Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32720

Segmentation fault at /mariadb-11.3.0/sql/sql_select.cc:5394

    XMLWordPrintable

Details

    Description

      Run these queries in debug build:

      CREATE TABLE x ( x INT ) ;
      INSERT INTO x ( x ) VALUES ( 1 ) ;
      UPDATE x SET x = 1 WHERE x = 1 ;
      INSERT INTO x ( x ) VALUES ( 1 ) , ( 1 ) ;
      WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1.000000 AS x FROM ( WITH x AS ( SELECT * FROM x ) SELECT ( SELECT x ) / ( SELECT x FROM x WHERE x = ( x = 1 OR 1 ^ 1.000000 ) NOT LIKE 'x' * x * 1 + x ) / 1 = 1 FROM x GROUP BY x HAVING x > 'x' ORDER BY x , x IN ( SELECT DISTINCT x FROM x WHERE CASE WHEN x * ( SELECT ( 'x' , x , x ) < ( 1 , 1 , 1 ) ORDER BY 1 , 1 , 1 , 1 ) + x THEN x = ( SELECT ( SELECT 1 FROM x GROUP BY x HAVING ( SELECT 1 / ( x = 1 OR x > 'x' ) > 1.000000 ) ^ x ORDER BY x , x DESC , x , x , x DESC , x , x , x , x NOT LIKE FALSE LIMIT 1 OFFSET 1 ) FROM x WHERE x <= 1 GROUP BY x HAVING x > 'x' ) ELSE x END ) DESC , x , x , x , x , ( SELECT x ORDER BY 1 ) LIMIT 1 OFFSET 1 ) AS x ) SELECT DISTINCT 1 AS x , CASE x WHEN 1 THEN x ELSE 1 END , 1 FROM x GROUP BY 1.000000 HAVING x > 'x' ORDER BY ( SELECT 1 FROM x ) + 1 ;

      Will trigger Segmentation fault.
      GDB info:
      #0 0x00005555572dee93 in get_sargable_cond (join=0x62d000088850, table=0x62000002c128) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5394
      #1 0x00005555572c1b80 in JOIN::optimize_inner (this=0x62d000088850) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2496
      #2 0x00005555572bbba6 in JOIN::optimize (this=0x62d000088850) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
      #3 0x0000555557527ce3 in st_select_lex_unit::optimize (this=0x6290000f6040) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:2262
      #4 0x00005555570d7bf2 in mysql_derived_optimize (thd=0x62c0001e0288, lex=0x62c0001e45f8, derived=0x62d000073150) at /home/wx/mariadb-11.3.0/sql/sql_derived.cc:1006
      #5 0x00005555570d27b6 in mysql_handle_single_derived (lex=0x62c0001e45f8, derived=0x62d000073150, phases=4) at /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200
      #6 0x00005555572c10e1 in JOIN::optimize_inner (this=0x62f000010498) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2442
      #7 0x00005555572bbba6 in JOIN::optimize (this=0x62f000010498) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
      #8 0x0000555557143851 in st_select_lex::optimize_unflattened_subqueries (this=0x62d0000709d8, const_only=true) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
      #9 0x00005555577b75f6 in JOIN::optimize_constant_subqueries (this=0x62d0000851e8) at /home/wx/mariadb-11.3.0/sql/opt_subselect.cc:5898
      #10 0x00005555572beb79 in JOIN::optimize_inner (this=0x62d0000851e8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2274
      #11 0x00005555572bbba6 in JOIN::optimize (this=0x62d0000851e8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
      #12 0x00005555572dd9ba in mysql_select (thd=0x62c0001e0288, tables=0x62d0000716d0, fields=..., conds=0x0, og_num=2, order=0x62d000074438, group=0x62d000071ee0, having=0x62d000072100, proc_param=0x0, select_options=2165049857, result=0x62d0000851b8, unit=0x62c0001e46d8, select_lex=0x62d0000709d8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
      #13 0x00005555572ad18a in handle_select (thd=0x62c0001e0288, lex=0x62c0001e45f8, result=0x62d0000851b8, setup_tables_done_option=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
      #14 0x00005555571ce583 in execute_sqlcom_select (thd=0x62c0001e0288, all_tables=0x62d0000716d0) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
      #15 0x00005555571becf6 in mysql_execute_command (thd=0x62c0001e0288, is_called_from_prepared_stmt=false) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
      #16 0x00005555571d95e2 in mysql_parse (thd=0x62c0001e0288, rawbuf=0x6290000f52a8 "WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1.000000 AS x FROM ( WITH x AS ( SELECT * FROM x ) SELECT ( SELECT x ) / ( SELECT x FROM x WHERE x = ( x = 1 OR 1 ^ 1.000000 ) NOT LIKE 'x' * x * 1 + "..., length=839, parser_state=0x7fffd2147870) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
      #17 0x00005555571b1237 in dispatch_command (command=COM_QUERY, thd=0x62c0001e0288, packet=0x6290000fa289 " WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1.000000 AS x FROM ( WITH x AS ( SELECT * FROM x ) SELECT ( SELECT x ) / ( SELECT x FROM x WHERE x = ( x = 1 OR 1 ^ 1.000000 ) NOT LIKE 'x' * x * 1 +"..., packet_length=843, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
      #18 0x00005555571adf7c in do_command (thd=0x62c0001e0288, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
      #19 0x000055555768e557 in do_handle_one_connection (connect=0x611000057148, put_in_cache=true) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
      #20 0x000055555768deb4 in handle_one_connection (arg=0x611000057008) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
      #21 0x00005555582fa350 in pfs_spawn_thread (arg=0x618000005508) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
      #22 0x00007ffff7115609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
      #23 0x00007ffff6ce8133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

      Attachments

        Activity

          People

            psergei Sergei Petrunia
            Xin Wen Xin Wen
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.