Server crashes in Item_func_nextval::val_int upon update on a view

CREATE SEQUENCE s;

CREATE TABLE t (a INT DEFAULT(NEXTVAL(s)));

CREATE VIEW v AS SELECT * FROM t;

INSERT INTO t VALUES (1);

UPDATE v SET a = DEFAULT;

DROP VIEW v;

DROP TABLE t;

DROP SEQUENCE s;

#4  <signal handler called>

#5  0x000055f3d0c2b34e in Item_func_nextval::val_int (this=0x62500024d228) at /data/bld/10.11-asan-ubsan/sql/item_func.cc:7154

#6  0x000055f3d09a0b3d in Item::save_int_in_field (this=this@entry=0x62500024d228, field=field@entry=0x62d00005f128, no_conversions=no_conversions@entry=false) at /data/bld/10.11-asan-ubsan/sql/item.cc:7116

#7  0x000055f3d0182cc8 in Type_handler_int_result::Item_save_in_field (this=<optimized out>, item=0x62500024d228, field=0x62d00005f128, no_conversions=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/sql_type.cc:4433

#8  0x000055f3d0929d30 in Item::save_in_field (this=0x62500024d228, field=0x62d00005f128, no_conversions=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/item.cc:7136

#9  0x000055f3d0724a15 in Field::set_default (this=0x62d00005f128) at /data/bld/10.11-asan-ubsan/sql/field.cc:2695

#10 0x000055f3d09b6193 in Item_default_value::calculate (this=this@entry=0x62d00005adc0) at /data/bld/10.11-asan-ubsan/sql/item.cc:9898

#11 0x000055f3d09b7139 in Item_default_value::save_in_field (this=0x62d00005adc0, field_arg=0x62500024c188, no_conversions=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/item.cc:9947

#12 0x000055f3cf27ca2e in fill_record (thd=thd@entry=0x62c0000b0218, table_arg=table_arg@entry=0x61900005cd98, fields=..., values=..., ignore_errors=ignore_errors@entry=false, update=update@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_base.cc:9110

#13 0x000055f3cf27dedf in fill_record_n_invoke_before_triggers (thd=thd@entry=0x62c0000b0218, table=table@entry=0x61900005cd98, fields=..., values=..., ignore_errors=ignore_errors@entry=false, event=event@entry=TRG_EVENT_UPDATE) at /data/bld/10.11-asan-ubsan/sql/sql_base.cc:9279

#14 0x000055f3cfc0011b in mysql_update (thd=thd@entry=0x62c0000b0218, table_list=<optimized out>, fields=..., values=..., conds=conds@entry=0x0, order_num=order_num@entry=0, order=<optimized out>, limit=18446744073709551615, ignore=<optimized out>, found_return=<optimized out>, updated_return=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/sql_update.cc:1067

#15 0x000055f3cf5d64e5 in mysql_execute_command (thd=thd@entry=0x62c0000b0218, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:4505

#16 0x000055f3cf5f36b4 in mysql_parse (thd=thd@entry=0x62c0000b0218, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fc97ddbdab0) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:8223

#17 0x000055f3cf5fca61 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x62c0000b0218, packet=packet@entry=0x62900024e219 "UPDATE v SET a = DEFAULT", packet_length=packet_length@entry=24, blocking=blocking@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1924

#18 0x000055f3cf609766 in do_command (thd=thd@entry=0x62c0000b0218, blocking=blocking@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1434

#19 0x000055f3cfe05e88 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x6080000039b8, put_in_cache=put_in_cache@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1475

#20 0x000055f3cfe06fe5 in handle_one_connection (arg=0x6080000039b8) at /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1387

#21 0x000055f3d178ba7d in pfs_spawn_thread (arg=0x617000005b98) at /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201

#22 0x00007fc987ea81c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#23 0x00007fc987f2885c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

commit 7a88776dc1eb8edd43eb093be49325250df3fa95

Commit:     Aleksey Midenkov

CommitDate: Fri Jan 23 14:25:06 2026 +0300

    MDEV-28650 Server crashes in Item_func_nextval::val_int after select from view