[MDEV-32720] Segmentation fault at /mariadb-11.3.0/sql/sql_select.cc:5394 - Jira

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 11.3.0, 10.4(EOL), 10.5, 10.6, 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL)
Fix Version/s: 10.5, 10.6, 10.11
Component/s: Optimizer - CTE, Server
Labels:
None
Environment:
Ubuntu 20.04

Description

Run these queries in debug build:

CREATE TABLE x ( x INT ) ;
INSERT INTO x ( x ) VALUES ( 1 ) ;
UPDATE x SET x = 1 WHERE x = 1 ;
INSERT INTO x ( x ) VALUES ( 1 ) , ( 1 ) ;
WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1.000000 AS x FROM ( WITH x AS ( SELECT * FROM x ) SELECT ( SELECT x ) / ( SELECT x FROM x WHERE x = ( x = 1 OR 1 ^ 1.000000 ) NOT LIKE 'x' * x * 1 + x ) / 1 = 1 FROM x GROUP BY x HAVING x > 'x' ORDER BY x , x IN ( SELECT DISTINCT x FROM x WHERE CASE WHEN x * ( SELECT ( 'x' , x , x ) < ( 1 , 1 , 1 ) ORDER BY 1 , 1 , 1 , 1 ) + x THEN x = ( SELECT ( SELECT 1 FROM x GROUP BY x HAVING ( SELECT 1 / ( x = 1 OR x > 'x' ) > 1.000000 ) ^ x ORDER BY x , x DESC , x , x , x DESC , x , x , x , x NOT LIKE FALSE LIMIT 1 OFFSET 1 ) FROM x WHERE x <= 1 GROUP BY x HAVING x > 'x' ) ELSE x END ) DESC , x , x , x , x , ( SELECT x ORDER BY 1 ) LIMIT 1 OFFSET 1 ) AS x ) SELECT DISTINCT 1 AS x , CASE x WHEN 1 THEN x ELSE 1 END , 1 FROM x GROUP BY 1.000000 HAVING x > 'x' ORDER BY ( SELECT 1 FROM x ) + 1 ;

Will trigger Segmentation fault.
GDB info:
#0 0x00005555572dee93 in get_sargable_cond (join=0x62d000088850, table=0x62000002c128) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5394
#1 0x00005555572c1b80 in JOIN::optimize_inner (this=0x62d000088850) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2496
#2 0x00005555572bbba6 in JOIN::optimize (this=0x62d000088850) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#3 0x0000555557527ce3 in st_select_lex_unit::optimize (this=0x6290000f6040) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:2262
#4 0x00005555570d7bf2 in mysql_derived_optimize (thd=0x62c0001e0288, lex=0x62c0001e45f8, derived=0x62d000073150) at /home/wx/mariadb-11.3.0/sql/sql_derived.cc:1006
#5 0x00005555570d27b6 in mysql_handle_single_derived (lex=0x62c0001e45f8, derived=0x62d000073150, phases=4) at /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200
#6 0x00005555572c10e1 in JOIN::optimize_inner (this=0x62f000010498) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2442
#7 0x00005555572bbba6 in JOIN::optimize (this=0x62f000010498) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#8 0x0000555557143851 in st_select_lex::optimize_unflattened_subqueries (this=0x62d0000709d8, const_only=true) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
#9 0x00005555577b75f6 in JOIN::optimize_constant_subqueries (this=0x62d0000851e8) at /home/wx/mariadb-11.3.0/sql/opt_subselect.cc:5898
#10 0x00005555572beb79 in JOIN::optimize_inner (this=0x62d0000851e8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2274
#11 0x00005555572bbba6 in JOIN::optimize (this=0x62d0000851e8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#12 0x00005555572dd9ba in mysql_select (thd=0x62c0001e0288, tables=0x62d0000716d0, fields=..., conds=0x0, og_num=2, order=0x62d000074438, group=0x62d000071ee0, having=0x62d000072100, proc_param=0x0, select_options=2165049857, result=0x62d0000851b8, unit=0x62c0001e46d8, select_lex=0x62d0000709d8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
#13 0x00005555572ad18a in handle_select (thd=0x62c0001e0288, lex=0x62c0001e45f8, result=0x62d0000851b8, setup_tables_done_option=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#14 0x00005555571ce583 in execute_sqlcom_select (thd=0x62c0001e0288, all_tables=0x62d0000716d0) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#15 0x00005555571becf6 in mysql_execute_command (thd=0x62c0001e0288, is_called_from_prepared_stmt=false) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#16 0x00005555571d95e2 in mysql_parse (thd=0x62c0001e0288, rawbuf=0x6290000f52a8 "WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1.000000 AS x FROM ( WITH x AS ( SELECT * FROM x ) SELECT ( SELECT x ) / ( SELECT x FROM x WHERE x = ( x = 1 OR 1 ^ 1.000000 ) NOT LIKE 'x' * x * 1 + "..., length=839, parser_state=0x7fffd2147870) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#17 0x00005555571b1237 in dispatch_command (command=COM_QUERY, thd=0x62c0001e0288, packet=0x6290000fa289 " WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1.000000 AS x FROM ( WITH x AS ( SELECT * FROM x ) SELECT ( SELECT x ) / ( SELECT x FROM x WHERE x = ( x = 1 OR 1 ^ 1.000000 ) NOT LIKE 'x' * x * 1 +"..., packet_length=843, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#18 0x00005555571adf7c in do_command (thd=0x62c0001e0288, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#19 0x000055555768e557 in do_handle_one_connection (connect=0x611000057148, put_in_cache=true) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#20 0x000055555768deb4 in handle_one_connection (arg=0x611000057008) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#21 0x00005555582fa350 in pfs_spawn_thread (arg=0x618000005508) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#22 0x00007ffff7115609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#23 0x00007ffff6ce8133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

Attachments

Activity

Ascending order - Click to sort in descending order

Xin Wen created issue - 2023-11-07 06:36

Alice Sherepa added a comment - 2023-11-07 16:52 - edited

Thanks!
Repeatable on 10.4-11.2

Version: '10.4.32-MariaDB-debug-log'

231107 17:51:19 [ERROR] mysqld got signal 11 ;

Server version: 10.4.32-MariaDB-debug-log source revision: e5a5573f782723e40c372f38346a60b1ccc644d6

mysys/stacktrace.c:174(my_print_stacktrace)[0x55df7165dd55]

sql/signal_handler.cc:235(handle_fatal_signal)[0x55df7021c615]

sigaction.c:0(__restore_rt)[0x7f245ab51420]

sql/sql_select.cc:4975(get_sargable_cond(JOIN*, TABLE*))[0x55df6fb36253]

sql/sql_select.cc:2274(JOIN::optimize_inner())[0x55df6fb1a102]

sql/sql_select.cc:1731(JOIN::optimize())[0x55df6fb140cd]

sql/sql_union.cc:1490(st_select_lex_unit::optimize())[0x55df6fd29695]

sql/sql_derived.cc:998(mysql_derived_optimize(THD*, LEX*, TABLE_LIST*))[0x55df6f986fb6]

sql/sql_derived.cc:200(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x55df6f981b1a]

sql/sql_select.cc:2221(JOIN::optimize_inner())[0x55df6fb19632]

sql/sql_select.cc:1731(JOIN::optimize())[0x55df6fb140cd]

sql/sql_lex.cc:4233(st_select_lex::optimize_unflattened_subqueries(bool))[0x55df6f9ebc76]

sql/opt_subselect.cc:5644(JOIN::optimize_constant_subqueries())[0x55df6ff60682]

sql/sql_select.cc:2068(JOIN::optimize_inner())[0x55df6fb17443]

sql/sql_select.cc:1731(JOIN::optimize())[0x55df6fb140cd]

sql/sql_select.cc:4832(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55df6fb350b7]

sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55df6fb05b1e]

sql/sql_parse.cc:6475(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55df6fa71886]

sql/sql_parse.cc:3978(mysql_execute_command(THD*))[0x55df6fa5effd]

sql/sql_parse.cc:8013(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55df6fa7adc5]

sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55df6fa51187]

sql/sql_parse.cc:1378(do_command(THD*))[0x55df6fa4dcb2]

sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x55df6fe5d5b5]

sql/sql_connect.cc:1325(handle_one_connection)[0x55df6fe5ce59]

perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55df70af947e]

nptl/pthread_create.c:478(start_thread)[0x7f245ab45609]

Query (0x62b0000a1290): WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1.000000 AS x FROM ( WITH x AS ( SELECT * FROM x ) SELECT ( SELECT x ) / ( SELECT x FROM x WHERE x = ( x = 1 OR 1 ^ 1.000000 ) NOT LIKE 'x' * x * 1 + x ) / 1 = 1 FROM x GROUP BY x HAVING x > 'x' ORDER BY x , x IN ( SELECT DISTINCT x FROM x WHERE CASE WHEN x * ( SELECT ( 'x' , x , x ) < ( 1 , 1 , 1 ) ORDER BY 1 , 1 , 1 , 1 ) + x THEN x = ( SELECT ( SELECT 1 FROM x GROUP BY x HAVING ( SELECT 1 / ( x = 1 OR x > 'x' ) > 1.000000 ) ^ x ORDER BY x , x DESC , x , x , x DESC , x , x , x , x NOT LIKE FALSE LIMIT 1 OFFSET 1 ) FROM x WHERE x <= 1 GROUP BY x HAVING x > 'x' ) ELSE x END ) DESC , x , x , x , x , ( SELECT x ORDER BY 1 ) LIMIT 1 OFFSET 1 ) AS x ) SELECT DISTINCT 1 AS x , CASE x WHEN 1 THEN x ELSE 1 END , 1 FROM x GROUP BY 1.000000 HAVING x > 'x' ORDER BY ( SELECT 1 FROM x ) + 1

CREATE TABLE x ( x INT ) ;

INSERT INTO x VALUES (1),(1),(1);

WITH RECURSIVE x ( x ) AS (

 SELECT 1

 UNION

 SELECT 1 AS x FROM

   ( WITH x AS ( SELECT * FROM x ) SELECT ( SELECT x FROM x ) FROM x  GROUP BY x ) AS x )

SELECT  1 ORDER BY ( SELECT 1 FROM x );

Alice Sherepa added a comment - 2023-11-07 16:52 - edited Thanks! Repeatable on 10.4-11.2 Version: '10.4.32-MariaDB-debug-log' 231107 17:51:19 [ERROR] mysqld got signal 11 ; Server version: 10.4.32-MariaDB-debug-log source revision: e5a5573f782723e40c372f38346a60b1ccc644d6 mysys/stacktrace.c:174(my_print_stacktrace)[0x55df7165dd55] sql/signal_handler.cc:235(handle_fatal_signal)[0x55df7021c615] sigaction.c:0(__restore_rt)[0x7f245ab51420] sql/sql_select.cc:4975(get_sargable_cond(JOIN*, TABLE*))[0x55df6fb36253] sql/sql_select.cc:2274(JOIN::optimize_inner())[0x55df6fb1a102] sql/sql_select.cc:1731(JOIN::optimize())[0x55df6fb140cd] sql/sql_union.cc:1490(st_select_lex_unit::optimize())[0x55df6fd29695] sql/sql_derived.cc:998(mysql_derived_optimize(THD*, LEX*, TABLE_LIST*))[0x55df6f986fb6] sql/sql_derived.cc:200(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x55df6f981b1a] sql/sql_select.cc:2221(JOIN::optimize_inner())[0x55df6fb19632] sql/sql_select.cc:1731(JOIN::optimize())[0x55df6fb140cd] sql/sql_lex.cc:4233(st_select_lex::optimize_unflattened_subqueries(bool))[0x55df6f9ebc76] sql/opt_subselect.cc:5644(JOIN::optimize_constant_subqueries())[0x55df6ff60682] sql/sql_select.cc:2068(JOIN::optimize_inner())[0x55df6fb17443] sql/sql_select.cc:1731(JOIN::optimize())[0x55df6fb140cd] sql/sql_select.cc:4832(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55df6fb350b7] sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55df6fb05b1e] sql/sql_parse.cc:6475(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55df6fa71886] sql/sql_parse.cc:3978(mysql_execute_command(THD*))[0x55df6fa5effd] sql/sql_parse.cc:8013(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55df6fa7adc5] sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55df6fa51187] sql/sql_parse.cc:1378(do_command(THD*))[0x55df6fa4dcb2] sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x55df6fe5d5b5] sql/sql_connect.cc:1325(handle_one_connection)[0x55df6fe5ce59] perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55df70af947e] nptl/pthread_create.c:478(start_thread)[0x7f245ab45609] Query (0x62b0000a1290): WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1.000000 AS x FROM ( WITH x AS ( SELECT * FROM x ) SELECT ( SELECT x ) / ( SELECT x FROM x WHERE x = ( x = 1 OR 1 ^ 1.000000 ) NOT LIKE 'x' * x * 1 + x ) / 1 = 1 FROM x GROUP BY x HAVING x > 'x' ORDER BY x , x IN ( SELECT DISTINCT x FROM x WHERE CASE WHEN x * ( SELECT ( 'x' , x , x ) < ( 1 , 1 , 1 ) ORDER BY 1 , 1 , 1 , 1 ) + x THEN x = ( SELECT ( SELECT 1 FROM x GROUP BY x HAVING ( SELECT 1 / ( x = 1 OR x > 'x' ) > 1.000000 ) ^ x ORDER BY x , x DESC , x , x , x DESC , x , x , x , x NOT LIKE FALSE LIMIT 1 OFFSET 1 ) FROM x WHERE x <= 1 GROUP BY x HAVING x > 'x' ) ELSE x END ) DESC , x , x , x , x , ( SELECT x ORDER BY 1 ) LIMIT 1 OFFSET 1 ) AS x ) SELECT DISTINCT 1 AS x , CASE x WHEN 1 THEN x ELSE 1 END , 1 FROM x GROUP BY 1.000000 HAVING x > 'x' ORDER BY ( SELECT 1 FROM x ) + 1 CREATE TABLE x ( x INT ) ; INSERT INTO x VALUES (1),(1),(1); WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1 AS x FROM ( WITH x AS ( SELECT * FROM x ) SELECT ( SELECT x FROM x ) FROM x GROUP BY x ) AS x ) SELECT 1 ORDER BY ( SELECT 1 FROM x );

Alice Sherepa made changes - 2023-11-07 16:54

Field	Original Value	New Value
Affects Version/s		10.4 [ 22408 ]
Affects Version/s		10.5 [ 23123 ]
Affects Version/s		10.6 [ 24028 ]
Affects Version/s		10.9 [ 26905 ]
Affects Version/s		10.10 [ 27530 ]
Affects Version/s		10.11 [ 27614 ]
Affects Version/s		11.0 [ 28320 ]
Affects Version/s		11.1 [ 28549 ]
Affects Version/s		11.2 [ 28603 ]

Alice Sherepa made changes - 2023-11-08 16:28

Component/s

Optimizer - CTE [ 13513 ]

Alice Sherepa made changes - 2023-11-23 15:45

Fix Version/s		10.4 [ 22408 ]
Fix Version/s		10.5 [ 23123 ]
Fix Version/s		10.6 [ 24028 ]
Fix Version/s		10.9 [ 26905 ]
Fix Version/s		10.10 [ 27530 ]
Fix Version/s		10.11 [ 27614 ]
Fix Version/s		11.0 [ 28320 ]
Fix Version/s		11.1 [ 28549 ]
Fix Version/s		11.2 [ 28603 ]

Alice Sherepa made changes - 2023-11-23 15:45

Assignee

Sergei Petrunia [ psergey ]

Alice Sherepa made changes - 2023-11-23 15:45

Status

Open [ 1 ]

Confirmed [ 10101 ]

Julien Fritsch made changes - 2023-11-28 10:21

Fix Version/s

10.9 [ 26905 ]

Julien Fritsch made changes - 2023-11-28 10:32

Fix Version/s

10.10 [ 27530 ]

Julien Fritsch made changes - 2024-05-03 14:39

Fix Version/s

11.0 [ 28320 ]

Julien Fritsch made changes - 2024-09-10 14:57

Fix Version/s

10.4 [ 22408 ]

Julien Fritsch made changes - 2024-09-10 15:27

Fix Version/s

11.1 [ 28549 ]

Julien Fritsch made changes - 2024-11-22 17:10

Fix Version/s

11.2(EOL) [ 28603 ]

People

Assignee:: Sergei Petrunia

Reporter:: Xin Wen

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2023-11-07 06:36

Updated:: 2024-11-22 17:10

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Attachments

Activity

People

Dates

Git Integration