Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
12.1, 12.2
-
Can result in hang or crash
-
Fix a scenario where SELECT statements with GROUP BY a virtual column expression and HAVING a condition involving the same expression could cause crash
-
Q4/2025 Server Maintenance
Description
CREATE TABLE t (a INT,a1 INT AS (a) VIRTUAL,INDEX (a1)); |
SELECT a FROM t WHERE a=(SELECT a FROM t GROUP BY a HAVING a=2); |
Leads to:
CS 12.2.0 e02f4d7e311e214ea62ff2e59599849e229f4165 (Debug, Clang) Build 07/08/2025 |
mariadbd: /test/12.2_dbg/sql/item.cc:6415: virtual bool Item_field::fix_fields(THD *, Item **): Assertion `field' failed.
|
CS 12.2.0 e02f4d7e311e214ea62ff2e59599849e229f4165 (Debug, Clang) Build 07/08/2025 |
Core was generated by `/test/MD070825-mariadb-12.2.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
|
Program terminated with signal SIGABRT, Aborted.
|
Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c.
|
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
 |
[Current thread is 1 (LWP 1502333)]
|
(gdb) bt
|
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
|
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
|
#3 0x000073f4cfa4527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
|
#4 0x000073f4cfa288ff in __GI_abort () at ./stdlib/abort.c:79
|
#5 0x000073f4cfa2881b in __assert_fail_base (fmt=0x73f4cfbd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5e5f3c732ca0 "field", file=file@entry=0x5e5f3c7532c5 "/test/12.2_dbg/sql/item.cc", line=line@entry=6415, function=function@entry=0x5e5f3c754f2c "virtual bool Item_field::fix_fields(THD *, Item **)") at ./assert/assert.c:96
|
#6 0x000073f4cfa3b517 in __assert_fail (assertion=0x5e5f3c732ca0 "field", file=0x5e5f3c7532c5 "/test/12.2_dbg/sql/item.cc", line=6415, function=0x5e5f3c754f2c "virtual bool Item_field::fix_fields(THD *, Item **)") at ./assert/assert.c:105
|
#7 0x00005e5f3baa8983 in Item_field::fix_fields (this=0x73d9bc01ee40, thd=0x73d9bc000d58, reference=0x73d9bc01eff0)at /test/12.2_dbg/sql/item.cc:6415
|
#8 0x00005e5f3b4f2a6a in Item::fix_fields_if_needed (this=0x73d9bc01ee40, thd=0x73d9bc000d58, ref=0x73d9bc01eff0) at /test/12.2_dbg/sql/item.h:1143
|
#9 0x00005e5f3bb13932 in Item_func::fix_fields (this=0x73d9bc01ef68, thd=0x73d9bc000d58, ref=0x0) at /test/12.2_dbg/sql/item_func.cc:394
|
#10 0x00005e5f3b60d66e in st_select_lex::pushdown_from_having_into_where (this=0x73d9bc01ae28, thd=0x73d9bc000d58, having=0x0)at /test/12.2_dbg/sql/sql_lex.cc:12447
|
#11 0x00005e5f3b6aa0e4 in JOIN::optimize_inner (this=0x73d9bc01e178)at /test/12.2_dbg/sql/sql_select.cc:2495
|
#12 0x00005e5f3b6a6348 in JOIN::optimize (this=0x73d9bc01e178)at /test/12.2_dbg/sql/sql_select.cc:2023
|
#13 0x00005e5f3b5f0e4e in st_select_lex::optimize_unflattened_subqueries (this=0x73d9bc019f58, const_only=true) at /test/12.2_dbg/sql/sql_lex.cc:5075
|
#14 0x00005e5f3b8987c7 in JOIN::optimize_constant_subqueries (this=0x73d9bc01d7b0) at /test/12.2_dbg/sql/opt_subselect.cc:5941
|
#15 0x00005e5f3b6a954a in JOIN::optimize_inner (this=0x73d9bc01d7b0)at /test/12.2_dbg/sql/sql_select.cc:2378
|
#16 0x00005e5f3b6a6348 in JOIN::optimize (this=0x73d9bc01d7b0)at /test/12.2_dbg/sql/sql_select.cc:2023
|
#17 0x00005e5f3b69df99 in mysql_select (thd=0x73d9bc000d58, tables=0x73d9bc01a5b0, fields=@0x73d9bc01a210: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x73d9bc01a560, last = 0x73d9bc01a560, elements = 1}, <No data fields>}, conds=0x73d9bc01cb88, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x73d9bc01d788, unit=0x73d9bc005158, select_lex=0x73d9bc019f58)at /test/12.2_dbg/sql/sql_select.cc:5388
|
#18 0x00005e5f3b69dad5 in handle_select (thd=0x73d9bc000d58, lex=0x73d9bc005078, result=0x73d9bc01d788, setup_tables_done_option=0)at /test/12.2_dbg/sql/sql_select.cc:634
|
#19 0x00005e5f3b645611 in execute_sqlcom_select (thd=0x73d9bc000d58, all_tables=0x73d9bc01a5b0) at /test/12.2_dbg/sql/sql_parse.cc:6167
|
#20 0x00005e5f3b63a39e in mysql_execute_command (thd=0x73d9bc000d58, is_called_from_prepared_stmt=false) at /test/12.2_dbg/sql/sql_parse.cc:3950
|
#21 0x00005e5f3b632664 in mysql_parse (thd=0x73d9bc000d58, rawbuf=0x73d9bc019e80 "SELECT a FROM t WHERE a=(SELECT a FROM t GROUP BY a HAVING a=2)", length=63, parser_state=0x73f4cc127a10)at /test/12.2_dbg/sql/sql_parse.cc:7883
|
#22 0x00005e5f3b62fa38 in dispatch_command (command=COM_QUERY, thd=0x73d9bc000d58, packet=0x73d9bc00b1f9 "SELECT a FROM t WHERE a=(SELECT a FROM t GROUP BY a HAVING a=2)", packet_length=63, blocking=true)at /test/12.2_dbg/sql/sql_parse.cc:1878
|
#23 0x00005e5f3b633213 in do_command (thd=0x73d9bc000d58, blocking=true)at /test/12.2_dbg/sql/sql_parse.cc:1417
|
#24 0x00005e5f3b8204b9 in do_handle_one_connection (connect=0x5e5f65737038, put_in_cache=true) at /test/12.2_dbg/sql/sql_connect.cc:1414
|
#25 0x00005e5f3b82025e in handle_one_connection (arg=0x5e5f6566b3a8)at /test/12.2_dbg/sql/sql_connect.cc:1326
|
#26 0x000073f4cfa9caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#27 0x000073f4cfb29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 040825 317f099ca56130a14a45b7250996c207cc95d461 No bug found
|
CS 10.6 opt 040825 317f099ca56130a14a45b7250996c207cc95d461 No bug found
|
CS 10.11 dbg 040825 55a39f13e40807c3c8fee4573380f3e4d93e8715 No bug found
|
CS 10.11 opt 040825 55a39f13e40807c3c8fee4573380f3e4d93e8715 No bug found
|
CS 11.4 dbg 040825 4e9c252bc4bfef525ff8ec4a37fabd957694285d No bug found
|
CS 11.4 opt 040825 4e9c252bc4bfef525ff8ec4a37fabd957694285d No bug found
|
CS 11.8 dbg 130825 1a446ccc48528e88a3cd6cd1d1ec9e7492d342ca No bug found
|
CS 11.8 opt 130825 1a446ccc48528e88a3cd6cd1d1ec9e7492d342ca No bug found
|
CS 12.1 dbg 100725 891108ed665cbcf882454caa16ec2565ed36e337 No bug found
|
CS 12.1 dbg 130825 033471a367b4c60b7262e64f43f46b02e95b9d74 field|SIGABRT|Item_field::fix_fields|Item::fix_fields_if_needed|Item_func::fix_fields|st_select_lex::pushdown_from_having_into_where
|
CS 12.1 opt 130825 033471a367b4c60b7262e64f43f46b02e95b9d74 SIGSEGV|Item_field::fix_fields|Item::fix_fields_if_needed|Item_func::fix_fields|st_select_lex::pushdown_from_having_into_where
|
CS 12.2 dbg 130825 e02f4d7e311e214ea62ff2e59599849e229f4165 field|SIGABRT|Item_field::fix_fields|Item::fix_fields_if_needed|Item_func::fix_fields|st_select_lex::pushdown_from_having_into_where
|
CS 12.2 opt 130825 e02f4d7e311e214ea62ff2e59599849e229f4165 SIGSEGV|Item_field::fix_fields|Item::fix_fields_if_needed|Item_func::fix_fields|st_select_lex::pushdown_from_having_into_where
|
ES 10.5 dbg 040825 70586522eacf09d04d49962072e14325a75d8155 No bug found
|
ES 10.5 opt 040825 70586522eacf09d04d49962072e14325a75d8155 No bug found
|
ES 10.6 dbg 040825 9b794f34b48fb7eee490b6da44edc0f33a947447 No bug found
|
ES 10.6 opt 040825 9b794f34b48fb7eee490b6da44edc0f33a947447 No bug found
|
ES 11.4 dbg 040825 a1c03ccd54b582e75506687ee19b273ca897f261 No bug found
|
ES 11.4 opt 040825 a1c03ccd54b582e75506687ee19b273ca897f261 No bug found
|
The assertion happens after this commit
commit 8cdee25952763a0401e4c2a4d61e92c13499bdc6
|
Author: Yuchen Pei <ycp@mariadb.com>
|
Date: Wed Jun 4 11:43:30 2025 +1000
|
 |
MDEV-36132 Substitute vcol expressions with indexed vcol fields in ORDER BY and GROUP BY
|
|
Also expand vcol field index coverings to include indexes covering all
|
the fields in the expression. The reasoning goes as follows: let f(c1,
|
c2, ..., cn) be a function on applied to columns c1, c2, ..., cn, if
|
f(...) is covered by an index, so should vc whose expression is
|
f(...).
|
|
For example, if t.vf = t.c1 + t.c2, and t has three indexes (vf), (c1,
|
c2), (c1).
|
[..]
|
No UB/ASAN issues observed.
Attachments
Issue Links
- is caused by
-
MDEV-36132 Optimizer support for functional indexes: handle GROUP/ORDER BY
-
- Closed
-