Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32718

Segmentation fault at /mariadb-11.3.0/sql/my_decimal.h:132

    XMLWordPrintable

Details

    • Bug
    • Status: Confirmed (View Workflow)
    • Major
    • Resolution: Unresolved
    • 11.3.0, 10.5, 10.6, 10.11, 11.1(EOL), 11.2(EOL), 11.3(EOL), 11.4
    • 10.5, 10.6, 10.11, 11.4
    • Server
    • None
    • Ubuntu 20.04

    Description

      Run these queries in debug build:

      CREATE TABLE x ( x DEC PRIMARY KEY ) ;
      INSERT INTO x ( x ) VALUES ( 1 ) ;
      UPDATE x SET x = 1 WHERE ( x BETWEEN ( SELECT x FROM x AS x WHERE CASE WHEN x * ( SELECT x * ( SELECT x FROM ( SELECT x FROM x GROUP BY ( SELECT 1 ORDER BY x , x DESC , x , x IN ( SELECT DISTINCT x FROM x WHERE - 'x' >= x IS NOT NULL = ( 1 < x AND x < 'x' ) ) LIMIT 1 OFFSET 1 ) ) AS x ORDER BY x , x DESC , x , x LIMIT 1 OFFSET 1 ) FROM x GROUP BY 'x' , ( SELECT x ) + ( SELECT ( SELECT x ) AS x FROM x WINDOW x AS ( PARTITION BY x ORDER BY x DESC ) ORDER BY ( SELECT 1 FROM x WHERE x = x ) , ( x AND x IS NULL AND x IN ( 1 , 1 , 1 , 1 , 1 ) ) BETWEEN 1 AND CASE WHEN x = 1 THEN 'x' ELSE x END DESC , x , x ) >= 1 WINDOW x AS ( PARTITION BY FALSE ORDER BY x DESC ) ) <= 1 AND x = x THEN 'x' END BETWEEN 1 AND 1 GROUP BY x ) AND x ) AND x = 1 AND ( x = 1 OR x = 1 ) ORDER BY x + x , x ;

      Will trigger Segmentation fault.
      GDB info:
      #0 0x00005555578d4235 in my_decimal::operator= (this=0x7fffd1928650, rhs=...) at /home/wx/mariadb-11.3.0/sql/my_decimal.h:132
      #1 0x00005555578d44cc in my_decimal2decimal (from=0x0, to=0x7fffd1928650) at /home/wx/mariadb-11.3.0/sql/my_decimal.h:353
      #2 0x0000555557f446ed in my_decimal::to_binary (this=0x0, bin=0x62d000096490 '\276' <repeats 200 times>..., prec=11, scale=0, mask=30) at /home/wx/mariadb-11.3.0/sql/my_decimal.cc:206
      #3 0x0000555557b021af in Type_handler_decimal_result::make_sort_key_part (this=0x55555b7b6cc0 <type_handler_newdecimal>, to=0x62d000096490 '\276' <repeats 200 times>..., item=0x62d000083870, sort_field=0x62f000006a60, tmp_buffer=0x7fffd1928d28) at /home/wx/mariadb-11.3.0/sql/filesort.cc:1381
      #4 0x0000555557b0cd2d in make_sortkey (param=0x7fffd1928cb0, to=0x62d000096490 '\276' <repeats 200 times>...) at /home/wx/mariadb-11.3.0/sql/filesort.cc:2954
      #5 0x0000555557b02449 in make_sortkey (param=0x7fffd1928cb0, to=0x62d000096488 "\177\377\377\377\377\377\377\377", '\276' <repeats 192 times>..., ref_pos=0x61a00041f800 "\200", using_packed_sortkeys=false) at /home/wx/mariadb-11.3.0/sql/filesort.cc:1414
      #6 0x0000555557aff864 in find_all_keys (thd=0x62c0001e0288, param=0x7fffd1928cb0, select=0x62d000083558, fs_info=0x615000114980, buffpek_pointers=0x7fffd1928fb0, tempfile=0x7fffd1928e00, pq=0x0, found_rows=0x615000114b70) at /home/wx/mariadb-11.3.0/sql/filesort.cc:1030
      #7 0x0000555557afab66 in filesort (thd=0x62c0001e0288, table=0x619000096608, filesort=0x62d000083b80, tracker=0x62d000084328, join=0x62d000079850, first_table_bit=1) at /home/wx/mariadb-11.3.0/sql/filesort.cc:408
      #8 0x00005555573791c3 in create_sort_index (thd=0x62c0001e0288, join=0x62d000079850, tab=0x62d00007f650, fsort=0x62d000083b80) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:26843
      #9 0x00005555573677dd in st_join_table::sort_table (this=0x62d00007f650) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:24485
      #10 0x0000555557366bdc in join_init_read_record (tab=0x62d00007f650) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:24405
      #11 0x0000555557360006 in sub_select (join=0x62d000079850, join_tab=0x62d00007f650, end_of_records=false) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23441
      #12 0x000055555735dadd in do_select (join=0x62d000079850, procedure=0x0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
      #13 0x00005555572dbfe9 in JOIN::exec_inner (this=0x62d000079850) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
      #14 0x00005555572d93a0 in JOIN::exec (this=0x62d000079850) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
      #15 0x0000555557dce72f in subselect_single_select_engine::exec (this=0x62900016ec70) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159
      #16 0x0000555557da9c85 in Item_subselect::exec (this=0x62900016ead0) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
      #17 0x0000555557db09eb in Item_singlerow_subselect::val_decimal (this=0x62900016ead0, decimal_value=0x7fffd192a118) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1525
      #18 0x0000555557899e4f in VDec::set (this=0x7fffd192a110, item=0x62900016ead0) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:286
      #19 0x0000555557cb45d2 in VDec2_lazy::VDec2_lazy (this=0x7fffd192a0c0, a=0x62d0000928c8, b=0x62900016ead0) at /home/wx/mariadb-11.3.0/sql/sql_type.h:510
      #20 0x0000555557c74bce in Item_func_plus::decimal_op (this=0x62900016ecb8, decimal_value=0x7fffd192a288) at /home/wx/mariadb-11.3.0/sql/item_func.cc:1196
      #21 0x000055555789a242 in VDec_op::VDec_op (this=0x7fffd192a280, item=0x62900016ecb8) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:300
      #22 0x00005555578b7227 in Type_handler_decimal_result::Item_func_hybrid_field_type_val_decimal (this=0x55555b7b6cc0 <type_handler_newdecimal>, item=0x62900016ecb8, dec=0x7fffd192a3d8) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:5347
      #23 0x0000555557181492 in Item_func_hybrid_field_type::val_decimal (this=0x62900016ecb8, dec=0x7fffd192a3d8) at /home/wx/mariadb-11.3.0/sql/item_func.h:912
      #24 0x000055555789a036 in VDec::VDec (this=0x7fffd192a3d0, item=0x62900016ecb8) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
      #25 0x0000555557beaf4b in Arg_comparator::compare_decimal (this=0x62900016eec8) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:865
      #26 0x0000555557c2e1d4 in Arg_comparator::compare (this=0x62900016eec8) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
      #27 0x0000555557bf5ec7 in Item_func_ge::val_int (this=0x62900016ee10) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1812
      #28 0x0000555557ba521f in Item::save_int_in_field (this=0x62900016ee10, field=0x61a000421a00, no_conversions=true) at /home/wx/mariadb-11.3.0/sql/item.cc:6843
      #29 0x00005555578b2242 in Type_handler_int_result::Item_save_in_field (this=0x55555b7b68c0 <type_handler_bool>, item=0x62900016ee10, field=0x61a000421a00, no_conversions=true) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:4341
      #30 0x0000555557ba540b in Item::save_in_field (this=0x62900016ee10, field=0x61a000421a00, no_conversions=true) at /home/wx/mariadb-11.3.0/sql/item.cc:6853
      #31 0x0000555556ea7174 in Item_result_field::save_in_result_field (this=0x62900016ee10, no_conversions=true) at /home/wx/mariadb-11.3.0/sql/item.h:3490
      #32 0x00005555573879d1 in copy_funcs (func_ptr=0x62100014ac30, thd=0x62c0001e0288) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:28843
      #33 0x000055555736c428 in end_write (join=0x62d000075050, join_tab=0x62d000091a30, end_of_records=false) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:24979
      #34 0x00005555573a1a77 in AGGR_OP::put_record (this=0x62d000092ea0, end_of_records=false) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:32254
      #35 0x00005555573b632d in AGGR_OP::put_record (this=0x62d000092ea0) at /home/wx/mariadb-11.3.0/sql/sql_select.h:1180
      #36 0x000055555735ec6a in sub_select_postjoin_aggr (join=0x62d000075050, join_tab=0x62d000091a30, end_of_records=false) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23134
      #37 0x000055555736194d in evaluate_join_record (join=0x62d000075050, join_tab=0x62d0000915b8, error=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
      #38 0x00005555573601c2 in sub_select (join=0x62d000075050, join_tab=0x62d0000915b8, end_of_records=false) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
      #39 0x000055555735dadd in do_select (join=0x62d000075050, procedure=0x0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
      #40 0x00005555572dbfe9 in JOIN::exec_inner (this=0x62d000075050) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
      #41 0x00005555572d93a0 in JOIN::exec (this=0x62d000075050) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
      #42 0x0000555557dce72f in subselect_single_select_engine::exec (this=0x62900016fe18) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159
      #43 0x0000555557da9c85 in Item_subselect::exec (this=0x62900016fc78) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
      #44 0x0000555557db09eb in Item_singlerow_subselect::val_decimal (this=0x62900016fc78, decimal_value=0x7fffd192b7b8) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1525
      #45 0x0000555557899e4f in VDec::set (this=0x7fffd192b7b0, item=0x62900016fc78) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:286
      #46 0x0000555557cb45d2 in VDec2_lazy::VDec2_lazy (this=0x7fffd192b760, a=0x6290000f7240, b=0x62900016fc78) at /home/wx/mariadb-11.3.0/sql/sql_type.h:510
      #47 0x0000555557c77568 in Item_func_mul::decimal_op (this=0x62900016fe60, decimal_value=0x7fffd192b928) at /home/wx/mariadb-11.3.0/sql/item_func.cc:1460
      #48 0x000055555789a242 in VDec_op::VDec_op (this=0x7fffd192b920, item=0x62900016fe60) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:300
      #49 0x00005555578b7227 in Type_handler_decimal_result::Item_func_hybrid_field_type_val_decimal (this=0x55555b7b6cc0 <type_handler_newdecimal>, item=0x62900016fe60, dec=0x7fffd192ba78) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:5347
      #50 0x0000555557181492 in Item_func_hybrid_field_type::val_decimal (this=0x62900016fe60, dec=0x7fffd192ba78) at /home/wx/mariadb-11.3.0/sql/item_func.h:912
      #51 0x000055555789a036 in VDec::VDec (this=0x7fffd192ba70, item=0x62900016fe60) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
      #52 0x0000555557beaf4b in Arg_comparator::compare_decimal (this=0x629000170070) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:865
      #53 0x0000555557c2e1d4 in Arg_comparator::compare (this=0x629000170070) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
      #54 0x0000555557bf6037 in Item_func_le::val_int (this=0x62900016ffb8) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1827
      #55 0x00005555578b4b6e in Type_handler_int_result::Item_val_bool (this=0x55555b7b68c0 <type_handler_bool>, item=0x62900016ffb8) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082
      #56 0x0000555556e147f6 in Item::val_bool (this=0x62900016ffb8) at /home/wx/mariadb-11.3.0/sql/item.h:1701
      #57 0x0000555557c1797a in Item_cond_and::val_int (this=0x629000170690) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5524
      #58 0x00005555578b4b6e in Type_handler_int_result::Item_val_bool (this=0x55555b7b68c0 <type_handler_bool>, item=0x629000170690) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082
      #59 0x0000555556e147f6 in Item::val_bool (this=0x629000170690) at /home/wx/mariadb-11.3.0/sql/item.h:1701
      #60 0x0000555557c03238 in Item_func_case_searched::find_item (this=0x6290001708b8) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3017
      #61 0x0000555557c03847 in Item_func_case::str_op (this=0x6290001708b8, str=0x6290001708e0) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3050
      #62 0x00005555578e473d in Item_func_hybrid_field_type::str_op_with_null_check (this=0x6290001708b8, str=0x6290001708e0) at /home/wx/mariadb-11.3.0/sql/item_func.h:837
      #63 0x0000555557c728c3 in Item_func_hybrid_field_type::val_decimal_from_str_op (this=0x6290001708b8, decimal_value=0x7fffd192bed8) at /home/wx/mariadb-11.3.0/sql/item_func.cc:959
      #64 0x00005555578b85a7 in Type_handler_string_result::Item_func_hybrid_field_type_val_decimal (this=0x55555b7b7080 <type_handler_varchar>, item=0x6290001708b8, dec=0x7fffd192bed8) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:5627
      #65 0x0000555557181492 in Item_func_hybrid_field_type::val_decimal (this=0x6290001708b8, dec=0x7fffd192bed8) at /home/wx/mariadb-11.3.0/sql/item_func.h:912
      #66 0x000055555789a036 in VDec::VDec (this=0x7fffd192bed0, item=0x6290001708b8) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
      #67 0x0000555557bfc13f in Item_func_between::val_int_cmp_decimal (this=0x629000170ad8) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:2298
      #68 0x00005555578b8c24 in Type_handler_decimal_result::Item_func_between_val_int (this=0x55555b7b6cc0 <type_handler_newdecimal>, func=0x629000170ad8) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:5713
      #69 0x0000555556eaae67 in Item_func_between::val_int (this=0x629000170ad8) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:996
      #70 0x0000555557360f52 in evaluate_join_record (join=0x62d000073c00, join_tab=0x62f000001ff8, error=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23545
      #71 0x00005555573601c2 in sub_select (join=0x62d000073c00, join_tab=0x62f000001ff8, end_of_records=false) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
      #72 0x000055555735dadd in do_select (join=0x62d000073c00, procedure=0x0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
      #73 0x00005555572dbfe9 in JOIN::exec_inner (this=0x62d000073c00) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
      #74 0x00005555572d93a0 in JOIN::exec (this=0x62d000073c00) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
      #75 0x0000555557dce72f in subselect_single_select_engine::exec (this=0x629000170f88) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159
      #76 0x0000555557da9c85 in Item_subselect::exec (this=0x629000170de8) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
      #77 0x0000555557db09eb in Item_singlerow_subselect::val_decimal (this=0x629000170de8, decimal_value=0x7fffd192cfb8) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1525
      #78 0x000055555789a036 in VDec::VDec (this=0x7fffd192cfb0, item=0x629000170de8) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
      #79 0x0000555557bfc21c in Item_func_between::val_int_cmp_decimal (this=0x629000171108) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:2301
      #80 0x00005555578b8c24 in Type_handler_decimal_result::Item_func_between_val_int (this=0x55555b7b6cc0 <type_handler_newdecimal>, func=0x629000171108) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:5713
      #81 0x0000555556eaae67 in Item_func_between::val_int (this=0x629000171108) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:996
      #82 0x00005555572dadd6 in JOIN::exec_inner (this=0x62d000072610) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4835
      #83 0x00005555572d93a0 in JOIN::exec (this=0x62d000072610) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
      #84 0x00005555573a840c in Sql_cmd_dml::execute_inner (this=0x6290000f62e0, thd=0x62c0001e0288) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:33413
      #85 0x0000555557569d49 in Sql_cmd_update::execute_inner (this=0x6290000f62e0, thd=0x62c0001e0288) at /home/wx/mariadb-11.3.0/sql/sql_update.cc:3069
      #86 0x00005555573a7f0d in Sql_cmd_dml::execute (this=0x6290000f62e0, thd=0x62c0001e0288) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:33350
      #87 0x00005555571c1637 in mysql_execute_command (thd=0x62c0001e0288, is_called_from_prepared_stmt=false) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4361
      #88 0x00005555571d95e2 in mysql_parse (thd=0x62c0001e0288, rawbuf=0x6290000f52a8 "UPDATE x SET x = 1 WHERE ( x BETWEEN ( SELECT x FROM x AS x WHERE CASE WHEN x * ( SELECT x * ( SELECT x FROM ( SELECT x FROM x GROUP BY ( SELECT 1 ORDER BY x , x DESC , x , x IN ( SELECT DISTINCT x FR"..., length=784, parser_state=0x7fffd192e870) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
      #89 0x00005555571b1237 in dispatch_command (command=COM_QUERY, thd=0x62c0001e0288, packet=0x6290000fa289 " UPDATE x SET x = 1 WHERE ( x BETWEEN ( SELECT x FROM x AS x WHERE CASE WHEN x * ( SELECT x * ( SELECT x FROM ( SELECT x FROM x GROUP BY ( SELECT 1 ORDER BY x , x DESC , x , x IN ( SELECT DISTINCT x F"..., packet_length=788, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
      #90 0x00005555571adf7c in do_command (thd=0x62c0001e0288, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
      #91 0x000055555768e557 in do_handle_one_connection (connect=0x611000064ac8, put_in_cache=true) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
      #92 0x000055555768deb4 in handle_one_connection (arg=0x611000064988) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
      #93 0x00005555582fa350 in pfs_spawn_thread (arg=0x618000005508) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
      #94 0x00007ffff7115609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
      #95 0x00007ffff6ce8133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

      Attachments

        Issue Links

          Activity

            People

              psergei Sergei Petrunia
              Xin Wen Xin Wen
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.