Details
-
Bug
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
-
12.3, 13.0, 13.1
-
Can result in hang or crash
Description
--source include/have_innodb.inc
|
--source include/have_partition.inc
|
CREATE TABLE t1 (c1 INT, c5 GEOMETRY NOT NULL, SPATIAL KEY(c5))Engine=InnoDB PARTITION BY HASH(c1); |
ALTER TABLE t1 ENCRYPTED=NO; |
Leads to:
|
CS 13.0.2 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a (Debug, UBASAN, Clang 22.1.8-20260621) Build 12/08/2026 |
Version: '13.0.2-MariaDB-asan-debug' socket: '/test/UBASAN_MD120826-mariadb-13.0.2-linux-x86_64-dbg/socket.sock' port: 11034 MariaDB Server
|
/test/13.0_dbg_san/storage/innobase/handler/handler0alter.cc:3965:3: runtime error: member call on null pointer of type 'Field'
|
#0 0x57b5ae07d3fd in innobase_create_index_def(TABLE const*, st_key const*, unsigned long, bool, bool, index_def_t*, mem_block_info_t*) /test/13.0_dbg_san/storage/innobase/handler/handler0alter.cc:3965:39
|
#1 0x57b5ae0a02c0 in ha_innobase_inplace_ctx::create_key_defs(Alter_inplace_info const*, TABLE const*, unsigned long&, unsigned long&, bool&, bool&, ha_table_option_struct const*) /test/13.0_dbg_san/storage/innobase/handler/handler0alter.cc:4234:4
|
#2 0x57b5ae04ac35 in prepare_inplace_alter_table_dict(Alter_inplace_info*, TABLE const*, TABLE const*, ha_table_option_struct const*, char const*, unsigned long, unsigned long, unsigned long, bool, bool) /test/13.0_dbg_san/storage/innobase/handler/handler0alter.cc:6597:20
|
#3 0x57b5ae03ac43 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /test/13.0_dbg_san/storage/innobase/handler/handler0alter.cc:8757:7
|
#4 0x57b5adb56ca9 in ha_partition::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /test/13.0_dbg_san/sql/ha_partition.cc:10946:24
|
#5 0x57b5ad195aa9 in mysql_inplace_alter_table(THD*, TABLE_LIST*, TABLE*, TABLE*, Alter_inplace_info*, MDL_request*, st_ddl_log_state*, TRIGGER_RENAME_PARAM*, Alter_table_ctx*, bool&, unsigned long long&, bool) /test/13.0_dbg_san/sql/sql_table.cc:8251:20
|
#6 0x57b5ad18291c in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /test/13.0_dbg_san/sql/sql_table.cc:11810:16
|
#7 0x57b5ad3e3558 in Sql_cmd_alter_table::execute(THD*) /test/13.0_dbg_san/sql/sql_alter.cc:705:11
|
#8 0x57b5acddf61d in mysql_execute_command(THD*, bool) /test/13.0_dbg_san/sql/sql_parse.cc:5905:26
|
#9 0x57b5acdcb699 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.0_dbg_san/sql/sql_parse.cc:7943:18
|
#10 0x57b5acdc49dc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.0_dbg_san/sql/sql_parse.cc:1903:7
|
#11 0x57b5acdccde3 in do_command(THD*, bool) /test/13.0_dbg_san/sql/sql_parse.cc:1437:17
|
#12 0x57b5ad3c2abc in do_handle_one_connection(CONNECT*, bool) /test/13.0_dbg_san/sql/sql_connect.cc:1514:11
|
#13 0x57b5ad3c26d8 in handle_one_connection /test/13.0_dbg_san/sql/sql_connect.cc:1426:5
|
#14 0x57b5ac0a9b86 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
|
#15 0x703c7bc9cb83 in start_thread nptl/pthread_create.c:447:8
|
#16 0x703c7bd29d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
|
SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use /test/13.0_dbg_san/storage/innobase/handler/handler0alter.cc:3965:3
|
Setup:
Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1 # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
|
|
SAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 120826 0931994096b84ecc9ffc8eb3517c7e09e6e8631e No bug found
|
CS 10.6 opt 120826 0931994096b84ecc9ffc8eb3517c7e09e6e8631e No bug found
|
CS 10.11 dbg 120826 aba2caa893cdfa880dbb9a4f2d8e6dfaa7ed8ebe No bug found
|
CS 10.11 opt 120826 aba2caa893cdfa880dbb9a4f2d8e6dfaa7ed8ebe No bug found
|
CS 11.4 dbg 120826 f6418ff7b2a0ecbc158f53331735994446bed0ac No bug found
|
CS 11.4 opt 120826 f6418ff7b2a0ecbc158f53331735994446bed0ac No bug found
|
CS 11.8 dbg 120826 da0beac410cc761be4ee52b90fded6c7fa2f8947 No bug found
|
CS 11.8 opt 120826 da0beac410cc761be4ee52b90fded6c7fa2f8947 No bug found
|
CS 12.3 dbg 120826 6b174bfb25be06f7efdab149183665e1a36b3dd5 UBSAN|member call on null pointer of type 'Field'|storage/innobase/handler/handler0alter.cc|innobase_create_index_def|ha_innobase_inplace_ctx::create_key_defs|prepare_inplace_alter_table_dict|ha_innobase::prepare_inplace_alter_table
|
CS 12.3 opt 120826 6b174bfb25be06f7efdab149183665e1a36b3dd5 No bug found
|
CS 13.0 dbg 120826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a UBSAN|member call on null pointer of type 'Field'|storage/innobase/handler/handler0alter.cc|innobase_create_index_def|ha_innobase_inplace_ctx::create_key_defs|prepare_inplace_alter_table_dict|ha_innobase::prepare_inplace_alter_table
|
CS 13.0 opt 120826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a No bug found
|
CS 13.1 dbg 120826 a217e1000f37a429a9c1d1c308952a959276b77e UBSAN|member call on null pointer of type 'Field'|storage/innobase/handler/handler0alter.cc|innobase_create_index_def|ha_innobase_inplace_ctx::create_key_defs|prepare_inplace_alter_table_dict|ha_innobase::prepare_inplace_alter_table
|
CS 13.1 opt 120826 a217e1000f37a429a9c1d1c308952a959276b77e No bug found
|
ES 10.6 dbg 120826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 10.6 opt 120826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 11.4 dbg 120826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.4 opt 120826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.8 dbg 120826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 11.8 opt 120826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 12.3 dbg 120826 ad4d36b69e4813957c35d5e148b93a51a61c91c6 UBSAN|member call on null pointer of type 'Field'|storage/innobase/handler/handler0alter.cc|innobase_create_index_def|ha_innobase_inplace_ctx::create_key_defs|prepare_inplace_alter_table_dict|ha_innobase::prepare_inplace_alter_table
|
ES 12.3 opt 120826 ad4d36b69e4813957c35d5e148b93a51a61c91c6 No bug found
|
Leads to:
|
CS 13.0.2 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a (Debug, Clang 22.1.8-20260621) Build 10/08/2026 |
Core was generated by `/test/MD100826-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x000059c0c57ece56 in Field::stored_in_db (this=0x0)at /test/13.0_dbg/sql/field.h:1547
|
|
|
[Current thread is 1 (LWP 1591600)]
|
(gdb) bt
|
#0 0x000059c0c57ece56 in Field::stored_in_db (this=0x0)at /test/13.0_dbg/sql/field.h:1547
|
#1 0x000059c0c60d7593 in innobase_create_index_def (altered_table=0x768250691f30, keys=0x6e814001cf60, key_number=0, new_clustered=true, key_clustered=false, index=0x6e81400455c0, heap=0x6e81400453c0)at /test/13.0_dbg/storage/innobase/handler/handler0alter.cc:3965
|
#2 0x000059c0c60ea4a8 in ha_innobase_inplace_ctx::create_key_defs (this=0x6e814001d340, ha_alter_info=0x768250691c08, altered_table=0x768250691f30, n_fts_add=@0x76825068fac0: 0, fts_doc_id_col=@0x76825068ffa8: 18446744073709551615, add_fts_doc_id=@0x76825068faf7: false, add_fts_doc_idx=@0x76825068faf6: false, opt=0x6e814002d530)at /test/13.0_dbg/storage/innobase/handler/handler0alter.cc:4234
|
#3 0x000059c0c60c7ab4 in prepare_inplace_alter_table_dict (ha_alter_info=0x768250691c08, altered_table=0x768250691f30, old_table=0x6e814002a340, old_opt=0x6e814002d530, table_name=0x6e8140033fa5 "t1", flags=33, flags2=80, fts_doc_id_col=18446744073709551615, add_fts_doc_id=false, add_fts_doc_id_idx=false)at /test/13.0_dbg/storage/innobase/handler/handler0alter.cc:6597
|
#4 0x000059c0c60c409c in ha_innobase::prepare_inplace_alter_table (this=0x6e814002b430, altered_table=0x768250691f30, ha_alter_info=0x768250691c08)at /test/13.0_dbg/storage/innobase/handler/handler0alter.cc:8757
|
#5 0x000059c0c5cadcd1 in handler::ha_prepare_inplace_alter_table (this=0x6e814002b430, altered_table=0x768250691f30, ha_alter_info=0x768250691c08) at /test/13.0_dbg/sql/handler.cc:6003
|
#6 0x000059c0c60130e4 in ha_partition::prepare_inplace_alter_table (this=0x6e814002ab20, altered_table=0x768250691f30, ha_alter_info=0x768250691c08) at /test/13.0_dbg/sql/ha_partition.cc:10946
|
#7 0x000059c0c5cadcd1 in handler::ha_prepare_inplace_alter_table (this=0x6e814002ab20, altered_table=0x768250691f30, ha_alter_info=0x768250691c08) at /test/13.0_dbg/sql/handler.cc:6003
|
#8 0x000059c0c59b9018 in mysql_inplace_alter_table (thd=0x6e8140000d60, table_list=0x6e814001a4d0, table=0x6e814002a340, altered_table=0x768250691f30, ha_alter_info=0x768250691c08, target_mdl_request=0x768250693ec0, ddl_log_state=0x768250691ea0, trigger_param=0x768250693ac0, alter_ctx=0x768250692d48, partial_alter=@0x768250691e6d: false, start_alter_id=@0x768250691e60: 0, if_exists=false) at /test/13.0_dbg/sql/sql_table.cc:8251
|
#9 0x000059c0c59b20b4 in mysql_alter_table (thd=0x6e8140000d60, new_db=0x6e8140005ba0, new_name=0x6e8140006038, create_info=0x768250694f90, table_list=0x6e814001a4d0, recreate_info=0x7682506946a8, alter_info=0x768250694e18, order_num=0, order=0x0, ignore=false, if_exists=false)at /test/13.0_dbg/sql/sql_table.cc:11810
|
#10 0x000059c0c5a7237c in Sql_cmd_alter_table::execute (this=0x6e814001ac80, thd=0x6e8140000d60) at /test/13.0_dbg/sql/sql_alter.cc:705
|
#11 0x000059c0c58a3c06 in mysql_execute_command (thd=0x6e8140000d60, is_called_from_prepared_stmt=false) at /test/13.0_dbg/sql/sql_parse.cc:5905
|
#12 0x000059c0c5894d18 in mysql_parse (thd=0x6e8140000d60, rawbuf=0x6e814001a3c0 "ALTER TABLE t1 ENCRYPTED=NO", length=27, parser_state=0x7682506969f0) at /test/13.0_dbg/sql/sql_parse.cc:7943
|
#13 0x000059c0c589246e in dispatch_command (command=COM_QUERY, thd=0x6e8140000d60, packet=0x6e814000b5f1 "ALTER TABLE t1 ENCRYPTED=NO", packet_length=27, blocking=true) at /test/13.0_dbg/sql/sql_parse.cc:1903
|
#14 0x000059c0c589579a in do_command (thd=0x6e8140000d60, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1437
|
#15 0x000059c0c5a6775e in do_handle_one_connection (connect=0x59c0fd96d8b0, put_in_cache=true) at /test/13.0_dbg/sql/sql_connect.cc:1514
|
#16 0x000059c0c5a67541 in handle_one_connection (arg=0x59c0fd94c210)at /test/13.0_dbg/sql/sql_connect.cc:1426
|
#17 0x0000768276e9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#18 0x0000768276f29d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 100826 0931994096b84ecc9ffc8eb3517c7e09e6e8631e No bug found
|
CS 10.6 opt 100826 0931994096b84ecc9ffc8eb3517c7e09e6e8631e No bug found
|
CS 10.11 dbg 100826 aba2caa893cdfa880dbb9a4f2d8e6dfaa7ed8ebe No bug found
|
CS 10.11 opt 100826 aba2caa893cdfa880dbb9a4f2d8e6dfaa7ed8ebe No bug found
|
CS 11.4 dbg 100826 f6418ff7b2a0ecbc158f53331735994446bed0ac No bug found
|
CS 11.4 opt 100826 f6418ff7b2a0ecbc158f53331735994446bed0ac No bug found
|
CS 11.8 dbg 100826 da0beac410cc761be4ee52b90fded6c7fa2f8947 No bug found
|
CS 11.8 opt 100826 da0beac410cc761be4ee52b90fded6c7fa2f8947 No bug found
|
CS 12.3 dbg 100826 6b174bfb25be06f7efdab149183665e1a36b3dd5 SIGSEGV|Field::stored_in_db|innobase_create_index_def|ha_innobase_inplace_ctx::create_key_defs|prepare_inplace_alter_table_dict
|
CS 12.3 opt 100826 6b174bfb25be06f7efdab149183665e1a36b3dd5 No bug found
|
CS 13.0 dbg 100826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a SIGSEGV|Field::stored_in_db|innobase_create_index_def|ha_innobase_inplace_ctx::create_key_defs|prepare_inplace_alter_table_dict
|
CS 13.0 opt 100826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a No bug found
|
CS 13.1 dbg 100826 a217e1000f37a429a9c1d1c308952a959276b77e SIGSEGV|Field::stored_in_db|innobase_create_index_def|ha_innobase_inplace_ctx::create_key_defs|prepare_inplace_alter_table_dict
|
CS 13.1 opt 100826 a217e1000f37a429a9c1d1c308952a959276b77e No bug found
|
ES 10.6 dbg 100826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 10.6 opt 100826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 11.4 dbg 100826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.4 opt 100826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.8 dbg 100826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 11.8 opt 100826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
|
ES 12.3 dbg 100826 ad4d36b69e4813957c35d5e148b93a51a61c91c6 SIGSEGV|Field::stored_in_db|innobase_create_index_def|ha_innobase_inplace_ctx::create_key_defs|prepare_inplace_alter_table_dict
|
ES 12.3 opt 100826 ad4d36b69e4813957c35d5e148b93a51a61c91c6 No bug found
|
