handler.cc:2160(ha_commit_one_phase(THD*, bool))[0x55ec0419369e]
            sql/handler.cc:1954(ha_commit_trans(THD*, bool))[0x55ec04184353]
            sql/transaction.cc:333(trans_commit_implicit(THD*))[0x55ec02e09530]
            sql/sql_parse.cc:5993(mysql_execute_command(THD*, bool))[0x55ec01c4f339]
            sql/sql_parse.cc:7901(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55ec01ba7efa]
            sql/sql_parse.cc:1903(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55ec01b88db9]
            sql/sql_parse.cc:1416(do_command(THD*, bool))[0x55ec01bb1e57]
            sql/sql_connect.cc:1415(do_handle_one_connection(CONNECT*, bool))[0x55ec02d14557]
            sql/sql_connect.cc:1329(handle_one_connection)[0x55ec02d12d1a]
            asan_interceptors.cpp.o:0(asan_thread_start(void*))[0x55ec00d5b5fd]
            nptl/pthread_create.c:447(start_thread)[0x1482e2a9ca94]
            x86_64/clone3.S:80(clone3)[0x1482e2b29c3c]
             
            Trying to get some variables.
            Some pointers may be invalid and cause the dump to abort.
            Query (0x5290000eb238): CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1
            

            Setup:

            Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:
                 # Note: llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18
                 sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools
                 sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so
            Compiled with: '-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++' and:
                -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
            Set before execution:
                export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1
                export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
            

            Present in all versions mentioned in the previous comment.

            Roel Roel Van de Paar added a comment - - edited Using a UBASAN clang build, with the second t/c leads to: CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang) 2025-01-10 10:41:58 0 [Note] /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd: ready for connections. Version: '11.8.0-MariaDB-debug' socket: '/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/socket.sock' port: 10348 MariaDB Server 2025-01-10 10:44:05 7 [Warning] Aborted connection 7 to db: 'unconnected' user: 'Spider' host: 'localhost' (init_connect command failed) 2025-01-10 10:44:05 7 [Warning] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dummy' at line 1 2025-01-10 10:44:05 8 [Warning] Aborted connection 8 to db: 'unconnected' user: 'Spider' host: 'localhost' (init_connect command failed) 2025-01-10 10:44:05 8 [Warning] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dummy' at line 1 2025-01-10 10:44:05 9 [Warning] Aborted connection 9 to db: 'unconnected' user: 'Spider' host: 'localhost' (init_connect command failed) 2025-01-10 10:44:05 9 [Warning] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dummy' at line 1 2025-01-10 10:44:05 10 [Warning] Aborted connection 10 to db: 'unconnected' user: 'Spider' host: 'localhost' (init_connect command failed) 2025-01-10 10:44:05 10 [Warning] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dummy' at line 1 2025-01-10 10:44:05 11 [Warning] Aborted connection 11 to db: 'unconnected' user: 'Spider' host: 'localhost' (init_connect command failed) 2025-01-10 10:44:05 11 [Warning] You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'dummy' at line 1 /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:210:15: runtime error: member access within address 0x51f0000eb6b8 which does not point to an object of type 'ha_spider' 0x51f0000eb6b8: note: object is of type 'handler' be be be be 10 dd ea 09 ec 55 00 00 b8 00 0b 00 c0 51 00 00 98 b9 1e 00 90 51 00 00 9a 0c 6a 95 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'handler' #0 0x1482b40a64f5 in spider_db_ping(ha_spider*, st_spider_conn*, int) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:210:15 #1 0x1482b40a834d in spider_db_conn_queue_action(st_spider_conn*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:256:24 #2 0x1482b40bbef7 in spider_db_before_query(st_spider_conn*, int*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:556:20 #3 0x1482b40d7620 in spider_db_query(st_spider_conn*, char const*, unsigned int, int, int*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:625:20 #4 0x1482b471e195 in spider_db_query_with_lock(st_spider_conn*, char const*, unsigned int, int*) /test/11.8_dbg_san/storage/spider/spd_db_mysql.cc:2501:7 #5 0x1482b471facb in spider_db_mbase::commit(int*) /test/11.8_dbg_san/storage/spider/spd_db_mysql.cc:2548:3 #6 0x1482b40ef1e4 in spider_db_commit(st_spider_conn*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:1070:37 #7 0x1482b4083ed8 in spider_commit(THD*, bool) /test/11.8_dbg_san/storage/spider/spd_trx.cc:3112:32 #8 0x55ec0418e01b in commit_one_phase_2(THD*, bool, THD_TRANS*, bool) /test/11.8_dbg_san/sql/handler.cc:2218:17 #9 0x55ec0419369d in ha_commit_one_phase(THD*, bool) /test/11.8_dbg_san/sql/handler.cc:2160:8 #10 0x55ec04184352 in ha_commit_trans(THD*, bool) /test/11.8_dbg_san/sql/handler.cc:1954:12 #11 0x55ec02e0952f in trans_commit_implicit(THD*) /test/11.8_dbg_san/sql/transaction.cc:333:10 #12 0x55ec01c4f338 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:5993:7 #13 0x55ec01ba7ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18 #14 0x55ec01b88db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7 #15 0x55ec01bb1e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17 #16 0x55ec02d14556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11 #17 0x55ec02d12d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5 #18 0x55ec00d5b5fc in asan_thread_start(void*) asan_interceptors.cpp.o #19 0x1482e2a9ca93 in start_thread nptl/pthread_create.c:447:8 #20 0x1482e2b29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78   SUMMARY: UndefinedBehaviorSanitizer: dynamic-type-mismatch /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:210:15 CS 11.8.0 7734c85c31c9e292ef1133115fba2f7edd71dd51 (Debug, UBASAN, Clang) ==1220788==ERROR: AddressSanitizer: heap-use-after-free on address 0x51f0000ec0d8 at pc 0x1482b40a6566 bp 0x1482b62f18f0 sp 0x1482b62f18e8 READ of size 8 at 0x51f0000ec0d8 thread T12 #0 0x1482b40a6565 in spider_db_ping(ha_spider*, st_spider_conn*, int) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:210:15 #1 0x1482b40a834d in spider_db_conn_queue_action(st_spider_conn*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:256:24 #2 0x1482b40bbef7 in spider_db_before_query(st_spider_conn*, int*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:556:20 #3 0x1482b40d7620 in spider_db_query(st_spider_conn*, char const*, unsigned int, int, int*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:625:20 #4 0x1482b471e195 in spider_db_query_with_lock(st_spider_conn*, char const*, unsigned int, int*) /test/11.8_dbg_san/storage/spider/spd_db_mysql.cc:2501:7 #5 0x1482b471facb in spider_db_mbase::commit(int*) /test/11.8_dbg_san/storage/spider/spd_db_mysql.cc:2548:3 #6 0x1482b40ef1e4 in spider_db_commit(st_spider_conn*) /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:1070:37 #7 0x1482b4083ed8 in spider_commit(THD*, bool) /test/11.8_dbg_san/storage/spider/spd_trx.cc:3112:32 #8 0x55ec0418e01b in commit_one_phase_2(THD*, bool, THD_TRANS*, bool) /test/11.8_dbg_san/sql/handler.cc:2218:17 #9 0x55ec0419369d in ha_commit_one_phase(THD*, bool) /test/11.8_dbg_san/sql/handler.cc:2160:8 #10 0x55ec04184352 in ha_commit_trans(THD*, bool) /test/11.8_dbg_san/sql/handler.cc:1954:12 #11 0x55ec02e0952f in trans_commit_implicit(THD*) /test/11.8_dbg_san/sql/transaction.cc:333:10 #12 0x55ec01c4f338 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:5993:7 #13 0x55ec01ba7ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18 #14 0x55ec01b88db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7 #15 0x55ec01bb1e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17 #16 0x55ec02d14556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11 #17 0x55ec02d12d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5 #18 0x55ec00d5b5fc in asan_thread_start(void*) asan_interceptors.cpp.o #19 0x1482e2a9ca93 in start_thread nptl/pthread_create.c:447:8 #20 0x1482e2b29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78   0x51f0000ec0d8 is located 2648 bytes inside of 3048-byte region [0x51f0000eb680,0x51f0000ec268) freed by thread T12 here: #0 0x55ec00d5d87a in free (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd+0x42ae87a) (BuildId: 6806f131f56caa3fd079d953e4400ba5ec496093) #1 0x55ec07d45431 in my_free /test/11.8_dbg_san/mysys/my_malloc.c:221:3 #2 0x55ec07ce3dea in root_free /test/11.8_dbg_san/mysys/my_alloc.c:77:5 #3 0x55ec07ce66c3 in free_root /test/11.8_dbg_san/mysys/my_alloc.c:502:7 #4 0x55ec02a1f3fe in closefrm(TABLE*) /test/11.8_dbg_san/sql/table.cc:4851:3 #5 0x55ec03717647 in intern_close_table(TABLE*) /test/11.8_dbg_san/sql/table_cache.cc:230:3 #6 0x55ec0371a07d in tc_remove_table(TABLE*) /test/11.8_dbg_san/sql/table_cache.cc:268:3 #7 0x55ec0371ee7d in tc_release_table(TABLE*) /test/11.8_dbg_san/sql/table_cache.cc:461:5 #8 0x55ec0152212f in close_thread_table(THD*, TABLE**) /test/11.8_dbg_san/sql/sql_base.cc:1051:3 #9 0x55ec01532b6b in drop_open_table(THD*, TABLE*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*) /test/11.8_dbg_san/sql/sql_base.cc:1460:5 #10 0x55ec019681e2 in select_create::abort_result_set() /test/11.8_dbg_san/sql/sql_insert.cc:5411:5 #11 0x55ec0195986a in select_create::send_eof() /test/11.8_dbg_san/sql/sql_insert.cc:5191:5 #12 0x55ec020e07c9 in JOIN::exec_inner() /test/11.8_dbg_san/sql/sql_select.cc:4919:30 #13 0x55ec020dc56a in JOIN::exec() /test/11.8_dbg_san/sql/sql_select.cc:4820:8 #14 0x55ec01f7aa79 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_dbg_san/sql/sql_select.cc:5353:21 #15 0x55ec01f76137 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10 #16 0x55ec02740362 in Sql_cmd_create_table_like::execute(THD*) /test/11.8_dbg_san/sql/sql_table.cc:13377:20 #17 0x55ec01c4ad67 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:5872:26 #18 0x55ec01ba7ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18 #19 0x55ec01b88db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7 #20 0x55ec01bb1e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17 #21 0x55ec02d14556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11 #22 0x55ec02d12d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5 #23 0x55ec00d5b5fc in asan_thread_start(void*) asan_interceptors.cpp.o   previously allocated by thread T12 here: #0 0x55ec00d5db13 in malloc (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd+0x42aeb13) (BuildId: 6806f131f56caa3fd079d953e4400ba5ec496093) #1 0x55ec07d4415e in my_malloc /test/11.8_dbg_san/mysys/my_malloc.c:93:29 #2 0x55ec07ce2b2e in root_alloc /test/11.8_dbg_san/mysys/my_alloc.c:66:10 #3 0x55ec07ce4f32 in alloc_root /test/11.8_dbg_san/mysys/my_alloc.c:333:29 #4 0x1482b40698a0 in Sql_alloc::operator new(unsigned long, st_mem_root*) /test/11.8_dbg_san/sql/sql_alloc.h:37:12 #5 0x1482b43fa171 in spider_create_handler(handlerton*, TABLE_SHARE*, st_mem_root*) /test/11.8_dbg_san/storage/spider/spd_table.cc:6190:3 #6 0x55ec041568ae in get_new_handler(TABLE_SHARE*, st_mem_root*, handlerton*) /test/11.8_dbg_san/sql/handler.cc:387:16 #7 0x55ec02a06952 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.8_dbg_san/sql/table.cc:4338:27 #8 0x55ec01541f99 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.8_dbg_san/sql/sql_base.cc:2239:12 #9 0x55ec01943de7 in select_create::create_table_from_items(THD*, List<Item>*, st_mysql_lock**) /test/11.8_dbg_san/sql/sql_insert.cc:4759:11 #10 0x55ec0194bf52 in select_create::prepare(List<Item>&, st_select_lex_unit*) /test/11.8_dbg_san/sql/sql_insert.cc:4916:16 #11 0x55ec01fab2ac in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /test/11.8_dbg_san/sql/sql_select.cc:1857:39 #12 0x55ec01f79bbb in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.8_dbg_san/sql/sql_select.cc:5328:21 #13 0x55ec01f76137 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.8_dbg_san/sql/sql_select.cc:633:10 #14 0x55ec02740362 in Sql_cmd_create_table_like::execute(THD*) /test/11.8_dbg_san/sql/sql_table.cc:13377:20 #15 0x55ec01c4ad67 in mysql_execute_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:5872:26 #16 0x55ec01ba7ef9 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.8_dbg_san/sql/sql_parse.cc:7901:18 #17 0x55ec01b88db8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1903:7 #18 0x55ec01bb1e56 in do_command(THD*, bool) /test/11.8_dbg_san/sql/sql_parse.cc:1416:17 #19 0x55ec02d14556 in do_handle_one_connection(CONNECT*, bool) /test/11.8_dbg_san/sql/sql_connect.cc:1415:11 #20 0x55ec02d12d19 in handle_one_connection /test/11.8_dbg_san/sql/sql_connect.cc:1327:5 #21 0x55ec00d5b5fc in asan_thread_start(void*) asan_interceptors.cpp.o   Thread T12 created by T0 here: #0 0x55ec00d43485 in pthread_create (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd+0x4294485) (BuildId: 6806f131f56caa3fd079d953e4400ba5ec496093) #1 0x55ec00dc624d in create_thread_to_handle_connection(CONNECT*) /test/11.8_dbg_san/sql/mysqld.cc:6266:19 #2 0x55ec00dc7637 in create_new_thread(CONNECT*) /test/11.8_dbg_san/sql/mysqld.cc:6328:3 #3 0x55ec00dc79b4 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.8_dbg_san/sql/mysqld.cc:6390:5 #4 0x55ec00dc925a in handle_connections_sockets() /test/11.8_dbg_san/sql/mysqld.cc:6502:9 #5 0x55ec00dc4a5f in run_main_loop() /test/11.8_dbg_san/sql/mysqld.cc:5744:3 #6 0x55ec00db53e5 in mysqld_main(int, char**) /test/11.8_dbg_san/sql/mysqld.cc:6167:3 #7 0x55ec00d9e4f3 in main /test/11.8_dbg_san/sql/main.cc:34:10 #8 0x1482e2a2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #9 0x1482e2a2a28a in __libc_start_main csu/../csu/libc-start.c:360:3 #10 0x55ec00cc2cc4 in _start (/test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd+0x4213cc4) (BuildId: 6806f131f56caa3fd079d953e4400ba5ec496093)   SUMMARY: AddressSanitizer: heap-use-after-free /test/11.8_dbg_san/storage/spider/spd_db_conn.cc:210:15 in spider_db_ping(ha_spider*, st_spider_conn*, int) Shadow bytes around the buggy address: 0x51f0000ebe00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51f0000ebe80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51f0000ebf00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51f0000ebf80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51f0000ec000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x51f0000ec080: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd 0x51f0000ec100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51f0000ec180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x51f0000ec200: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa 0x51f0000ec280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x51f0000ec300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1220788==ABORTING 250110 10:44:05 [ERROR] mysqld got signal 6 ; Sorry, we probably made a mistake, and this is a bug.   Your assistance in bug reporting will enable us to fix this for the next release. To report this bug, see https://mariadb.com/kb/en/reporting-bugs   We will try our best to scrape up some info that will hopefully help diagnose the problem, but since we have already crashed, something is definitely wrong and this may fail.   Server version: 11.8.0-MariaDB-debug source revision: 7734c85c31c9e292ef1133115fba2f7edd71dd51 key_buffer_size=134217728 read_buffer_size=131072 max_used_connections=2 max_threads=10002 thread_count=4 It is possible that mysqld could use up to key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 22168263 K bytes of memory Hope that's ok; if not, decrease some variables in the equation.   Thread pointer: 0x52b000165218 Attempting backtrace. You can use the following information to find out where mysqld died. If you see no messages after this, something went terribly wrong... stack_bottom = 0x1482b6302000 thread_stack 0xb00000 /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(___interceptor_backtrace+0x4a)[0x55ec00d075da] /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(my_print_stacktrace+0x144)[0x55ec07d5bdec] sql/signal_handler.cc:247(handle_fatal_signal)[0x55ec041517fd] libc_sigaction.c:0(__restore_rt)[0x1482e2a45320] nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x1482e2a9eb1c] posix/raise.c:27(__GI_raise)[0x1482e2a4526e] stdlib/abort.c:81(__GI_abort)[0x1482e2a288ff] /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(+0x42d50ab)[0x55ec00d840ab] /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(+0x42d3235)[0x55ec00d82235] /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(+0x42b395f)[0x55ec00d6295f] /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(+0x42b69e5)[0x55ec00d659e5] /test/UBASAN_MD191224-mariadb-11.8.0-linux-x86_64-dbg/bin/mariadbd(__asan_report_load8+0x2c)[0x55ec00d6674c] spider/spd_db_conn.cc:0(spider_db_ping(ha_spider*, st_spider_conn*, int))[0x1482b40a6566] spider/spd_db_conn.cc:256(spider_db_conn_queue_action(st_spider_conn*))[0x1482b40a834e] spider/spd_db_conn.cc:556(spider_db_before_query(st_spider_conn*, int*))[0x1482b40bbef8] spider/spd_db_conn.cc:625(spider_db_query(st_spider_conn*, char const*, unsigned int, int, int*))[0x1482b40d7621] spider/spd_db_mysql.cc:2501(spider_db_query_with_lock(st_spider_conn*, char const*, unsigned int, int*))[0x1482b471e196] spider/spd_db_mysql.cc:2548(spider_db_mbase::commit(int*))[0x1482b471facc] spider/spd_db_conn.cc:1070(spider_db_commit(st_spider_conn*))[0x1482b40ef1e5] spider/spd_trx.cc:3112(spider_commit(THD*, bool))[0x1482b4083ed9] sql/handler.cc:2218(commit_one_phase_2(THD*, bool, THD_TRANS*, bool))[0x55ec0418e01c] sql/handler.cc:2160(ha_commit_one_phase(THD*, bool))[0x55ec0419369e] sql/handler.cc:1954(ha_commit_trans(THD*, bool))[0x55ec04184353] sql/transaction.cc:333(trans_commit_implicit(THD*))[0x55ec02e09530] sql/sql_parse.cc:5993(mysql_execute_command(THD*, bool))[0x55ec01c4f339] sql/sql_parse.cc:7901(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55ec01ba7efa] sql/sql_parse.cc:1903(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55ec01b88db9] sql/sql_parse.cc:1416(do_command(THD*, bool))[0x55ec01bb1e57] sql/sql_connect.cc:1415(do_handle_one_connection(CONNECT*, bool))[0x55ec02d14557] sql/sql_connect.cc:1329(handle_one_connection)[0x55ec02d12d1a] asan_interceptors.cpp.o:0(asan_thread_start(void*))[0x55ec00d5b5fd] nptl/pthread_create.c:447(start_thread)[0x1482e2a9ca94] x86_64/clone3.S:80(clone3)[0x1482e2b29c3c]   Trying to get some variables. Some pointers may be invalid and cause the dump to abort. Query (0x5290000eb238): CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1 Setup: Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions: # Note: llvm-17-linker-tools installs /usr/lib/llvm-17/lib/LLVMgold.so, which is needed for compilation, and LLVMgold.so is no longer included in LLVM 18 sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev llvm-17-linker-tools sudo ln -s /usr/lib/llvm-17/lib/LLVMgold.so /usr/lib/llvm-18/lib/LLVMgold.so Compiled with: '-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++' and: -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON Set before execution: export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1 export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1 # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter Present in all versions mentioned in the previous comment.
            Roel Roel Van de Paar made changes -
            Labels UBSAN hang UBSAN dynamic-type-mismatch hang
            Roel Roel Van de Paar made changes -
            Labels UBSAN dynamic-type-mismatch hang UBSAN dynamic-type-mismatch hang heap-use-after-free memory_corruption
            Roel Roel Van de Paar made changes -
            Labels UBSAN dynamic-type-mismatch hang heap-use-after-free memory_corruption ASAN UBSAN dynamic-type-mismatch hang heap-use-after-free memory_corruption
            Roel Roel Van de Paar made changes -
            Summary SIGSEGV in spider_db_ping on INSERT SIGSEGV in spider_db_ping on CREATE TABLE
            Roel Roel Van de Paar made changes -
            Summary SIGSEGV in spider_db_ping on CREATE TABLE SIGSEGV in spider_db_ping, ASAN heap-use-after-free in spider_db_ping and UBSAN dynamic-type-mismatch in spider_db_ping on CREATE TABLE
            Roel Roel Van de Paar added a comment - - edited

            MTR Testcase for both the SIGSEGV and the UBSAN and ASAN issues:

            --let $SOCKET= `SELECT @@global.socket`
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            SET spider_same_server_link=1;
            CREATE USER spider@localhost IDENTIFIED BY 'pwd';
            GRANT ALL ON test.* TO spider@localhost;
            eval CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET "$SOCKET",DATABASE 'test',USER 'spider',PASSWORD 'pwd');
            SET unique_checks=0,foreign_key_checks=0,autocommit=0;
            SET GLOBAL init_connect="dummy";
            CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1;
            

            Note that a Clang UB+ASAN build is quite slow and MTR may appear to be hanging on the final statement. If you see a timeout, try again.

            Roel Roel Van de Paar added a comment - - edited MTR Testcase for both the SIGSEGV and the UBSAN and ASAN issues: --let $SOCKET= `SELECT @@global.socket` INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; SET spider_same_server_link=1; CREATE USER spider@localhost IDENTIFIED BY 'pwd' ; GRANT ALL ON test.* TO spider@localhost; eval CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET "$SOCKET" , DATABASE 'test' , USER 'spider' , PASSWORD 'pwd' ); SET unique_checks=0,foreign_key_checks=0,autocommit=0; SET GLOBAL init_connect= "dummy" ; CREATE TABLE t ENGINE=Spider COMMENT= 'WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1; Note that a Clang UB+ASAN build is quite slow and MTR may appear to be hanging on the final statement. If you see a timeout, try again.
            ycp Yuchen Pei added a comment - - edited

            Thanks a lot for the mtr case Roel. Indeed I can reproduce it now. The reason I could not previously was that I forgot that init_connect is ignored when connected with a SUPDER user, and the standard boilerplate spider test setup uses root. So, the following testcase where we create a new (unprivileged) user works (i.e. reproduces the crash):

            10.5 f862fe8b2bb359e0bbeb48d0d38047a95dc0e43c

            --disable_query_log
            --disable_result_log
            --source ../../t/test_init.inc
            --enable_result_log
            --enable_query_log
             
            set spider_same_server_link= 1;
            CREATE USER spider@localhost IDENTIFIED BY 'pwd';
            GRANT ALL ON test.* TO spider@localhost;
            evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql
            OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'spider', password 'pwd');
            SET autocommit=0;
            SET GLOBAL init_connect="dummy";
            CREATE TABLE t ENGINE=Spider COMMENT='WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1;
            drop server srv;
             
            --disable_query_log
            --disable_result_log
            --source ../../t/test_deinit.inc
            --enable_result_log
            --enable_query_log

            ycp Yuchen Pei added a comment - - edited Thanks a lot for the mtr case Roel . Indeed I can reproduce it now. The reason I could not previously was that I forgot that init_connect is ignored when connected with a SUPDER user, and the standard boilerplate spider test setup uses root. So, the following testcase where we create a new (unprivileged) user works (i.e. reproduces the crash): 10.5 f862fe8b2bb359e0bbeb48d0d38047a95dc0e43c --disable_query_log --disable_result_log --source ../../t/test_init.inc --enable_result_log --enable_query_log   set spider_same_server_link= 1; CREATE USER spider@localhost IDENTIFIED BY 'pwd' ; GRANT ALL ON test.* TO spider@localhost; evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql OPTIONS (SOCKET "$MASTER_1_MYSOCK" , DATABASE 'test' , user 'spider' , password 'pwd' ); SET autocommit=0; SET GLOBAL init_connect= "dummy" ; CREATE TABLE t ENGINE=Spider COMMENT= 'WRAPPER "mysql",srv "srv",TABLE "t"' AS SELECT 1; drop server srv;   --disable_query_log --disable_result_log --source ../../t/test_deinit.inc --enable_result_log --enable_query_log
            ycp Yuchen Pei added a comment -

            A draft patch:

            9520fb010ec bb-10.5-mdev-29605 MDEV-29605 Clear the queued ha_spider to ping on ping failure

            ycp Yuchen Pei added a comment - A draft patch: 9520fb010ec bb-10.5-mdev-29605 MDEV-29605 Clear the queued ha_spider to ping on ping failure
            ycp Yuchen Pei added a comment - - edited

            Hi holyfoot, ptal thanks:

            3677caba91a bb-10.5-mdev-29605 MDEV-29605 Reset queued ping info of all spider connections associated with a closed spider handler
            

            ycp Yuchen Pei added a comment - - edited Hi holyfoot , ptal thanks: 3677caba91a bb-10.5-mdev-29605 MDEV-29605 Reset queued ping info of all spider connections associated with a closed spider handler
            ycp Yuchen Pei made changes -
            Assignee Yuchen Pei [ JIRAUSER52627 ] Alexey Botchkov [ holyfoot ]
            Status Confirmed [ 10101 ] In Review [ 10002 ]

            Nice, thank you

            Roel Roel Van de Paar added a comment - Nice, thank you
            ycp Yuchen Pei added a comment -

            Hi holyfoot, ptal at this patch instead, thanks

            18a44b4298c upstream/bb-10.5-mdev-29605 MDEV-29605 Reset queued ping info of all spider connections associated with a closed spider handler
            

            ycp Yuchen Pei added a comment - Hi holyfoot , ptal at this patch instead, thanks 18a44b4298c upstream/bb-10.5-mdev-29605 MDEV-29605 Reset queued ping info of all spider connections associated with a closed spider handler
            julien.fritsch Julien Fritsch made changes -
            Fix Version/s 11.7(EOL) [ 29815 ]

            ok to push.

            holyfoot Alexey Botchkov added a comment - ok to push.
            holyfoot Alexey Botchkov made changes -
            Assignee Alexey Botchkov [ holyfoot ] Yuchen Pei [ JIRAUSER52627 ]
            Status In Review [ 10002 ] Stalled [ 10000 ]
            ycp Yuchen Pei made changes -
            Fix Version/s 10.5 [ 23123 ]
            Fix Version/s 10.6 [ 24028 ]
            ycp Yuchen Pei added a comment -

            Changing fixversions to 10.11+ according to the new "3+2 maintenance for CS LTS releases" rules

            ycp Yuchen Pei added a comment - Changing fixversions to 10.11+ according to the new "3+2 maintenance for CS LTS releases" rules
            ycp Yuchen Pei added a comment -

            Thanks for the review - pushed 49d976feaa9de7d7d1cdde1560d43e637f7b607b to 10.11

            ycp Yuchen Pei added a comment - Thanks for the review - pushed 49d976feaa9de7d7d1cdde1560d43e637f7b607b to 10.11
            ycp Yuchen Pei made changes -
            Fix Version/s 10.11.12 [ 29998 ]
            Fix Version/s 10.11 [ 27614 ]
            Fix Version/s 11.4 [ 29301 ]
            Resolution Fixed [ 1 ]
            Status Stalled [ 10000 ] Closed [ 6 ]
            JIraAutomate JiraAutomate made changes -
            Fix Version/s 11.4.6 [ 29999 ]
            Fix Version/s 11.8.2 [ 30001 ]

            People

              ycp Yuchen Pei
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.