[MDEV-40560] Assertion `n < m_size' failed in Item::split_sum_func2 on SELECT w/ multiple aggregates in ORDER BY - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.6, 10.11, 11.4, 11.8, 12.3, 13.0, 13.1
Fix Version/s: 10.6, 10.11, 11.4, 11.8, 12.3, 13.0
Component/s: Optimizer
Labels:
- ASAN
- use-after-poison

Description

CREATE TABLE t (c INT);

(SELECT * FROM t OFFSET 1 ROW) ORDER BY c OR COUNT(*) AND 1 || COUNT(*) OR NOT COUNT(*);

Testcase is CLI and MTR compatible.

The ref_ptrs slice is sized by winfunc_factor in st_select_lex::get_cardinality_of_ref_ptrs_slice, which is 1 when the statement has no window function. This testcase has none, and three aggregates in the ORDER BY of a bracketed SELECT still run past the end of the array. ~~MDEV-32317~~ covered the window function route only.

Leads to:

CS 11.8.9 1d23deff797ab448f091e39756434903d81a98c2 (Debug, Clang 22.1.8-20260622) Build 22/07/2026
Core was generated by `/test/MD220726-mariadb-11.8.9-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 2829249)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
#3 0x0000741b6e04526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
#4 0x0000741b6e0288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x0000741b6e02881b in __assert_fail_base (fmt=0x741b6e1d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x58be31a6002a "n < m_size", file=file@entry=0x58be31abf738 "sql/sql_array.h", line=line@entry=65, function=function@entry=0x58be31a1a992 "Element_type &Bounds_checked_array<Item >::operator[](size_t) [Element_type = Item ]") at ./assert/assert.c:94
#6 0x0000741b6e03b507 in __assert_fail (assertion=0x58be31a6002a "n < m_size", file=0x58be31abf738 "sql/sql_array.h", line=65, function=0x58be31a1a992 "Element_type &Bounds_checked_array<Item >::operator[](size_t) [Element_type = Item ]") at ./assert/assert.c:103
#7 0x000058be322960ae in Bounds_checked_array<Item*>::operator[] (this=0x741b6c5b0440, n=5) at sql/sql_array.h:65
#8 0x000058be322779d5 in Item::split_sum_func2 (this=0x6c1a4001bd90, thd=0x6c1a40000d58, ref_pointer_array={m_array = 0x6c1a4001eb08, m_size = 5}, fields=@0x6c1a4001db10: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6c1a4001f1d0, last = 0x6c1a4001c620, elements = 5}, <No data fields>}, ref=0x6c1a4001bf38, split_flags=3) at sql/item.cc:2415
#9 0x000058be322a8a34 in Item_func::split_sum_func (this=0x6c1a4001beb8, thd=0x6c1a40000d58, ref_pointer_array={m_array = 0x6c1a4001eb08, m_size = 5}, fields=@0x6c1a4001db10: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6c1a4001f1d0, last = 0x6c1a4001c620, elements = 5}, <No data fields>}, flags=3) at sql/item_func.cc:637
#10 0x000058be322778ea in Item::split_sum_func2 (this=0x6c1a4001beb8, thd=0x6c1a40000d58, ref_pointer_array={m_array = 0x6c1a4001eb08, m_size = 5}, fields=@0x6c1a4001db10: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6c1a4001f1d0, last = 0x6c1a4001c620, elements = 5}, <No data fields>}, ref=0x6c1a4001bf78, split_flags=3) at sql/item.cc:2386
#11 0x000058be32253ae2 in Item_cond::split_sum_func (this=0x6c1a4001ba60, thd=0x6c1a40000d58, ref_pointer_array={m_array = 0x6c1a4001eb08, m_size = 5}, fields=@0x6c1a4001db10: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6c1a4001f1d0, last = 0x6c1a4001c620, elements = 5}, <No data fields>}, flags=2) at sql/item_cmpfunc.cc:5551
#12 0x000058be3266795f in JOIN::prepare (this=0x6c1a4001d768, tables_init=0x6c1a4001c660, conds_init=0x0, og_num=1, order_init=0x6c1a4001bf98, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x6c1a4001c038, unit_arg=0x6c1a400050a8) at sql/sql_select.cc:1737
#13 0x000058be32662f7c in mysql_select (thd=0x6c1a40000d58, tables=0x6c1a4001c660, fields=@0x6c1a4001c2f0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6c1a4001c620, last = 0x6c1a4001c620, elements = 1}, <No data fields>}, conds=0x0, og_num=1, order=0x6c1a4001bf98, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x6c1a4001d740, unit=0x6c1a400050a8, select_lex=0x6c1a4001c038)at sql/sql_select.cc:5397
#14 0x000058be32662b7d in handle_select (thd=0x6c1a40000d58, lex=0x6c1a40004fc8, result=0x6c1a4001d740, setup_tables_done_option=0)at sql/sql_select.cc:634
#15 0x000058be3260db2a in execute_sqlcom_select (thd=0x6c1a40000d58, all_tables=0x6c1a4001c660) at sql/sql_parse.cc:6232
#16 0x000058be3260410e in mysql_execute_command (thd=0x6c1a40000d58, is_called_from_prepared_stmt=false) at sql/sql_parse.cc:4014
#17 0x000058be325fce18 in mysql_parse (thd=0x6c1a40000d58, rawbuf=0x6c1a40019e30 "(SELECT * FROM t OFFSET 1 ROW) ORDER BY c OR COUNT() AND 1 \|\| COUNT() OR NOT COUNT(*)", length=87, parser_state=0x741b6c5b2a10)at sql/sql_parse.cc:7953
#18 0x000058be325fa56a in dispatch_command (command=COM_QUERY, thd=0x6c1a40000d58, packet=0x6c1a4000b079 "(SELECT * FROM t OFFSET 1 ROW) ORDER BY c OR COUNT() AND 1 \|\| COUNT() OR NOT COUNT(*)", packet_length=87, blocking=true)at sql/sql_parse.cc:1923
#19 0x000058be325fd89a in do_command (thd=0x6c1a40000d58, blocking=true)at sql/sql_parse.cc:1431
#20 0x000058be327ef88e in do_handle_one_connection (connect=0x58be34d868b8, put_in_cache=true) at sql/sql_connect.cc:1511
#21 0x000058be327ef671 in handle_one_connection (arg=0x58be34e68bd8)at sql/sql_connect.cc:1423
#22 0x0000741b6e09ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#23 0x0000741b6e129c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 220726 5520c9aac5b6a5a9ea60d78582ddffa5349e2d0f n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_cond::split_sum_func\|JOIN::prepare
CS 10.6 opt 220726 5520c9aac5b6a5a9ea60d78582ddffa5349e2d0f No bug found
CS 10.11 dbg 220726 6268f6023fe3e8dc8ec81869dea711e14cbb28c3 n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_cond::split_sum_func\|JOIN::prepare
CS 10.11 opt 220726 6268f6023fe3e8dc8ec81869dea711e14cbb28c3 No bug found
CS 11.4 dbg 220726 2cbce592c39dd39902c8f03db2b35069832fd10b n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
CS 11.4 opt 220726 2cbce592c39dd39902c8f03db2b35069832fd10b No bug found
CS 11.8 dbg 220726 1d23deff797ab448f091e39756434903d81a98c2 n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
CS 11.8 opt 220726 1d23deff797ab448f091e39756434903d81a98c2 No bug found
CS 12.3 dbg 220726 9b075b2cb53338f67e7230cc585e02d2d34514ed n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
CS 12.3 opt 220726 9b075b2cb53338f67e7230cc585e02d2d34514ed No bug found
CS 13.0 dbg 220726 84c246ca5387c0611f75097136ff4f4bea092aa3 n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
CS 13.0 opt 220726 84c246ca5387c0611f75097136ff4f4bea092aa3 No bug found
CS 13.1 dbg 220726 934108aab5cb541b3fc09672b5d4090558ab408e n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
CS 13.1 opt 220726 934108aab5cb541b3fc09672b5d4090558ab408e No bug found
ES 10.6 dbg 220726 fcecb2620f25965723d640decede7c018bcb1dcc n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_cond::split_sum_func\|JOIN::prepare
ES 10.6 opt 220726 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
ES 11.4 dbg 220726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
ES 11.4 opt 220726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
ES 11.8 dbg 220726 4694e931d10fecf733c34f83ea2146d31b708eb3 n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
ES 11.8 opt 220726 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
ES 12.3 dbg 220726 9d8abb61e913bec023cd8caeccad4b42717151cb n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
ES 12.3 opt 220726 9d8abb61e913bec023cd8caeccad4b42717151cb No bug found
MS 5.5 dbg 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
MS 5.5 opt 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
MS 5.6 dbg 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
MS 5.6 opt 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
MS 5.7 dbg 070525 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
MS 5.7 opt 070525 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
MS 8.0 dbg 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
MS 8.0 opt 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
MS 9.1 dbg 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found
MS 9.1 opt 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found

On optimized builds the overrun is silent. An ASAN build catches the write:

CS 13.1.0 934108aab5cb541b3fc09672b5d4090558ab408e (Optimized, UBASAN, Clang 22.1.8-20260622) Build 22/07/2026
==2192149==ERROR: AddressSanitizer: use-after-poison on address 0x7a538fda1760 at pc 0x626413038cb4 bp 0x6f82902ffc10 sp 0x6f82902ffc08
WRITE of size 8 at 0x7a538fda1760 thread T14
#0 0x626413038cb3 in setup_copy_fields(THD, TMP_TABLE_PARAM, Bounds_checked_array<Item*>, List<Item>&, List<Item>&, unsigned int, List<Item>&) sql/sql_select.cc:29828:74
#1 0x626413021b7b in JOIN::make_aggr_tables_info() sql/sql_select.cc:4216:5
#2 0x626412fd5bcf in JOIN::optimize_stage2() sql/sql_select.cc:3576:7
#3 0x626412fcc86f in JOIN::optimize_inner() sql/sql_select.cc:2789:9
#4 0x626412fc7cab in JOIN::optimize() sql/sql_select.cc:2016:10
#5 0x626412fa85b6 in mysql_select(THD, TABLE_LIST, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) sql/sql_select.cc:5425:19
#6 0x626412fa6f7f in handle_select(THD, LEX, select_result*, unsigned long long) sql/sql_select.cc:636:10
#7 0x626412e6bae3 in execute_sqlcom_select(THD, TABLE_LIST) sql/sql_parse.cc:6217:12
#8 0x626412e509fc in mysql_execute_command(THD*, bool) sql/sql_parse.cc:3991:12
#9 0x626412e34e76 in mysql_parse(THD, char, unsigned int, Parser_state*) sql/sql_parse.cc:7958:18
#10 0x626412e2a78e in dispatch_command(enum_server_command, THD, char, unsigned int, bool) sql/sql_parse.cc:1903:7
#11 0x626412e36d7c in do_command(THD*, bool) sql/sql_parse.cc:1437:17
#12 0x6264135ec4dc in do_handle_one_connection(CONNECT*, bool) sql/sql_connect.cc:1510:11
#13 0x6264135ebf7d in handle_one_connection sql/sql_connect.cc:1422:5
#14 0x626413fcae25 in pfs_spawn_thread storage/perfschema/pfs.cc:2198:3
#15 0x7b8391548e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
#16 0x7b8390a9ca93 in start_thread nptl/pthread_create.c:447:8
#17 0x7b8390b29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x7a538fda1760 is located 21344 bytes inside of 32768-byte region [0x7a538fd9c400,0x7a538fda4400)
allocated by thread T14 here:
#0 0x7b839154b594 in malloc /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3
#1 0x626414e49195 in my_malloc mysys/my_malloc.c:93:29
#2 0x626414e1a0d8 in reset_root_defaults mysys/my_alloc.c:249:30
#3 0x626412a06543 in THD::init_for_queries() sql/sql_class.cc:1563:3
#4 0x6264135eaf59 in prepare_new_connection_state(THD*) sql/sql_connect.cc:1348:8
#5 0x6264135edf22 in thd_prepare_connection(THD*) sql/sql_connect.cc:1443:3
#6 0x6264135ec4c3 in do_handle_one_connection(CONNECT*, bool) sql/sql_connect.cc:1500:9
#7 0x6264135ebf7d in handle_one_connection sql/sql_connect.cc:1422:5
#8 0x626413fcae25 in pfs_spawn_thread storage/perfschema/pfs.cc:2198:3
#9 0x7b8391548e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28

Thread T14 created by T0 here:
#0 0x7b839152eae1 in pthread_create /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:257:3
#1 0x626413fcb411 in my_thread_create(unsigned long, pthread_attr_t const, void* ()(void), void*) storage/perfschema/my_thread.h:38:10
#2 0x626413fcb411 in pfs_spawn_thread_v1 storage/perfschema/pfs.cc:2249:15
#3 0x626411ea202f in inline_mysql_thread_create(unsigned int, unsigned long, pthread_attr_t const, void* ()(void), void*) include/mysql/psi/mysql_thread.h:1139:11
#4 0x626411ea202f in create_thread_to_handle_connection(CONNECT*) sql/mysqld.cc:6523:19
#5 0x626411ea3828 in handle_connections_sockets() sql/mysqld.cc:6759:9
#6 0x626411ea1762 in run_main_loop() sql/mysqld.cc:5993:3
#7 0x626411e946d1 in mysqld_main(int, char**) sql/mysqld.cc:6419:3
#8 0x7b8390a2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#9 0x7b8390a2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#10 0x626411e89934 in _start (/test/UBASAN_MD220726-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd+0x371b934)

SUMMARY: AddressSanitizer: use-after-poison sql/sql_select.cc:29828:74 in setup_copy_fields(THD, TMP_TABLE_PARAM, Bounds_checked_array<Item*>, List<Item>&, List<Item>&, unsigned int, List<Item>&)
Shadow bytes around the buggy address:
0x7a538fda1480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 f7
0x7a538fda1500: 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7a538fda1580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7a538fda1600: 00 00 00 00 00 00 00 00 00 f7 01 f7 f7 04 f7 f7
0x7a538fda1680: 02 f7 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7a538fda1700: 00 00 00 00 00 00 00 00 00 00 00 00[f7]f7 00 00
0x7a538fda1780: f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7a538fda1800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7a538fda1880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7a538fda1900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7a538fda1980: 00 00 00 00 00 00 00 00 f7 f7 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb

NOTE: the stack trace above identifies the code that accessed the poisoned memory.
To identify the code that poisoned the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=<size>.
==2192149==ABORTING

Setup:

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O2 -march=native -mtune=native'" and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1

SAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 220726 5520c9aac5b6a5a9ea60d78582ddffa5349e2d0f n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_cond::split_sum_func\|JOIN::prepare
CS 10.6 opt 220726 5520c9aac5b6a5a9ea60d78582ddffa5349e2d0f ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner
CS 10.11 dbg 220726 6268f6023fe3e8dc8ec81869dea711e14cbb28c3 n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_cond::split_sum_func\|JOIN::prepare
CS 10.11 opt 220726 6268f6023fe3e8dc8ec81869dea711e14cbb28c3 ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner
CS 11.4 dbg 220726 2cbce592c39dd39902c8f03db2b35069832fd10b n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
CS 11.4 opt 220726 2cbce592c39dd39902c8f03db2b35069832fd10b ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner
CS 11.8 dbg 220726 1d23deff797ab448f091e39756434903d81a98c2 n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
CS 11.8 opt 220726 1d23deff797ab448f091e39756434903d81a98c2 ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner
CS 12.3 dbg 220726 9b075b2cb53338f67e7230cc585e02d2d34514ed n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
CS 12.3 opt 220726 9b075b2cb53338f67e7230cc585e02d2d34514ed ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner
CS 13.0 dbg 220726 84c246ca5387c0611f75097136ff4f4bea092aa3 n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
CS 13.0 opt 220726 84c246ca5387c0611f75097136ff4f4bea092aa3 ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner
CS 13.1 dbg 220726 934108aab5cb541b3fc09672b5d4090558ab408e n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
CS 13.1 opt 220726 934108aab5cb541b3fc09672b5d4090558ab408e ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner
ES 10.6 dbg 310726 fcecb2620f25965723d640decede7c018bcb1dcc n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_cond::split_sum_func\|JOIN::prepare
ES 10.6 opt 310726 fcecb2620f25965723d640decede7c018bcb1dcc ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner
ES 11.4 dbg 310726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
ES 11.4 opt 310726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner
ES 11.8 dbg 310726 4694e931d10fecf733c34f83ea2146d31b708eb3 n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
ES 11.8 opt 310726 4694e931d10fecf733c34f83ea2146d31b708eb3 ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner
ES 12.3 dbg 310726 c1ba9a81dd4f6cdb34ca2cfe1c68ca0d68da2fca n < m_size\|SIGABRT\|Bounds_checked_array<Item*>::operator[]\|Item::split_sum_func2\|Item_func::split_sum_func\|Item::split_sum_func2
ES 12.3 opt 310726 c1ba9a81dd4f6cdb34ca2cfe1c68ca0d68da2fca ASAN\|use-after-poison\|sql/sql_select.cc\|setup_copy_fields\|JOIN::make_aggr_tables_info\|JOIN::optimize_stage2\|JOIN::optimize_inner

Attachments

Issue Links

relates to

MDEV-32317 ref_ptrs exhaust on multiple ORDER by func from winfunc

Closed

MDEV-37422 SIGSEGV failed in base_list_iterator::replace, Assertion `n < m_size' in Bounds_checked_array, ASAN use-after-poison in JOIN::rollup_make_fields

Closed

Activity

People

Assignee:: Aleksey Midenkov

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2 days ago 07:13

Updated:: 2 days ago 22:28

Time Tracking

Estimated:

Not Specified

Remaining:

Not Specified

Logged:

0.75h

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.