Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Critical
-
Resolution: Unresolved
-
11.8, 12.3, 13.0
-
Can result in hang or crash
-
Q4/2026 Server Maintenance
Description
SET sql_mode=''; |
CREATE TABLE t1 (c2 VECTOR(1)); |
CREATE TABLE t2 (c2 JSON); |
INSERT INTO t2 (c2) VALUES (1); |
INSERT INTO t2 () VALUES (); |
INSERT INTO t1 (c2) VALUES (1); |
SELECT c2 FROM t2 INTERSECT SELECT c2 FROM t1; |
Leads to:
|
CS 13.0.2 eb0f3282ae8d1f3762c86d682dba99c892498049 (Debug, Clang 22.1.8-20260622) Build 29/06/2026 |
Core was generated by `/test/MD290626-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x00005e9f88b3300c in hp_movelink (pos=0x680af811f8d0, next_link=0x8787ef927f995168, newlink=0x680af811ca08)at /test/13.0_dbg/storage/heap/hp_hash.c:218
|
218 while ((next_link=next_link->next_key) != pos);
|
[Current thread is 1 (LWP 1992434)]
|
(gdb) bt
|
#0 0x00005e9f88b3300c in hp_movelink (pos=0x680af811f8d0, next_link=0x8787ef927f995168, newlink=0x680af811ca08)at /test/13.0_dbg/storage/heap/hp_hash.c:218
|
#1 0x00005e9f88b31bb0 in hp_delete_key (info=0x680af8090640, keyinfo=0x680af8090288, record=0x680af8089410 "\377\377", recpos=0x680af809c9f0 "\377\377", flag=0)at /test/13.0_dbg/storage/heap/hp_delete.c:179
|
#2 0x00005e9f88b31692 in heap_delete (info=0x680af8090640, record=0x680af8089410 "\377\377")at /test/13.0_dbg/storage/heap/hp_delete.c:41
|
#3 0x00005e9f88b30258 in ha_heap::delete_row (this=0x680af8088e50, buf=0x680af8089410 "\377\377")at /test/13.0_dbg/storage/heap/ha_heap.cc:330
|
#4 0x00005e9f884a8f60 in handler::ha_delete_tmp_row (this=0x680af8088e50, buf=0x680af8089410 "\377\377") at /test/13.0_dbg/sql/sql_class.h:8156
|
#5 0x00005e9f884a33dc in select_unit::delete_record (this=0x680af801cf40)at /test/13.0_dbg/sql/sql_union.cc:538
|
#6 0x00005e9f884a359e in select_unit::send_eof (this=0x680af801cf40)at /test/13.0_dbg/sql/sql_union.cc:245
|
#7 0x00005e9f883e7dbf in do_select (join=0x680af801d8d0, procedure=0x0)at /test/13.0_dbg/sql/sql_select.cc:24285
|
#8 0x00005e9f883e7096 in JOIN::exec_inner (this=0x680af801d8d0)at /test/13.0_dbg/sql/sql_select.cc:5125
|
#9 0x00005e9f883e63b3 in JOIN::exec (this=0x680af801d8d0)at /test/13.0_dbg/sql/sql_select.cc:4913
|
#10 0x00005e9f884a7a1f in st_select_lex_unit::exec_inner (this=0x680af8005280)at /test/13.0_dbg/sql/sql_union.cc:2454
|
#11 0x00005e9f884a268a in st_select_lex_unit::exec (this=0x680af8005280)at /test/13.0_dbg/sql/sql_union.cc:2350
|
#12 0x00005e9f884a0307 in mysql_union (thd=0x680af8000d60, lex=0x680af80051a0, result=0x680af801cf10, unit=0x680af8005280, setup_tables_done_option=0)at /test/13.0_dbg/sql/sql_union.cc:45
|
#13 0x00005e9f883c3f57 in handle_select (thd=0x680af8000d60, lex=0x680af80051a0, result=0x680af801cf10, setup_tables_done_option=0)at /test/13.0_dbg/sql/sql_select.cc:626
|
#14 0x00005e9f8836ebe6 in execute_sqlcom_select (thd=0x680af8000d60, all_tables=0x680af801ab30) at /test/13.0_dbg/sql/sql_parse.cc:6217
|
#15 0x00005e9f88365018 in mysql_execute_command (thd=0x680af8000d60, is_called_from_prepared_stmt=false) at /test/13.0_dbg/sql/sql_parse.cc:3991
|
#16 0x00005e9f8835de08 in mysql_parse (thd=0x680af8000d60, rawbuf=0x680af801a3c0 "SELECT c2 FROM t2 INTERSECT SELECT c2 FROM t1", length=45, parser_state=0x700c2c2069f0)at /test/13.0_dbg/sql/sql_parse.cc:7945
|
#17 0x00005e9f8835b55e in dispatch_command (command=COM_QUERY, thd=0x680af8000d60, packet=0x680af800b5f1 "SELECT c2 FROM t2 INTERSECT SELECT c2 FROM t1", packet_length=45, blocking=true) at /test/13.0_dbg/sql/sql_parse.cc:1903
|
#18 0x00005e9f8835e88a in do_command (thd=0x680af8000d60, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1437
|
#19 0x00005e9f8852fd4e in do_handle_one_connection (connect=0x5e9fbc21b800, put_in_cache=true) at /test/13.0_dbg/sql/sql_connect.cc:1503
|
#20 0x00005e9f8852fb31 in handle_one_connection (arg=0x5e9fbc1fa160)at /test/13.0_dbg/sql/sql_connect.cc:1415
|
#21 0x0000700c2fa9caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#22 0x0000700c2fb29c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 230626 8eda90189340c31f7dfbae9ed870bfd8c0ad1776 No bug found
|
CS 10.6 opt 220626 8eda90189340c31f7dfbae9ed870bfd8c0ad1776 No bug found
|
CS 10.11 dbg 230626 d051e8663a8600cb899094498718859199a3ff0a No bug found
|
CS 10.11 opt 220626 d051e8663a8600cb899094498718859199a3ff0a No bug found
|
CS 11.4 dbg 230626 bbd558c38616ce24bd2973486763c2a7c4db0969 No bug found
|
CS 11.4 opt 220626 bbd558c38616ce24bd2973486763c2a7c4db0969 No bug found
|
CS 11.8 dbg 230626 eccdef627382b7b1f5338450ba328d16216c4fa2 SIGSEGV|hp_movelink|hp_delete_key|heap_delete|ha_heap::delete_row
|
CS 11.8 opt 220626 eccdef627382b7b1f5338450ba328d16216c4fa2 No bug found
|
CS 12.3 dbg 250626 c46441bc5f19f6b10dc1c3a2513d963c496e6578 SIGSEGV|hp_movelink|hp_delete_key|heap_delete|ha_heap::delete_row
|
CS 12.3 opt 220626 c46441bc5f19f6b10dc1c3a2513d963c496e6578 No bug found
|
CS 12.3 opt 250626 c46441bc5f19f6b10dc1c3a2513d963c496e6578 No bug found
|
CS 13.0 dbg 290626 eb0f3282ae8d1f3762c86d682dba99c892498049 SIGSEGV|hp_movelink|hp_delete_key|heap_delete|ha_heap::delete_row
|
CS 13.0 opt 290626 eb0f3282ae8d1f3762c86d682dba99c892498049 No bug found
|
ES 10.6 dbg 230626 e05a2b2ddaa1032a24924a6e1a12acd467abf4da No bug found
|
ES 10.6 opt 220626 e05a2b2ddaa1032a24924a6e1a12acd467abf4da No bug found
|
ES 11.4 dbg 230626 5b6db6d09008ba92cfc5a2ef980ab86badf70d12 SIGSEGV|hp_movelink|hp_delete_key|heap_delete|ha_heap::delete_row
|
ES 11.4 opt 220626 5b6db6d09008ba92cfc5a2ef980ab86badf70d12 No bug found
|
ES 11.8 dbg 230626 cc48b2b61be04be37daa2badcf254d96a26d2ba7 SIGSEGV|hp_movelink|hp_delete_key|heap_delete|ha_heap::delete_row
|
ES 11.8 opt 220626 cc48b2b61be04be37daa2badcf254d96a26d2ba7 No bug found
|
ES 12.3 dbg 230626 a1d3628ea75207c85664946574ff803cbfc7c511 SIGSEGV|hp_movelink|hp_delete_key|heap_delete|ha_heap::delete_row
|
ES 12.3 opt 220626 a1d3628ea75207c85664946574ff803cbfc7c511 No bug found
|
