Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Major
-
Resolution: Unresolved
-
11.2, 11.3, 11.4
Description
SELECT json_array_intersect(@json1,@json2); |
Leads to
|
11.4.0 3fad2b115569864d8c1b7ea90ce92aa895cfef08 (Optimized) |
Core was generated by `/test/mtest/MD010124-mariadb-11.4.0-linux-x86_64-opt/bin/mariadbd --no-defaults'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x000055fde5069d9d in Item_func_json_array_intersect::prepare_json_and_create_hash (this=this@entry=0x14dd5c0112d8, je1=je1@entry=0x14dda00cd270, js=0x0)
|
at /test/mtest/11.4_opt/sql/item_jsonfunc.cc:5265
|
5265 json_scan_start(je1, js->charset(), (const uchar *) js->ptr(),
|
[Current thread is 1 (Thread 0x14dda00cf700 (LWP 2799882))]
|
(gdb) bt
|
#0 0x000055fde5069d9d in Item_func_json_array_intersect::prepare_json_and_create_hash (this=this@entry=0x14dd5c0112d8, je1=je1@entry=0x14dda00cd270, js=0x0) at /test/mtest/11.4_opt/sql/item_jsonfunc.cc:5265
|
#1 0x000055fde506a56b in Item_func_json_array_intersect::fix_length_and_dec (this=0x14dd5c0112d8, thd=<optimized out>) at /test/mtest/11.4_opt/sql/item_jsonfunc.cc:5306
|
#2 0x000055fde51cc21b in Item_func::fix_fields (ref=<optimized out>, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item_func.cc:377
|
#3 Item_func::fix_fields (this=this@entry=0x14dd5c0112d8, thd=thd@entry=0x14dd5c000c58, ref=<optimized out>) at /test/mtest/11.4_opt/sql/item_func.cc:326
|
#4 0x000055fde5202746 in Item_str_func::fix_fields (this=0x14dd5c0112d8, thd=0x14dd5c000c58, ref=<optimized out>) at /test/mtest/11.4_opt/sql/item_strfunc.cc:132
|
#5 0x000055fde4e6c6a0 in Item::fix_fields_if_needed (ref=0x14dd5c0114a0, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item.h:1151
|
#6 Item::fix_fields_if_needed (ref=0x14dd5c0114a0, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item.h:1151
|
#7 Item::fix_fields_if_needed_for_scalar (ref=0x14dd5c0114a0, thd=0x14dd5c000c58, this=0x14dd5c0112d8) at /test/mtest/11.4_opt/sql/item.h:1162
|
#8 setup_fields (thd=0x14dd5c000c58, ref_pointer_array=<optimized out>, fields=<optimized out>, column_usage=<optimized out>, sum_func_list=sum_func_list@entry=0x14dd5c0121b8, pre_fix=0x14dd5c010e78, allow_sum_func=true) at /test/mtest/11.4_opt/sql/sql_base.cc:8084
|
#9 0x000055fde4f46816 in JOIN::prepare (this=0x14dd5c011e18, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x14dd5c010ba8, unit_arg=0x14dd5c004f10) at /test/mtest/11.4_opt/sql/sql_select.cc:1549
|
#10 0x000055fde4f5a8ab in mysql_select (thd=0x14dd5c000c58, tables=0x0, fields=@0x14dd5c010e60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14dd5c011498, last = 0x14dd5c011498, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14dd5c011df0, unit=0x14dd5c004f10, select_lex=0x14dd5c010ba8) at /test/mtest/11.4_opt/sql/sql_select.cc:5278
|
#11 0x000055fde4f5aba7 in handle_select (thd=thd@entry=0x14dd5c000c58, lex=lex@entry=0x14dd5c004e30, result=result@entry=0x14dd5c011df0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/mtest/11.4_opt/sql/sql_select.cc:630
|
#12 0x000055fde4ed458e in execute_sqlcom_select (thd=0x14dd5c000c58, all_tables=0x0) at /test/mtest/11.4_opt/sql/sql_parse.cc:6077
|
#13 0x000055fde4ee2bc1 in mysql_execute_command (thd=0x14dd5c000c58, is_called_from_prepared_stmt=<optimized out>) at /test/mtest/11.4_opt/sql/sql_parse.cc:3926
|
#14 0x000055fde4ecf156 in mysql_parse (thd=0x14dd5c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/mtest/11.4_opt/sql/sql_parse.cc:7798
|
#15 0x000055fde4edb6d5 in dispatch_command (command=COM_QUERY, thd=0x14dd5c000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/mtest/11.4_opt/sql/sql_class.h:1552
|
#16 0x000055fde4edd91e in do_command (thd=0x14dd5c000c58, blocking=blocking@entry=true) at /test/mtest/11.4_opt/sql/sql_parse.cc:1406
|
#17 0x000055fde500d397 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/mtest/11.4_opt/sql/sql_connect.cc:1417
|
#18 0x000055fde500d6dd in handle_one_connection (arg=arg@entry=0x55fde8702d08) at /test/mtest/11.4_opt/sql/sql_connect.cc:1319
|
#19 0x000055fde53b599c in pfs_spawn_thread (arg=0x55fde86b7cb8) at /test/mtest/11.4_opt/storage/perfschema/pfs.cc:2201
|
#20 0x000014dda3576609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#21 0x000014dda3162133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
|
11.4.0 3fad2b115569864d8c1b7ea90ce92aa895cfef08 (Debug) |
Core was generated by `/test/mtest/MD010124-mariadb-11.4.0-linux-x86_64-dbg/bin/mariadbd --no-defaults'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 Binary_string::ptr (this=0x8) at /test/mtest/11.4_dbg/sql/sql_string.h:359
|
359 inline const char *ptr() const { return Ptr; }
|
[Current thread is 1 (Thread 0x1489fc09c700 (LWP 1846667))]
|
(gdb) bt
|
#0 Binary_string::ptr (this=0x8) at /test/mtest/11.4_dbg/sql/sql_string.h:359
|
#1 Item_func_json_array_intersect::prepare_json_and_create_hash (this=this@entry=0x1489b4013cd8, je1=je1@entry=0x1489fc09a1c0, js=0x0) at /test/mtest/11.4_dbg/sql/item_jsonfunc.cc:5266
|
#2 0x00005594b2cc4515 in Item_func_json_array_intersect::fix_length_and_dec (this=0x1489b4013cd8, thd=<optimized out>) at /test/mtest/11.4_dbg/sql/item_jsonfunc.cc:5306
|
#3 0x00005594b2e7cb2d in Item_func::fix_fields (this=this@entry=0x1489b4013cd8, thd=thd@entry=0x1489b4000d48, ref=<optimized out>) at /test/mtest/11.4_dbg/sql/item_func.cc:377
|
#4 0x00005594b2ec75c2 in Item_str_func::fix_fields (this=0x1489b4013cd8, thd=0x1489b4000d48, ref=<optimized out>) at /test/mtest/11.4_dbg/sql/item_strfunc.cc:132
|
#5 0x00005594b2a49034 in Item::fix_fields_if_needed (ref=0x1489b4013ea0, thd=0x1489b4000d48, this=0x1489b4013cd8) at /test/mtest/11.4_dbg/sql/item.h:1162
|
#6 Item::fix_fields_if_needed_for_scalar (ref=0x1489b4013ea0, thd=0x1489b4000d48, this=0x1489b4013cd8) at /test/mtest/11.4_dbg/sql/item.h:1162
|
#7 setup_fields (thd=0x1489b4000d48, ref_pointer_array=<optimized out>, fields=<optimized out>, column_usage=<optimized out>, sum_func_list=sum_func_list@entry=0x1489b4014bc0, pre_fix=0x1489b4013878, allow_sum_func=true) at /test/mtest/11.4_dbg/sql/sql_base.cc:8084
|
#8 0x00005594b2b4aa31 in JOIN::prepare (this=this@entry=0x1489b4014818, tables_init=tables_init@entry=0x0, conds_init=conds_init@entry=0x0, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x1489b40135a8, unit_arg=0x1489b40051c8) at /test/mtest/11.4_dbg/sql/sql_select.cc:1549
|
#9 0x00005594b2b633d9 in mysql_select (thd=thd@entry=0x1489b4000d48, tables=0x0, fields=@0x1489b4013860: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1489b4013e98, last = 0x1489b4013e98, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x1489b40147f0, unit=0x1489b40051c8, select_lex=0x1489b40135a8) at /test/mtest/11.4_dbg/sql/sql_select.cc:5278
|
#10 0x00005594b2b63603 in handle_select (thd=thd@entry=0x1489b4000d48, lex=lex@entry=0x1489b40050e8, result=result@entry=0x1489b40147f0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/mtest/11.4_dbg/sql/sql_select.cc:630
|
#11 0x00005594b2ac2da4 in execute_sqlcom_select (thd=thd@entry=0x1489b4000d48, all_tables=0x0) at /test/mtest/11.4_dbg/sql/sql_parse.cc:6077
|
#12 0x00005594b2acf89d in mysql_execute_command (thd=thd@entry=0x1489b4000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/mtest/11.4_dbg/sql/sql_parse.cc:3926
|
#13 0x00005594b2abcd20 in mysql_parse (thd=thd@entry=0x1489b4000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1489fc09b2b0) at /test/mtest/11.4_dbg/sql/sql_parse.cc:7798
|
#14 0x00005594b2acabfc in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1489b4000d48, packet=packet@entry=0x1489b400b1b9 "SELECT json_array_intersect(@json1,@json2)", packet_length=packet_length@entry=42, blocking=blocking@entry=true) at /test/mtest/11.4_dbg/sql/sql_class.h:1552
|
#15 0x00005594b2acd328 in do_command (thd=0x1489b4000d48, blocking=blocking@entry=true) at /test/mtest/11.4_dbg/sql/sql_parse.cc:1406
|
#16 0x00005594b2c47eb5 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5594b6aebd08, put_in_cache=put_in_cache@entry=true) at /test/mtest/11.4_dbg/sql/sql_connect.cc:1417
|
#17 0x00005594b2c4846a in handle_one_connection (arg=arg@entry=0x5594b6aebd08) at /test/mtest/11.4_dbg/sql/sql_connect.cc:1319
|
#18 0x00005594b30b654c in pfs_spawn_thread (arg=0x5594b6a3f2b8) at /test/mtest/11.4_dbg/storage/perfschema/pfs.cc:2201
|
#19 0x00001489ffb7d609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#20 0x00001489ff769133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
And UBSAN sees a runtime error: member access within null pointer of type 'struct String':
|
11.4.2 9b6e267bfd8fbed66807b8ca81a84d1faa84ff34 (Optimized, UBASAN) |
/test/11.4_opt_san/sql/item_jsonfunc.cc:5266:42: runtime error: member access within null pointer of type 'struct String'
|
#0 0x555fd0ba97c4 in Item_func_json_array_intersect::prepare_json_and_create_hash(st_json_engine_t*, String*) /test/11.4_opt_san/sql/item_jsonfunc.cc:5266
|
#1 0x555fd0bac5ca in Item_func_json_array_intersect::fix_length_and_dec(THD*) /test/11.4_opt_san/sql/item_jsonfunc.cc:5306
|
#2 0x555fd1a41d29 in Item_func::fix_fields(THD*, Item**) /test/11.4_opt_san/sql/item_func.cc:377
|
#3 0x555fd1cec0cb in Item_str_func::fix_fields(THD*, Item**) /test/11.4_opt_san/sql/item_strfunc.cc:132
|
#4 0x555fcfb0ad30 in Item::fix_fields_if_needed(THD*, Item**) /test/11.4_opt_san/sql/item.h:1166
|
#5 0x555fcfb0ad30 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /test/11.4_opt_san/sql/item.h:1175
|
#6 0x555fcfb0ad30 in setup_fields(THD*, Bounds_checked_array<Item*>, List<Item>&, enum_column_usage, List<Item>*, List<Item>*, bool) /test/11.4_opt_san/sql/sql_base.cc:8084
|
#7 0x555fd023c1b5 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /test/11.4_opt_san/sql/sql_select.cc:1549
|
#8 0x555fd0338297 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.4_opt_san/sql/sql_select.cc:5279
|
#9 0x555fd033a390 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.4_opt_san/sql/sql_select.cc:630
|
#10 0x555fcfeacf40 in execute_sqlcom_select /test/11.4_opt_san/sql/sql_parse.cc:6094
|
#11 0x555fcff10e35 in mysql_execute_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:3943
|
#12 0x555fcff1fba2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.4_opt_san/sql/sql_parse.cc:7815
|
#13 0x555fcff2bbbb in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.4_opt_san/sql/sql_parse.cc:1893
|
#14 0x555fcff37608 in do_command(THD*, bool) /test/11.4_opt_san/sql/sql_parse.cc:1406
|
#15 0x555fd088ecbc in do_handle_one_connection(CONNECT*, bool) /test/11.4_opt_san/sql/sql_connect.cc:1437
|
#16 0x555fd08912bc in handle_one_connection /test/11.4_opt_san/sql/sql_connect.cc:1339
|
#17 0x14e92ec94ac2 in start_thread nptl/pthread_create.c:442
|
#18 0x14e92ed2684f (/lib/x86_64-linux-gnu/libc.so.6+0x12684f)
|
Bug confirmed present in:
MariaDB: 11.2.3 (dbg), 11.2.3 (opt), 11.3.2 (dbg), 11.3.2 (opt), 11.4.0 (dbg), 11.4.0 (opt), 11.5.0 (dbg)
Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.4.33 (dbg), 10.4.33 (opt), 10.5.24 (dbg), 10.5.24 (opt), 10.6.17 (dbg), 10.6.17 (opt), 10.11.7 (dbg), 10.11.7 (opt), 11.0.5 (dbg), 11.0.5 (opt), 11.1.4 (dbg), 11.1.4 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.44 (dbg), 5.7.44 (opt), 8.0.36 (dbg), 8.0.36 (opt)