UBSAN load of null pointer and Assertion `b == &type_handler_row || b == &type_handler_null' in Arg_comparator::set_cmp_func when using ROW()

CREATE FUNCTION f() RETURNS ROW TYPE OF t RETURN 1;

CREATE TABLE t (a INT);

SELECT ROW(f(),1)=ROW(1,1) AS eq;

Core was generated by `/test/MD070525-mariadb-12.0.1-linux-x86_64-opt/bin/mariadbd --no-defaults --max'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x00005b5e52c70d91 in Arg_comparator::set_cmp_func (this=<error reading variable: Incompatible types on DWARF stack>, thd=0x70f1a4000c68, owner_arg=0x70f1a4018ca0, a1=0x70f1a4017fe0, a2=0x0, set_null_arg=true) at /test/12.0_opt/sql/item_cmpfunc.h:105

[Current thread is 1 (LWP 1263292)]

(gdb) bt

#0  0x00005b5e52c70d91 in Arg_comparator::set_cmp_func (this=<error reading variable: Incompatible types on DWARF stack>, thd=0x70f1a4000c68, owner_arg=0x70f1a4018ca0, a1=0x70f1a4017fe0, a2=0x0, set_null_arg=true) at /test/12.0_opt/sql/item_cmpfunc.h:105

#1  Arg_comparator::set_cmp_func_for_row_arguments (this=0x70f1a401b848, thd=0x70f1a4000c68) at /test/12.0_opt/sql/item_cmpfunc.cc:582

#2  0x00005b5e52c70e17 in Arg_comparator::set_cmp_func (this=0x70f1a401b848, thd=0x70f1a4000c68, owner_arg=0x70f1a4018ca0, compare_handler=0x70f1a4018ab0, a1=0x70f1a4018a70, a2=0x70f1a4018c68)at /test/12.0_opt/sql/item_cmpfunc.cc:560

#3  Arg_comparator::set_cmp_func (this=0x70f1a401b848, thd=0x70f1a4000c68, owner_arg=0x70f1a4018ca0, compare_handler=0x70f1a4018ab0, a1=0x70f1a4018a70, a2=0x70f1a4018c68, set_null_arg=true)at /test/12.0_opt/sql/item_cmpfunc.h:100

#4  Arg_comparator::set_cmp_func (this=0x70f1a401b848, thd=0x70f1a4000c68, owner_arg=0x70f1a4018ca0, a1=0x70f1a4018a70, a2=0x70f1a4018c68, set_null_arg=true) at /test/12.0_opt/sql/item_cmpfunc.h:110

#5  Arg_comparator::set_cmp_func_for_row_arguments (this=0x70f1a4018d58, thd=0x70f1a4000c68) at /test/12.0_opt/sql/item_cmpfunc.cc:582

#6  0x00005b5e52c70b9a in Arg_comparator::set_cmp_func (this=0x70f1a401b720, thd=0x0, owner_arg=<optimized out>, compare_handler=0x70f1a4017fe0, a1=<optimized out>, a2=0x70f1a4018d28)at /test/12.0_opt/sql/item_cmpfunc.cc:560

#7  0x00005b5e52b7f398 in Arg_comparator::set_cmp_func (this=0x70f1a4018ab0, thd=0x0, owner_arg=0x5b5e53c33d38 <type_handler_null>, compare_handler=0x70f1a4017fe0, a1=0x70f1a401bba6, a2=0x70f1a4018d28, set_null_arg=true) at /test/12.0_opt/sql/item_cmpfunc.h:100

#8  Item_bool_rowready_func2::fix_length_and_dec_generic (this=0x5b5e53c33d38 <type_handler_null>, thd=0x0, compare_handler=0x70f1a4017fe0) at /test/12.0_opt/sql/item_cmpfunc.h:619

#9  Type_handler::Item_bool_rowready_func2_fix_length_and_dec (this=0x70f1a4017fe0, thd=0x0, func=0x5b5e53c33d38 <type_handler_null>)at /test/12.0_opt/sql/sql_type.cc:5867

#10 0x00005b5e52c70b1c in Item_bool_rowready_func2::fix_length_and_dec (this=0x70f1a4018ca0, thd=0x70f1a4000c68)at /test/12.0_opt/sql/item_cmpfunc.cc:527

#11 0x00005b5e52ca5888 in Item_func::fix_fields (this=0x70f1a4018ca0, thd=0x70f1a4000c68, ref=<optimized out>)at /test/12.0_opt/sql/item_func.cc:380

#12 0x00005b5e529504a5 in Item::fix_fields_if_needed (this=0x70f1a4018ca0, thd=0x70f1a4000c68, ref=0x70f1a4018ee0) at /test/12.0_opt/sql/item.h:1113

#13 Item::fix_fields_if_needed_for_scalar (this=0x70f1a4018ca0, thd=0x70f1a4000c68, ref=0x70f1a4018ee0) at /test/12.0_opt/sql/item.h:1122

#14 setup_fields (thd=0x70f1a4000c68, ref_pointer_array={m_array = 0x70f1a401a258, m_size = 9}, fields=<optimized out>, column_usage=<optimized out>, sum_func_list=sum_func_list@entry=0x70f1a4019e40, pre_fix=0x70f1a4017a50, allow_sum_func=<optimized out>, where=THD_WHERE::DEFAULT_WHERE)at /test/12.0_opt/sql/sql_base.cc:8120

#15 0x00005b5e529fcb8e in JOIN::prepare (this=this@entry=0x70f1a4019aa0, tables_init=tables_init@entry=0x0, conds_init=conds_init@entry=0x0, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x70f1a4017780, unit_arg=0x70f1a4005080)at /test/12.0_opt/sql/sql_select.cc:1584

#16 0x00005b5e529f8e01 in mysql_select (thd=thd@entry=0x70f1a4000c68, tables=0x0, fields=@0x70f1a4017a38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x70f1a4018ed8, last = 0x70f1a4018ed8, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x70f1a4019a78, unit=0x70f1a4005080, select_lex=0x70f1a4017780)at /test/12.0_opt/sql/sql_select.cc:5365

#17 0x00005b5e529f8bb9 in handle_select (thd=thd@entry=0x70f1a4000c68, lex=lex@entry=0x70f1a4004fa0, result=result@entry=0x70f1a4019a78, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/12.0_opt/sql/sql_select.cc:634

#18 0x00005b5e529c617e in execute_sqlcom_select (thd=thd@entry=0x70f1a4000c68, all_tables=0x0) at /test/12.0_opt/sql/sql_parse.cc:6166

#19 0x00005b5e529c4667 in mysql_execute_command (thd=thd@entry=0x70f1a4000c68, is_called_from_prepared_stmt=false) at /test/12.0_opt/sql/sql_parse.cc:3954

#20 0x00005b5e529bcf61 in mysql_parse (thd=thd@entry=0x70f1a4000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7110909fe420)at /test/12.0_opt/sql/sql_parse.cc:7891

#21 0x00005b5e529bb47f in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x70f1a4000c68, packet=packet@entry=0x70f1a4008a59 "SELECT ROW(f(),1)=ROW(1,1) AS eq", packet_length=packet_length@entry=32, blocking=true)at /test/12.0_opt/sql/sql_parse.cc:1877

#22 0x00005b5e529bd371 in do_command (thd=thd@entry=0x70f1a4000c68, blocking=true) at /test/12.0_opt/sql/sql_parse.cc:1416

#23 0x00005b5e52ae9e9d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5b5e8ee7ba08, put_in_cache=true)at /test/12.0_opt/sql/sql_connect.cc:1414

#24 0x00005b5e52ae9c5f in handle_one_connection (arg=arg@entry=0x5b5e8ee7ba08)at /test/12.0_opt/sql/sql_connect.cc:1326

#25 0x00005b5e52e873d9 in pfs_spawn_thread (arg=0x5b5e8ee28368)at /test/12.0_opt/storage/perfschema/pfs.cc:2198

#26 0x000071109949caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#27 0x0000711099529c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

mariadbd: /test/12.0_dbg/sql/sql_type.cc:240: virtual const Type_handler *Type_collection_row::aggregate_for_comparison(const Type_handler *, const Type_handler *) const: Assertion `b == &type_handler_row || b == &type_handler_null' failed.

Core was generated by `/test/MD070525-mariadb-12.0.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.

Program terminated with signal SIGABRT, Aborted.

Download failed: Invalid argument.  Continuing without source file ./nptl/./nptl/pthread_kill.c.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 1263196)]

(gdb) bt

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

#1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78

#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89

#3  0x0000737db564527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26

#4  0x0000737db56288ff in __GI_abort () at ./stdlib/abort.c:79

#5  0x0000737db562881b in __assert_fail_base (fmt=0x737db57d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x62e8a8ead240 "b == &type_handler_row || b == &type_handler_null", file=file@entry=0x62e8a8ea801a "/test/12.0_dbg/sql/sql_type.cc", line=line@entry=240, function=function@entry=0x62e8a8ead1c4 "virtual const Type_handler *Type_collection_row::aggregate_for_comparison(const Type_handler *, const Type_handler *) const") at ./assert/assert.c:96

#6  0x0000737db563b517 in __assert_fail (assertion=0x62e8a8ead240 "b == &type_handler_row || b == &type_handler_null", file=0x62e8a8ea801a "/test/12.0_dbg/sql/sql_type.cc", line=240, function=0x62e8a8ead1c4 "virtual const Type_handler *Type_collection_row::aggregate_for_comparison(const Type_handler *, const Type_handler *) const")at ./assert/assert.c:105

#7  0x000062e8a80f8ead in Type_collection_row::aggregate_for_comparison (this=0x62e8a97f7f18 <type_collection_row>, a=0x62e8a9a4f750 <type_handler_row>, b=0x62e8a9a4f810 <type_handler_slonglong>)at /test/12.0_dbg/sql/sql_type.cc:240

#8  0x000062e8a80cfbae in Type_handler_hybrid_field_type::aggregate_for_comparison (this=0x737dae6b9fd8, h=0x62e8a9a4f810 <type_handler_slonglong>)at /test/12.0_dbg/sql/sql_type.cc:1957

#9  0x000062e8a828556c in Type_handler_hybrid_field_type::aggregate_for_comparison (this=0x737dae6b9fd8, funcname=@0x737dae6b9fc8: {str = 0x62e8a8eb3106 "=", length = 1}, items=0x737dae6b9fe0, nitems=2, int_uint_as_dec=false)at /test/12.0_dbg/sql/item_cmpfunc.cc:107

#10 0x000062e8a7ed795c in Arg_comparator::set_cmp_func (this=0x73629801e380, thd=0x736298000d58, owner_arg=0x73629801b628, a1=0x73629801b3f8, a2=0x73629801b5f0, set_null_arg=true)at /test/12.0_dbg/sql/item_cmpfunc.h:107

#11 0x000062e8a8287000 in Arg_comparator::set_cmp_func_for_row_arguments (this=0x73629801b6e0, thd=0x736298000d58)at /test/12.0_dbg/sql/item_cmpfunc.cc:582

#12 0x000062e8a828709c in Arg_comparator::set_cmp_func_row (this=0x73629801b6e0, thd=0x736298000d58)at /test/12.0_dbg/sql/item_cmpfunc.cc:594

#13 0x000062e8a80d9061 in Type_handler_row::set_comparator_func (this=0x62e8a9a4f750 <type_handler_row>, thd=0x736298000d58, cmp=0x73629801b6e0) at /test/12.0_dbg/sql/sql_type.cc:4468

#14 0x000062e8a8286c3e in Arg_comparator::set_cmp_func (this=0x73629801b6e0, thd=0x736298000d58, owner_arg=0x73629801b628, compare_handler=0x62e8a9a4f750 <type_handler_row>, a1=0x73629801b6a8, a2=0x73629801b6b0) at /test/12.0_dbg/sql/item_cmpfunc.cc:560

#15 0x000062e8a7ed7a1d in Arg_comparator::set_cmp_func (this=0x73629801b6e0, thd=0x736298000d58, owner_arg=0x73629801b628, compare_handler=0x62e8a9a4f750 <type_handler_row>, a1=0x73629801b6a8, a2=0x73629801b6b0, set_null_arg=true)at /test/12.0_dbg/sql/item_cmpfunc.h:100

#16 0x000062e8a80f3905 in Item_bool_rowready_func2::fix_length_and_dec_generic(this=0x73629801b628, thd=0x736298000d58, compare_handler=0x62e8a9a4f750 <type_handler_row>)at /test/12.0_dbg/sql/item_cmpfunc.h:619

#17 0x000062e8a80dd1d5 in Type_handler::Item_bool_rowready_func2_fix_length_and_dec (this=0x62e8a9a4f750 <type_handler_row>, thd=0x736298000d58, func=0x73629801b628) at /test/12.0_dbg/sql/sql_type.cc:5867

#18 0x000062e8a8286ade in Item_bool_rowready_func2::fix_length_and_dec (this=0x73629801b628, thd=0x736298000d58)at /test/12.0_dbg/sql/item_cmpfunc.cc:527

#19 0x000062e8a82cf503 in Item_func::fix_fields (this=0x73629801b628, thd=0x736298000d58, ref=0x73629801b868)at /test/12.0_dbg/sql/item_func.cc:380

#20 0x000062e8a7cbe82a in Item::fix_fields_if_needed (this=0x73629801b628, thd=0x736298000d58, ref=0x73629801b868) at /test/12.0_dbg/sql/item.h:1113

#21 0x000062e8a7cbd779 in Item::fix_fields_if_needed_for_scalar (this=0x73629801b628, thd=0x736298000d58, ref=0x73629801b868)at /test/12.0_dbg/sql/item.h:1122

#22 0x000062e8a7d45b21 in setup_fields (thd=0x736298000d58, ref_pointer_array={m_array = 0x73629801cbf0, m_size = 9}, fields=@0x73629801a238: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x73629801b860, last = 0x73629801b860, elements = 1}, <No data fields>}, column_usage=MARK_COLUMNS_READ, sum_func_list=0x73629801c7d0, pre_fix=0x73629801a250, allow_sum_func=true, where=THD_WHERE::DEFAULT_WHERE) at /test/12.0_dbg/sql/sql_base.cc:8120

#23 0x000062e8a7e6f84a in JOIN::prepare (this=0x73629801c428, tables_init=0x0, conds_init=0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x736298019f80, unit_arg=0x736298005148)at /test/12.0_dbg/sql/sql_select.cc:1584

#24 0x000062e8a7e6b1c9 in mysql_select (thd=0x736298000d58, tables=0x0, fields=@0x73629801a238: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x73629801b860, last = 0x73629801b860, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x73629801c400, unit=0x736298005148, select_lex=0x736298019f80) at /test/12.0_dbg/sql/sql_select.cc:5365

#25 0x000062e8a7e6ad55 in handle_select (thd=0x736298000d58, lex=0x736298005068, result=0x73629801c400, setup_tables_done_option=0)at /test/12.0_dbg/sql/sql_select.cc:634

#26 0x000062e8a7e12a61 in execute_sqlcom_select (thd=0x736298000d58, all_tables=0x0) at /test/12.0_dbg/sql/sql_parse.cc:6166

#27 0x000062e8a7e078ae in mysql_execute_command (thd=0x736298000d58, is_called_from_prepared_stmt=false) at /test/12.0_dbg/sql/sql_parse.cc:3954

#28 0x000062e8a7dffb34 in mysql_parse (thd=0x736298000d58, rawbuf=0x736298019ee0 "SELECT ROW(f(),1)=ROW(1,1) AS eq", length=32, parser_state=0x737dae6bca10) at /test/12.0_dbg/sql/sql_parse.cc:7891

#29 0x000062e8a7dfcf08 in dispatch_command (command=COM_QUERY, thd=0x736298000d58, packet=0x73629800b259 "SELECT ROW(f(),1)=ROW(1,1) AS eq", packet_length=32, blocking=true) at /test/12.0_dbg/sql/sql_parse.cc:1877

#30 0x000062e8a7e006e3 in do_command (thd=0x736298000d58, blocking=true)at /test/12.0_dbg/sql/sql_parse.cc:1416

#31 0x000062e8a7febbd9 in do_handle_one_connection (connect=0x62e8addf1008, put_in_cache=true) at /test/12.0_dbg/sql/sql_connect.cc:1414

#32 0x000062e8a7feb97e in handle_one_connection (arg=0x62e8aded5eb8)at /test/12.0_dbg/sql/sql_connect.cc:1326

#33 0x0000737db569caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#34 0x0000737db5729c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

    Rel    o/d  Build   Commit                                    UniqueID observed             

CS  10.6   dbg  080825  13f337ce1f295f4aac75db681e00c71f2bf8acaf  No bug found                  

CS  10.6   opt  080825  13f337ce1f295f4aac75db681e00c71f2bf8acaf  No bug found                  

CS  10.11  dbg  080825  c45a34b2fb10e4e8f768e7e5fe846e9592eb6ea8  No bug found                  

CS  10.11  opt  080825  c45a34b2fb10e4e8f768e7e5fe846e9592eb6ea8  No bug found                  

CS  11.4   dbg  080825  03b31c0bd99390c1984f19a19f22dd6e77b7692e  No bug found                  

CS  11.4   opt  080825  03b31c0bd99390c1984f19a19f22dd6e77b7692e  No bug found                  

CS  11.8   dbg  080825  1a446ccc48528e88a3cd6cd1d1ec9e7492d342ca  b == &type_handler_row|SIGABRT|Type_collection_row::aggregate_for_comparison|Type_handler_hybrid_field_type::aggregate_for_comparison|Type_handler_hybrid_field_type::aggregate_for_comparison|Arg_comparator::set_cmp_func

CS  11.8   opt  080825  1a446ccc48528e88a3cd6cd1d1ec9e7492d342ca  SIGSEGV|Arg_comparator::set_cmp_func|Arg_comparator::set_cmp_func_for_row_arguments|Arg_comparator::set_cmp_func|Arg_comparator::set_cmp_func

CS  12.1   dbg  080825  033471a367b4c60b7262e64f43f46b02e95b9d74  b == &type_handler_row || b == &type_handler_null|SIGABRT|Type_collection_row::aggregate_for_comparison|Type_handler_hybrid_field_type::aggregate_for_comparison|Type_handler_hybrid_field_type::aggregate_for_comparison|Arg_comparator::set_cmp_func

CS  12.1   opt  080825  033471a367b4c60b7262e64f43f46b02e95b9d74  SIGSEGV|Arg_comparator::set_cmp_func|Arg_comparator::set_cmp_func_for_row_arguments|Arg_comparator::set_cmp_func|Arg_comparator::set_cmp_func

CS  12.2   dbg  080825  e02f4d7e311e214ea62ff2e59599849e229f4165  b == &type_handler_row || b == &type_handler_null|SIGABRT|Type_collection_row::aggregate_for_comparison|Type_handler_hybrid_field_type::aggregate_for_comparison|Type_handler_hybrid_field_type::aggregate_for_comparison|Arg_comparator::set_cmp_func

CS  12.2   opt  080825  e02f4d7e311e214ea62ff2e59599849e229f4165  SIGSEGV|Arg_comparator::set_cmp_func|Arg_comparator::set_cmp_func_for_row_arguments|Arg_comparator::set_cmp_func|Arg_comparator::set_cmp_func

ES  10.5   dbg  080825  70586522eacf09d04d49962072e14325a75d8155  No bug found                  

ES  10.5   opt  080825  70586522eacf09d04d49962072e14325a75d8155  No bug found                  

ES  10.6   dbg  080825  9b794f34b48fb7eee490b6da44edc0f33a947447  No bug found                  

ES  10.6   opt  080825  9b794f34b48fb7eee490b6da44edc0f33a947447  No bug found                  

ES  11.4   dbg  080825  a1c03ccd54b582e75506687ee19b273ca897f261  No bug found                  

ES  11.4   opt  080825  a1c03ccd54b582e75506687ee19b273ca897f261  No bug found                  

ES  11.8   dbg  080825  4cdf75ab6ba37d4e7e208690785e880ed3176f2f  b == &type_handler_row|SIGABRT|Type_collection_row::aggregate_for_comparison|Type_handler_hybrid_field_type::aggregate_for_comparison|Type_handler_hybrid_field_type::aggregate_for_comparison|Arg_comparator::set_cmp_func

ES  11.8   opt  080825  4cdf75ab6ba37d4e7e208690785e880ed3176f2f  SIGSEGV|Arg_comparator::set_cmp_func|Arg_comparator::set_cmp_func_for_row_arguments|Arg_comparator::set_cmp_func|Arg_comparator::set_cmp_func

MS  5.5    dbg  070123  bac287c315b1792e7ae33f91add6a60292f9bae8  No bug found                  

MS  5.5    opt  070123  bac287c315b1792e7ae33f91add6a60292f9bae8  No bug found                  

MS  5.6    dbg  070123  dab95781a1244104d6b87020ac2fc4d190ba2946  No bug found                  

MS  5.6    opt  070123  dab95781a1244104d6b87020ac2fc4d190ba2946  No bug found                  

MS  5.7    dbg  070525  f7680e98b6bbe3500399fbad465d08a6b75d7a5c  No bug found                  

MS  5.7    opt  070525  f7680e98b6bbe3500399fbad465d08a6b75d7a5c  No bug found                  

MS  8.0    dbg  060224  49ef33f7edadef3ae04665e73d1babd40179a4f1  No bug found                  

MS  8.0    opt  060224  49ef33f7edadef3ae04665e73d1babd40179a4f1  No bug found                  

MS  9.1    dbg  211024  61a3a1d8ef15512396b4c2af46e922a19bf2b174  No bug found                  

MS  9.1    opt  211024  61a3a1d8ef15512396b4c2af46e922a19bf2b174  No bug found