Details
-
Bug
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
-
10.11
-
Can result in hang or crash
Description
CLI based sql test case:-
CREATE TABLE t1 (c2 INT,KEY(c2)); |
SET optimizer_trace=1; |
SELECT 1 FROM t1 WHERE c2=RAND(1) GROUP BY c2 LIMIT 1; |
Leads to:
|
CS 10.11.19 1dab253482dd562457c89deb68082fb647572959 (Optimized, MSAN, Clang 20.1.8-20250804) Build 01/08/2026 |
==231751==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x5eb474e1c853 in sel_arg_range_seq_next(void*, st_key_multi_range*) /test/msan_slow_src/10.11_opt_msan/sql/opt_range_mrr.cc:236:55
|
#1 0x5eb474e2a48e in trace_ranges(Json_writer_array*, PARAM*, unsigned int, SEL_ARG*, st_key_part_info const*) /test/msan_slow_src/10.11_opt_msan/sql/opt_range.cc:16887:11
|
#2 0x5eb474e47873 in get_best_group_min_max(PARAM*, SEL_TREE*, double) /test/msan_slow_src/10.11_opt_msan/sql/opt_range.cc:14411:11
|
#3 0x5eb474e30ee0 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool, Item_func::Bitmap) /test/msan_slow_src/10.11_opt_msan/sql/opt_range.cc:3062:23
|
#4 0x5eb4753a1be3 in make_join_select(JOIN*, SQL_SELECT*, Item*) /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:13740:21
|
#5 0x5eb47537ca52 in JOIN::optimize_stage2() /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:2981:7
|
#6 0x5eb475378888 in JOIN::optimize_inner() /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:2705:9
|
#7 0x5eb47535cd90 in JOIN::optimize() /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:1967:10
|
#8 0x5eb47535cd90 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:5271:19
|
#9 0x5eb47535bb27 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:601:10
|
#10 0x5eb4752abd5a in execute_sqlcom_select(THD*, TABLE_LIST*) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:6461:12
|
#11 0x5eb47529ec5c in mysql_execute_command(THD*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:4040:12
|
#12 0x5eb475294cf5 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:8219:18
|
#13 0x5eb47528ee1a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:1924:7
|
#14 0x5eb4752958d8 in do_command(THD*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:1434:17
|
#15 0x5eb47570a35c in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_connect.cc:1486:11
|
#16 0x5eb475709cd2 in handle_one_connection /test/msan_slow_src/10.11_opt_msan/sql/sql_connect.cc:1398:5
|
#17 0x7b45cac9cb83 in start_thread nptl/pthread_create.c:447:8
|
#18 0x7b45cad29d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Memory was marked as uninitialized
|
#0 0x5eb4748c5aa1 in __msan_allocated_memory (/test/MSAN_MD010826-mariadb-10.11.19-linux-x86_64-opt/bin/mariadbd+0xe0faa1) (BuildId: 11196b81d08252e74b6f74eb5d4803d04980156f)
|
#1 0x5eb47646180e in my_malloc /test/msan_slow_src/10.11_opt_msan/mysys/my_malloc.c:116:7
|
#2 0x5eb476444345 in alloc_root /test/msan_slow_src/10.11_opt_msan/mysys/my_alloc.c:288:30
|
#3 0x5eb474e59e35 in Sql_alloc::operator new(unsigned long) /test/msan_slow_src/10.11_opt_msan/sql/sql_alloc.h:28:12
|
#4 0x5eb474e59e35 in Item_bool_func::get_mm_parts(RANGE_OPT_PARAM*, Field*, Item_func::Functype, Item*) /test/msan_slow_src/10.11_opt_msan/sql/opt_range.cc:8818:17
|
#5 0x5eb474e5fc00 in Item_bool_func::get_full_func_mm_tree(RANGE_OPT_PARAM*, Item_field*, Item*) /test/msan_slow_src/10.11_opt_msan/sql/opt_range.cc:8439:12
|
#6 0x5eb474aa8935 in Item_bool_func::get_full_func_mm_tree_for_args(RANGE_OPT_PARAM*, Item*, Item*) /test/msan_slow_src/10.11_opt_msan/sql/item_cmpfunc.h:222:7
|
#7 0x5eb474aa8935 in Item_bool_func2_with_rev::get_mm_tree(RANGE_OPT_PARAM*, Item**) /test/msan_slow_src/10.11_opt_msan/sql/item_cmpfunc.h:567:18
|
#8 0x5eb474e30974 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool, Item_func::Bitmap) /test/msan_slow_src/10.11_opt_msan/sql/opt_range.cc:2908:23
|
#9 0x5eb4753a1be3 in make_join_select(JOIN*, SQL_SELECT*, Item*) /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:13740:21
|
#10 0x5eb47537ca52 in JOIN::optimize_stage2() /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:2981:7
|
#11 0x5eb475378888 in JOIN::optimize_inner() /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:2705:9
|
#12 0x5eb47535cd90 in JOIN::optimize() /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:1967:10
|
#13 0x5eb47535cd90 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:5271:19
|
#14 0x5eb47535bb27 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/msan_slow_src/10.11_opt_msan/sql/sql_select.cc:601:10
|
#15 0x5eb4752abd5a in execute_sqlcom_select(THD*, TABLE_LIST*) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:6461:12
|
#16 0x5eb47529ec5c in mysql_execute_command(THD*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:4040:12
|
#17 0x5eb475294cf5 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:8219:18
|
#18 0x5eb47528ee1a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:1924:7
|
#19 0x5eb4752958d8 in do_command(THD*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_parse.cc:1434:17
|
#20 0x5eb47570a35c in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/10.11_opt_msan/sql/sql_connect.cc:1486:11
|
#21 0x5eb475709cd2 in handle_one_connection /test/msan_slow_src/10.11_opt_msan/sql/sql_connect.cc:1398:5
|
#22 0x7b45cac9cb83 in start_thread nptl/pthread_create.c:447:8
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/msan_slow_src/10.11_opt_msan/sql/opt_range_mrr.cc:236:55 in sel_arg_range_seq_next(void*, st_key_multi_range*)
|
|
CS 10.11.19 1dab253482dd562457c89deb68082fb647572959 (Debug, MSAN, Clang 20.1.8-20250804) Build 01/08/2026 |
==233333==WARNING: MemorySanitizer: use-of-uninitialized-value
|
#0 0x566fa4e1e64f in sel_arg_range_seq_next(void*, st_key_multi_range*) /test/msan_slow_src/10.11_dbg_msan/sql/opt_range_mrr.cc:236:55
|
#1 0x566fa4e2d5ad in trace_ranges(Json_writer_array*, PARAM*, unsigned int, SEL_ARG*, st_key_part_info const*) /test/msan_slow_src/10.11_dbg_msan/sql/opt_range.cc:16887:11
|
#2 0x566fa4e51826 in get_best_group_min_max(PARAM*, SEL_TREE*, double) /test/msan_slow_src/10.11_dbg_msan/sql/opt_range.cc:14411:11
|
#3 0x566fa4e35cb0 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool, Item_func::Bitmap) /test/msan_slow_src/10.11_dbg_msan/sql/opt_range.cc:3062:23
|
#4 0x566fa542a506 in make_join_select(JOIN*, SQL_SELECT*, Item*) /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:13740:21
|
#5 0x566fa5400791 in JOIN::optimize_stage2() /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:2981:7
|
#6 0x566fa53fbd38 in JOIN::optimize_inner() /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:2705:9
|
#7 0x566fa53decb7 in JOIN::optimize() /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:1967:10
|
#8 0x566fa53decb7 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:5271:19
|
#9 0x566fa53ddbc2 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/msan_slow_src/10.11_dbg_msan/sql/sql_select.cc:601:10
|
#10 0x566fa531fdc1 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:6461:12
|
#11 0x566fa530efb3 in mysql_execute_command(THD*, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:4040:12
|
#12 0x566fa53034ef in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:8219:18
|
#13 0x566fa52fcf26 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:1924:7
|
#14 0x566fa5303fae in do_command(THD*, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_parse.cc:1434:17
|
#15 0x566fa57d157c in do_handle_one_connection(CONNECT*, bool) /test/msan_slow_src/10.11_dbg_msan/sql/sql_connect.cc:1486:11
|
#16 0x566fa57d0f06 in handle_one_connection /test/msan_slow_src/10.11_dbg_msan/sql/sql_connect.cc:1398:5
|
#17 0x7d1d0b09cb83 in start_thread nptl/pthread_create.c:447:8
|
#18 0x7d1d0b129d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
Memory was marked as uninitialized
|
#0 0x566fa4831f21 in __msan_allocated_memory (/test/MSAN_MD010826-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd+0x1000f21) (BuildId: 6999d25a3f2d8b356f53183bbc8e90162d24134e)
|
#1 0x566fa6832741 in my_malloc /test/msan_slow_src/10.11_dbg_msan/mysys/my_malloc.c:116:7
|
|
|
SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/msan_slow_src/10.11_dbg_msan/sql/opt_range_mrr.cc:236:55 in sel_arg_range_seq_next(void*, st_key_multi_range*)
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O2 -march=native -mtune=native'" and:
|
-DWITH_MSAN=ON # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)
|
Set before execution:
|
export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0
|
|
MSAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 010826 4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe No bug found
|
CS 10.6 opt 010826 4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe No bug found
|
CS 10.11 dbg 010826 1dab253482dd562457c89deb68082fb647572959 MSAN|use-of-uninitialized-value|sql/opt_range_mrr.cc|sel_arg_range_seq_next|trace_ranges|get_best_group_min_max|SQL_SELECT::test_quick_select
|
CS 10.11 dbg 030826 41cdc5630eb53e0e184cb685202c1ad7a69bb6a6 MSAN|use-of-uninitialized-value|sql/opt_range_mrr.cc|sel_arg_range_seq_next|trace_ranges|get_best_group_min_max|SQL_SELECT::test_quick_select
|
CS 10.11 opt 010826 1dab253482dd562457c89deb68082fb647572959 MSAN|use-of-uninitialized-value|sql/opt_range_mrr.cc|sel_arg_range_seq_next|trace_ranges|get_best_group_min_max|SQL_SELECT::test_quick_select
|
CS 10.11 opt 030826 41cdc5630eb53e0e184cb685202c1ad7a69bb6a6 MSAN|use-of-uninitialized-value|sql/opt_range_mrr.cc|sel_arg_range_seq_next|trace_ranges|get_best_group_min_max|SQL_SELECT::test_quick_select
|
CS 11.4 dbg 010826 c57069561c4fe8f72191d4a2a4a829e5b57537dc No bug found
|
CS 11.4 opt 010826 c57069561c4fe8f72191d4a2a4a829e5b57537dc No bug found
|
CS 11.8 dbg 010826 eaca80bf3208fb9657b7304b940a6726b4c86213 No bug found
|
CS 11.8 opt 010826 eaca80bf3208fb9657b7304b940a6726b4c86213 No bug found
|
CS 12.3 dbg 010826 51263b851df7093758e98c7029f091332c1c576f No bug found
|
CS 12.3 opt 010826 51263b851df7093758e98c7029f091332c1c576f No bug found
|
CS 13.0 dbg 010826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a No bug found
|
CS 13.0 opt 010826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a No bug found
|
CS 13.1 dbg 010826 548c80aeafb6dd2be64f56e902e921a4052b5fe0 No bug found
|
CS 13.1 opt 010826 548c80aeafb6dd2be64f56e902e921a4052b5fe0 No bug found
|
ES 10.6 dbg 010826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 10.6 opt 010826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 11.4 dbg 010826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.4 opt 010826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.8 dbg 010826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 11.8 opt 010826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 12.3 dbg 010826 c86ea989a715d9fbe1a5d760939acec22acfc0df No bug found
|
ES 12.3 opt 010826 c86ea989a715d9fbe1a5d760939acec22acfc0df No bug found
|
