Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36854

LeakSanitizer errors in get_window_functions_required_cursors upon illegal use of INET6

    XMLWordPrintable

Details

    Description

      --source include/have_innodb.inc
       
      CREATE TABLE t (f INET6) ENGINE=InnoDB;
      INSERT INTO t VALUES ('::'),('::');
      --error ER_ILLEGAL_PARAMETER_DATA_TYPES2_FOR_OPERATION
      SELECT NTH_VALUE(f,f) OVER (), COUNT(*) OVER (PARTITION BY f) FROM t;
       
      DROP TABLE t;
      

      10.6 60f046d7e6b0a61f9b0762fe05c4021cff1b79d8

      ==311974==ERROR: LeakSanitizer: detected memory leaks
       
      Direct leak of 24 byte(s) in 1 object(s) allocated from:
          #0 0x7f5e3bcb94c8 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95
          #1 0x55e52031d4f8 in get_window_functions_required_cursors(THD*, List<Item_window_func>&, List<Cursor_manager>*) /data/bld/10.6-asan-ubsan/sql/sql_window.cc:2687
          #2 0x55e520321682 in Window_func_runner::exec(THD*, TABLE*, SORT_INFO*) /data/bld/10.6-asan-ubsan/sql/sql_window.cc:3042
          #3 0x55e520321c1f in Window_funcs_sort::exec(JOIN*, bool) /data/bld/10.6-asan-ubsan/sql/sql_window.cc:3075
          #4 0x55e520321f55 in Window_funcs_computation::exec(JOIN*, bool) /data/bld/10.6-asan-ubsan/sql/sql_window.cc:3202
          #5 0x55e51f8a8085 in AGGR_OP::end_send() /data/bld/10.6-asan-ubsan/sql/sql_select.cc:31557
          #6 0x55e51f8a9567 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/bld/10.6-asan-ubsan/sql/sql_select.cc:22081
          #7 0x55e51f839b9a in sub_select(JOIN*, st_join_table*, bool) /data/bld/10.6-asan-ubsan/sql/sql_select.cc:22334
          #8 0x55e51f8e2002 in do_select /data/bld/10.6-asan-ubsan/sql/sql_select.cc:21918
          #9 0x55e51f99bf7f in JOIN::exec_inner() /data/bld/10.6-asan-ubsan/sql/sql_select.cc:4939
          #10 0x55e51f99c6b1 in JOIN::exec() /data/bld/10.6-asan-ubsan/sql/sql_select.cc:4717
          #11 0x55e51f99303f in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/10.6-asan-ubsan/sql/sql_select.cc:5196
          #12 0x55e51f994229 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/bld/10.6-asan-ubsan/sql/sql_select.cc:573
          #13 0x55e51f68b0b1 in execute_sqlcom_select /data/bld/10.6-asan-ubsan/sql/sql_parse.cc:6422
          #14 0x55e51f6ceb3b in mysql_execute_command(THD*, bool) /data/bld/10.6-asan-ubsan/sql/sql_parse.cc:4013
          #15 0x55e51f6f0a55 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.6-asan-ubsan/sql/sql_parse.cc:8200
          #16 0x55e51f6f9d25 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.6-asan-ubsan/sql/sql_parse.cc:1908
          #17 0x55e51f706977 in do_command(THD*, bool) /data/bld/10.6-asan-ubsan/sql/sql_parse.cc:1421
          #18 0x55e51fe88a11 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.6-asan-ubsan/sql/sql_connect.cc:1386
          #19 0x55e51fe89b6e in handle_one_connection /data/bld/10.6-asan-ubsan/sql/sql_connect.cc:1298
          #20 0x55e5218b48b8 in pfs_spawn_thread /data/bld/10.6-asan-ubsan/storage/perfschema/pfs.cc:2201
          #21 0x7f5e3b2a81c3 in start_thread nptl/pthread_create.c:442
       
      SUMMARY: AddressSanitizer: 24 byte(s) leaked in 1 allocation(s).
      250521 18:38:15 [ERROR] /share8t/bld/10.6-asan-ubsan/sql/mariadbd got signal 6 ;
      Sorry, we probably made a mistake, and this is a bug.
       
      Your assistance in bug reporting will enable us to fix this for the next release.
      To report this bug, see https://mariadb.com/kb/en/reporting-bugs about how to report
      a bug on https://jira.mariadb.org/.
       
      Please include the information from the server start above, to the end of the
      information below.
       
      Server version: 10.6.22-MariaDB-asan-debug-log source revision: 60f046d7e6b0a61f9b0762fe05c4021cff1b79d8
       
      The information page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/
      contains instructions to obtain a better version of the backtrace below.
      Following these instructions will help MariaDB developers provide a fix quicker.
       
      Attempting backtrace. Include this in the bug report.
      (note: Retrieving this information may fail)
       
      Thread pointer: 0x0
      stack_bottom = 0x0 thread_stack 0xb00000
      sanitizer_common/sanitizer_common_interceptors.inc:4277(__interceptor_backtrace.part.0)[0x7f5e3bc51f31]
      mysys/stacktrace.c:215(my_print_stacktrace)[0x55e522afa36f]
      sql/signal_handler.cc:227(handle_fatal_signal)[0x55e520887349]
      libc_sigaction.c:0(__restore_rt)[0x7f5e3b25b050]
      nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7f5e3b2a9ebc]
      posix/raise.c:27(__GI_raise)[0x7f5e3b25afb2]
      stdlib/abort.c:81(__GI_abort)[0x7f5e3b245472]
      sanitizer_common/sanitizer_posix_libcdep.cpp:137(__sanitizer::Abort())[0x7f5e3bcd650f]
      sanitizer_common/sanitizer_termination.cpp:59(__sanitizer::Die())[0x7f5e3bce2ba1]
      lsan/lsan_common_linux.cpp:120(__lsan::HandleLeaks())[0x7f5e3bcea87c]
      lsan/lsan_common.cpp:732(__lsan::DoLeakCheck())[0x7f5e3bce8dc5]
      stdlib/cxa_finalize.c:84(__cxa_finalize)[0x7f5e3b25cff7]
      crtstuff.c:0(__do_global_dtors_aux)[0x7f5e3bc24bc7]
      Writing a core file...
      Working directory at /dev/shm/var_auto_gjjx/mysqld.1/data
      Resource Limits (excludes unlimited resources):
      Limit                     Soft Limit           Hard Limit           Units     
      Max stack size            8388608              unlimited            bytes     
      Max processes             514196               514196               processes 
      Max open files            65536                65536                files     
      Max locked memory         16854077440          16854077440          bytes     
      Max pending signals       514196               514196               signals   
      Max msgqueue size         819200               819200               bytes     
      Max nice priority         0                    0                    
      Max realtime priority     0                    0                    
      Core pattern: core
       
      Kernel version: Linux version 6.1.0-27-amd64 (debian-kernel@lists.debian.org) (gcc-12 (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC Debian 6.1.115-1 (2024-11-01)
      

      The failure started happening after this commit in 10.5.28:

      commit 0b7fa4c267cb7eee4a84a696170266f10397f266
      Author: Alexander Barkov
      Date:   Fri Nov 29 21:03:16 2024 +0400
       
          MDEV-31219 Assertion `fixed' failed in Item_func_hybrid_field_type / Frame_positional_cursor
      

      Attachments

        Issue Links

          Activity

            People

              bar Alexander Barkov
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.