Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Duplicate
-
11.3.0
-
None
-
Ubuntu 20.04
Description
Run these queries in debug build:
CREATE TABLE x ( x TEXT ) ;
INSERT INTO x ( x ) VALUES ( 1 ) ;
UPDATE x SET x = ( SELECT 1.000000 WHERE - 'x' >= x IS NOT NULL = ( CASE x IN ( SELECT x FROM x WHERE x BETWEEN 1 AND 1 GROUP BY x , x HAVING CASE WHEN - 'x' >= x IS NOT NULL = ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1 - x FROM x INTERSECT SELECT * FROM x ) SELECT x FROM x WHERE 1 = x ) < x AND x < 'x' ) THEN 'x' ELSE x END ) WHEN x < ( WITH x ( x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x ) AS ( WITH x AS ( SELECT ( SELECT x FROM x WHERE 1 = x ) AS x FROM x GROUP BY - CASE x WHEN CASE 1 WHEN 1 THEN 1 / 1 WHEN 1 THEN 1 ELSE 1 / ( WITH x ( x ) AS ( WITH x ( x ) AS ( SELECT 1 UNION SELECT 1 - x FROM x ) SELECT 1 UNION SELECT x + 1 FROM x ) SELECT DISTINCT * FROM x UNION SELECT * FROM x ORDER BY x ) END THEN FALSE < ( WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT x + 1 FROM x ) SELECT * FROM x WHERE x > 1 AND x = CASE WHEN x >= 1 THEN ( - ( SELECT 1.000000 BETWEEN ( x = 1 AND x < ( WITH x ( x ) AS ( WITH x AS ( SELECT 'x' AS x ) SELECT 1 UNION SELECT 1 - x FROM x ) SELECT * FROM x WHERE ( x , x ) NOT IN ( SELECT TRUE , x FROM x ) ) ) AND 1 FROM x WHERE 1 = x ) >= x IS NOT NULL = ( 1 < x AND x < 'x' ) IS NOT NULL ) ELSE x END NOT LIKE 1 + 1 + 1 + 1 + 1 + 1 + 1 + ( SELECT ( SELECT x FROM x WHERE 1 = x ) AS x FROM x WHERE ( SELECT 1 FROM x ORDER BY x < 1 OR ( x > 1 AND CASE WHEN 1 = 1 THEN 1 / 1 WHEN 1 = 1 THEN 1 ELSE 1 / 1 END < 1 ) ) != ( x IN ( SELECT DISTINCT x AS x FROM x WHERE x = x + 1 ORDER BY ( WITH x ( x ) AS ( SELECT 1 UNION SELECT 1 - x FROM x WHERE ( x = 1 ) OR ( x = 1 ) OR ( x BETWEEN 1 AND 1 ) OR ( x = 1 ) ) SELECT x ORDER BY 1 ) ) ) >= 1 WINDOW x AS ( PARTITION BY x ORDER BY x DESC ) ) UNION SELECT * FROM x ) BETWEEN 1 AND 1 ELSE CASE WHEN x % 1 != 1 THEN x END END > 1 WINDOW x AS ( PARTITION BY x ORDER BY x DESC ) ) SELECT ( SELECT 1.000000 FROM ( SELECT x FROM x GROUP BY x ) AS x WHERE - 'x' >= x IS NOT NULL = ( x IN ( x NOT LIKE ( SELECT x ) + x IS NOT NULL ) AND x NOT IN ( 1 , 1 ) ) ) IS NULL FROM x ) SELECT 1 FROM x ) THEN 'x' WHEN 1 >= x LIKE ( SELECT x FROM ( SELECT ( SELECT x FROM x WHERE 1 = x ) AS x FROM x WINDOW x AS ( PARTITION BY x ORDER BY x DESC ) ORDER BY x , x ) AS x WHERE ( x = 'x' OR x = 'x' ) AND x IS NOT NULL GROUP BY x ) THEN 1 END < x AND x < 'x' ) ) WHERE x = 1 ;
Will trigger heap-use-after-free.
ASAN info:
=================================================================
==105373==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f0000524b8 at pc 0x000000c70740 bp 0x7fffd242aa70 sp 0x7fffd242aa68
READ of size 8 at 0x61f0000524b8 thread T15
#0 0xc7073f in st_join_table::cleanup() /home/wx/mariadb-11.3.0/sql/sql_select.cc:15810:15
#1 0xc48292 in JOIN::cleanup(bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:16335:16
#2 0xc47951 in JOIN::destroy() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4970:3
#3 0xdeee11 in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2905:18
#4 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#5 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#6 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#7 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#8 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#9 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#10 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#11 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#12 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#13 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#14 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#15 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#16 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#17 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#18 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#19 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#20 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#21 0xcc3bee in Sql_cmd_dml::prepare(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc
#22 0xcc3eba in Sql_cmd_dml::execute(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33318:9
#23 0xb2ce81 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4361:27
#24 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#25 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#26 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#27 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#28 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#29 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#30 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#31 0x7ffff770f132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
0x61f0000524b8 is located 56 bytes inside of 3136-byte region [0x61f000052480,0x61f0000530c0)
freed by thread T15 here:
#0 0x7ca37d in free (/usr/local/mysql/bin/mariadbd+0x7ca37d)
#1 0x22909f4 in root_free /home/wx/mariadb-11.3.0/mysys/my_alloc.c:83:5
#2 0x22909f4 in free_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:509:7
#3 0xc3da3d in free_tmp_table(THD*, TABLE*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22713:3
#4 0x9b7233 in close_thread_tables(THD*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:882:7
#5 0x9cbb0d in open_tables_for_query(THD*, TABLE_LIST*, unsigned int*, unsigned int, DML_prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:5750:5
#6 0xcc3b6a in Sql_cmd_dml::prepare(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33256:7
#7 0xcc3eba in Sql_cmd_dml::execute(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33318:9
#8 0xb2ce81 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4361:27
#9 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#10 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#11 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#12 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#13 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#14 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#15 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
previously allocated by thread T15 here:
#0 0x7ca5fd in malloc (/usr/local/mysql/bin/mariadbd+0x7ca5fd)
#1 0x22a6308 in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89:29
#2 0x228fff9 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71:10
#3 0x228fff9 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339:29
#4 0x229068a in multi_alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:412:24
#5 0xc8ae29 in Create_tmp_table::start(THD*, TMP_TABLE_PARAM*, st_mysql_const_lex_string const*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21053:8
#6 0xc36773 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21919:22
#7 0xde6e5c in select_unit::create_result_table(THD*, List<Item>, bool, unsigned long long, st_mysql_const_lex_string const, bool, bool, bool, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_union.cc:354:17
#8 0xa53691 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:876:32
#9 0xa57cc1 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200:15
#10 0xe7cf8c in TABLE_LIST::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/table.cc:9651:9
#11 0xab86cb in LEX::handle_list_of_derived(TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.h:4579:43
#12 0xab86cb in st_select_lex::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4989:15
#13 0xbf2a77 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:1439:19
#14 0x15d5c2f in subselect_single_select_engine::prepare(THD*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3943:13
#15 0x15b1a8d in Item_subselect::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:296:22
#16 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#17 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#18 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#19 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#20 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#21 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#22 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#23 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#24 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#25 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#26 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#27 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#28 0x13c2a9e in Item_func_case::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3148:24
#29 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#30 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#31 0x13e04eb in Item_func_like::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5879:24
#32 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#33 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#34 0x13d7fdb in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#35 0x13d7fdb in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1156:12
#36 0x13d7fdb in Item::fix_fields_if_needed_for_bool(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1160:12
#37 0x13d7fdb in Item_cond::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:4941:15
#38 0x9d70b2 in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#39 0x9d70b2 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1156:12
#40 0x9d70b2 in Item::fix_fields_if_needed_for_bool(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1160:12
#41 0x9d70b2 in setup_conds(THD*, TABLE_LIST*, List<TABLE_LIST>&, Item**) /home/wx/mariadb-11.3.0/sql/sql_base.cc:8888:19
#42 0xbf3348 in setup_without_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<TABLE_LIST>&, List<Item>&, List<Item>&, Item*, st_order, st_order*, List<Window_spec>&, List<Item_window_func>&, bool*, unsigned int*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:931:8
#43 0xbf3348 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:1531:7
#44 0xdec229 in st_select_lex_unit::prepare_join(THD*, st_select_lex*, select_result*, unsigned long long, bool) /home/wx/mariadb-11.3.0/sql/sql_union.cc:1103:22
#45 0xde1742 in st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_union.cc:1659:14
#46 0x15d5e56 in subselect_union_engine::prepare(THD*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3961:16
Thread T15 created by T0 here:
#0 0x7b502a in pthread_create (/usr/local/mysql/bin/mariadbd+0x7b502a)
#1 0x1a00edd in my_thread_create(unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52:10
#2 0x1a00edd in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252:15
#3 0x80e649 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139:11
#4 0x80e649 in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150:19
#5 0x80f608 in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212:3
#6 0x80f608 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274:5
#7 0x80caa8 in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398:9
#8 0x8051de in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045:3
#9 0x7ffff7614082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/sql/sql_select.cc:15810:15 in st_join_table::cleanup()
Shadow bytes around the buggy address:
0x0c3e80002440: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e80002450: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
0x0c3e80002460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3e80002470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3e80002480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c3e80002490: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd
0x0c3e800024a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e800024b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e800024c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e800024d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e800024e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==105373==ABORTING
Attachments
Issue Links
- duplicates
-
MDEV-28615 Crash caused by multi-table UPDATE over derived with hanging CTE
-
- Closed
-
Thanks! THis is the same as
MDEV-28615mysqld: /10.4/src/sql/handler.cc:2898: int handler::ha_rnd_next(uchar*): Assertion `table_share->tmp_table != NO_TMP_TABLE || m_lock_type != 2' failed.
Server version: 10.4.32-MariaDB-debug-log source revision: 0c7af6a2a19343cb9d4fedbd7165b8f73bc4cf96
/lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7f537ac04fd6]
sql/handler.cc:2900(handler::ha_rnd_next(unsigned char*))[0x555b6d2c9d7f]
sql/handler.cc:3148(handler::read_first_row(unsigned char*, unsigned int))[0x555b6d2cf542]
sql/sql_class.h:6804(handler::ha_read_first_row(unsigned char*, unsigned int))[0x555b6cc8d25c]
sql/sql_select.cc:21441(join_read_system(st_join_table*))[0x555b6cc41d7e]
sql/sql_select.cc:21337(join_read_const_table(THD*, st_join_table*, POSITION*))[0x555b6cc40d43]
sql/sql_select.cc:5244(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x555b6cbcea89]
sql/sql_select.cc:2368(JOIN::optimize_inner())[0x555b6cbb10f7]
sql/sql_select.cc:1711(JOIN::optimize())[0x555b6cbaa10d]
sql/sql_union.cc:1490(st_select_lex_unit::optimize())[0x555b6cdbe019]
sql/sql_derived.cc:998(mysql_derived_optimize(THD*, LEX*, TABLE_LIST*))[0x555b6ca1de38]
sql/sql_derived.cc:200(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x555b6ca1899c]
sql/sql_select.cc:2201(JOIN::optimize_inner())[0x555b6cbaf672]
sql/sql_select.cc:1711(JOIN::optimize())[0x555b6cbaa10d]
sql/item_subselect.cc:3937(subselect_single_select_engine::exec())[0x555b6d50acde]
sql/item_subselect.cc:758(Item_subselect::exec())[0x555b6d4e6d58]
sql/item_subselect.cc:1382(Item_singlerow_subselect::val_int())[0x555b6d4ecb9f]
sql/item_func.cc:1809(Item_func_neg::fix_length_and_dec_int())[0x555b6d41f975]
sql/sql_type.cc:6144(Type_handler_int_result::Item_func_neg_fix_length_and_dec(Item_func_neg*) const)[0x555b6d07c64e]
sql/item_func.cc:1851(Item_func_neg::fix_length_and_dec())[0x555b6d420175]
sql/item_func.cc:379(Item_func::fix_fields(THD*, Item**))[0x555b6d40e906]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item_cmpfunc.cc:3145(Item_func_case::fix_fields(THD*, Item**))[0x555b6d39cc41]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item_cmpfunc.cc:5702(Item_func_like::fix_fields(THD*, Item**))[0x555b6d3b3ee2]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item.h:970(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x555b6c851607]
sql/item.h:975(Item::fix_fields_if_needed_for_bool(THD*, Item**))[0x555b6c989ab1]
sql/item_cmpfunc.cc:4848(Item_cond::fix_fields(THD*, Item**))[0x555b6d3abdbc]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item.h:970(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x555b6c851607]
sql/item.h:975(Item::fix_fields_if_needed_for_bool(THD*, Item**))[0x555b6c989ab1]
sql/sql_base.cc:8546(setup_conds(THD*, TABLE_LIST*, List<TABLE_LIST>&, Item**))[0x555b6c980f40]
sql/sql_select.cc:744(setup_without_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<TABLE_LIST>&, List<Item>&, List<Item>&, Item**, st_order*, st_order*, List<Window_spec>&, List<Item_window_func>&, bool*))[0x555b6cb9de0e]
sql/sql_select.cc:1335(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x555b6cba559b]
sql/sql_union.cc:662(st_select_lex_unit::prepare_join(THD*, st_select_lex*, select_result*, unsigned long, bool))[0x555b6cdb5208]
sql/sql_union.cc:1089(st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long))[0x555b6cdb958f]
sql/item_subselect.cc:3823(subselect_union_engine::prepare(THD*))[0x555b6d509b78]
sql/item_subselect.cc:289(Item_subselect::fix_fields(THD*, Item**))[0x555b6d4e3481]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item_cmpfunc.cc:3145(Item_func_case::fix_fields(THD*, Item**))[0x555b6d39cc41]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item.h:970(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x555b6c851607]
sql/item.h:979(Item::fix_fields_if_needed_for_order_by(THD*, Item**))[0x555b6cc872ef]
sql/sql_select.cc:24897(find_order_in_list(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, st_order*, List<Item>&, List<Item>&, bool, bool, bool))[0x555b6cc5bb0d]
sql/sql_select.cc:25021(setup_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<Item>&, List<Item>&, st_order*, bool*, bool))[0x555b6cc5c7f3]
sql/sql_select.cc:757(setup_without_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<TABLE_LIST>&, List<Item>&, List<Item>&, Item**, st_order*, st_order*, List<Window_spec>&, List<Item_window_func>&, bool*))[0x555b6cb9e1bc]
sql/sql_select.cc:1335(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x555b6cba559b]
sql/sql_union.cc:662(st_select_lex_unit::prepare_join(THD*, st_select_lex*, select_result*, unsigned long, bool))[0x555b6cdb5208]
sql/sql_union.cc:1009(st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long))[0x555b6cdb89a7]
sql/sql_derived.cc:824(mysql_derived_prepare(THD*, LEX*, TABLE_LIST*))[0x555b6ca1c5cb]
sql/sql_derived.cc:200(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x555b6ca1899c]
sql/table.cc:9097(TABLE_LIST::handle_derived(LEX*, unsigned int))[0x555b6ce45105]
sql/sql_lex.h:4395(LEX::handle_list_of_derived(TABLE_LIST*, unsigned int))[0x555b6ca60e96]
sql/sql_lex.cc:4306(st_select_lex::handle_derived(LEX*, unsigned int))[0x555b6ca82f35]
sql/table.cc:9094(TABLE_LIST::handle_derived(LEX*, unsigned int))[0x555b6ce45077]
sql/sql_lex.h:4395(LEX::handle_list_of_derived(TABLE_LIST*, unsigned int))[0x555b6ca60e96]
sql/sql_lex.cc:4306(st_select_lex::handle_derived(LEX*, unsigned int))[0x555b6ca82f35]
sql/sql_select.cc:1243(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x555b6cba3fcc]
sql/item_subselect.cc:3804(subselect_single_select_engine::prepare(THD*))[0x555b6d509a0c]
sql/item_subselect.cc:289(Item_subselect::fix_fields(THD*, Item**))[0x555b6d4e3481]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item_func.cc:355(Item_func::fix_fields(THD*, Item**))[0x555b6d40e236]
sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x555b6c8515cd]
sql/item.h:970(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x555b6c851607]
sql/sql_base.cc:7745(setup_fields(THD*, Bounds_checked_array<Item*>, List<Item>&, enum_column_usage, List<Item>*, List<Item>*, bool))[0x555b6c97aeaf]
sql/sql_select.cc:1330(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x555b6cba5269]
sql/sql_union.cc:662(st_select_lex_unit::prepare_join(THD*, st_select_lex*, select_result*, unsigned long, bool))[0x555b6cdb5208]
sql/sql_union.cc:1009(st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long))[0x555b6cdb89a7]
sql/sql_derived.cc:824(mysql_derived_prepare(THD*, LEX*, TABLE_LIST*))[0x555b6ca1c5cb]
sql/sql_derived.cc:123(mysql_handle_derived(LEX*, unsigned int))[0x555b6ca1816d]
sql/sql_update.cc:1719(Multiupdate_prelocking_strategy::handle_end(THD*))[0x555b6cdd642f]
sql/sql_update.cc:1886(mysql_multi_update_prepare(THD*))[0x555b6cdd7866]
sql/sql_parse.cc:4494(mysql_execute_command(THD*))[0x555b6caf849f]
sql/sql_parse.cc:8012(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x555b6cb110bf]
sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x555b6cae74e5]
sql/sql_parse.cc:1378(do_command(THD*))[0x555b6cae4010]
sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x555b6cef1deb]
sql/sql_connect.cc:1325(handle_one_connection)[0x555b6cef168f]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x555b6db9c274]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x62b0000a1290): UPDATE x SET x = ( SELECT 1.000000 WHERE - 'x' >= x IS NOT NULL = ( CASE x IN ( SELECT x FROM x WHERE x BETWEEN 1 AND 1 GROUP BY x , x HAVING CASE WHEN - 'x' >= x IS NOT NULL = ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1 - x FROM x INTERSECT SELECT * FROM x ) SELECT x FROM x WHERE 1 = x ) < x AND x < 'x' ) THEN 'x' ELSE x END ) WHEN x < ( WITH x ( x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x ) AS ( WITH x AS ( SELECT ( SELECT x FROM x WHERE 1 = x ) AS x FROM x GROUP BY - CASE x WHEN CASE 1 WHEN 1 THEN 1 / 1 WHEN 1 THEN 1 ELSE 1 / ( WITH x ( x ) AS ( WITH x ( x ) AS ( SELECT 1 UNION SELECT 1 - x FROM x ) SELECT 1 UNION SELECT x + 1 FROM x ) SELECT DISTINCT * FROM x UNION SELECT * FROM x ORDER BY x ) END THEN FALSE < ( WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT x + 1 FROM x ) SELECT * FROM x WHERE x > 1 AND x = CASE WHEN x >= 1 THEN ( - ( SELECT 1.000000 BETWEEN ( x = 1 AND x < ( WITH x ( x ) AS ( WITH x AS ( SELECT 'x' AS x ) SELECT 1 UNION SELECT 1 - x FROM x ) SELECT * FROM x WHERE ( x , x ) NOT IN ( SELECT TRUE , x FROM x ) ) ) AND 1 FROM x WHERE 1 = x ) >= x IS NOT NULL = ( 1 < x AND x < 'x' ) IS NOT NULL ) ELSE x END NOT LIKE 1 + 1 + 1 + 1 + 1 + 1 + 1 + ( SELECT ( SELECT x FROM x WHERE 1 = x ) AS x FROM x WHERE ( SELECT 1 FROM x ORDER BY x < 1 OR ( x > 1 AND CASE WHEN 1 = 1 THEN 1 / 1 WHEN 1 = 1 THEN 1 ELSE 1 / 1 END < 1 ) ) != ( x IN ( SELECT DISTINCT x AS x FROM x WHERE x = x + 1 ORDER BY ( WITH x ( x ) AS ( SELECT 1 UNION SELECT 1 - x FROM x WHERE ( x = 1 ) OR ( x = 1 ) OR ( x BETWEEN 1 AND 1 ) OR ( x = 1 ) ) SELECT x ORDER BY 1 ) ) ) >= 1 WINDOW x AS ( PARTITION BY x ORDER BY x DESC ) ) UNION SELECT * FROM x ) BETWEEN 1 AND 1 ELSE CASE WHEN x % 1 != 1 THEN x END END > 1 WINDOW x AS ( PARTITION BY x ORDER BY x DESC ) ) SELECT ( SELECT 1.000000 FROM ( SELECT x FROM x GROUP BY x ) AS x WHERE - 'x' >= x IS NOT NULL = ( x IN ( x NOT LIKE ( SELECT x ) + x IS NOT NULL ) AND x NOT IN ( 1 , 1 ) ) ) IS NULL FROM x ) SELECT 1 FROM x ) THEN 'x' WHEN 1 >= x LIKE ( SELECT x FROM ( SELECT ( SELECT x FROM x WHERE 1 = x ) AS x FROM x WINDOW x AS ( PARTITION BY x ORDER BY x DESC ) ORDER BY x , x ) AS x WHERE ( x = 'x' OR x = 'x' ) AND x IS NOT NULL GROUP BY x ) THEN 1 END < x AND x < 'x' ) ) WHERE x = 1