Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Duplicate
-
11.3.0
-
None
-
Ubuntu 20.04
Description
Run these queries in release build:
CREATE TABLE x ( x BOOLEAN NOT NULL ) ;
INSERT INTO x ( x ) VALUES ( 1 ) ;
UPDATE x SET x = 1 WHERE x = 1 ;
INSERT INTO x ( x ) VALUES ( 1 ) , ( 1 ) ;
SELECT x , x * ( SELECT ( x = 1 ) OR ( x = 1 ) OR ( x BETWEEN 1 AND 1 ) OR ( x = 1 ) OR ( x BETWEEN 1 AND 1 ) ) + x IS NULL FROM x WHERE NULL BETWEEN ( SELECT x FROM x AS x GROUP BY x ORDER BY x * 1 ) AND 1 GROUP BY x HAVING ( CASE WHEN x = 1.000000 THEN x ELSE EXISTS ( WITH RECURSIVE x AS ( SELECT 1 ) SELECT * FROM x WHERE x / ( SELECT x FROM x ) <= x GROUP BY ( x = 'x' AND x BETWEEN 1 AND 1 ) OR ( x IN ( SELECT x FROM x WHERE ( x = x AND x = 1 ) OR ( x = 1 AND x >= ( x = 1 AND x IN ( WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT 1.000000 + 1 FROM x ) SELECT x FROM ( SELECT x FROM x UNION SELECT x FROM x ) AS x ) ) ) ) ) HAVING x IN ( SELECT x FROM ( WITH x ( x ) AS ( SELECT 1 FROM x AS x EXCEPT SELECT x FROM x GROUP BY - 'x' >= x IS NOT NULL = ( 1 < x AND x < 'x' ) WINDOW x AS ( PARTITION BY x IN ( x NOT LIKE ( SELECT ( SELECT x FROM x WINDOW x AS ( PARTITION BY ( x , x ) NOT IN ( SELECT x , x = x AND x = x FROM x ) ORDER BY x DESC ) ORDER BY ( x = 1 AND x = 1 ) DESC LIMIT 1 OFFSET 1 ) ) NOT LIKE ( ( x = 'x' OR x = 'x' ) AND x IS NOT NULL ) NOT LIKE ( SELECT 1 FROM x WHERE x = x OR x = 'x' ) IS NOT NULL ) AND x NOT IN ( 1 , 1 ) AND x = 1 ORDER BY 1 ) ) SELECT x FROM x UNION SELECT x FROM x ) AS x ) AND x = 'x' ) END AND x = 1 ) WINDOW x AS ( PARTITION BY x IN ( x NOT LIKE ( SELECT x ) + x IS NOT NULL ) AND x NOT IN ( 1 , 1 ) AND x = 1 ORDER BY x DESC ) ORDER BY x ;
Will trigger Segmentation fault.
GDB info:
Thread 16 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd242e300 (LWP 2333)]
add_key_field (join=<optimized out>, join@entry=0x62f00001cca0,
key_fields=key_fields@entry=0x7fffd2428a10, and_level=<optimized out>,
cond=cond@entry=0x631000096058, field=<optimized out>, eq_func=true,
value=0x7fffd24286a0, num_values=1, usable_tables=18446744073709551615,
sargables=0x7fffd2428f20, row_col_no=0)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:6554
6554 stat[0].keys.merge(possible_keys); // Add possible keys
(gdb) p stat[0]
Cannot access memory at address 0x0
#0 add_key_field (join=<optimized out>, join@entry=0x62f00001cca0, key_fields=key_fields@entry=0x7fffd2428a10, and_level=<optimized out>, cond=cond@entry=0x631000096058, field=<optimized out>, eq_func=true, value=0x7fffd24286a0, num_values=1, usable_tables=18446744073709551615, sargables=0x7fffd2428f20, row_col_no=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:6554
#1 0x0000000000c4e4d6 in Item_equal::add_key_fields (this=0x631000096058, join=<optimized out>, key_fields=<optimized out>, and_level=<optimized out>, usable_tables=<optimized out>, sargables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:7003
#2 0x0000000000c4a713 in Item_cond::add_key_fields (this=<optimized out>, join=0x62f00001cca0, key_fields=0x7fffd2428a10, and_level=0x7fffd2428a00, usable_tables=18446744073709551615, sargables=0x7fffd2428f20) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:6766
#3 0x0000000000cbadc4 in update_ref_and_keys (thd=<optimized out>, keyuse=<optimized out>, join_tab=<optimized out>, tables=<optimized out>, cond=<optimized out>, normal_tables=<optimized out>, select_lex=<optimized out>, sargables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:7432
#4 0x0000000000c17080 in make_join_statistics (join=0x62f00001cca0, tables_list=..., keyuse_array=0x62f00001d000) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5676
#5 JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2624
#6 0x0000000000bfc156 in JOIN::optimize (this=0x62f00001cca0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#7 0x0000000000ab5421 in st_select_lex::optimize_unflattened_subqueries (this=<optimized out>, const_only=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
#8 0x0000000000c0856c in JOIN::optimize_stage2 (this=0x62f000017950) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:3229
#9 0x0000000000c13911 in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
#10 0x0000000000bfc156 in JOIN::optimize (this=0x62f000017950) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#11 0x0000000000ab5421 in st_select_lex::optimize_unflattened_subqueries (this=<optimized out>, const_only=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
#12 0x0000000000bfc6e2 in JOIN::optimize_stage2 (this=0x62f000012580) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:3453
#13 0x0000000000c13911 in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
#14 0x0000000000bfc156 in JOIN::optimize (this=this@entry=0x62f000012580) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#15 0x0000000000be4fdf in mysql_select (thd=<optimized out>, thd@entry=0x62b00016c218, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x6290000b16e0, having=0x62d0000ea1f0, proc_param=0x0, select_options=<optimized out>, result=0x62f000012550, unit=0x62b0001704a8, select_lex=0x629000091d70) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
#16 0x0000000000be4596 in handle_select (thd=thd@entry=0x62b00016c218, lex=<optimized out>, lex@entry=0x62b0001703c8, result=<optimized out>, result@entry=0x62f000012550, setup_tables_done_option=<optimized out>, setup_tables_done_option@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#17 0x0000000000b3df18 in execute_sqlcom_select (thd=0x62b00016c218, all_tables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#18 0x0000000000b2cd51 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#19 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd242ca80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#20 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#21 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#22 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#23 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x60800212c8b8) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#24 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000006298) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#25 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#26 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6
Attachments
Issue Links
- duplicates
-
-
- In Review
-
Thanks!
This is the same bug as MDEV-28509
231023 18:35:23 [ERROR] mysqld got signal 11 ;Server version: 10.4.32-MariaDB-debug-log source revision: babd833685e1fd1da4411a0874ba1c98bb0b631dsql/signal_handler.cc:238(handle_fatal_signal)[0x5653517daca1]sigaction.c:0(__restore_rt)[0x7faf802f7420]sql/sql_bitmap.h:220(Bitmap<64u>::merge(Bitmap<64u> const&))[0x5653511c8661]sql/sql_select.cc:6090(add_key_field(JOIN*, KEY_FIELD**, unsigned int, Item_bool_func*, Field*, bool, Item**, unsigned int, unsigned long long, SARGABLE_PARAM**, unsigned int))[0x5653510fff81]sql/sql_select.cc:6522(Item_equal::add_key_fields(JOIN*, KEY_FIELD**, unsigned int*, unsigned long long, SARGABLE_PARAM**))[0x56535110410f]sql/sql_select.cc:6288(Item_cond::add_key_fields(JOIN*, KEY_FIELD**, unsigned int*, unsigned long long, SARGABLE_PARAM**))[0x56535110160a]sql/sql_select.cc:6953(update_ref_and_keys(THD*, st_dynamic_array*, st_join_table*, unsigned int, Item*, unsigned long long, st_select_lex*, SARGABLE_PARAM**))[0x565351108025]sql/sql_select.cc:5206(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x5653510f767e]sql/sql_select.cc:2368(JOIN::optimize_inner())[0x5653510da293]sql/sql_select.cc:1711(JOIN::optimize())[0x5653510d32a9]sql/sql_lex.cc:4232(st_select_lex::optimize_unflattened_subqueries(bool))[0x565350fabb84]sql/opt_subselect.cc:5611(JOIN::optimize_unflattened_subqueries())[0x56535151e027]sql/sql_select.cc:2942(JOIN::optimize_stage2())[0x5653510e0627]sql/sql_select.cc:2394(JOIN::optimize_inner())[0x5653510da59e]sql/sql_select.cc:1711(JOIN::optimize())[0x5653510d32a9]sql/sql_lex.cc:4232(st_select_lex::optimize_unflattened_subqueries(bool))[0x565350fabb84]sql/opt_subselect.cc:5611(JOIN::optimize_unflattened_subqueries())[0x56535151e027]sql/sql_select.cc:3165(JOIN::optimize_stage2())[0x5653510e24b6]sql/sql_select.cc:2394(JOIN::optimize_inner())[0x5653510da59e]sql/sql_select.cc:1711(JOIN::optimize())[0x5653510d32a9]sql/sql_select.cc:4812(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5653510f4293]sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x5653510c4f7c]sql/sql_parse.cc:6475(execute_sqlcom_select(THD*, TABLE_LIST*))[0x565351030d80]sql/sql_parse.cc:3978(mysql_execute_command(THD*))[0x56535101e4f7]sql/sql_parse.cc:8012(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x56535103a25b]sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x565351010681]sql/sql_parse.cc:1378(do_command(THD*))[0x56535100d1ac]sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x56535141b56d]sql/sql_connect.cc:1325(handle_one_connection)[0x56535141ae11]perfschema/pfs.cc:1871(pfs_spawn_thread)[0x5653520c5d8a]nptl/pthread_create.c:478(start_thread)[0x7faf802eb609]Query (0x62b0000a1290): SELECT x , x * ( SELECT ( x = 1 ) OR ( x = 1 ) OR ( x BETWEEN 1 AND 1 ) OR ( x = 1 ) OR ( x BETWEEN 1 AND 1 ) ) + x IS NULL FROM x WHERE NULL BETWEEN ( SELECT x FROM x AS x GROUP BY x ORDER BY x * 1 ) AND 1 GROUP BY x HAVING ( CASE WHEN x = 1.000000 THEN x ELSE EXISTS ( WITH RECURSIVE x AS ( SELECT 1 ) SELECT * FROM x WHERE x / ( SELECT x FROM x ) <= x GROUP BY ( x = 'x' AND x BETWEEN 1 AND 1 ) OR ( x IN ( SELECT x FROM x WHERE ( x = x AND x = 1 ) OR ( x = 1 AND x >= ( x = 1 AND x IN ( WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT 1.000000 + 1 FROM x ) SELECT x FROM ( SELECT x FROM x UNION SELECT x FROM x ) AS x ) ) ) ) ) HAVING x IN ( SELECT x FROM ( WITH x ( x ) AS ( SELECT 1 FROM x AS x EXCEPT SELECT x FROM x GROUP BY - 'x' >= x IS NOT NULL = ( 1 < x AND x < 'x' ) WINDOW x AS ( PARTITION BY x IN ( x NOT LIKE ( SELECT ( SELECT x FROM x WINDOW x AS ( PARTITION BY ( x , x ) NOT IN ( SELECT x , x = x AND x = x FROM x ) ORDER BY x DESC ) ORDER BY ( x = 1 AND x = 1 ) DESC LIMIT 1 OFFSET 1 ) ) NOT LIKE ( ( x = 'x' OR x = 'x' ) AND x IS NOT NULL ) NOT LIKE ( SELECT 1 FROM x WHERE x = x OR x = 'x' ) IS NOT NULL ) AND x NOT IN ( 1 , 1 ) AND x = 1 ORDER BY 1 ) ) SELECT x FROM x UNION SELECT x FROM x ) AS x ) AND x = 'x' ) END AND x = 1 ) WINDOW x AS ( PARTITION BY x IN ( x NOT LIKE ( SELECT x ) + x IS NOT NULL ) AND x NOT IN ( 1 , 1 ) AND x = 1 ORDER BY x DESC ) ORDER BY x