Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Blocker
-
Resolution: Unresolved
-
12.3, 13.0, 13.1
-
Can result in hang or crash
-
Q4/2026 Server Maintenance
Description
CREATE TABLE t3(c2 INT); |
INSERT INTO t3 VALUES (0),(0); |
SELECT ST_COLLECT(c2) FROM t3; |
Leads to:
|
CS 13.0.2 172609526b93ac278203607274b70e6b6d8e67fd (Optimized, MSAN, Clang 20.1.8-20250804) Build 07/07/2026 |
==1359930==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x5555568cccb3 in Item_func_collect::add() /test/13.0_opt_msan/sql/item_sum.cc:4651:16
|
#1 0x555557155546 in Item_sum::aggregator_add() /test/13.0_opt_msan/sql/item_sum.h:569:47
|
#2 0x555557155546 in update_sum_func(Item_sum**) /test/13.0_opt_msan/sql/sql_select.cc:30340:15
|
#3 0x555557155546 in end_send_group(JOIN*, st_join_table*, bool) /test/13.0_opt_msan/sql/sql_select.cc:26347:7
|
#4 0x555557157a8d in evaluate_join_record(JOIN*, st_join_table*, int) /test/13.0_opt_msan/sql/sql_select.cc:24971:11
|
#5 0x555557077c1e in sub_select(JOIN*, st_join_table*, bool) /test/13.0_opt_msan/sql/sql_select.cc:24775:9
|
#6 0x5555570e9503 in do_select(JOIN*, Procedure*) /test/13.0_opt_msan/sql/sql_select.cc:24249:14
|
#7 0x5555570e71c4 in JOIN::exec_inner() /test/13.0_opt_msan/sql/sql_select.cc:5125:50
|
#8 0x555557079958 in JOIN::exec() /test/13.0_opt_msan/sql/sql_select.cc:4913:8
|
#9 0x555557079958 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.0_opt_msan/sql/sql_select.cc:5439:21
|
#10 0x555557078e8b in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.0_opt_msan/sql/sql_select.cc:636:10
|
#11 0x555556fc5361 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.0_opt_msan/sql/sql_parse.cc:6217:12
|
#12 0x555556fb845b in mysql_execute_command(THD*, bool) /test/13.0_opt_msan/sql/sql_parse.cc:3991:12
|
#13 0x555556fadcef in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_opt_msan/sql/sql_parse.cc:7945:18
|
#14 0x555556fa7745 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_opt_msan/sql/sql_parse.cc:1903:7
|
#15 0x555556fae7b4 in do_command(THD*, bool) /test/13.0_opt_msan/sql/sql_parse.cc:1437:17
|
#16 0x5555574690ec in do_handle_one_connection(CONNECT*, bool) /test/13.0_opt_msan/sql/sql_connect.cc:1510:11
|
#17 0x555557468a6e in handle_one_connection /test/13.0_opt_msan/sql/sql_connect.cc:1422:5
|
#18 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
|
#19 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Memory was marked as uninitialized
|
#0 0x5555564c7971 in __msan_allocated_memory (/test/MSAN_MD070726-mariadb-13.0.2-linux-x86_64-opt/bin/mariadbd+0xf73971) (BuildId: b0458e033cbf6ffe612ed69b6414ea64df9d4998)
|
#1 0x55555828185e in my_malloc /test/13.0_opt_msan/mysys/my_malloc.c:117:7
|
#2 0x5555572690c5 in Binary_string::real_alloc(unsigned long) /test/13.0_opt_msan/sql/sql_string.cc:41:23
|
#3 0x5555566094c8 in Binary_string::alloc(unsigned long) /test/13.0_opt_msan/sql/sql_string.h:744:12
|
#4 0x5555566094c8 in Field_int::val_str_from_long(String*, unsigned int, int, long) /test/13.0_opt_msan/sql/field.cc:4484:15
|
#5 0x5555568cc80b in Item_func_collect::add() /test/13.0_opt_msan/sql/item_sum.cc:4638:25
|
#6 0x555557155804 in Item_sum::aggregator_add() /test/13.0_opt_msan/sql/item_sum.h:569:47
|
#7 0x555557155804 in Item_sum::reset_and_add() /test/13.0_opt_msan/sql/item_sum.h:451:12
|
#8 0x555557155804 in init_sum_functions(Item_sum**, Item_sum**) /test/13.0_opt_msan/sql/sql_select.cc:30322:22
|
#9 0x555557155804 in end_send_group(JOIN*, st_join_table*, bool) /test/13.0_opt_msan/sql/sql_select.cc:26338:11
|
#10 0x555557157a8d in evaluate_join_record(JOIN*, st_join_table*, int) /test/13.0_opt_msan/sql/sql_select.cc:24971:11
|
#11 0x555557077b53 in sub_select(JOIN*, st_join_table*, bool) /test/13.0_opt_msan/sql/sql_select.cc:24738:9
|
#12 0x5555570e9503 in do_select(JOIN*, Procedure*) /test/13.0_opt_msan/sql/sql_select.cc:24249:14
|
#13 0x5555570e71c4 in JOIN::exec_inner() /test/13.0_opt_msan/sql/sql_select.cc:5125:50
|
#14 0x555557079958 in JOIN::exec() /test/13.0_opt_msan/sql/sql_select.cc:4913:8
|
#15 0x555557079958 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/13.0_opt_msan/sql/sql_select.cc:5439:21
|
#16 0x555557078e8b in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/13.0_opt_msan/sql/sql_select.cc:636:10
|
#17 0x555556fc5361 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/13.0_opt_msan/sql/sql_parse.cc:6217:12
|
#18 0x555556fb845b in mysql_execute_command(THD*, bool) /test/13.0_opt_msan/sql/sql_parse.cc:3991:12
|
#19 0x555556fadcef in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_opt_msan/sql/sql_parse.cc:7945:18
|
#20 0x555556fa7745 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_opt_msan/sql/sql_parse.cc:1903:7
|
#21 0x555556fae7b4 in do_command(THD*, bool) /test/13.0_opt_msan/sql/sql_parse.cc:1437:17
|
#22 0x5555574690ec in do_handle_one_connection(CONNECT*, bool) /test/13.0_opt_msan/sql/sql_connect.cc:1510:11
|
#23 0x555557468a6e in handle_one_connection /test/13.0_opt_msan/sql/sql_connect.cc:1422:5
|
#24 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/13.0_opt_msan/sql/item_sum.cc:4651:16 in Item_func_collect::add()
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:
|
-DWITH_MSAN=ON # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
|
Set before execution:
|
export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
|
|
MSAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 070726 736edbe77ce5db44ea38347280f77d6a304fa3ae No bug found
|
CS 10.6 opt 070726 736edbe77ce5db44ea38347280f77d6a304fa3ae No bug found
|
CS 10.11 dbg 070726 2be9ba2537aa3ff5836b21489cfca6b0f0ccf80a No bug found
|
CS 10.11 opt 070726 2be9ba2537aa3ff5836b21489cfca6b0f0ccf80a No bug found
|
CS 11.4 dbg 090726 176589bf19ea6e2261bb3ef57886c13b9c0b6759 No bug found
|
CS 11.4 opt 090726 176589bf19ea6e2261bb3ef57886c13b9c0b6759 No bug found
|
CS 11.8 dbg 070726 666b2aca09cb84d59b4ece2185a9200d745cb287 No bug found
|
CS 11.8 opt 070726 666b2aca09cb84d59b4ece2185a9200d745cb287 No bug found
|
CS 12.3 dbg 070726 8da34620ac3935814cc7f9ba30bb51a6e2070237 MSAN|use-of-uninitialized-value|sql/item_sum.cc|Item_func_collect::add|Item_sum::aggregator_add|update_sum_func|end_send_group
|
CS 12.3 opt 070726 8da34620ac3935814cc7f9ba30bb51a6e2070237 MSAN|use-of-uninitialized-value|sql/item_sum.cc|Item_func_collect::add|Item_sum::aggregator_add|update_sum_func|end_send_group
|
CS 13.0 dbg 070726 172609526b93ac278203607274b70e6b6d8e67fd MSAN|use-of-uninitialized-value|sql/item_sum.cc|Item_func_collect::add|Item_sum::aggregator_add|update_sum_func|end_send_group
|
CS 13.0 opt 070726 172609526b93ac278203607274b70e6b6d8e67fd MSAN|use-of-uninitialized-value|sql/item_sum.cc|Item_func_collect::add|Item_sum::aggregator_add|update_sum_func|end_send_group
|
CS 13.1 dbg 070726 fd8cec54af7a9d79749df25ea70dac695b371641 MSAN|use-of-uninitialized-value|sql/item_sum.cc|Item_func_collect::add|Item_sum::aggregator_add|update_sum_func|end_send_group
|
CS 13.1 opt 070726 fd8cec54af7a9d79749df25ea70dac695b371641 MSAN|use-of-uninitialized-value|sql/item_sum.cc|Item_func_collect::add|Item_sum::aggregator_add|update_sum_func|end_send_group
|
ES 10.6 dbg 070726 07b87fa33b7263c3b46b1a820474f88803d25a04 No bug found
|
ES 10.6 opt 070726 07b87fa33b7263c3b46b1a820474f88803d25a04 No bug found
|
ES 11.4 dbg 070726 89bb238190d313ead3b68e508099974e3728515e No bug found
|
ES 11.4 opt 070726 89bb238190d313ead3b68e508099974e3728515e No bug found
|
ES 11.8 dbg 070726 97386db1d887891fb17e5210536bfe8756bae3cf No bug found
|
ES 11.8 opt 070726 97386db1d887891fb17e5210536bfe8756bae3cf No bug found
|
ES 12.3 dbg 070726 b96de078339ebc1995fd6185bf5433c72fedbdaf MSAN|use-of-uninitialized-value|sql/item_sum.cc|Item_func_collect::add|Item_sum::aggregator_add|update_sum_func|end_send_group
|
ES 12.3 opt 070726 b96de078339ebc1995fd6185bf5433c72fedbdaf MSAN|use-of-uninitialized-value|sql/item_sum.cc|Item_func_collect::add|Item_sum::aggregator_add|update_sum_func|end_send_group
|
