Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40633

SIGSEGV in collect_indexed_vcols_for_table

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Q3/2026 Server Development

    Description

      CREATE TABLE t1 (c1 LONGTEXT,c2 VECTOR(1));
      INSERT INTO t1 VALUES (REPEAT('a',32),NULL);
      SELECT c1 FROM t1 UNION SELECT c2 FROM t1;
      

      Leads to:

      CS 13.0.2 84c246ca5387c0611f75097136ff4f4bea092aa3 (Optimized, Clang 22.1.8-20260622) Build 29/07/2026

      Core was generated by `/test/MD290726-mariadb-13.0.2-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  collect_indexed_vcols_for_table (table=0x72d658058bd0, vcol_fields=vcol_fields@entry=0x7ad74c06e830)at /test/13.0_opt/sql/opt_vcol_substitution.cc:139
       
      [Current thread is 1 (LWP 3520811)]
      (gdb) bt
      #0  collect_indexed_vcols_for_table (table=0x72d658058bd0, vcol_fields=vcol_fields@entry=0x7ad74c06e830)at /test/13.0_opt/sql/opt_vcol_substitution.cc:139
      #1  0x000056189dd78590 in collect_indexed_vcols_for_join (join=0x72d65801ba70, vcol_fields=0x7ad74c06e830)at /test/13.0_opt/sql/opt_vcol_substitution.cc:160
      #2  substitute_indexed_vcols_for_join (join=join@entry=0x72d65801ba70)at /test/13.0_opt/sql/opt_vcol_substitution.cc:290
      #3  0x000056189de87412 in JOIN::optimize_inner (this=this@entry=0x72d65801ba70)at /test/13.0_opt/sql/sql_select.cc:2472
      #4  0x000056189de80da9 in JOIN::optimize (this=0x72d65801ba70)at /test/13.0_opt/sql/sql_select.cc:2016
      #5  mysql_select (thd=0x72d658000c70, tables=<optimized out>, fields=<optimized out>, conds=conds@entry=0x0, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x72d65801a6a0, unit=0x72d6580051b8, select_lex=0x72d65801a0c0)at /test/13.0_opt/sql/sql_select.cc:5425
      #6  0x000056189df19031 in st_select_lex_unit::exec_inner (this=0x72d6580051b8)at /test/13.0_opt/sql/sql_union.cc:2551
      #7  0x000056189df14255 in mysql_union (thd=thd@entry=0x72d658000c70, lex=<optimized out>, result=result@entry=0x72d65801a6a0, unit=0x72d6580051b8, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/13.0_opt/sql/sql_union.cc:45
      #8  0x000056189de80753 in handle_select (thd=thd@entry=0x72d658000c70, lex=0x0, lex@entry=0x72d6580050d8, result=result@entry=0x72d65801a6a0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/13.0_opt/sql/sql_select.cc:626
      #9  0x000056189de4e557 in execute_sqlcom_select (thd=thd@entry=0x72d658000c70, all_tables=0x72d6580182c0) at /test/13.0_opt/sql/sql_parse.cc:6217
      #10 0x000056189de49f89 in mysql_execute_command (thd=thd@entry=0x72d658000c70, is_called_from_prepared_stmt=false) at /test/13.0_opt/sql/sql_parse.cc:3991
      #11 0x000056189de452ad in mysql_parse (thd=thd@entry=0x72d658000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7ad74c06f4f0)at /test/13.0_opt/sql/sql_parse.cc:7945
      #12 0x000056189de43a7f in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x72d658000c70, packet=packet@entry=0x72d658008d91 "SELECT c1 FROM t1 UNION SELECT c2 FROM t1", packet_length=packet_length@entry=41, blocking=true)at /test/13.0_opt/sql/sql_parse.cc:1903
      #13 0x000056189de45730 in do_command (thd=thd@entry=0x72d658000c70, blocking=true) at /test/13.0_opt/sql/sql_parse.cc:1437
      #14 0x000056189df6d91d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5618af2c7860, put_in_cache=true)at /test/13.0_opt/sql/sql_connect.cc:1510
      #15 0x000056189df6d752 in handle_one_connection (arg=arg@entry=0x5618af2c7860)at /test/13.0_opt/sql/sql_connect.cc:1422
      #16 0x000056189e310133 in pfs_spawn_thread (arg=0x5618af2e7c50)at /test/13.0_opt/storage/perfschema/pfs.cc:2198
      #17 0x00007ad74f69cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #18 0x00007ad74f729d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      CS 13.0.2 84c246ca5387c0611f75097136ff4f4bea092aa3 (Debug, Clang 22.1.8-20260622) Build 29/07/2026

      Core was generated by `/test/MD290726-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x0000635b209abbe2 in collect_indexed_vcols_for_table (table=0x7719d007cf00, vcol_fields=0x7f1ae39594b8)at /test/13.0_dbg/sql/opt_vcol_substitution.cc:139
       
      [Current thread is 1 (LWP 3520831)]
      (gdb) bt
      #0  0x0000635b209abbe2 in collect_indexed_vcols_for_table (table=0x7719d007cf00, vcol_fields=0x7f1ae39594b8)at /test/13.0_dbg/sql/opt_vcol_substitution.cc:139
      #1  0x0000635b209ab544 in collect_indexed_vcols_for_join (join=0x7719d001e2e0, vcol_fields=0x7f1ae39594b8)at /test/13.0_dbg/sql/opt_vcol_substitution.cc:160
      #2  0x0000635b209ab37e in substitute_indexed_vcols_for_join (join=0x7719d001e2e0) at /test/13.0_dbg/sql/opt_vcol_substitution.cc:290
      #3  0x0000635b20b72e3c in JOIN::optimize_inner (this=0x7719d001e2e0)at /test/13.0_dbg/sql/sql_select.cc:2472
      #4  0x0000635b20b71c66 in JOIN::optimize (this=0x7719d001e2e0)at /test/13.0_dbg/sql/sql_select.cc:2016
      #5  0x0000635b20b6a4ad in mysql_select (thd=0x7719d0000d60, tables=0x7719d00052d0, fields=@0x7719d0005ab8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7719d001e2d0, last = 0x7719d001e2d0, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2199023255552, result=0x7719d001cf00, unit=0x7719d0005280, select_lex=0x7719d001c920) at /test/13.0_dbg/sql/sql_select.cc:5425
      #6  0x0000635b20c4e024 in st_select_lex_unit::exec_inner (this=0x7719d0005280)at /test/13.0_dbg/sql/sql_union.cc:2551
      #7  0x0000635b20c487ba in st_select_lex_unit::exec (this=0x7719d0005280)at /test/13.0_dbg/sql/sql_union.cc:2350
      #8  0x0000635b20c46437 in mysql_union (thd=0x7719d0000d60, lex=0x7719d00051a0, result=0x7719d001cf00, unit=0x7719d0005280, setup_tables_done_option=0)at /test/13.0_dbg/sql/sql_union.cc:45
      #9  0x0000635b20b69fc7 in handle_select (thd=0x7719d0000d60, lex=0x7719d00051a0, result=0x7719d001cf00, setup_tables_done_option=0)at /test/13.0_dbg/sql/sql_select.cc:626
      #10 0x0000635b20b14c56 in execute_sqlcom_select (thd=0x7719d0000d60, all_tables=0x7719d001ab20) at /test/13.0_dbg/sql/sql_parse.cc:6217
      #11 0x0000635b20b0b088 in mysql_execute_command (thd=0x7719d0000d60, is_called_from_prepared_stmt=false) at /test/13.0_dbg/sql/sql_parse.cc:3991
      #12 0x0000635b20b03e78 in mysql_parse (thd=0x7719d0000d60, rawbuf=0x7719d001a3c0 "SELECT c1 FROM t1 UNION SELECT c2 FROM t1", length=41, parser_state=0x7f1ae395b9f0)at /test/13.0_dbg/sql/sql_parse.cc:7945
      #13 0x0000635b20b015ce in dispatch_command (command=COM_QUERY, thd=0x7719d0000d60, packet=0x7719d000b5f1 "SELECT c1 FROM t1 UNION SELECT c2 FROM t1", packet_length=41, blocking=true) at /test/13.0_dbg/sql/sql_parse.cc:1903
      #14 0x0000635b20b048fa in do_command (thd=0x7719d0000d60, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1437
      #15 0x0000635b20cd5ebe in do_handle_one_connection (connect=0x635b25b29990, put_in_cache=true) at /test/13.0_dbg/sql/sql_connect.cc:1510
      #16 0x0000635b20cd5ca1 in handle_one_connection (arg=0x635b25b082f0)at /test/13.0_dbg/sql/sql_connect.cc:1422
      #17 0x00007f1b0a29cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #18 0x00007f1b0a329d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.6   dbg  290726  67ea07dd3400004e4f7ae01bf977f4344bbe064b  No bug found                  
      CS  10.6   opt  290726  67ea07dd3400004e4f7ae01bf977f4344bbe064b  No bug found                  
      CS  10.11  dbg  290726  41cdc5630eb53e0e184cb685202c1ad7a69bb6a6  No bug found                  
      CS  10.11  opt  290726  41cdc5630eb53e0e184cb685202c1ad7a69bb6a6  No bug found                  
      CS  11.4   dbg  290726  eccf9ca5f15bdca5b8e887396d9a570d580eb4ee  No bug found                  
      CS  11.4   opt  290726  eccf9ca5f15bdca5b8e887396d9a570d580eb4ee  No bug found                  
      CS  11.8   dbg  290726  1d23deff797ab448f091e39756434903d81a98c2  No bug found                  
      CS  11.8   opt  290726  1d23deff797ab448f091e39756434903d81a98c2  No bug found                  
      CS  12.3   dbg  290726  8436fe3f48173914b81f43ff0759ec493c06e767  SIGSEGV|collect_indexed_vcols_for_table|collect_indexed_vcols_for_join|substitute_indexed_vcols_for_join|JOIN::optimize_inner
      CS  12.3   opt  290726  8436fe3f48173914b81f43ff0759ec493c06e767  SIGSEGV|collect_indexed_vcols_for_table|collect_indexed_vcols_for_join|substitute_indexed_vcols_for_join|JOIN::optimize_inner
      CS  13.0   dbg  290726  84c246ca5387c0611f75097136ff4f4bea092aa3  SIGSEGV|collect_indexed_vcols_for_table|collect_indexed_vcols_for_join|substitute_indexed_vcols_for_join|JOIN::optimize_inner
      CS  13.0   opt  290726  84c246ca5387c0611f75097136ff4f4bea092aa3  SIGSEGV|collect_indexed_vcols_for_table|collect_indexed_vcols_for_join|substitute_indexed_vcols_for_join|JOIN::optimize_inner
      CS  13.1   dbg  290726  cded2b25e65853a75c2213cfe0832819832708bd  SIGSEGV|collect_indexed_vcols_for_table|collect_indexed_vcols_for_join|substitute_indexed_vcols_for_join|JOIN::optimize_inner
      CS  13.1   opt  290726  cded2b25e65853a75c2213cfe0832819832708bd  SIGSEGV|collect_indexed_vcols_for_table|collect_indexed_vcols_for_join|substitute_indexed_vcols_for_join|JOIN::optimize_inner
      ES  10.6   dbg  290726  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  11.4   dbg  290726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  
      ES  11.8   dbg  290726  4694e931d10fecf733c34f83ea2146d31b708eb3  SIGSEGV|collect_indexed_vcols_for_table|collect_indexed_vcols_for_join|substitute_indexed_vcols_for_join|JOIN::optimize_inner
      ES  12.3   dbg  290726  c1ba9a81dd4f6cdb34ca2cfe1c68ca0d68da2fca  SIGSEGV|collect_indexed_vcols_for_table|collect_indexed_vcols_for_join|substitute_indexed_vcols_for_join|JOIN::optimize_inner
      

      Attachments

        Issue Links

          Activity

            People

              ycp Yuchen Pei
              saahil Saahil Alam
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1.5h
                  1.5h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.