[MDEV-34578] Server crashes when attempting to run JSON_OBJECTAGG as a window function - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Duplicate
Affects Version/s: 11.2.4
Fix Version/s: N/A
Component/s: Optimizer, Optimizer - Window functions
Labels:
None
Environment:
Docker on windows, using the images from here https://hub.docker.com/_/mariadb/tags

Description

I'm connecting to MariaDB using JDBC (e.g. from my own application, or using Dbeaver). I'll run this statement:

select

  json_objectagg(t.k, t.v) over (order by t.k)

from (

  select

t.*

  from (

    select

      'a' as k,

      1 as v

) t

) as t

order by t.k;

And get this error:

SQL Error [08000]: Socket fail to connect to host:address=(host=localhost)(port=3307)(type=primary). Connection refused: no further information

This effectively crashes the server

Attachments

Issue Links

duplicates

MDEV-32396 Segmentation fault at /mariadb-11.3.0/sql/sql_select.cc:27583

Confirmed

Activity

Alice Sherepa added a comment - 2024-07-12 11:53

Thanks!
This is he same bug as MDEV-32396, I will add the test there.

mariadbd: /10.11/src/sql/sql_array.h:65: Element_type& Bounds_checked_array<Element_type>::operator[](size_t) [with Element_type = Item*; size_t = long unsigned int]: Assertion `n < m_size' failed.

240712 13:50:51 [ERROR] mysqld got signal 6 ;

/lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7f4a35a93fd6]

sql/sql_array.h:66(Bounds_checked_array<Item*>::operator[](unsigned long))[0x557496653e27]

sql/sql_select.cc:26555(find_order_in_list(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, st_order*, List<Item>&, List<Item>&, bool, bool, bool))[0x55749699a419]

sql/sql_select.cc:26620(setup_order(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<Item>&, List<Item>&, st_order*, bool))[0x55749699aae5]

sql/sql_window.cc:247(setup_windows(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<Item>&, List<Item>&, List<Window_spec>&, List<Item_window_func>&))[0x557496ee391d]

sql/sql_select.cc:925(setup_without_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<TABLE_LIST>&, List<Item>&, List<Item>&, Item**, st_order*, st_order*, List<Window_spec>&, List<Item_window_func>&, bool*))[0x5574968d18a0]

sql/sql_select.cc:1530(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x5574968d8ffb]

sql/sql_select.cc:5171(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5574969001ad]

sql/sql_select.cc:586(handle_select(THD*, LEX*, select_result*, unsigned long long))[0x5574968cf3d3]

sql/sql_parse.cc:6385(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5574967efbed]

sql/sql_parse.cc:3988(mysql_execute_command(THD*, bool))[0x5574967dde6e]

sql/sql_parse.cc:8143(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5574967facca]

sql/sql_parse.cc:1897(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5574967d0046]

sql/sql_parse.cc:1408(do_command(THD*, bool))[0x5574967ccd80]

sql/sql_connect.cc:1417(do_handle_one_connection(CONNECT*, bool))[0x557496c9f1bb]

sql/sql_connect.cc:1321(handle_one_connection)[0x557496c9eb18]

perfschema/pfs.cc:2203(pfs_spawn_thread)[0x5574978efe9c]

Query (0x6290001092a8): SELECT json_objectagg(t.k, t.v) over ( ORDER BY t.k) FROM ( SELECT t.*  FROM  ( SELECT 'a' AS k,  1 AS v ) t) AS t ORDER BY t.k

Alice Sherepa added a comment - 2024-07-12 11:53 Thanks! This is he same bug as MDEV-32396 , I will add the test there. mariadbd: /10.11/src/sql/sql_array.h:65: Element_type& Bounds_checked_array<Element_type>::operator[](size_t) [with Element_type = Item*; size_t = long unsigned int]: Assertion `n < m_size' failed. 240712 13:50:51 [ERROR] mysqld got signal 6 ; /lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7f4a35a93fd6] sql/sql_array.h:66(Bounds_checked_array<Item*>::operator[](unsigned long))[0x557496653e27] sql/sql_select.cc:26555(find_order_in_list(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, st_order*, List<Item>&, List<Item>&, bool, bool, bool))[0x55749699a419] sql/sql_select.cc:26620(setup_order(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<Item>&, List<Item>&, st_order*, bool))[0x55749699aae5] sql/sql_window.cc:247(setup_windows(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<Item>&, List<Item>&, List<Window_spec>&, List<Item_window_func>&))[0x557496ee391d] sql/sql_select.cc:925(setup_without_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<TABLE_LIST>&, List<Item>&, List<Item>&, Item**, st_order*, st_order*, List<Window_spec>&, List<Item_window_func>&, bool*))[0x5574968d18a0] sql/sql_select.cc:1530(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x5574968d8ffb] sql/sql_select.cc:5171(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5574969001ad] sql/sql_select.cc:586(handle_select(THD*, LEX*, select_result*, unsigned long long))[0x5574968cf3d3] sql/sql_parse.cc:6385(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5574967efbed] sql/sql_parse.cc:3988(mysql_execute_command(THD*, bool))[0x5574967dde6e] sql/sql_parse.cc:8143(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5574967facca] sql/sql_parse.cc:1897(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5574967d0046] sql/sql_parse.cc:1408(do_command(THD*, bool))[0x5574967ccd80] sql/sql_connect.cc:1417(do_handle_one_connection(CONNECT*, bool))[0x557496c9f1bb] sql/sql_connect.cc:1321(handle_one_connection)[0x557496c9eb18] perfschema/pfs.cc:2203(pfs_spawn_thread)[0x5574978efe9c] Query (0x6290001092a8): SELECT json_objectagg(t.k, t.v) over ( ORDER BY t.k) FROM ( SELECT t.* FROM ( SELECT 'a' AS k, 1 AS v ) t) AS t ORDER BY t.k

People

Assignee:: Unassigned

Reporter:: Lukas Eder

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2024-07-12 09:53

Updated:: 2024-07-12 11:58

Resolved:: 2024-07-12 11:57

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server