[MDEV-40573] Assertion `del_table == table_being_deleted' failed in multi_delete::send_data on DELETE w/ index hint + window function - Jira

XML

Word

Printable

Details

Type: Bug
Status: In Review (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 11.8, 12.3, 13.0, 13.1
Fix Version/s: 11.8, 12.3, 13.0
Component/s: Data Manipulation - Delete, Optimizer - Window functions
Labels:

Description

CREATE TABLE t (c INT);

DELETE FROM t USE KEY() WHERE 0 ORDER BY PERCENTILE_CONT(COUNT(*)) WITHIN GROUP(ORDER BY c) OVER();

Testcase is CLI/MTR compatible

Leads to:

CS 13.1.0 934108aab5cb541b3fc09672b5d4090558ab408e (Optimized, Clang 22.1.8-20260622) Build 22/07/2026
Core was generated by `/test/MD220726-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 copy_funcs (func_ptr=0x0, thd=0x6dd580000c70)at /test/13.1_opt/sql/sql_select.cc:30365

[Current thread is 1 (LWP 1703828)]
(gdb) bt
#0 copy_funcs (func_ptr=0x0, thd=0x6dd580000c70)at /test/13.1_opt/sql/sql_select.cc:30365
#1 0x000055b372d60207 in multi_delete::send_data (this=0x6dd580019570, values=<optimized out>) at /test/13.1_opt/sql/sql_delete.cc:1462
#2 0x000055b372cf1a7f in select_result_sink::send_data_with_check (this=0x0, items=@0x6dd580000c70: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55b3736bc2a0 <vtable for THD+16>, last = 0x55b373863d58 <server_threads>, elements = 1938177376}, <No data fields>}, u=0x0, sent=120763743049200)at /test/13.1_opt/sql/sql_class.cc:3317
#3 0x000055b372e017b6 in end_send (join=0x6dd5800196c0, join_tab=0x6dd58001a688, end_of_records=<optimized out>)at /test/13.1_opt/sql/sql_select.cc:26098
#4 0x000055b372e212fd in evaluate_join_record (join=join@entry=0x6dd5800196c0, join_tab=0x6dd58001a210, error=error@entry=0) at /test/13.1_opt/sql/sql_select.cc:24971
#5 0x000055b372e20e24 in AGGR_OP::end_send (this=0x6dd58001a9b0)at /test/13.1_opt/sql/sql_select.cc:33958
#6 0x000055b372e01e77 in sub_select_postjoin_aggr (join=0x6dd5800196c0, join_tab=0x6dd58001a210, end_of_records=false)at /test/13.1_opt/sql/sql_select.cc:24416
#7 0x000055b372e058a1 in do_select (join=join@entry=0x6dd5800196c0, procedure=<optimized out>) at /test/13.1_opt/sql/sql_select.cc:24251
#8 0x000055b372e05349 in JOIN::exec_inner (this=this@entry=0x6dd5800196c0)at /test/13.1_opt/sql/sql_select.cc:5125
#9 0x000055b372e2a9b8 in JOIN::exec (this=0x6dd5800196c0)at /test/13.1_opt/sql/sql_select.cc:4913
#10 Sql_cmd_dml::execute_inner (this=this@entry=0x6dd580019450, thd=thd@entry=0x6dd580000c70) at /test/13.1_opt/sql/sql_select.cc:35085
#11 0x000055b372d61899 in Sql_cmd_delete::execute_inner (this=0x6dd580019450, thd=0x6dd580000c70) at /test/13.1_opt/sql/sql_delete.cc:2169
#12 0x000055b372e2a66c in Sql_cmd_dml::execute (this=0x6dd580019450, thd=0x6dd580000c70) at /test/13.1_opt/sql/sql_select.cc:35015
#13 0x000055b372dafc3e in mysql_execute_command (thd=thd@entry=0x6dd580000c70, is_called_from_prepared_stmt=false) at /test/13.1_opt/sql/sql_parse.cc:4446
#14 0x000055b372daae2d in mysql_parse (thd=thd@entry=0x6dd580000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x75d680db34e0)at /test/13.1_opt/sql/sql_parse.cc:7958
#15 0x000055b372da9605 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x6dd580000c70, packet=packet@entry=0x6dd580008e01 "DELETE FROM t USE KEY() WHERE 0 ORDER BY PERCENTILE_CONT(COUNT(*)) WITHIN GROUP(ORDER BY c) OVER()", packet_length=packet_length@entry=98, blocking=true)at /test/13.1_opt/sql/sql_parse.cc:1903
#16 0x000055b372dab2b0 in do_command (thd=thd@entry=0x6dd580000c70, blocking=true) at /test/13.1_opt/sql/sql_parse.cc:1437
#17 0x000055b372f044fd in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55b375bb28e0, put_in_cache=true)at /test/13.1_opt/sql/sql_connect.cc:1510
#18 0x000055b372f04332 in handle_one_connection (arg=arg@entry=0x55b375bb28e0)at /test/13.1_opt/sql/sql_connect.cc:1422
#19 0x000055b3730c8793 in pfs_spawn_thread (arg=0x55b375bd3680)at /test/13.1_opt/storage/perfschema/pfs.cc:2198
#20 0x000075d68409ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#21 0x000075d684129c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CS 13.1.0 934108aab5cb541b3fc09672b5d4090558ab408e (Debug, Clang 22.1.8-20260622) Build 22/07/2026
mariadbd: /test/13.1_dbg/sql/sql_delete.cc:1424: virtual int multi_delete::send_data(List<Item> &): Assertion `del_table == table_being_deleted' failed.

CS 13.1.0 934108aab5cb541b3fc09672b5d4090558ab408e (Debug, Clang 22.1.8-20260622) Build 22/07/2026
Core was generated by `/test/MD220726-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 1707802)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
#3 0x0000757dbac4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
#4 0x0000757dbac288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x0000757dbac2881b in __assert_fail_base (fmt=0x757dbadd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x623f7388aa18 "del_table == table_being_deleted", file=file@entry=0x623f738dbb7d "/test/13.1_dbg/sql/sql_delete.cc", line=line@entry=1424, function=function@entry=0x623f73969eae "virtual int multi_delete::send_data(List<Item> &)") at ./assert/assert.c:94
#6 0x0000757dbac3b507 in __assert_fail (assertion=0x623f7388aa18 "del_table == table_being_deleted", file=0x623f738dbb7d "/test/13.1_dbg/sql/sql_delete.cc", line=1424, function=0x623f73969eae "virtual int multi_delete::send_data(List<Item> &)") at ./assert/assert.c:103
#7 0x0000623f74599cea in multi_delete::send_data (this=0x6d7cdc01bdd0, values=@0x6d7cdc01c328: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x623f75726090 <end_of_list>, last = 0x6d7cdc01d4c0, elements = 0}, <No data fields>}) at /test/13.1_dbg/sql/sql_delete.cc:1424
#8 0x0000623f744c980f in select_result_sink::send_data_with_check (this=0x6d7cdc01bdd0, items=@0x6d7cdc01c328: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x623f75726090 <end_of_list>, last = 0x6d7cdc01d4c0, elements = 0}, <No data fields>}, u=0x6d7cdc0052d0, sent=0) at /test/13.1_dbg/sql/sql_class.cc:3317
#9 0x0000623f746956bf in end_send (join=0x6d7cdc01bf20, join_tab=0x6d7cdc01cef8, end_of_records=false)at /test/13.1_dbg/sql/sql_select.cc:26098
#10 0x0000623f746be6f4 in evaluate_join_record (join=0x6d7cdc01bf20, join_tab=0x6d7cdc01ca80, error=0) at /test/13.1_dbg/sql/sql_select.cc:24971
#11 0x0000623f746be08b in AGGR_OP::end_send (this=0x6d7cdc01d220)at /test/13.1_dbg/sql/sql_select.cc:33958
#12 0x0000623f74696340 in sub_select_postjoin_aggr (join=0x6d7cdc01bf20, join_tab=0x6d7cdc01ca80, end_of_records=true)at /test/13.1_dbg/sql/sql_select.cc:24416
#13 0x0000623f7469b862 in do_select (join=0x6d7cdc01bf20, procedure=0x0)at /test/13.1_dbg/sql/sql_select.cc:24251
#14 0x0000623f7469ad06 in JOIN::exec_inner (this=0x6d7cdc01bf20)at /test/13.1_dbg/sql/sql_select.cc:5125
#15 0x0000623f7469a023 in JOIN::exec (this=0x6d7cdc01bf20)at /test/13.1_dbg/sql/sql_select.cc:4913
#16 0x0000623f746cb274 in Sql_cmd_dml::execute_inner (this=0x6d7cdc01bcb0, thd=0x6d7cdc000d60) at /test/13.1_dbg/sql/sql_select.cc:35085
#17 0x0000623f7459bdaa in Sql_cmd_delete::execute_inner (this=0x6d7cdc01bcb0, thd=0x6d7cdc000d60) at /test/13.1_dbg/sql/sql_delete.cc:2169
#18 0x0000623f746cae59 in Sql_cmd_dml::execute (this=0x6d7cdc01bcb0, thd=0x6d7cdc000d60) at /test/13.1_dbg/sql/sql_select.cc:35015
#19 0x0000623f746157c0 in mysql_execute_command (thd=0x6d7cdc000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:4446
#20 0x0000623f7460cab8 in mysql_parse (thd=0x6d7cdc000d60, rawbuf=0x6d7cdc01a430 "DELETE FROM t USE KEY() WHERE 0 ORDER BY PERCENTILE_CONT(COUNT(*)) WITHIN GROUP(ORDER BY c) OVER()", length=98, parser_state=0x757db3fb29c0) at /test/13.1_dbg/sql/sql_parse.cc:7958
#21 0x0000623f7460a1de in dispatch_command (command=COM_QUERY, thd=0x6d7cdc000d60, packet=0x6d7cdc00b661 "DELETE FROM t USE KEY() WHERE 0 ORDER BY PERCENTILE_CONT(COUNT(*)) WITHIN GROUP(ORDER BY c) OVER()", packet_length=98, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903
#22 0x0000623f7460d53a in do_command (thd=0x6d7cdc000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
#23 0x0000623f74813d0e in do_handle_one_connection (connect=0x623f77b0bda0, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1510
#24 0x0000623f74813af1 in handle_one_connection (arg=0x623f77ae7e80)at /test/13.1_dbg/sql/sql_connect.cc:1422
#25 0x0000757dbac9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#26 0x0000757dbad29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 220726 5520c9aac5b6a5a9ea60d78582ddffa5349e2d0f No bug found
CS 10.6 opt 220726 5520c9aac5b6a5a9ea60d78582ddffa5349e2d0f No bug found
CS 10.11 dbg 220726 6268f6023fe3e8dc8ec81869dea711e14cbb28c3 No bug found
CS 10.11 opt 220726 6268f6023fe3e8dc8ec81869dea711e14cbb28c3 No bug found
CS 11.4 dbg 220726 2cbce592c39dd39902c8f03db2b35069832fd10b No bug found
CS 11.4 opt 220726 2cbce592c39dd39902c8f03db2b35069832fd10b No bug found
CS 11.8 dbg 220726 1d23deff797ab448f091e39756434903d81a98c2 del_table == table_being_deleted\|SIGABRT\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
CS 11.8 opt 220726 1d23deff797ab448f091e39756434903d81a98c2 SIGSEGV\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
CS 12.3 dbg 220726 9b075b2cb53338f67e7230cc585e02d2d34514ed del_table == table_being_deleted\|SIGABRT\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
CS 12.3 opt 220726 9b075b2cb53338f67e7230cc585e02d2d34514ed SIGSEGV\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
CS 13.0 dbg 220726 84c246ca5387c0611f75097136ff4f4bea092aa3 del_table == table_being_deleted\|SIGABRT\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
CS 13.0 opt 220726 84c246ca5387c0611f75097136ff4f4bea092aa3 SIGSEGV\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
CS 13.1 dbg 220726 934108aab5cb541b3fc09672b5d4090558ab408e del_table == table_being_deleted\|SIGABRT\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
CS 13.1 opt 220726 934108aab5cb541b3fc09672b5d4090558ab408e SIGSEGV\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
ES 10.6 dbg 220726 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
ES 10.6 opt 220726 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
ES 11.4 dbg 220726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
ES 11.4 opt 220726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
ES 11.8 dbg 220726 4694e931d10fecf733c34f83ea2146d31b708eb3 del_table == table_being_deleted\|SIGABRT\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
ES 11.8 opt 220726 4694e931d10fecf733c34f83ea2146d31b708eb3 SIGSEGV\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
ES 12.3 dbg 220726 9d8abb61e913bec023cd8caeccad4b42717151cb del_table == table_being_deleted\|SIGABRT\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
ES 12.3 opt 220726 9d8abb61e913bec023cd8caeccad4b42717151cb SIGSEGV\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
MS 5.5 dbg 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
MS 5.5 opt 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
MS 5.6 dbg 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
MS 5.6 opt 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
MS 5.7 dbg 070525 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
MS 5.7 opt 070525 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
MS 8.0 dbg 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
MS 8.0 opt 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
MS 9.1 dbg 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found
MS 9.1 opt 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found

CS 13.1.0 934108aab5cb541b3fc09672b5d4090558ab408e (Debug, UBASAN, Clang 22.1.8-20260622) Build 22/07/2026
/test/13.1_dbg_san/sql/sql_delete.cc:1397:23: runtime error: load of value 165, which is not a valid value for type 'bool'
#0 0x6185389a2500 in multi_delete::send_data(List<Item>&) /test/13.1_dbg_san/sql/sql_delete.cc:1397:23
#1 0x6185386e2061 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.1_dbg_san/sql/sql_class.cc:3317:11
#2 0x618538d645ab in end_send(JOIN, st_join_table, bool) /test/13.1_dbg_san/sql/sql_select.cc:26098:40
#3 0x618538e2f9ba in evaluate_join_record(JOIN, st_join_table, int) /test/13.1_dbg_san/sql/sql_select.cc:24971:11
#4 0x618538e2d5f2 in AGGR_OP::end_send() /test/13.1_dbg_san/sql/sql_select.cc:33958:11
#5 0x618538d687c2 in sub_select_postjoin_aggr(JOIN, st_join_table, bool) /test/13.1_dbg_san/sql/sql_select.cc:24416:15
#6 0x618538d806d1 in do_select(JOIN, Procedure) /test/13.1_dbg_san/sql/sql_select.cc:24251:14
#7 0x618538d7d8e6 in JOIN::exec_inner() /test/13.1_dbg_san/sql/sql_select.cc:5125:50
#8 0x618538d7a918 in JOIN::exec() /test/13.1_dbg_san/sql/sql_select.cc:4913:8
#9 0x618538e7502f in Sql_cmd_dml::execute_inner(THD*) /test/13.1_dbg_san/sql/sql_select.cc:35085:13
#10 0x6185389ac7f0 in Sql_cmd_delete::execute_inner(THD*) /test/13.1_dbg_san/sql/sql_delete.cc:2169:39
#11 0x618538e73d05 in Sql_cmd_dml::execute(THD*) /test/13.1_dbg_san/sql/sql_select.cc:35015:9
#12 0x618538b5ad0d in mysql_execute_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:4446:27
#13 0x618538b3db0a in mysql_parse(THD, char, unsigned int, Parser_state*) /test/13.1_dbg_san/sql/sql_parse.cc:7958:18
#14 0x618538b35aee in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1903:7
#15 0x618538b3fef6 in do_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1437:17
#16 0x61853936ff0c in do_handle_one_connection(CONNECT*, bool) /test/13.1_dbg_san/sql/sql_connect.cc:1510:11
#17 0x61853936fa35 in handle_one_connection /test/13.1_dbg_san/sql/sql_connect.cc:1422:5
#18 0x7dedd8f48e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
#19 0x7dedd849ca93 in start_thread nptl/pthread_create.c:447:8
#20 0x7dedd8529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: invalid-bool-load /test/13.1_dbg_san/sql/sql_delete.cc:1397:23

CS 13.1.0 934108aab5cb541b3fc09672b5d4090558ab408e (Optimized, UBASAN, Clang 22.1.8-20260622) Build 22/07/2026
/test/13.1_opt_san/sql/sql_select.cc:30365:18: runtime error: load of null pointer of type 'Item *'
#0 0x640bf630ca0c in copy_funcs(Item*, THD const) /test/13.1_opt_san/sql/sql_select.cc:30365:18
#1 0x640bf5ec89e9 in multi_delete::send_data(List<Item>&) /test/13.1_opt_san/sql/sql_delete.cc:1462:11
#2 0x640bf5c29321 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/13.1_opt_san/sql/sql_class.cc:3317:11
#3 0x640bf623ce27 in end_send(JOIN, st_join_table, bool) /test/13.1_opt_san/sql/sql_select.cc:26098:40
#4 0x640bf62fe54a in evaluate_join_record(JOIN, st_join_table, int) /test/13.1_opt_san/sql/sql_select.cc:24971:11
#5 0x640bf62fc424 in AGGR_OP::end_send() /test/13.1_opt_san/sql/sql_select.cc:33958:11
#6 0x640bf62409f7 in sub_select_postjoin_aggr(JOIN, st_join_table, bool) /test/13.1_opt_san/sql/sql_select.cc:24416:15
#7 0x640bf6256be3 in do_select(JOIN, Procedure) /test/13.1_opt_san/sql/sql_select.cc:24251:14
#8 0x640bf6254151 in JOIN::exec_inner() /test/13.1_opt_san/sql/sql_select.cc:5125:50
#9 0x640bf625150a in JOIN::exec() /test/13.1_opt_san/sql/sql_select.cc:4913:8
#10 0x640bf633f95e in Sql_cmd_dml::execute_inner(THD*) /test/13.1_opt_san/sql/sql_select.cc:35085:13
#11 0x640bf5ed3562 in Sql_cmd_delete::execute_inner(THD*) /test/13.1_opt_san/sql/sql_delete.cc:2169:39
#12 0x640bf633ebc4 in Sql_cmd_dml::execute(THD*) /test/13.1_opt_san/sql/sql_select.cc:35015:9
#13 0x640bf6060b44 in mysql_execute_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:4446:27
#14 0x640bf6044e76 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/13.1_opt_san/sql/sql_parse.cc:7958:18
#15 0x640bf603a78e in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/13.1_opt_san/sql/sql_parse.cc:1903:7
#16 0x640bf6046d7c in do_command(THD*, bool) /test/13.1_opt_san/sql/sql_parse.cc:1437:17
#17 0x640bf67fc4dc in do_handle_one_connection(CONNECT*, bool) /test/13.1_opt_san/sql/sql_connect.cc:1510:11
#18 0x640bf67fbf7d in handle_one_connection /test/13.1_opt_san/sql/sql_connect.cc:1422:5
#19 0x640bf71dae25 in pfs_spawn_thread /test/13.1_opt_san/storage/perfschema/pfs.cc:2198:3
#20 0x70efbc748e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
#21 0x70efbbe9ca93 in start_thread nptl/pthread_create.c:447:8
#22 0x70efbbf29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use /test/13.1_opt_san/sql/sql_select.cc:30365:18

Setup:

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

SAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 220726 5520c9aac5b6a5a9ea60d78582ddffa5349e2d0f No bug found
CS 10.6 opt 220726 5520c9aac5b6a5a9ea60d78582ddffa5349e2d0f No bug found
CS 10.11 dbg 220726 6268f6023fe3e8dc8ec81869dea711e14cbb28c3 No bug found
CS 10.11 opt 220726 6268f6023fe3e8dc8ec81869dea711e14cbb28c3 No bug found
CS 11.4 dbg 220726 2cbce592c39dd39902c8f03db2b35069832fd10b No bug found
CS 11.4 opt 220726 2cbce592c39dd39902c8f03db2b35069832fd10b No bug found
CS 11.8 dbg 220726 1d23deff797ab448f091e39756434903d81a98c2 UBSAN\|load of value X, which is not a valid value for type 'bool'\|sql/sql_delete.cc\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
CS 11.8 opt 220726 1d23deff797ab448f091e39756434903d81a98c2 UBSAN\|load of null pointer of type 'Item *'\|sql/sql_select.cc\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
CS 12.3 dbg 220726 9b075b2cb53338f67e7230cc585e02d2d34514ed UBSAN\|load of value X, which is not a valid value for type 'bool'\|sql/sql_delete.cc\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
CS 12.3 opt 220726 9b075b2cb53338f67e7230cc585e02d2d34514ed UBSAN\|load of null pointer of type 'Item *'\|sql/sql_select.cc\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
CS 13.0 dbg 220726 84c246ca5387c0611f75097136ff4f4bea092aa3 UBSAN\|load of value X, which is not a valid value for type 'bool'\|sql/sql_delete.cc\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
CS 13.0 opt 220726 84c246ca5387c0611f75097136ff4f4bea092aa3 UBSAN\|load of null pointer of type 'Item *'\|sql/sql_select.cc\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
CS 13.1 dbg 220726 934108aab5cb541b3fc09672b5d4090558ab408e UBSAN\|load of value X, which is not a valid value for type 'bool'\|sql/sql_delete.cc\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
CS 13.1 opt 220726 934108aab5cb541b3fc09672b5d4090558ab408e UBSAN\|load of null pointer of type 'Item *'\|sql/sql_select.cc\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
ES 10.6 dbg 310726 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
ES 10.6 opt 310726 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
ES 11.4 dbg 310726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
ES 11.4 opt 310726 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
ES 11.8 dbg 310726 4694e931d10fecf733c34f83ea2146d31b708eb3 UBSAN\|load of value X, which is not a valid value for type 'bool'\|sql/sql_delete.cc\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
ES 11.8 opt 310726 4694e931d10fecf733c34f83ea2146d31b708eb3 UBSAN\|load of null pointer of type 'Item *'\|sql/sql_select.cc\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send
ES 12.3 dbg 310726 c1ba9a81dd4f6cdb34ca2cfe1c68ca0d68da2fca UBSAN\|load of value X, which is not a valid value for type 'bool'\|sql/sql_delete.cc\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send\|evaluate_join_record
ES 12.3 opt 310726 c1ba9a81dd4f6cdb34ca2cfe1c68ca0d68da2fca UBSAN\|load of null pointer of type 'Item *'\|sql/sql_select.cc\|copy_funcs\|multi_delete::send_data\|select_result_sink::send_data_with_check\|end_send

Attachments

Issue Links

is caused by

MDEV-30469 Support ORDER BY and LIMIT for multi-table DELETE, index hints for single-table DELETE.

Closed

relates to

MDEV-22667 Multi-delete on table with unique blob and partitions: Failing assertion: node->pcur->rel_pos == BTR_PCUR_ON, Error 126: Index is corrupted, Assertion `bitmap_is_set(&(m_part_info->read_partitions), m_last_part)' failed

Closed

MDEV-32212 DELETE with ORDER BY and semijoin optimization causing crash

Closed

Activity

People

Assignee:: Oleksandr Byelkin

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: Yesterday 05:05

Updated:: 3 hours ago

Time Tracking

Estimated:

Remaining:

0.25d

Logged:

6.75h

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.