Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
10.11, 11.1(EOL), 11.0(EOL)
Description
New regression. Note that 10.11 (opt) fails with a slightly different stack (Protocol::send_result_set_row), and that the UBSAN stack on opt vs dbg is not indentical.
SET lc_time_names=111; |
SELECT MONTHNAME('2010-12-12'); |
Leads to:
11.1.0 2b61ff8f2221745f0a96855a0feb0825c426f993 (Debug) |
Core was generated by `/test/MD010423-mariadb-11.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74
|
[Current thread is 1 (Thread 0x14d6c75af640 (LWP 1242041))]
|
(gdb) bt
|
#0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74
|
#1 0x000055c15ad22b87 in Item_func_monthname::val_str (this=0x14d6340137d8, str=0x14d6c75acf90) at /test/11.1_dbg/sql/item_timefunc.cc:997
|
#2 0x000055c15ab2e5d8 in Type_handler::Item_send_str (this=<optimized out>, item=0x14d6340137d8, protocol=0x14d634001368, buf=<optimized out>) at /test/11.1_dbg/sql/sql_type.cc:7446
|
#3 0x000055c15aa6e105 in Type_handler_string_result::Item_send (this=<optimized out>, item=<optimized out>, protocol=<optimized out>, buf=<optimized out>) at /test/11.1_dbg/sql/sql_type.h:5455
|
#4 0x000055c15a80b5e8 in Item::send (this=0x14d6340137d8, protocol=0x14d634001368, buffer=0x14d6c75acf60) at /test/11.1_dbg/sql/item.h:1235
|
#5 0x000055c15a8411dd in Protocol::send_result_set_row (this=this@entry=0x14d634001368, row_items=row_items@entry=0x14d6340134d8) at /test/11.1_dbg/sql/protocol.cc:1332
|
#6 0x000055c15a8c3a7d in select_send::send_data (this=0x14d6340141c0, items=@0x14d6340134d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d634013890, last = 0x14d634013890, elements = 1}, <No data fields>}) at /test/11.1_dbg/sql/sql_class.cc:3102
|
#7 0x000055c15a9b3ac9 in select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/11.1_dbg/sql/sql_class.h:5748
|
#8 JOIN::exec_inner (this=this@entry=0x14d6340141e8) at /test/11.1_dbg/sql/sql_select.cc:4763
|
#9 0x000055c15a9b49c0 in JOIN::exec (this=this@entry=0x14d6340141e8) at /test/11.1_dbg/sql/sql_select.cc:4674
|
#10 0x000055c15a9b2898 in mysql_select (thd=thd@entry=0x14d634000d58, tables=<optimized out>, fields=@0x14d6340134d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d634013890, last = 0x14d634013890, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x14d6340141c0, unit=0x14d634004fa0, select_lex=0x14d634013218) at /test/11.1_dbg/sql/sql_select.cc:5155
|
#11 0x000055c15a9b301e in handle_select (thd=thd@entry=0x14d634000d58, lex=lex@entry=0x14d634004ec8, result=result@entry=0x14d6340141c0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.1_dbg/sql/sql_select.cc:611
|
#12 0x000055c15a919314 in execute_sqlcom_select (thd=thd@entry=0x14d634000d58, all_tables=0x0) at /test/11.1_dbg/sql/sql_parse.cc:6024
|
#13 0x000055c15a924974 in mysql_execute_command (thd=thd@entry=0x14d634000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.1_dbg/sql/sql_parse.cc:3944
|
#14 0x000055c15a92af05 in mysql_parse (thd=thd@entry=0x14d634000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14d6c75ae230) at /test/11.1_dbg/sql/sql_parse.cc:7760
|
#15 0x000055c15a92d099 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14d634000d58, packet=packet@entry=0x14d63400ae49 "", packet_length=packet_length@entry=30, blocking=blocking@entry=true) at /test/11.1_dbg/sql/sql_class.h:242
|
#16 0x000055c15a92eef5 in do_command (thd=0x14d634000d58, blocking=blocking@entry=true) at /test/11.1_dbg/sql/sql_parse.cc:1405
|
#17 0x000055c15aa80cfc in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55c15db5b988, put_in_cache=put_in_cache@entry=true) at /test/11.1_dbg/sql/sql_connect.cc:1416
|
#18 0x000055c15aa80f5b in handle_one_connection (arg=0x55c15db5b988) at /test/11.1_dbg/sql/sql_connect.cc:1318
|
#19 0x000014d6e4740b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
|
#20 0x000014d6e47d2a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
|
10.11.3 50c8ef01fc63e32acd38788107ae4029d0f1b9ce (Optimized) |
Core was generated by `/test/MD290323-mariadb-10.11.3-linux-x86_64-opt/bin/mariadbd --no-defaults --co'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=22438654330432)
|
at ./nptl/pthread_kill.c:44
|
[Current thread is 1 (Thread 0x146868054640 (LWP 1243054))]
|
(gdb) bt
|
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=22438654330432) at ./nptl/pthread_kill.c:44
|
#1 __pthread_kill_internal (signo=11, threadid=22438654330432) at ./nptl/pthread_kill.c:78
|
#2 __GI___pthread_kill (threadid=22438654330432, signo=11) at ./nptl/pthread_kill.c:89
|
#3 0x000055827c933828 in handle_fatal_signal (sig=<optimized out>) at /test/10.11_opt/sql/signal_handler.cc:357
|
#4 <signal handler called>
|
#5 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74
|
#6 0x000055827ca37712 in Item_func_monthname::val_str (this=0x1467d0010fe0, str=0x146868051960) at /test/10.11_opt/sql/item_timefunc.cc:997
|
#7 0x000055827c88eb38 in Type_handler::Item_send_str (this=<optimized out>, item=<optimized out>, protocol=0x1467d00011f0, buf=<optimized out>) at /test/10.11_opt/sql/sql_type.cc:7446
|
#8 0x000055827c6054fa in Protocol::send_result_set_row (this=this@entry=0x1467d00011f0, row_items=row_items@entry=0x1467d0010cf8) at /test/10.11_opt/sql/protocol.cc:1332
|
#9 0x000055827c682b27 in select_send::send_data (this=0x1467d0011a40, items=@0x1467d0010cf8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1467d0010780, last = 0x1467d0010780, elements = 1}, <No data fields>}) at /test/10.11_opt/sql/sql_class.cc:3103
|
#10 0x000055827c758730 in select_result_sink::send_data_with_check (u=<optimized out>, sent=0, items=<optimized out>, this=<optimized out>) at /test/10.11_opt/sql/sql_class.h:5746
|
#11 select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/10.11_opt/sql/sql_class.h:5736
|
#12 JOIN::exec_inner (this=0x1467d0011aa0) at /test/10.11_opt/sql/sql_select.cc:4701
|
#13 0x000055827c758f19 in JOIN::exec (this=this@entry=0x1467d0011aa0) at /test/10.11_opt/sql/sql_select.cc:4613
|
#14 0x000055827c756fc1 in mysql_select (thd=0x1467d0000c68, tables=0x0, fields=@0x1467d0010cf8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1467d0010780, last = 0x1467d0010780, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x1467d0011a40, unit=0x1467d0004ce8, select_lex=0x1467d0010a40) at /test/10.11_opt/sql/sql_select.cc:5093
|
#15 0x000055827c757714 in handle_select (thd=thd@entry=0x1467d0000c68, lex=lex@entry=0x1467d0004c10, result=result@entry=0x1467d0011a40, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_opt/sql/sql_select.cc:581
|
#16 0x000055827c6cf905 in execute_sqlcom_select (thd=0x1467d0000c68, all_tables=0x0) at /test/10.11_opt/sql/sql_parse.cc:6267
|
#17 0x000055827c6de9f0 in mysql_execute_command (thd=0x1467d0000c68, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:3949
|
#18 0x000055827c6e0284 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x1467d0000c68) at /test/10.11_opt/sql/sql_parse.cc:8002
|
#19 mysql_parse (thd=0x1467d0000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7924
|
#20 0x000055827c6e28c2 in dispatch_command (command=COM_QUERY, thd=0x1467d0000c68, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:1991
|
#21 0x000055827c6e40a8 in do_command (thd=0x1467d0000c68, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407
|
#22 0x000055827c803c7f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55827f2bb1e8, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1416
|
#23 0x000055827c803f5d in handle_one_connection (arg=0x55827f2bb1e8) at /test/10.11_opt/sql/sql_connect.cc:1318
|
#24 0x000014687fa0ab43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
|
#25 0x000014687fa9ca00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
|
11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Optimized, UBASAN) |
2023-04-07 10:57:12 0 [Note] /test/UBASAN_MD250323-mariadb-11.0.2-linux-x86_64-opt/bin/mariadbd: ready for connections.
|
Version: '11.0.2-MariaDB' socket: '/test/UBASAN_MD250323-mariadb-11.0.2-linux-x86_64-opt/socket.sock' port: 11678 MariaDB Server
|
/test/11.0_opt_san/sql/item_timefunc.cc:997:38: runtime error: null pointer passed as argument 1, which is declared to never be null
|
#0 0x5580a0843a5a in Item_func_monthname::val_str(String*) /test/11.0_opt_san/sql/item_timefunc.cc:997
|
#1 0x5580a22a26d6 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_opt_san/sql/sql_type.cc:7446
|
#2 0x5580a0e13a9c in Protocol::send_result_set_row(List<Item>*) /test/11.0_opt_san/sql/protocol.cc:1332
|
#3 0x5580a11958aa in select_send::send_data(List<Item>&) /test/11.0_opt_san/sql/sql_class.cc:3102
|
#4 0x5580a18f88a2 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_opt_san/sql/sql_class.h:5748
|
#5 0x5580a18f88a2 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_opt_san/sql/sql_class.h:5738
|
#6 0x5580a18f88a2 in JOIN::exec_inner() /test/11.0_opt_san/sql/sql_select.cc:4761
|
#7 0x5580a18fd5b3 in JOIN::exec() /test/11.0_opt_san/sql/sql_select.cc:4672
|
#8 0x5580a18eb050 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_opt_san/sql/sql_select.cc:5153
|
#9 0x5580a18eebe0 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_opt_san/sql/sql_select.cc:611
|
#10 0x5580a147be40 in execute_sqlcom_select /test/11.0_opt_san/sql/sql_parse.cc:6267
|
#11 0x5580a14e153c in mysql_execute_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:3949
|
#12 0x5580a14f2322 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_opt_san/sql/sql_parse.cc:7999
|
#13 0x5580a14fffad in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_opt_san/sql/sql_parse.cc:1894
|
#14 0x5580a1509718 in do_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:1407
|
#15 0x5580a1e0ac2c in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1416
|
#16 0x5580a1e0d22c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318
|
#17 0x145a54f29b42 in start_thread nptl/pthread_create.c:442
|
#18 0x145a54fbb9ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
|
 |
230407 10:57:13 [ERROR] mysqld got signal 11 ;
|
11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug, UBASAN) |
2023-04-07 10:57:39 0 [Note] /test/UBASAN_MD250323-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd: ready for connections.
|
Version: '11.0.2-MariaDB-debug' socket: '/test/UBASAN_MD250323-mariadb-11.0.2-linux-x86_64-dbg/socket.sock' port: 12441 MariaDB Server
|
/test/11.0_dbg_san/sql/item_timefunc.cc:997:38: runtime error: null pointer passed as argument 1, which is declared to never be null
|
#0 0x560971984914 in Item_func_monthname::val_str(String*) /test/11.0_dbg_san/sql/item_timefunc.cc:997
|
#1 0x5609705215a1 in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
|
#2 0x56096ff6faa2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
|
#3 0x56096ed1359c in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
|
#4 0x56096eecf05c in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
|
#5 0x56096f2989ca in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
|
#6 0x56096fa0fb03 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
|
#7 0x56096fa0fb03 in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4761
|
#8 0x56096fa1657a in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4672
|
#9 0x56096fa04d38 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5153
|
#10 0x56096fa09193 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:611
|
#11 0x56096f588973 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6267
|
#12 0x56096f5e9cce in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
|
#13 0x56096f6195e6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
|
#14 0x56096f62937a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
|
#15 0x56096f63717f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
|
#16 0x56096fffb459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
|
#17 0x56096fffc974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
|
#18 0x14c005515b42 in start_thread nptl/pthread_create.c:442
|
#19 0x14c0055a79ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
|
 |
230407 10:57:41 [ERROR] mysqld got signal 11 ;
|
Bug confirmed present in:
MariaDB: 10.11.3 (dbg), 10.11.3 (opt), 11.0.1 (dbg), 11.0.1 (opt), 11.1.0 (dbg), 11.1.0 (opt)
Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.38 (dbg), 10.3.38 (opt), 10.3.39 (dbg), 10.3.39 (opt), 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.2 (dbg), 10.11.2 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.40 (dbg), 5.7.40 (opt), 8.0.31 (dbg), 8.0.31 (opt)
Attachments
Issue Links
- relates to
-
MDEV-30997 SIGSEGV in __strlen_avx2 | make_date_time | Item_func_date_format::val_str
- Closed