Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40471

SIGSEGV in get_sel_arg_for_keypart on SELECT ... GROUP BY

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Q4/2026 Server Maintenance

    Description

      CREATE TABLE t1 (c1 INT KEY,c2 INT,INDEX(c2));
      		 
      SELECT c2 FROM t1 WHERE RAND()=c2 GROUP BY c2 LIMIT 1;

      Leads to:

      CS 10.11.19 50faece416f0642b57a515d546f20cefd9062379 (Optimized, Clang 22.1.8-20260622) Build 16/07/2026

      		 
      Core was generated by `/test/MD160726-mariadb-10.11.19-linux-x86_64-opt/bin/mariadbd --no-defaults --l'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  0x00005c37c7742313 in get_sel_arg_for_keypart (field=0x6b123c01daa0, keypart_tree=keypart_tree@entry=0x6b123c04e9d8, cur_range=cur_range@entry=0x73130fb1a308)at /test/10.11_opt/sql/opt_range.cc:14793
      		 
       
      		 
      [Current thread is 1 (LWP 3587185)]
      		 
      (gdb) bt
      		 
      #0  0x00005c37c7742313 in get_sel_arg_for_keypart (field=0x6b123c01daa0, keypart_tree=keypart_tree@entry=0x6b123c04e9d8, cur_range=cur_range@entry=0x73130fb1a308)at /test/10.11_opt/sql/opt_range.cc:14793
      		 
      #1  0x00005c37c77421e9 in get_constant_key_infix (index_info=<optimized out>, index_range_tree=0x6b123c04e9d8, first_non_group_part=<optimized out>, min_max_arg_part=min_max_arg_part@entry=0x0, last_part=last_part@entry=0x6b123c01de20, thd=<optimized out>, key_infix=key_infix@entry=0x73130fb1a4c0 "", key_infix_len=key_infix_len@entry=0x73130fb1a438, first_non_infix_part=0x73130fb1a380)at /test/10.11_opt/sql/opt_range.cc:14884
      		 
      #2  0x00005c37c7731465 in get_best_group_min_max (param=param@entry=0x73130fb1bf90, tree=tree@entry=0x6b123c04e958, read_time=1.2001098565761366) at /test/10.11_opt/sql/opt_range.cc:14313
      		 
      #3  0x00005c37c772bef6 in SQL_SELECT::test_quick_select (this=this@entry=0x6b123c015540, thd=thd@entry=0x6b123c000c68, keys_to_use=<optimized out>, prev_tables=<optimized out>, limit=<optimized out>, force_quick_range=false, ordered_output=<optimized out>, remove_false_parts_of_where=<optimized out>, only_single_index_range_scan=<optimized out>, note_unusable_keys=Item_func::BITMAP_ALL)at /test/10.11_opt/sql/opt_range.cc:3062
      		 
      #4  0x00005c37c785039d in make_join_select (join=join@entry=0x6b123c012a30, select=0x6b123c0153f0, cond=0x6b123c011c90)at /test/10.11_opt/sql/sql_select.cc:13740
      		 
      #5  0x00005c37c7848953 in JOIN::optimize_stage2 (this=this@entry=0x6b123c012a30) at /test/10.11_opt/sql/sql_select.cc:2981
      		 
      #6  0x00005c37c7847a49 in JOIN::optimize_inner (this=this@entry=0x6b123c012a30)at /test/10.11_opt/sql/sql_select.cc:2705
      		 
      #7  0x00005c37c7840ef6 in JOIN::optimize (this=0x6b123c012a30)at /test/10.11_opt/sql/sql_select.cc:1967
      		 
      #8  mysql_select (thd=thd@entry=0x6b123c000c68, tables=<optimized out>, fields=@0x6b123c011000: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6b123c011330, last = 0x6b123c011330, elements = 1}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x6b123c011fd8, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x6b123c012a08, unit=0x6b123c004f68, select_lex=0x6b123c010d48)at /test/10.11_opt/sql/sql_select.cc:5271
      		 
      #9  0x00005c37c78409d9 in handle_select (thd=thd@entry=0x6b123c000c68, lex=lex@entry=0x6b123c004e90, result=result@entry=0x6b123c012a08, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/10.11_opt/sql/sql_select.cc:601
      		 
      #10 0x00005c37c78100d9 in execute_sqlcom_select (thd=thd@entry=0x6b123c000c68, all_tables=0x6b123c011380) at /test/10.11_opt/sql/sql_parse.cc:6461
      		 
      #11 0x00005c37c780ab9e in mysql_execute_command (thd=thd@entry=0x6b123c000c68, is_called_from_prepared_stmt=false)at /test/10.11_opt/sql/sql_parse.cc:4040
      		 
      #12 0x00005c37c78063ed in mysql_parse (thd=thd@entry=0x6b123c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x73130fb1d560)at /test/10.11_opt/sql/sql_parse.cc:8219
      		 
      #13 0x00005c37c7804b29 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x6b123c000c68, packet=packet@entry=0x6b123c008709 "SELECT c2 FROM t1 WHERE RAND()=c2 GROUP BY c2 LIMIT 1", packet_length=packet_length@entry=53, blocking=true)at /test/10.11_opt/sql/sql_parse.cc:1924
      		 
      #14 0x00005c37c7806870 in do_command (thd=thd@entry=0x6b123c000c68, blocking=true) at /test/10.11_opt/sql/sql_parse.cc:1434
      		 
      #15 0x00005c37c791f25d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5c37da0cf6a8, put_in_cache=true)at /test/10.11_opt/sql/sql_connect.cc:1482
      		 
      #16 0x00005c37c791f086 in handle_one_connection (arg=arg@entry=0x5c37da0cf6a8)at /test/10.11_opt/sql/sql_connect.cc:1394
      		 
      #17 0x00005c37c7c57fee in pfs_spawn_thread (arg=0x5c37da05bbe8)at /test/10.11_opt/storage/perfschema/pfs.cc:2201
      		 
      #18 0x000073133cc9caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      		 
      #19 0x000073133cd29c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

      CS 10.11.19 50faece416f0642b57a515d546f20cefd9062379 (Debug, Clang 22.1.8-20260622) Build 16/07/2026

      		 
      Core was generated by `/test/MD160726-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd --no-defaults --l'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  0x00005f20ef1bf080 in get_sel_arg_for_keypart (field=0x73ce78021310, keypart_tree=0x73ce78072038, cur_range=0x7bcf740a0658)at /test/10.11_dbg/sql/opt_range.cc:14793
      		 
       
      		 
      [Current thread is 1 (LWP 3587050)]
      		 
      (gdb) bt
      		 
      #0  0x00005f20ef1bf080 in get_sel_arg_for_keypart (field=0x73ce78021310, keypart_tree=0x73ce78072038, cur_range=0x7bcf740a0658)at /test/10.11_dbg/sql/opt_range.cc:14793
      		 
      #1  0x00005f20ef1bee31 in get_constant_key_infix (index_info=0x73ce78021570, index_range_tree=0x73ce78072038, first_non_group_part=0x73ce78021678, min_max_arg_part=0x0, last_part=0x73ce78021698, thd=0x73ce78000d58, key_infix=0x7bcf740a0bd0 "", key_infix_len=0x7bcf740a0a14, first_non_infix_part=0x7bcf740a0a40)at /test/10.11_dbg/sql/opt_range.cc:14884
      		 
      #2  0x00005f20ef1a55e0 in get_best_group_min_max (param=0x7bcf740a2a00, tree=0x73ce78071fb8, read_time=1.2001098565761366)at /test/10.11_dbg/sql/opt_range.cc:14313
      		 
      #3  0x00005f20ef1a00c1 in SQL_SELECT::test_quick_select (this=0x73ce78017e88, thd=0x73ce78000d58, keys_to_use={static BITS_PER_ELEMENT = 64, static ARRAY_ELEMENTS = 1, static ALL_BITS_SET = 18446744073709551615, buffer = {2}}, prev_tables=13835058055282163712, limit=1, force_quick_range=false, ordered_output=false, remove_false_parts_of_where=false, only_single_index_range_scan=false, note_unusable_keys=Item_func::BITMAP_ALL)at /test/10.11_dbg/sql/opt_range.cc:3062
      		 
      #4  0x00005f20ef37768e in make_join_select (join=0x73ce78015230, select=0x73ce78017cb8, cond=0x73ce78014490)at /test/10.11_dbg/sql/sql_select.cc:13740
      		 
      #5  0x00005f20ef36d494 in JOIN::optimize_stage2 (this=0x73ce78015230)at /test/10.11_dbg/sql/sql_select.cc:2981
      		 
      #6  0x00005f20ef36c5a2 in JOIN::optimize_inner (this=0x73ce78015230)at /test/10.11_dbg/sql/sql_select.cc:2705
      		 
      #7  0x00005f20ef36a3bc in JOIN::optimize (this=0x73ce78015230)at /test/10.11_dbg/sql/sql_select.cc:1967
      		 
      #8  0x00005f20ef362e2f in mysql_select (thd=0x73ce78000d58, tables=0x73ce78013b80, fields=@0x73ce78013800: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x73ce78013b30, last = 0x73ce78013b30, elements = 1}, <No data fields>}, conds=0x73ce78014490, og_num=1, order=0x0, group=0x73ce780147d8, having=0x0, proc_param=0x0, select_options=2164525824, result=0x73ce78015208, unit=0x73ce78005028, select_lex=0x73ce78013548)at /test/10.11_dbg/sql/sql_select.cc:5271
      		 
      #9  0x00005f20ef3629cd in handle_select (thd=0x73ce78000d58, lex=0x73ce78004f50, result=0x73ce78015208, setup_tables_done_option=0)at /test/10.11_dbg/sql/sql_select.cc:601
      		 
      #10 0x00005f20ef3116a5 in execute_sqlcom_select (thd=0x73ce78000d58, all_tables=0x73ce78013b80) at /test/10.11_dbg/sql/sql_parse.cc:6461
      		 
      #11 0x00005f20ef306b46 in mysql_execute_command (thd=0x73ce78000d58, is_called_from_prepared_stmt=false)at /test/10.11_dbg/sql/sql_parse.cc:4040
      		 
      #12 0x00005f20ef2ff8c8 in mysql_parse (thd=0x73ce78000d58, rawbuf=0x73ce78013480 "SELECT c2 FROM t1 WHERE RAND()=c2 GROUP BY c2 LIMIT 1", length=53, parser_state=0x7bcf740a5a20)at /test/10.11_dbg/sql/sql_parse.cc:8219
      		 
      #13 0x00005f20ef2fd11a in dispatch_command (command=COM_QUERY, thd=0x73ce78000d58, packet=0x73ce7800af09 "SELECT c2 FROM t1 WHERE RAND()=c2 GROUP BY c2 LIMIT 1", packet_length=53, blocking=true) at /test/10.11_dbg/sql/sql_parse.cc:1924
      		 
      #14 0x00005f20ef30034a in do_command (thd=0x73ce78000d58, blocking=true)at /test/10.11_dbg/sql/sql_parse.cc:1434
      		 
      #15 0x00005f20ef4b4a4e in do_handle_one_connection (connect=0x5f2129226308, put_in_cache=true) at /test/10.11_dbg/sql/sql_connect.cc:1482
      		 
      #16 0x00005f20ef4b4835 in handle_one_connection (arg=0x5f21293205a8)at /test/10.11_dbg/sql/sql_connect.cc:1394
      		 
      #17 0x00007bcf76c9caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      		 
      #18 0x00007bcf76d29c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

      Bug Detection Matrix

      		 
          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.6   dbg  160726  85ab366da3fc5d13b61d9e491e63e2b62c017cf4  No bug found                  
      CS  10.6   opt  160726  85ab366da3fc5d13b61d9e491e63e2b62c017cf4  No bug found                  
      CS  10.11  dbg  160726  50faece416f0642b57a515d546f20cefd9062379  SIGSEGV|get_sel_arg_for_keypart|get_constant_key_infix|get_best_group_min_max|SQL_SELECT::test_quick_select
      		 
      CS  10.11  opt  160726  50faece416f0642b57a515d546f20cefd9062379  SIGSEGV|get_sel_arg_for_keypart|get_constant_key_infix|get_best_group_min_max|SQL_SELECT::test_quick_select
      		 
      CS  11.4   dbg  160726  17fe060a549d2bfa56f6efb82456b20146ac569f  No bug found                  
      CS  11.4   opt  160726  17fe060a549d2bfa56f6efb82456b20146ac569f  No bug found                  
      CS  11.8   dbg  160726  bf58d4cb5fccd4078ec91c065a2de86be3b46281  No bug found                  
      CS  11.8   opt  160726  bf58d4cb5fccd4078ec91c065a2de86be3b46281  No bug found                  
      CS  12.3   dbg  160726  f9d797f1ccb8bbdbad0b50005644f29cd6125a6c  No bug found                  
      CS  12.3   opt  160726  f9d797f1ccb8bbdbad0b50005644f29cd6125a6c  No bug found                  
      CS  13.0   dbg  160726  84c246ca5387c0611f75097136ff4f4bea092aa3  No bug found                  
      CS  13.0   opt  160726  84c246ca5387c0611f75097136ff4f4bea092aa3  No bug found                  
      CS  13.1   dbg  160726  7322a6656a5357b4574b7413493c76ba2fc41f84  No bug found                  
      CS  13.1   opt  160726  7322a6656a5357b4574b7413493c76ba2fc41f84  No bug found                  
      ES  10.6   dbg  160726  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  10.6   opt  160726  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  11.4   dbg  160726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  
      ES  11.4   opt  160726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  
      ES  11.8   dbg  160726  4694e931d10fecf733c34f83ea2146d31b708eb3  No bug found                  
      ES  11.8   opt  160726  4694e931d10fecf733c34f83ea2146d31b708eb3  No bug found                  
      ES  12.3   dbg  160726  9d8abb61e913bec023cd8caeccad4b42717151cb  No bug found                  
      ES  12.3   opt  160726  9d8abb61e913bec023cd8caeccad4b42717151cb  No bug found

      Attachments

        Activity

          People

            psergei Sergei Petrunia
            saahil Saahil Alam
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 1.5h
                1.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.