Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40527

Assertion `items.elements == s->fields' failed in bool Virtual_tmp_table::sp_set_from_select_list(THD *, const List<Item> &)

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

       
      SET sql_mode=ORACLE;
      CREATE TABLE t1 (a INT, b VARCHAR(10));
      INSERT INTO t1 VALUES (1,'b1');
      CREATE TABLE t2 (x INT);
      INSERT INTO t2 VALUES (100);
      DELIMITER $$;
      CREATE PROCEDURE p1 AS
        TYPE rec0_t IS RECORD (a INT, b VARCHAR(10));
        TYPE cur0_t IS REF CURSOR RETURN rec0_t;
        TYPE cur1_t IS REF CURSOR;
        c0 cur0_t;
        c1 cur1_t;
        r0 rec0_t;
      BEGIN
        OPEN c1 FOR SELECT a,b FROM t1;
        c0 := c1;
        FETCH c0 INTO r0;
        SELECT r0.a, r0.b;
        CLOSE c1;
        OPEN c1 FOR SELECT x FROM t2;
        FETCH c0 INTO r0;
        SELECT r0.a, r0.b;
        CLOSE c1;
      END;
      $$
      DELIMITER ;$$
      CALL p1;
       
      #Cleanup
      DROP PROCEDURE p1;
      DROP TABLE t1, t2;
      

      Leads to:

      CS 13.1.0 0350ad8cb0540e0f57f930b1f6e5dc225bff41bb (Debug, Clang 18.1.3-11) Build 13/07/2026

      mariadbd: /test/13.1_dbg/sql/sql_select.cc:23359: bool Virtual_tmp_table::sp_set_from_select_list(THD *, const List<Item> &): Assertion `items.elements == s->fields' failed.
      

      CS 13.1.0 0350ad8cb0540e0f57f930b1f6e5dc225bff41bb (Debug, Clang 18.1.3-11) Build 13/07/2026

      Core was generated by `/test/MD130726-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 160834)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x00007de53564527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x00007de5356288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x00007de53562881b in __assert_fail_base (fmt=0x7de5357d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x62ce14f0eee9 "items.elements == s->fields", file=file@entry=0x62ce14f0c4c3 "/test/13.1_dbg/sql/sql_select.cc", line=line@entry=23359, function=function@entry=0x62ce14f0ef05 "bool Virtual_tmp_table::sp_set_from_select_list(THD *, const List<Item> &)") at ./assert/assert.c:96
      #6  0x00007de53563b517 in __assert_fail (assertion=0x62ce14f0eee9 "items.elements == s->fields", file=0x62ce14f0c4c3 "/test/13.1_dbg/sql/sql_select.cc", line=23359, function=0x62ce14f0ef05 "bool Virtual_tmp_table::sp_set_from_select_list(THD *, const List<Item> &)") at ./assert/assert.c:105
      #7  0x000062ce13e53af1 in Virtual_tmp_table::sp_set_from_select_list (this=0x75c28401e8a0, thd=0x75c284000d60, items=@0x75c2840d53e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x75c2840d5550, last = 0x75c2840d5550, elements = 1}, <No data fields>})at /test/13.1_dbg/sql/sql_select.cc:23359
      #8  0x000062ce13c87346 in sp_cursor::Select_fetch_into_spvars::send_data_with_return_type (this=0x75c284087dc0, items=@0x75c2840d53e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x75c2840d5550, last = 0x75c2840d5550, elements = 1}, <No data fields>})at /test/13.1_dbg/sql/sp_rcontext.cc:1012
      #9  0x000062ce13c87190 in sp_cursor::Select_fetch_into_spvars::send_data (this=0x75c284087dc0, items=@0x75c2840d53e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x75c2840d5550, last = 0x75c2840d5550, elements = 1}, <No data fields>})at /test/13.1_dbg/sql/sp_rcontext.cc:982
      #10 0x000062ce13d13929 in Materialized_cursor::fetch (this=0x75c2840d4af0, num_rows=1) at /test/13.1_dbg/sql/sql_cursor.cc:304
      #11 0x000062ce13c86ec7 in sp_cursor::fetch (this=0x75c284087da0, thd=0x75c284000d60, return_type=0x75c28401e8a0, vars=0x75c284097a90, error_on_no_data=false) at /test/13.1_dbg/sql/sp_rcontext.cc:908
      #12 0x000062ce1407782f in sp_instr_cfetch_by_ref::execute (this=0x75c284097a50, thd=0x75c284000d60, nextp=0x7de157663708)at /test/13.1_dbg/sql/sp_instr.cc:2803
      #13 0x000062ce13c6fe0c in sp_head::execute (this=0x75c284089cb0, thd=0x75c284000d60, merge_da_on_success=true)at /test/13.1_dbg/sql/sp_head.cc:1332
      #14 0x000062ce13c7280e in sp_head::execute_procedure (this=0x75c284089cb0, thd=0x75c284000d60, args=0x75c284006280)at /test/13.1_dbg/sql/sp_head.cc:2369
      #15 0x000062ce13d9d367 in do_execute_sp (thd=0x75c284000d60, sp=0x75c284089cb0)at /test/13.1_dbg/sql/sql_parse.cc:3084
      #16 0x000062ce13d9ce88 in Sql_cmd_call::execute (this=0x75c28401a680, thd=0x75c284000d60) at /test/13.1_dbg/sql/sql_parse.cc:3322
      #17 0x000062ce13da92b8 in mysql_execute_command (thd=0x75c284000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:5905
      #18 0x000062ce13d98434 in mysql_parse (thd=0x75c284000d60, rawbuf=0x75c28401a3e0 "CALL p1", length=7, parser_state=0x7de1576659f0)at /test/13.1_dbg/sql/sql_parse.cc:7945
      #19 0x000062ce13d9577d in dispatch_command (command=COM_QUERY, thd=0x75c284000d60, packet=0x75c28400b611 "", packet_length=7, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903
      #20 0x000062ce13d98fe3 in do_command (thd=0x75c284000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
      #21 0x000062ce13f97549 in do_handle_one_connection (connect=0x62ce254ac590, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1510
      #22 0x000062ce13f972ee in handle_one_connection (arg=0x62ce25552bb0)at /test/13.1_dbg/sql/sql_connect.cc:1422
      #23 0x00007de53569caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #24 0x00007de535729c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed
      CS  10.11  dbg  100726  0617cf2ab5fc37f49b25c22524c909f26069bd44  No bug found
      CS  10.11  opt  100726  0617cf2ab5fc37f49b25c22524c909f26069bd44  No bug found
      CS  11.4   dbg  100726  1fff140f0c25f6a5b2f6fd0b5ef6b6c50d60e913  No bug found
      CS  11.4   opt  100726  1fff140f0c25f6a5b2f6fd0b5ef6b6c50d60e913  No bug found
      CS  11.8   dbg  130726  666b2aca09cb84d59b4ece2185a9200d745cb287  No bug found
      CS  11.8   opt  130726  666b2aca09cb84d59b4ece2185a9200d745cb287  No bug found
      CS  12.3   dbg  130726  27df5668c2e3eef406a5357672d3d8e89d25ff48  No bug found
      CS  12.3   opt  130726  27df5668c2e3eef406a5357672d3d8e89d25ff48  No bug found
      CS  13.0   dbg  130726  84c246ca5387c0611f75097136ff4f4bea092aa3  items.elements == s->fields|SIGABRT|Virtual_tmp_table::sp_set_from_select_list|sp_cursor::Select_fetch_into_spvars::send_data_with_return_type|sp_cursor::Select_fetch_into_spvars::send_data|Materialized_cursor::fetch
      CS  13.0   opt  130726  84c246ca5387c0611f75097136ff4f4bea092aa3  No bug found
      CS  13.1   dbg  130726  0350ad8cb0540e0f57f930b1f6e5dc225bff41bb  items.elements == s->fields|SIGABRT|Virtual_tmp_table::sp_set_from_select_list|sp_cursor::Select_fetch_into_spvars::send_data_with_return_type|sp_cursor::Select_fetch_into_spvars::send_data|Materialized_cursor::fetch
      CS  13.1   opt  130726  0350ad8cb0540e0f57f930b1f6e5dc225bff41bb  No bug found
      ES  10.6   dbg  040825  9b794f34b48fb7eee490b6da44edc0f33a947447  No bug found
      ES  10.6   opt  040825  9b794f34b48fb7eee490b6da44edc0f33a947447  No bug found
      ES  11.4   dbg  040825  a1c03ccd54b582e75506687ee19b273ca897f261  No bug found
      ES  11.4   opt  040825  a1c03ccd54b582e75506687ee19b273ca897f261  No bug found
      ES  11.8   dbg  151025  780565c207e9ce0ebf7d8e3d59f223801447b619  No bug found
      ES  11.8   opt  151025  780565c207e9ce0ebf7d8e3d59f223801447b619  No bug found
      

      Attachments

        Issue Links

          Activity

            People

              bar Alexander Barkov
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 0.5h
                  0.5h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.