Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11, 12.3, 13.0
-
Can result in unexpected behaviour
-
Q4/2026 Server Maintenance
Description
CREATE TABLE t1 (c1 INT) ENGINE=Aria; |
CREATE TABLE t5 (c1 INT) ENGINE=Aria PARTITION BY KEY (c1) PARTITIONS 2; |
LOCK TABLES t5 WRITE, t1 WRITE;
|
REPLACE INTO t5 SET c1=1; |
ALTER TABLE t5 COALESCE PARTITION 1; |
Leads to:
|
CS 13.0.2 eb0f3282ae8d1f3762c86d682dba99c892498049 (Debug, UBASAN, Clang 22.1.8-20260622) Build 23/06/2026 |
Version: '13.0.2-MariaDB-asan-debug' socket: '/test/UBASAN_MD230626-mariadb-13.0.2-linux-x86_64-dbg/socket.sock' port: 12486 MariaDB Server
|
/test/13.0_dbg_san/storage/maria/ma_state.c:835:25: runtime error: member access within null pointer of type 'MARIA_STATE_HISTORY' (aka 'struct st_state_history')
|
#0 0x647e0b1d69f2 in _ma_reset_history /test/13.0_dbg_san/storage/maria/ma_state.c:835:25
|
#1 0x647e0b1d60d8 in _ma_trnman_end_trans_hook /test/13.0_dbg_san/storage/maria/ma_state.c:482:11
|
#2 0x647e0b334fa8 in trnman_end_trn /test/13.0_dbg_san/storage/maria/trnman.c:498:7
|
#3 0x647e0b3f080f in ma_commit /test/13.0_dbg_san/storage/maria/ma_commit.c:73:9
|
#4 0x647e0b2b7c58 in ha_maria::external_lock(THD*, int) /test/13.0_dbg_san/storage/maria/ha_maria.cc:3029:17
|
#5 0x647e09ad743a in handler::ha_external_lock(THD*, int) /test/13.0_dbg_san/sql/handler.cc:8033:14
|
#6 0x647e0b4263a6 in ha_partition::external_lock(THD*, int) /test/13.0_dbg_san/sql/ha_partition.cc:4268:37
|
#7 0x647e09ad743a in handler::ha_external_lock(THD*, int) /test/13.0_dbg_san/sql/handler.cc:8033:14
|
#8 0x647e09b22d56 in handler::ha_external_unlock(THD*) /test/13.0_dbg_san/sql/handler.h:3772:45
|
#9 0x647e09b22d56 in unlock_external(THD*, TABLE**, unsigned int) /test/13.0_dbg_san/sql/lock.cc:791:43
|
#10 0x647e09b23127 in mysql_unlock_tables(THD*, st_mysql_lock*, bool) /test/13.0_dbg_san/sql/lock.cc:482:12
|
#11 0x647e0a36509e in close_thread_tables(THD*) /test/13.0_dbg_san/sql/sql_base.cc:1001:9
|
#12 0x647e0a371a62 in Locked_tables_list::unlock_locked_tables(THD*) /test/13.0_dbg_san/sql/sql_base.cc:2724:10
|
#13 0x647e0a3db123 in THD::cleanup() /test/13.0_dbg_san/sql/sql_class.cc:1717:22
|
#14 0x647e099fda5f in unlink_thd(THD*) /test/13.0_dbg_san/sql/mysqld.cc:2939:8
|
#15 0x647e0acc58db in do_handle_one_connection(CONNECT*, bool) /test/13.0_dbg_san/sql/sql_connect.cc:1514:5
|
#16 0x647e0acc53f8 in handle_one_connection /test/13.0_dbg_san/sql/sql_connect.cc:1415:5
|
#17 0x647e099b3646 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
|
#18 0x7dc7c4e9caa3 in start_thread nptl/pthread_create.c:447:8
|
#19 0x7dc7c4f29c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
 |
SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use /test/13.0_dbg_san/storage/maria/ma_state.c:835:25
|
grep: /test/UBASAN_MD230626-mariadb-13.0.2-linux-x86_64-opt/log/master.err: No such file or directory
grep: /test/UBASAN_MD230626-mariadb-13.0.2-linux-x86_64-opt/log/master.err: No such file or directory
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1 # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
|
-DWITH_MSAN=ON # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
|
Set before execution:
|
export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
|
|
SAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 230626 8eda90189340c31f7dfbae9ed870bfd8c0ad1776 No bug found
|
CS 10.6 opt 230626 8eda90189340c31f7dfbae9ed870bfd8c0ad1776 No bug found
|
CS 10.11 dbg 230626 d051e8663a8600cb899094498718859199a3ff0a UBSAN|member access within null pointer of type 'MARIA_STATE_HISTORY' (aka 'struct st_state_history')|storage/maria/ma_state.c|_ma_reset_history|_ma_trnman_end_trans_hook|trnman_end_trn|ma_commit
|
CS 10.11 opt 230626 d051e8663a8600cb899094498718859199a3ff0a No bug found
|
CS 11.4 dbg 230626 bbd558c38616ce24bd2973486763c2a7c4db0969 No bug found
|
CS 11.4 opt 230626 bbd558c38616ce24bd2973486763c2a7c4db0969 No bug found
|
CS 11.8 dbg 230626 eccdef627382b7b1f5338450ba328d16216c4fa2 No bug found
|
CS 11.8 opt 230626 eccdef627382b7b1f5338450ba328d16216c4fa2 No bug found
|
CS 12.3 dbg 230626 c46441bc5f19f6b10dc1c3a2513d963c496e6578 UBSAN|member access within null pointer of type 'MARIA_STATE_HISTORY' (aka 'struct st_state_history')|storage/maria/ma_state.c|_ma_reset_history|_ma_trnman_end_trans_hook|trnman_end_trn|ma_commit
|
CS 12.3 opt 230626 c46441bc5f19f6b10dc1c3a2513d963c496e6578 UBSAN|member access within null pointer of type 'MARIA_STATE_HISTORY' (aka 'struct st_state_history')|storage/maria/ma_state.c|_ma_reset_history|_ma_trnman_end_trans_hook|trnman_end_trn|ma_commit
|
CS 13.0 dbg 230626 eb0f3282ae8d1f3762c86d682dba99c892498049 UBSAN|member access within null pointer of type 'MARIA_STATE_HISTORY' (aka 'struct st_state_history')|storage/maria/ma_state.c|_ma_reset_history|_ma_trnman_end_trans_hook|trnman_end_trn|ma_commit
|
CS 13.0 opt 230626 eb0f3282ae8d1f3762c86d682dba99c892498049 No bug found
|
ES 10.6 dbg 230626 e05a2b2ddaa1032a24924a6e1a12acd467abf4da No bug found
|
ES 10.6 opt 230626 e05a2b2ddaa1032a24924a6e1a12acd467abf4da No bug found
|
ES 11.4 dbg 230626 5b6db6d09008ba92cfc5a2ef980ab86badf70d12 No bug found
|
ES 11.4 opt 230626 5b6db6d09008ba92cfc5a2ef980ab86badf70d12 No bug found
|
ES 11.8 dbg 230626 cc48b2b61be04be37daa2badcf254d96a26d2ba7 No bug found
|
ES 11.8 opt 230626 cc48b2b61be04be37daa2badcf254d96a26d2ba7 No bug found
|
ES 12.3 dbg 230626 a1d3628ea75207c85664946574ff803cbfc7c511 No bug found
|
ES 12.3 opt 230626 a1d3628ea75207c85664946574ff803cbfc7c511 No bug found
|
