[MDEV-40599] SIGSEGV in TDBDOS::EstimatedLength / TDBDOS::SaveBlockValues/ TXTFAM::SetNrec/ TABDEF::GetElemt - Jira

  --source include/have_partition.inc

  --disable_result_log

  INSTALL SONAME 'ha_connect';

  --disable_warnings

  DROP TABLE IF EXISTS t1;

  --enable_warnings

  perl;

  open(F,'>',"$ENV{MYSQL_TMP_DIR}/c1.dos") or die $!;

  binmode F;

  print F 'a' x 152, "\n";

  close F;

EOF

  --eval CREATE TABLE t1 (c1 INT,c2 VARCHAR(133)) ENGINE=CONNECT FILE_NAME='$MYSQL_TMP_DIR/c1.dos' MAPPED=1 PARTITION BY HASH(c1) PARTITIONS 2

  SELECT * FROM t1;

  SELECT 1 FROM t1;

CS 10.6.28 4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe (Debug, MSAN, Clang 20.1.8-20250804) Build 01/08/2026
Core was generated by `/test/MSAN_MD010826-mariadb-10.6.28-linux-x86_64-dbg/bin/mariadbd --defaults-gr'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 827552)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=11, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=11)at ./nptl/pthread_kill.c:89
#3 0x000055555694d979 in handle_fatal_signal (sig=11)at /test/msan_slow_src/10.6_dbg_msan/sql/signal_handler.cc:298
#4 0x00005555563fbe0d in SignalHandler(int) ()
#5 <signal handler called>
#6 0x00007fffc95cfe13 in TDBDOS::EstimatedLength (this=<optimized out>)at /test/msan_slow_src/10.6_dbg_msan/storage/connect/reldef.h:209
#7 0x00007fffc950f7fc in EvalColumns (g=g@entry=0x72500001e000, tdbp=tdbp@entry=0x7fffc26009f8, reset=false, mrr=false)at /test/msan_slow_src/10.6_dbg_msan/storage/connect/connect.cc:405
#8 0x00007fffc950fb4b in CntReadNext (g=0x72500001e000, tdbp=0x7fffc26009f8)at /test/msan_slow_src/10.6_dbg_msan/storage/connect/connect.cc:455
#9 0x00007fffc94f36e5 in ha_connect::rnd_next (this=0x71d000153630, buf=0x71200004dbb0 "")at /test/msan_slow_src/10.6_dbg_msan/storage/connect/ha_connect.cc:4213
#10 0x000055555648b364 in handler::ha_rnd_next (this=0x71d000153630, buf=0x71200004dbb0 "")at /test/msan_slow_src/10.6_dbg_msan/sql/handler.cc:3586
#11 0x00005555578efc27 in ha_partition::rnd_next (this=<optimized out>, buf=0x71200004dbb0 "")at /test/msan_slow_src/10.6_dbg_msan/sql/ha_partition.cc:5430
#12 0x000055555648b364 in handler::ha_rnd_next (this=0x71d000152230, buf=0x71200004dbb0 "")at /test/msan_slow_src/10.6_dbg_msan/sql/handler.cc:3586
#13 0x0000555556a20a03 in rr_sequential (info=0x71e000012108)at /test/msan_slow_src/10.6_dbg_msan/sql/records.cc:519
#14 0x0000555556f3897f in READ_RECORD::read_record (this=0x71e000012108)at /test/msan_slow_src/10.6_dbg_msan/sql/records.h:81
#15 sub_select (join=0x71a000021030, join_tab=0x71e000012030, end_of_records=<optimized out>)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_select.cc:22418
#16 0x0000555556fb3b81 in do_select (join=0x71a000021030, procedure=<optimized out>)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_select.cc:21922
#17 0x0000555556fb1559 in JOIN::exec_inner (this=0x71a000021030)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_select.cc:4939
#18 0x0000555556faeb1e in JOIN::exec (this=0x71a000021030)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_select.cc:4717
#19 0x0000555556f3a1b3 in mysql_select (thd=thd@entry=0x72b00003f018, tables=<optimized out>, fields=@0x71900002a0f0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x704000012d30, last = 0x704000012d30, elements = 1}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x7060000124b0, unit=0x72b0000431d8, select_lex=0x719000029e30)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_select.cc:5196
#20 0x0000555556f3999a in handle_select (thd=thd@entry=0x72b00003f018, lex=lex@entry=0x72b000043110, result=result@entry=0x7060000124b0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_select.cc:573
#21 0x0000555556e7da4f in execute_sqlcom_select (thd=thd@entry=0x72b00003f018, all_tables=0x71c000011030)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_parse.cc:6421
#22 0x0000555556e6d4d5 in mysql_execute_command (thd=thd@entry=0x72b00003f018, is_called_from_prepared_stmt=false)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_parse.cc:4012
#23 0x0000555556e61e09 in mysql_parse (thd=thd@entry=0x72b00003f018, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fffc9bba220)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_parse.cc:8199
#24 0x0000555556e5b82f in dispatch_command (command=COM_QUERY, thd=thd@entry=0x72b00003f018, packet=<optimized out>, packet_length=<optimized out>, blocking=true)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_parse.cc:1911
#25 0x0000555556e62915 in do_command (thd=thd@entry=0x72b00003f018, blocking=<optimized out>)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_parse.cc:1421
#26 0x0000555557334edd in do_handle_one_connection (connect=<optimized out>, connect@entry=0x70600000de18, put_in_cache=true)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_connect.cc:1393
#27 0x00005555573347ea in handle_one_connection (arg=0x70600000de18)at /test/msan_slow_src/10.6_dbg_msan/sql/sql_connect.cc:1305
#28 0x00007fffe689cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#29 0x00007fffe6929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CS 10.11.19 1dab253482dd562457c89deb68082fb647572959 (Debug, MSAN, Clang 20.1.8-20250804) Build 01/08/2026
Core was generated by `/test/MSAN_MD010826-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd --defaults-g'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 864169)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=11, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=11)at ./nptl/pthread_kill.c:89
#3 0x0000555556b23040 in handle_fatal_signal (sig=11)at /test/msan_slow_src/10.11_dbg_msan/sql/signal_handler.cc:300
#4 0x00005555565a4bed in SignalHandler(int) ()
#5 <signal handler called>
#6 0x00007fffc95cb85b in TDBDOS::SaveBlockValues (this=0x7fffc2600e80, g=0x72500001e000)at /test/msan_slow_src/10.11_dbg_msan/storage/connect/tabdos.cpp:913
#7 0x00007fffc951670f in EvalColumns (g=g@entry=0x72500001e000, tdbp=tdbp@entry=0x7fffc26009f8, reset=false, mrr=false)at /test/msan_slow_src/10.11_dbg_msan/storage/connect/connect.cc:405
#8 0x00007fffc9516a5b in CntReadNext (g=0x72500001e000, tdbp=0x7fffc26009f8)at /test/msan_slow_src/10.11_dbg_msan/storage/connect/connect.cc:455
#9 0x00007fffc94fd13d in ha_connect::rnd_next (this=0x71d000154030, buf=0x71200004dd30 "")at /test/msan_slow_src/10.11_dbg_msan/storage/connect/ha_connect.cc:4218
#10 0x0000555556639ed7 in handler::ha_rnd_next (this=0x71d000154030, buf=0x71200004dd30 "")at /test/msan_slow_src/10.11_dbg_msan/sql/handler.cc:3613
#11 0x0000555557abf1f0 in ha_partition::rnd_next (this=<optimized out>, buf=0x71200004dd30 "")at /test/msan_slow_src/10.11_dbg_msan/sql/ha_partition.cc:5446
#12 0x0000555556639ed7 in handler::ha_rnd_next (this=0x71d000152c30, buf=0x71200004dd30 "")at /test/msan_slow_src/10.11_dbg_msan/sql/handler.cc:3613
#13 0x0000555556bf55fe in rr_sequential (info=0x71e000011508)at /test/msan_slow_src/10.11_dbg_msan/sql/records.cc:519
#14 0x00005555570ffbc5 in READ_RECORD::read_record (this=0x71e000011508)at /test/msan_slow_src/10.11_dbg_msan/sql/records.h:81
#15 sub_select (join=0x71b000025330, join_tab=0x71e000011430, end_of_records=<optimized out>)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:23115
#16 0x000055555717a8e6 in do_select (join=join@entry=0x71b000025330, procedure=<optimized out>)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:22619
#17 0x0000555557178873 in JOIN::exec_inner (this=this@entry=0x71b000025330)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:5023
#18 0x0000555557176804 in JOIN::exec (this=0x71b000025330)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:4807
#19 0x000055555710191a in mysql_select (thd=thd@entry=0x72b00003f018, tables=<optimized out>, fields=@0x7190000264e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x704000012d30, last = 0x704000012d30, elements = 1}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=<optimized out>, having=<optimized out>, proc_param=<optimized out>, select_options=<optimized out>, result=<optimized out>, unit=<optimized out>, select_lex=<optimized out>)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:5285
#20 0x0000555557100bc3 in handle_select (thd=thd@entry=0x72b00003f018, lex=<optimized out>, lex@entry=0x72b0000431e8, result=result@entry=0x706000012990, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:601
#21 0x0000555557042dc2 in execute_sqlcom_select (thd=thd@entry=0x72b00003f018, all_tables=0x71c000011030)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:6461
#22 0x0000555557031fb4 in mysql_execute_command (thd=thd@entry=0x72b00003f018, is_called_from_prepared_stmt=false)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:4040
#23 0x00005555570264f0 in mysql_parse (thd=thd@entry=0x72b00003f018, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fffc9bba440)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:8219
#24 0x000055555701ff27 in dispatch_command (command=COM_QUERY, thd=thd@entry=0x72b00003f018, packet=packet@entry=0x729000069019 "", packet_length=packet_length@entry=16, blocking=true)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:1924
#25 0x0000555557026faf in do_command (thd=thd@entry=0x72b00003f018, blocking=<optimized out>)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:1434
#26 0x00005555574f457d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x70600000de78, put_in_cache=true)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_connect.cc:1486
#27 0x00005555574f3f07 in handle_one_connection (arg=0x70600000de78)at /test/msan_slow_src/10.11_dbg_msan/sql/sql_connect.cc:1398
#28 0x00007fffe689cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#29 0x00007fffe6929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CS 10.11.19 1dab253482dd562457c89deb68082fb647572959 (Optimized, MSAN, Clang 20.1.8-20250804) Build 01/08/2026
Core was generated by `/test/MSAN_MD010826-mariadb-10.11.19-linux-x86_64-opt/bin/mariadbd --defaults-g'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 877467)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=11, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=11)at ./nptl/pthread_kill.c:89
#3 0x000055555689abd7 in handle_fatal_signal (sig=11)at /test/msan_slow_src/10.11_opt_msan/sql/signal_handler.cc:300
#4 0x00005555563b376d in SignalHandler(int) ()
#5 <signal handler called>
#6 0x00007fffc9dc14ff in TDBDOS::SaveBlockValues (this=0x7fffc2e00e80, g=0x7fffc2e009f8)at /test/msan_slow_src/10.11_opt_msan/storage/connect/tabdos.cpp:913
#7 0x00007fffc9d077b6 in CntReadNext (g=0x725000061800, tdbp=0x7fffc2e009f8)at /test/msan_slow_src/10.11_opt_msan/storage/connect/connect.cc:445
#8 0x00007fffc9cef5e5 in ha_connect::rnd_next (this=0x71d00003ca30, buf=0x712000019830 "")at /test/msan_slow_src/10.11_opt_msan/storage/connect/ha_connect.cc:4218
#9 0x00005555564321b7 in handler::ha_rnd_next (this=0x71d00003ca30, buf=0x712000019830 "")at /test/msan_slow_src/10.11_opt_msan/sql/handler.cc:3613
#10 0x000055555770efc3 in ha_partition::rnd_next (this=<optimized out>, buf=0x712000019830 "")at /test/msan_slow_src/10.11_opt_msan/sql/ha_partition.cc:5446
#11 0x00005555564321b7 in handler::ha_rnd_next (this=0x71d00003ac30, buf=0x712000019830 "")at /test/msan_slow_src/10.11_opt_msan/sql/handler.cc:3613
#12 0x00005555569606a3 in rr_sequential (info=0x71e000011508)at /test/msan_slow_src/10.11_opt_msan/sql/records.cc:519
#13 0x0000555556df8aed in READ_RECORD::read_record (this=0x71e000011508)at /test/msan_slow_src/10.11_opt_msan/sql/records.h:81
#14 sub_select (join=0x71b00000fc30, join_tab=0x71e000011430, end_of_records=<optimized out>)at /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:23115
#15 0x0000555556e68934 in do_select (join=join@entry=0x71b00000fc30, procedure=<optimized out>)at /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:22619
#16 0x0000555556e66b73 in JOIN::exec_inner (this=this@entry=0x71b00000fc30)at /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:5023
#17 0x0000555556dfaa77 in JOIN::exec (this=0x71b00000fc30)at /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:4807
#18 mysql_select (thd=thd@entry=0x72b00003f018, tables=<optimized out>, fields=@0x7190000345e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x70400000acf0, last = 0x70400000acf0, elements = 1}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x7060000125d0, unit=0x72b0000430f0, select_lex=0x719000034330)at /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:5285
#19 0x0000555556df9b28 in handle_select (thd=thd@entry=0x72b00003f018, lex=lex@entry=0x72b000043018, result=result@entry=0x7060000125d0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:601
#20 0x0000555556d49d5b in execute_sqlcom_select (thd=thd@entry=0x72b00003f018, all_tables=0x71c000011030)at /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:6461
#21 0x0000555556d3cc5d in mysql_execute_command (thd=thd@entry=0x72b00003f018, is_called_from_prepared_stmt=false)at /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:4040
#22 0x0000555556d32cf6 in mysql_parse (thd=thd@entry=0x72b00003f018, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fffe5db2350)at /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:8219
#23 0x0000555556d2ce1b in dispatch_command (command=COM_QUERY, thd=thd@entry=0x72b00003f018, packet=packet@entry=0x72900003c019 "", packet_length=packet_length@entry=16, blocking=true)at /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:1924
#24 0x0000555556d338d9 in do_command (thd=thd@entry=0x72b00003f018, blocking=<optimized out>)at /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:1434
#25 0x00005555571a835d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x70600000ddb8, put_in_cache=true)at /test/msan_slow_src/10.11_opt_msan/sql/sql_connect.cc:1486
#26 0x00005555571a7cd3 in handle_one_connection (arg=0x70600000ddb8)at /test/msan_slow_src/10.11_opt_msan/sql/sql_connect.cc:1398
#27 0x00007fffe689cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#28 0x00007fffe6929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CS 11.4.13 c57069561c4fe8f72191d4a2a4a829e5b57537dc (Optimized, MSAN, Clang 20.1.8-20250804) Build 01/08/2026
Core was generated by `/test/MSAN_MD010826-mariadb-11.4.13-linux-x86_64-opt/bin/mariadbd --defaults-gr'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 918887)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=11, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=11)at ./nptl/pthread_kill.c:89
#3 0x00005555568bfdd7 in handle_fatal_signal (sig=11)at /test/msan_slow_src/11.4_opt_msan/sql/signal_handler.cc:298
#4 0x00005555563e276d in SignalHandler(int) ()
#5 <signal handler called>
#6 0x00007fffc9dd3514 in TXTFAM::SetNrec (this=0x7fff00000000, n=1)at /test/msan_slow_src/11.4_opt_msan/storage/connect/filamtxt.h:51
#7 TDBDOS::RestoreNrec (this=<optimized out>)at /test/msan_slow_src/11.4_opt_msan/storage/connect/tabdos.h:142
#8 0x00007fffc9d07da6 in CntReadNext (g=0x725000061800, tdbp=0x7fffc2e00a18)at /test/msan_slow_src/11.4_opt_msan/storage/connect/connect.cc:445
#9 0x00007fffc9cef925 in ha_connect::rnd_next (this=0x71d00003c030, buf=0x712000019cb0 "")at /test/msan_slow_src/11.4_opt_msan/storage/connect/ha_connect.cc:4202
#10 0x00005555564672c7 in handler::ha_rnd_next (this=0x71d00003c030, buf=0x712000019cb0 "")at /test/msan_slow_src/11.4_opt_msan/sql/handler.cc:3788
#11 0x000055555779ed13 in ha_partition::rnd_next (this=<optimized out>, buf=0x712000019cb0 "")at /test/msan_slow_src/11.4_opt_msan/sql/ha_partition.cc:5448
#12 0x00005555564672c7 in handler::ha_rnd_next (this=0x71d00003ac30, buf=0x712000019cb0 "")at /test/msan_slow_src/11.4_opt_msan/sql/handler.cc:3788
#13 0x000055555698da33 in rr_sequential (info=0x71f000012700)at /test/msan_slow_src/11.4_opt_msan/sql/records.cc:513
#14 0x0000555556e2296a in READ_RECORD::read_record (this=0x71f000012700)at /test/msan_slow_src/11.4_opt_msan/sql/records.h:81
#15 sub_select (join=0x71b00000fc30, join_tab=0x71f000012630, end_of_records=<optimized out>)at /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:24388
#16 0x0000555556e9240d in do_select (join=join@entry=0x71b00000fc30, procedure=<optimized out>)at /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:23882
#17 0x0000555556e900b2 in JOIN::exec_inner (this=0x71b00000fc30)at /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:5102
#18 0x0000555556e24ad6 in JOIN::exec (this=0x71b00000fc30)at /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:4893
#19 mysql_select (thd=thd@entry=0x72b00003f018, tables=<optimized out>, fields=@0x7190000241e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7040000145f0, last = 0x7040000145f0, elements = 1}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x706000012930, unit=0x72b0000430e0, select_lex=0x719000023f30)at /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:5416
#20 0x0000555556e23aa8 in handle_select (thd=thd@entry=0x72b00003f018, lex=lex@entry=0x72b000043000, result=result@entry=0x706000012930, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/msan_slow_src/11.4_opt_msan/sql/sql_select.cc:643
#21 0x0000555556d7342b in execute_sqlcom_select (thd=thd@entry=0x72b00003f018, all_tables=0x71c000011030)at /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:6222
#22 0x0000555556d675e4 in mysql_execute_command (thd=thd@entry=0x72b00003f018, is_called_from_prepared_stmt=false)at /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:4010
#23 0x0000555556d5d646 in mysql_parse (thd=thd@entry=0x72b00003f018, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fffe5db2350)at /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:7941
#24 0x0000555556d576b3 in dispatch_command (command=COM_QUERY, thd=thd@entry=0x72b00003f018, packet=packet@entry=0x72900004b019 "", packet_length=packet_length@entry=16, blocking=true)at /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:1925
#25 0x0000555556d5e229 in do_command (thd=thd@entry=0x72b00003f018, blocking=<optimized out>)at /test/msan_slow_src/11.4_opt_msan/sql/sql_parse.cc:1433
#26 0x00005555571e785d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x70600000e0b8, put_in_cache=true)at /test/msan_slow_src/11.4_opt_msan/sql/sql_connect.cc:1508
#27 0x00005555571e71e3 in handle_one_connection (arg=0x70600000e0b8)at /test/msan_slow_src/11.4_opt_msan/sql/sql_connect.cc:1420
#28 0x00007fffe689cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#29 0x00007fffe6929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CS 10.11.19 41cdc5630eb53e0e184cb685202c1ad7a69bb6a6 (Debug, MSAN, Clang 20.1.8-20250804) Build 03/08/2026
Core was generated by `/test/MSAN_MD030826-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd --defaults-g'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 1113511)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=11, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=11)at ./nptl/pthread_kill.c:89
#3 0x0000555556b1ce9a in handle_fatal_signal (sig=11)at /test/10.11_dbg_msan/sql/signal_handler.cc:298
#4 0x000055555659ed3d in SignalHandler(int) ()
#5 <signal handler called>
#6 0x00007fffc95c9768 in TABDEF::GetElemt (this=0x0)at /test/10.11_dbg_msan/storage/connect/reldef.h:83
#7 TDBDOS::MakeBlockValues (this=0x7fffc2600e80, g=0x7fffc26009f8)at /test/10.11_dbg_msan/storage/connect/tabdos.cpp:657
#8 0x00007fffc95167ca in CntReadNext (g=0x72500001e000, tdbp=0x7fffc26009f8)at /test/10.11_dbg_msan/storage/connect/connect.cc:445
#9 0x00007fffc94fcf2d in ha_connect::rnd_next (this=0x71d000154030, buf=0x71200004dd30 "")at /test/10.11_dbg_msan/storage/connect/ha_connect.cc:4218
#10 0x0000555556633db7 in handler::ha_rnd_next (this=0x71d000154030, buf=0x71200004dd30 "") at /test/10.11_dbg_msan/sql/handler.cc:3613
#11 0x0000555557ab7190 in ha_partition::rnd_next (this=<optimized out>, buf=0x71200004dd30 "") at /test/10.11_dbg_msan/sql/ha_partition.cc:5446
#12 0x0000555556633db7 in handler::ha_rnd_next (this=0x71d000152c30, buf=0x71200004dd30 "") at /test/10.11_dbg_msan/sql/handler.cc:3613
#13 0x0000555556bef45e in rr_sequential (info=0x71e000011508)at /test/10.11_dbg_msan/sql/records.cc:519
#14 0x00005555570f8d25 in READ_RECORD::read_record (this=0x71e000011508)at /test/10.11_dbg_msan/sql/records.h:81
#15 sub_select (join=0x71b000025330, join_tab=0x71e000011430, end_of_records=<optimized out>)at /test/10.11_dbg_msan/sql/sql_select.cc:23115
#16 0x0000555557173a46 in do_select (join=join@entry=0x71b000025330, procedure=<optimized out>) at /test/10.11_dbg_msan/sql/sql_select.cc:22619
#17 0x00005555571719d3 in JOIN::exec_inner (this=this@entry=0x71b000025330)at /test/10.11_dbg_msan/sql/sql_select.cc:5023
#18 0x000055555716f964 in JOIN::exec (this=0x71b000025330)at /test/10.11_dbg_msan/sql/sql_select.cc:4807
#19 0x00005555570faa7a in mysql_select (thd=thd@entry=0x72b00003f018, tables=<optimized out>, fields=@0x7190000264e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x704000012d30, last = 0x704000012d30, elements = 1}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=<optimized out>, having=<optimized out>, proc_param=<optimized out>, select_options=<optimized out>, result=<optimized out>, unit=<optimized out>, select_lex=<optimized out>)at /test/10.11_dbg_msan/sql/sql_select.cc:5285
#20 0x00005555570f9d23 in handle_select (thd=thd@entry=0x72b00003f018, lex=<optimized out>, lex@entry=0x72b0000431e8, result=result@entry=0x706000012990, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/10.11_dbg_msan/sql/sql_select.cc:601
#21 0x000055555703bf92 in execute_sqlcom_select (thd=thd@entry=0x72b00003f018, all_tables=0x71c000011030) at /test/10.11_dbg_msan/sql/sql_parse.cc:6461
#22 0x000055555702b184 in mysql_execute_command (thd=thd@entry=0x72b00003f018, is_called_from_prepared_stmt=false)at /test/10.11_dbg_msan/sql/sql_parse.cc:4040
#23 0x000055555701f6b0 in mysql_parse (thd=thd@entry=0x72b00003f018, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fffc9bba440)at /test/10.11_dbg_msan/sql/sql_parse.cc:8219
#24 0x00005555570190e7 in dispatch_command (command=COM_QUERY, thd=thd@entry=0x72b00003f018, packet=packet@entry=0x729000069019 "", packet_length=packet_length@entry=16, blocking=true)at /test/10.11_dbg_msan/sql/sql_parse.cc:1924
#25 0x000055555702016f in do_command (thd=thd@entry=0x72b00003f018, blocking=<optimized out>) at /test/10.11_dbg_msan/sql/sql_parse.cc:1434
#26 0x00005555574ed76d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x70600000de78, put_in_cache=true)at /test/10.11_dbg_msan/sql/sql_connect.cc:1486
#27 0x00005555574ed0f7 in handle_one_connection (arg=0x70600000de78)at /test/10.11_dbg_msan/sql/sql_connect.cc:1398
#28 0x00007fffe689cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#29 0x00007fffe6929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 010826 4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe SIGSEGV\|TDBDOS::EstimatedLength\|EvalColumns\|CntReadNext\|ha_connect::rnd_next
CS 10.6 opt 010826 4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe MSAN\|use-of-uninitialized-value\|storage/connect/connect.cc\|CntReadNext\|ha_connect::rnd_next\|handler::ha_rnd_next\|ha_partition::rnd_next
CS 10.11 dbg 010826 1dab253482dd562457c89deb68082fb647572959 SIGSEGV\|TDBDOS::SaveBlockValues\|EvalColumns\|CntReadNext\|ha_connect::rnd_next
CS 10.11 dbg 030826 41cdc5630eb53e0e184cb685202c1ad7a69bb6a6 SIGSEGV\|TABDEF::GetElemt\|TDBDOS::MakeBlockValues\|CntReadNext\|ha_connect::rnd_next
CS 10.11 opt 010826 1dab253482dd562457c89deb68082fb647572959 SIGSEGV\|TDBDOS::SaveBlockValues\|CntReadNext\|ha_connect::rnd_next\|handler::ha_rnd_next
CS 10.11 opt 030826 41cdc5630eb53e0e184cb685202c1ad7a69bb6a6 SIGSEGV\|TDBDOS::SaveBlockValues\|CntReadNext\|ha_connect::rnd_next\|handler::ha_rnd_next
CS 11.4 dbg 010826 c57069561c4fe8f72191d4a2a4a829e5b57537dc No bug found
CS 11.4 opt 010826 c57069561c4fe8f72191d4a2a4a829e5b57537dc SIGSEGV\|TXTFAM::SetNrec\|TDBDOS::RestoreNrec\|CntReadNext\|ha_connect::rnd_next
CS 11.8 dbg 010826 eaca80bf3208fb9657b7304b940a6726b4c86213 No bug found
CS 11.8 opt 010826 eaca80bf3208fb9657b7304b940a6726b4c86213 No bug found
CS 12.3 dbg 010826 51263b851df7093758e98c7029f091332c1c576f No bug found
CS 12.3 opt 010826 51263b851df7093758e98c7029f091332c1c576f No bug found
CS 13.0 dbg 010826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a No bug found
CS 13.0 opt 010826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a No bug found
CS 13.1 dbg 010826 548c80aeafb6dd2be64f56e902e921a4052b5fe0 No bug found
CS 13.1 opt 010826 548c80aeafb6dd2be64f56e902e921a4052b5fe0 No bug found
ES 10.6 dbg 010826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
ES 10.6 opt 010826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
ES 11.4 dbg 010826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
ES 11.4 opt 010826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
ES 11.8 dbg 010826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
ES 11.8 opt 010826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
ES 12.3 dbg 010826 c86ea989a715d9fbe1a5d760939acec22acfc0df No bug found
ES 12.3 opt 010826 c86ea989a715d9fbe1a5d760939acec22acfc0df No bug found

SIGSEGV in TDBDOS::EstimatedLength / TDBDOS::SaveBlockValues/ TXTFAM::SetNrec/ TABDEF::GetElemt

Details

Description

Attachments

Activity

People

Dates

Time Tracking

Git Integration