MariaDB crashes when executing the following statement:
drop database if exists test123;
create database if not exists test123;
use test123;
DESC FOR CONNECTION + INTERVAL TRUE IN ( SELECT 'string' ) YEAR_MONTH + FALSE <=> TRUE NOT IN ( SELECT * );
Crash stack:
#0 0x0000000001bbe8bc in Item_subselect::init (this=0xffff7e8f2640, select_lex=0xffff7e8f17b8, result=0xffff7e8f2850)
at /home/mariadb/mariadb-server/sql/item_subselect.cc:124
#1 0x0000000001bccc44 in Item_in_subselect::Item_in_subselect (this=0xffff7e8f2640, thd=0xffff58e5b218, left_exp=<optimized out>,
select_lex=0xffff7e8f17b8) at /home/mariadb/mariadb-server/sql/item_subselect.cc:1664
#2 0x0000000001649b48 in MYSQLparse (thd=<optimized out>) at /home/mariadb/mariadb-server/sql/sql_yacc.yy:9670
#3 0x0000000000d575c0 in parse_sql (thd=0xffff58e5b218, parser_state=<optimized out>, creation_ctx=0x0, do_pfs_digest=true)
at /home/mariadb/mariadb-server/sql/sql_parse.cc:10328
#4 0x0000000000d1c8b8 in mysql_parse (thd=0xffff58e5b218,
rawbuf=0xffff7e8f0438 "DESC FOR CONNECTION + INTERVAL TRUE IN ( SELECT 'string' ) YEAR_MONTH + FALSE <=> TRUE NOT IN ( SELECT * )",
length=<optimized out>, parser_state=<optimized out>) at /home/mariadb/mariadb-server/sql/sql_parse.cc:7867
#5 0x0000000000d120f0 in dispatch_command (command=<optimized out>, thd=<optimized out>, packet=<optimized out>, packet_length=<optimized out>,
blocking=<optimized out>) at /home/mariadb/mariadb-server/sql/sql_parse.cc:1902
#6 0x0000000000d1dbf4 in do_command (thd=0xffff58e5b218, blocking=true) at /home/mariadb/mariadb-server/sql/sql_parse.cc:1415
#7 0x00000000012846f8 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /home/mariadb/mariadb-server/sql/sql_connect.cc:1415
#8 0x00000000012841b4 in handle_one_connection (arg=0xffff84a34db8) at /home/mariadb/mariadb-server/sql/sql_connect.cc:1327
#9 0x0000000002200c38 in pfs_spawn_thread (arg=0xffff7e405f18) at /home/mariadb/mariadb-server/storage/perfschema/pfs.cc:2198
#10 0x0000ffff8a44d624 in start_thread (arg=0x883ac8 <asan_thread_start(void*)>) at pthread_create.c:477
#11 0x0000ffff8a16f66c in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone.S:78
Yu Liang
created issue -
2025-03-22 19:14
Roel Van de Paar
made changes -
2025-03-24 05:29
Field
Original Value
New Value
Description
MariaDB crashes when executing the following statement:
{code:sql}
drop database if exists test123;
create database if not exists test123;
use test123;
DESC FOR CONNECTION + INTERVAL TRUE IN ( SELECT 'string' ) YEAR_MONTH + FALSE <=> TRUE NOT IN ( SELECT * );
{code}
Crash stack:
{quote}
#0 0x0000000001bbe8bc in Item_subselect::init (this=0xffff7e8f2640, select_lex=0xffff7e8f17b8, result=0xffff7e8f2850)
at /home/mariadb/mariadb-server/sql/item_subselect.cc:124
#1 0x0000000001bccc44 in Item_in_subselect::Item_in_subselect (this=0xffff7e8f2640, thd=0xffff58e5b218, left_exp=<optimized out>,
select_lex=0xffff7e8f17b8) at /home/mariadb/mariadb-server/sql/item_subselect.cc:1664
#2 0x0000000001649b48 in MYSQLparse (thd=<optimized out>) at /home/mariadb/mariadb-server/sql/sql_yacc.yy:9670
#3 0x0000000000d575c0 in parse_sql (thd=0xffff58e5b218, parser_state=<optimized out>, creation_ctx=0x0, do_pfs_digest=true)
at /home/mariadb/mariadb-server/sql/sql_parse.cc:10328
#4 0x0000000000d1c8b8 in mysql_parse (thd=0xffff58e5b218,
rawbuf=0xffff7e8f0438 "DESC FOR CONNECTION + INTERVAL TRUE IN ( SELECT 'string' ) YEAR_MONTH + FALSE <=> TRUE NOT IN ( SELECT * )",
length=<optimized out>, parser_state=<optimized out>) at /home/mariadb/mariadb-server/sql/sql_parse.cc:7867
#5 0x0000000000d120f0 in dispatch_command (command=<optimized out>, thd=<optimized out>, packet=<optimized out>, packet_length=<optimized out>,
blocking=<optimized out>) at /home/mariadb/mariadb-server/sql/sql_parse.cc:1902
#6 0x0000000000d1dbf4 in do_command (thd=0xffff58e5b218, blocking=true) at /home/mariadb/mariadb-server/sql/sql_parse.cc:1415
#7 0x00000000012846f8 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /home/mariadb/mariadb-server/sql/sql_connect.cc:1415
#8 0x00000000012841b4 in handle_one_connection (arg=0xffff84a34db8) at /home/mariadb/mariadb-server/sql/sql_connect.cc:1327
#9 0x0000000002200c38 in pfs_spawn_thread (arg=0xffff7e405f18) at /home/mariadb/mariadb-server/storage/perfschema/pfs.cc:2198
#10 0x0000ffff8a44d624 in start_thread (arg=0x883ac8 <asan_thread_start(void*)>) at pthread_create.c:477
#11 0x0000ffff8a16f66c in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone.S:78
{quote}
MariaDB crashes when executing the following statement:
{code:sql}
drop database if exists test123;
create database if not exists test123;
use test123;
DESC FOR CONNECTION + INTERVAL TRUE IN ( SELECT 'string' ) YEAR_MONTH + FALSE <=> TRUE NOT IN ( SELECT * );
{code}
Crash stack:
{noformat}
#0 0x0000000001bbe8bc in Item_subselect::init (this=0xffff7e8f2640, select_lex=0xffff7e8f17b8, result=0xffff7e8f2850)
at /home/mariadb/mariadb-server/sql/item_subselect.cc:124
#1 0x0000000001bccc44 in Item_in_subselect::Item_in_subselect (this=0xffff7e8f2640, thd=0xffff58e5b218, left_exp=<optimized out>,
select_lex=0xffff7e8f17b8) at /home/mariadb/mariadb-server/sql/item_subselect.cc:1664
#2 0x0000000001649b48 in MYSQLparse (thd=<optimized out>) at /home/mariadb/mariadb-server/sql/sql_yacc.yy:9670
#3 0x0000000000d575c0 in parse_sql (thd=0xffff58e5b218, parser_state=<optimized out>, creation_ctx=0x0, do_pfs_digest=true)
at /home/mariadb/mariadb-server/sql/sql_parse.cc:10328
#4 0x0000000000d1c8b8 in mysql_parse (thd=0xffff58e5b218,
rawbuf=0xffff7e8f0438 "DESC FOR CONNECTION + INTERVAL TRUE IN ( SELECT 'string' ) YEAR_MONTH + FALSE <=> TRUE NOT IN ( SELECT * )",
length=<optimized out>, parser_state=<optimized out>) at /home/mariadb/mariadb-server/sql/sql_parse.cc:7867
#5 0x0000000000d120f0 in dispatch_command (command=<optimized out>, thd=<optimized out>, packet=<optimized out>, packet_length=<optimized out>,
blocking=<optimized out>) at /home/mariadb/mariadb-server/sql/sql_parse.cc:1902
#6 0x0000000000d1dbf4 in do_command (thd=0xffff58e5b218, blocking=true) at /home/mariadb/mariadb-server/sql/sql_parse.cc:1415
#7 0x00000000012846f8 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /home/mariadb/mariadb-server/sql/sql_connect.cc:1415
#8 0x00000000012841b4 in handle_one_connection (arg=0xffff84a34db8) at /home/mariadb/mariadb-server/sql/sql_connect.cc:1327
#9 0x0000000002200c38 in pfs_spawn_thread (arg=0xffff7e405f18) at /home/mariadb/mariadb-server/storage/perfschema/pfs.cc:2198
#10 0x0000ffff8a44d624 in start_thread (arg=0x883ac8 <asan_thread_start(void*)>) at pthread_create.c:477
#11 0x0000ffff8a16f66c in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone.S:78
{noformat}
Roel Van de Paar
made changes -
2025-03-24 05:31
Summary
MariaDB SEGV when executing query
MariaDB SEGV in Item_subselect::init when executing query
Roel Van de Paar
made changes -
2025-03-24 05:34
Affects Version/s
11.7.2
[ 29914
]
Roel Van de Paar
made changes -
2025-03-24 05:34
Fix Version/s
10.11
[ 27614
]
Fix Version/s
11.4
[ 29301
]
Fix Version/s
11.8
[ 29921
]
Affects Version/s
10.11
[ 27614
]
Affects Version/s
11.4
[ 29301
]
Affects Version/s
11.8
[ 29921
]
Affects Version/s
12.0
[ 29945
]
Roel Van de Paar
made changes -
2025-03-24 05:35
Labels
UBSAN
UBSAN null-pointer-use
Roel Van de Paar
made changes -
2025-03-24 05:38
Status
Open
[ 1
]
Confirmed
[ 10101
]
Roel Van de Paar
made changes -
2025-03-24 05:38
Component/s
Optimizer
[ 10200
]
Roel Van de Paar
made changes -
2025-03-24 05:38
Assignee
Sergei Petrunia
[ psergey
]
{"report":{"fcp":1440.5,"ttfb":388.9000005722046,"pageVisibility":"visible","entityId":133436,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":32,"apdex":0.5,"journeyId":"de2dc205-7374-413b-9272-78f0e7bcf4c4","navigationType":0,"readyForUser":1426.6999998092651,"redirectCount":0,"resourceLoadedEnd":2483.1000003814697,"resourceLoadedStart":404.1000003814697,"resourceTiming":[{"duration":361.0999994277954,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":404.1000003814697,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":404.1000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":765.1999998092651,"responseStart":0,"secureConnectionStart":0},{"duration":361,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2cib/820016/12ta74/2bf333562ca6724060a9d5f1535471f6/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":404.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":404.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":765.5,"responseStart":0,"secureConnectionStart":0},{"duration":376,"initiatorType":"script","name":"https://jira.mariadb.org/s/0917945aaa57108d00c5076fea35e069-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":404.80000019073486,"connectEnd":404.80000019073486,"connectStart":404.80000019073486,"domainLookupEnd":404.80000019073486,"domainLookupStart":404.80000019073486,"fetchStart":404.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":404.80000019073486,"responseEnd":780.8000001907349,"responseStart":780.8000001907349,"secureConnectionStart":404.80000019073486},{"duration":554.8999996185303,"initiatorType":"script","name":"https://jira.mariadb.org/s/2d8175ec2fa4c816e8023260bd8c1786-CDN/lu2cib/820016/12ta74/2bf333562ca6724060a9d5f1535471f6/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":405.4000005722046,"connectEnd":405.4000005722046,"connectStart":405.4000005722046,"domainLookupEnd":405.4000005722046,"domainLookupStart":405.4000005722046,"fetchStart":405.4000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":405.4000005722046,"responseEnd":960.3000001907349,"responseStart":960.3000001907349,"secureConnectionStart":405.4000005722046},{"duration":557,"initiatorType":"script","name":"https://jira.mariadb.org/s/a9324d6758d385eb45c462685ad88f1d-CDN/lu2cib/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":408,"connectEnd":408,"connectStart":408,"domainLookupEnd":408,"domainLookupStart":408,"fetchStart":408,"redirectEnd":0,"redirectStart":0,"requestStart":408,"responseEnd":965,"responseStart":965,"secureConnectionStart":408},{"duration":560.3000001907349,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":409.5,"connectEnd":409.5,"connectStart":409.5,"domainLookupEnd":409.5,"domainLookupStart":409.5,"fetchStart":409.5,"redirectEnd":0,"redirectStart":0,"requestStart":409.5,"responseEnd":969.8000001907349,"responseStart":969.8000001907349,"secureConnectionStart":409.5},{"duration":560.2000007629395,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":410.69999980926514,"connectEnd":410.69999980926514,"connectStart":410.69999980926514,"domainLookupEnd":410.69999980926514,"domainLookupStart":410.69999980926514,"fetchStart":410.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":410.69999980926514,"responseEnd":970.9000005722046,"responseStart":970.9000005722046,"secureConnectionStart":410.69999980926514},{"duration":586.6999998092651,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2cib/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":411.4000005722046,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":411.4000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":998.1000003814697,"responseStart":0,"secureConnectionStart":0},{"duration":559.4000005722046,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":412,"connectEnd":412,"connectStart":412,"domainLookupEnd":412,"domainLookupStart":412,"fetchStart":412,"redirectEnd":0,"redirectStart":0,"requestStart":412,"responseEnd":971.4000005722046,"responseStart":971.4000005722046,"secureConnectionStart":412},{"duration":586.3000001907349,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":412.19999980926514,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":412.19999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":998.5,"responseStart":0,"secureConnectionStart":0},{"duration":559.6999998092651,"initiatorType":"script","name":"https://jira.mariadb.org/s/5d5e8fe91fbc506585e83ea3b62ccc4b-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":412.30000019073486,"connectEnd":412.30000019073486,"connectStart":412.30000019073486,"domainLookupEnd":412.30000019073486,"domainLookupStart":412.30000019073486,"fetchStart":412.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":412.30000019073486,"responseEnd":972,"responseStart":972,"secureConnectionStart":412.30000019073486},{"duration":2034.4000005722046,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":440,"connectEnd":440,"connectStart":440,"domainLookupEnd":440,"domainLookupStart":440,"fetchStart":440,"redirectEnd":0,"redirectStart":0,"requestStart":440,"responseEnd":2474.4000005722046,"responseStart":2474.4000005722046,"secureConnectionStart":440},{"duration":1976.1999998092651,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":506.9000005722046,"connectEnd":506.9000005722046,"connectStart":506.9000005722046,"domainLookupEnd":506.9000005722046,"domainLookupStart":506.9000005722046,"fetchStart":506.9000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":506.9000005722046,"responseEnd":2483.1000003814697,"responseStart":2483.1000003814697,"secureConnectionStart":506.9000005722046},{"duration":1455,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":964.9000005722046,"connectEnd":964.9000005722046,"connectStart":964.9000005722046,"domainLookupEnd":964.9000005722046,"domainLookupStart":964.9000005722046,"fetchStart":964.9000005722046,"redirectEnd":0,"redirectStart":0,"requestStart":964.9000005722046,"responseEnd":2419.9000005722046,"responseStart":2419.9000005722046,"secureConnectionStart":964.9000005722046},{"duration":1265.3999996185303,"initiatorType":"script","name":"https://www.google-analytics.com/analytics.js","startTime":1321.3000001907349,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1321.3000001907349,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":2586.699999809265,"responseStart":0,"secureConnectionStart":0},{"duration":309.1000003814697,"initiatorType":"link","name":"https://jira.mariadb.org/s/d5715adaadd168a9002b108b2b039b50-CDN/lu2cib/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/css/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":2424,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":2424,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":2733.1000003814697,"responseStart":0,"secureConnectionStart":0},{"duration":262.0999994277954,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/e65b778d185daf5aee24936755b43da6/_/download/contextbatch/js/browser-metrics-plugin.contrib,-_super,-project.issue.navigator,-jira.view.issue,-atl.general/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":2425.1000003814697,"connectEnd":2425.1000003814697,"connectStart":2425.1000003814697,"domainLookupEnd":2425.1000003814697,"domainLookupStart":2425.1000003814697,"fetchStart":2425.1000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":2425.1000003814697,"responseEnd":2687.199999809265,"responseStart":2687.199999809265,"secureConnectionStart":2425.1000003814697},{"duration":278.19999980926514,"initiatorType":"script","name":"https://jira.mariadb.org/s/097ae97cb8fbec7d6ea4bbb1f26955b9-CDN/lu2cib/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/js/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":2425.5,"connectEnd":2425.5,"connectStart":2425.5,"domainLookupEnd":2425.5,"domainLookupStart":2425.5,"fetchStart":2425.5,"redirectEnd":0,"redirectStart":0,"requestStart":2425.5,"responseEnd":2703.699999809265,"responseStart":2703.699999809265,"secureConnectionStart":2425.5}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":176,"responseStart":389,"responseEnd":508,"domLoading":393,"domInteractive":2640,"domContentLoadedEventStart":2640,"domContentLoadedEventEnd":2733,"domComplete":3757,"loadEventStart":3757,"loadEventEnd":3758,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":2587.699999809265},{"name":"bigPipe.sidebar-id.end","time":2588.6000003814697},{"name":"bigPipe.activity-panel-pipe-id.start","time":2588.800000190735},{"name":"bigPipe.activity-panel-pipe-id.end","time":2592.4000005722046},{"name":"activityTabFullyLoaded","time":2754}],"measures":[],"correlationId":"59bbe0f1a3c82b","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":147,"dbReadsTimeInMs":34,"dbConnsTimeInMs":44,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}