Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-33854

Segmentation fault in Item_field::find_item_in_field_list_processor

    XMLWordPrintable

Details

    Description

      I run the following statements, and the server crashed.

      CREATE TABLE t1 (c1 decimal, c2 binary, UNIQUE KEY i1 (c1,c2));
      SELECT ca5 FROM (SELECT c1 AS ca5 FROM t1) AS ta1 WHERE (ca5 IN (SELECT ca10 AS ca7 FROM (SELECT c2 AS ca10 FROM t1) AS ta2 WHERE (NOT ca10))) LIKE NULL GROUP BY ca5;
      

      I got the following trace.

      #0  Item_field::find_item_in_field_list_processor (this=0x7fffa4017dd8, arg=0x7ffff4129b60)
          at /home/jellyfish/mariadb-11.3.2/sql/item.cc:863
      #1  0x0000555555e09bdc in Item::walk (this=0x7fffa4017dd8,
          processor=&virtual Item::find_item_in_field_list_processor(void*), walk_subquery=true,
          arg=0x7ffff4129b60) at /home/jellyfish/mariadb-11.3.2/sql/item.h:2148
      #2  0x0000555555e427e7 in Item_args::walk_args (this=0x7fffa4017f70,
          processor=&virtual Item::find_item_in_field_list_processor(void*), walk_subquery=true,
          arg=0x7ffff4129b60) at /home/jellyfish/mariadb-11.3.2/sql/item.h:2799
      #3  0x0000555555e42f98 in Item_func_or_sum::walk (this=0x7fffa4017ef8,
          processor=&virtual table offset 896, walk_subquery=true, arg=0x7ffff4129b60)
          at /home/jellyfish/mariadb-11.3.2/sql/item.h:5528
      #4  0x00005555564cfd04 in Item_subselect::walk (this=0x7fffa4017fc0, processor=&virtual table offset 896,
          walk_subquery=true, argument=0x7ffff4129b60)
          at /home/jellyfish/mariadb-11.3.2/sql/item_subselect.cc:750
      #5  0x00005555564e6a5f in Item_in_subselect::walk (this=0x7fffa4017fc0,
          processor=&virtual table offset 896, walk_subquery=true, arg=0x7ffff4129b60)
          at /home/jellyfish/mariadb-11.3.2/sql/item_subselect.h:757
      #6  0x000055555640db7e in Item_in_optimizer::walk (this=0x7fffa4084150,
          processor=&virtual table offset 896, walk_subquery=true, arg=0x7ffff4129b60)
          at /home/jellyfish/mariadb-11.3.2/sql/item_cmpfunc.cc:1537
      #7  0x0000555555e427e7 in Item_args::walk_args (this=0x7fffa4077798, processor=&virtual table offset 896,
          walk_subquery=true, arg=0x7ffff4129b60) at /home/jellyfish/mariadb-11.3.2/sql/item.h:2799
      #8  0x0000555555e45644 in Item_func_like::walk (this=0x7fffa4077720, processor=&virtual table offset 896,
          walk_subquery=true, arg=0x7ffff4129b60) at /home/jellyfish/mariadb-11.3.2/sql/item_cmpfunc.h:3020
      #9  0x0000555555e38d19 in get_best_group_min_max (param=0x7ffff412b6a0, tree=0x0,
          read_time=0.0067926050000000002) at /home/jellyfish/mariadb-11.3.2/sql/opt_range.cc:14584
      #10 0x0000555555e1a6e8 in SQL_SELECT::test_quick_select (this=0x7fffa4085c38, thd=0x7fffa4000dc8,
      --Type <RET> for more, q to quit, c to continue without paging--
          e=..., prev_tables=0, limit=18446744073709551615, force_quick_range=false, ordered_output=false, remove_false_parts_of_where=true, only_single_index_range_scan=false,
          note_unusable_keys=Item_func::BITMAP_EXCEPT_ANY_EQUALITY) at /home/jellyfish/mariadb-11.3.2/sql/opt_range.cc:3100
      #11 0x00005555560177bd in get_quick_record_count (thd=0x7fffa4000dc8, select=0x7fffa4085c38, table=0x7fffa4070f48, keys=0x7fffa4084790, limit=18446744073709551615,
          quick_count=0x7ffff412c260) at /home/jellyfish/mariadb-11.3.2/sql/sql_select.cc:5365
      #12 0x000055555601a446 in make_join_statistics (join=0x7fffa4078318, tables_list=..., keyuse_array=0x7fffa4078678) at /home/jellyfish/mariadb-11.3.2/sql/sql_select.cc:6142
      #13 0x000055555600daf9 in JOIN::optimize_inner (this=0x7fffa4078318) at /home/jellyfish/mariadb-11.3.2/sql/sql_select.cc:2657
      #14 0x000055555600b1c3 in JOIN::optimize (this=0x7fffa4078318) at /home/jellyfish/mariadb-11.3.2/sql/sql_select.cc:1966
      #15 0x0000555556017487 in mysql_select (thd=0x7fffa4000dc8, tables=0x7fffa4016198, fields=..., conds=0x7fffa4077720, og_num=1, order=0x0, group=0x7fffa4018330, having=0x0,
          proc_param=0x0, select_options=2164525824, result=0x7fffa40782f0, unit=0x7fffa4005250, select_lex=0x7fffa4014598) at /home/jellyfish/mariadb-11.3.2/sql/sql_select.cc:5290
      #16 0x00005555560059eb in handle_select (thd=0x7fffa4000dc8, lex=0x7fffa4005170, result=0x7fffa40782f0, setup_tables_done_option=0) at /home/jellyfish/mariadb-11.3.2/sql/sql_select.cc:630
      #17 0x0000555555fa8969 in execute_sqlcom_select (thd=0x7fffa4000dc8, all_tables=0x7fffa4016198) at /home/jellyfish/mariadb-11.3.2/sql/sql_parse.cc:6094
      #18 0x0000555555fa07bb in mysql_execute_command (thd=0x7fffa4000dc8, is_called_from_prepared_stmt=false) at /home/jellyfish/mariadb-11.3.2/sql/sql_parse.cc:3943
      #19 0x0000555555fad976 in mysql_parse (thd=0x7fffa4000dc8,
          rawbuf=0x7fffa40143f0 "SELECT ca5 FROM (SELECT c1 AS ca5 FROM t1) AS ta1 WHERE (ca5 IN (SELECT ca10 AS ca7 FROM (SELECT c2 AS ca10 FROM t1) AS ta2 WHERE (NOT ca10))) LIKE NULL GROUP BY ca5", length=165, parser_state=0x7ffff412d2b0) at /home/jellyfish/mariadb-11.3.2/sql/sql_parse.cc:7815
      #20 0x0000555555f9a2c5 in dispatch_command (command=COM_QUERY, thd=0x7fffa4000dc8,
          packet=0x7fffa400bbc9 "SELECT ca5 FROM (SELECT c1 AS ca5 FROM t1) AS ta1 WHERE (ca5 IN (SELECT ca10 AS ca7 FROM (SELECT c2 AS ca10 FROM t1) AS ta2 WHERE (NOT ca10))) LIKE NULL GROUP BY ca5", packet_length=165, blocking=true) at /home/jellyfish/mariadb-11.3.2/sql/sql_parse.cc:1893
      #21 0x0000555555f98c0b in do_command (thd=0x7fffa4000dc8, blocking=true) at /home/jellyfish/mariadb-11.3.2/sql/sql_parse.cc:1406
      #22 0x0000555556194732 in do_handle_one_connection (connect=0x555558b582f8, put_in_cache=true) at /home/jellyfish/mariadb-11.3.2/sql/sql_connect.cc:1437
      #23 0x000055555619449b in handle_one_connection (arg=0x555558b582f8) at /home/jellyfish/mariadb-11.3.2/sql/sql_connect.cc:1339
      #24 0x000055555672aa05 in pfs_spawn_thread (arg=0x555558b31728) at /home/jellyfish/mariadb-11.3.2/storage/perfschema/pfs.cc:2201
      #25 0x00007ffff75aaac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
      #26 0x00007ffff763c850 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
      

      Attachments

        Activity

          People

            psergei Sergei Petrunia
            John Jove John Jove
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.