Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-37648

Server crash at Item_direct_view_ref::val_decimal

    XMLWordPrintable

Details

    • Bug
    • Status: Confirmed (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.11, 11.4, 11.8, 12.1, 12.1.1
    • 10.11, 11.4, 11.8, 12.1
    • Optimizer, Server
    • Ubuntu 20.04 x86-64, docker image mariadb:12.1.1

    Description

      PoC:

      SELECT ( WITH x ( x ) AS ( SELECT 1 FROM ( SELECT -1 ) x ) SELECT * FROM x WHERE x / x IN ( SELECT * FROM ( WITH x ( x ) AS ( SELECT 1 ) SELECT instr ( x , x ) FROM x GROUP BY x ) x ) ) x;
      

      docker log:

      #0 0x60f10b29ee31 (_ZN20Item_direct_view_ref11val_decimalEP10my_decimal+0x31)
      #1 0x60f10b0bbbb6 (_ZN4VDecC2EP4Item+0x46)
      #2 0x60f10b30c4df (_ZN13Item_func_div10decimal_opEP10my_decimal+0x5f)
      #3 0x60f10b0d48f7 (_ZNK27Type_handler_decimal_result39Item_func_hybrid_field_type_val_decimalEP27Item_func_hybrid_field_typeP10my_decimal+0x57)
      #4 0x60f10b0bbbb6 (_ZN4VDecC2EP4Item+0x46)
      #5 0x60f10af9aefc (_ZNK27Type_handler_decimal_result13Item_val_boolEP4Item+0x3c)
      #6 0x60f10ac01656 (_ZN9Item_func28is_simplified_cond_processorEPv+0x56)
      #7 0x60f10ac01055 (_ZN16Item_func_or_sum4walkEM4ItemFbPvES1_h+0x75)
      #8 0x60f10b039c6b (_Z36and_new_conditions_to_optimized_condP3THDP4ItemPP10COND_EQUALR4ListIS1_EPNS1_11cond_resultE+0xa5b)
      #9 0x60f10ae0d839 (_ZN4JOIN14optimize_innerEv+0x2589)
      #10 0x60f10adfef8b (_ZN4JOIN8optimizeEv+0x13b)
      #11 0x60f10ad102bb (_ZL22mysql_derived_optimizeP3THDP3LEXP10TABLE_LIST+0x56b)
      #12 0x60f10ad12418 (_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj+0x158)
      #13 0x60f10ae0d687 (_ZN4JOIN14optimize_innerEv+0x23d7)
      #14 0x60f10adfef8b (_ZN4JOIN8optimizeEv+0x13b)
      #15 0x60f10adf4c04 (_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x514)
      #16 0x60f10adf4635 (_Z13handle_selectP3THDP3LEXP13select_resulty+0x265)
      #17 0x60f10ad94fc8 (_ZL21execute_sqlcom_selectP3THDP10TABLE_LIST+0x698)
      #18 0x60f10ad8b095 (_Z21mysql_execute_commandP3THDb+0x3f65)
      #19 0x60f10ad80485 (_Z11mysql_parseP3THDPcjP12Parser_state+0x345)
      #20 0x60f10ad7c9d1 (_Z16dispatch_command19enum_server_commandP3THDPcjb+0x16b1)
      #21 0x60f10ad80cd1 (_Z10do_commandP3THDb+0x4b1)
      #22 0x60f10afb6b74 (_Z24do_handle_one_connectionP7CONNECTb+0x2a4)
      #23 0x60f10afb67a3 (handle_one_connection+0xd3)
      #24 0x60f10b67f0b4 (pfs_spawn_thread+0x104)
      #25 0x7c550f91b609 (start_thread+0xd9)
      #26 0x7c550f63d353 (clone+0x43)
      

      Attachments

        Issue Links

          Activity

            People

              Johnston Rex Johnston
              Yuxiao Guo Yuxiao Guo
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.