Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Duplicate
-
11.8.8
-
None
-
Not for Release Notes
Description
The grammar accepts a general numeric `literal` before ROWS
PRECEDING/FOLLOWING. Window setup verifies only `INT_RESULT`. It does not
enforce that the value fits the signed domain later assumed by the executor.
`get_frame_cursor()` evaluates the offset with `val_int()` and assigns it to
unsigned `ha_rows`. At `LLONG_MAX+1`, the stored bit pattern is `2^63`, but the
next Debug check casts it back to `longlong` and aborts because it is negative.
The exact source comment says this should have been handled by the parser.
Without assertions, `Frame_n_rows_preceding::move_cursor_if_possible()`
subtracts unsigned counters and assigns the result to `longlong`. On the
tested x86-64 target, `2^63` becomes `LLONG_MIN`, so the code takes the
negative catch-up path and removes an aggregate value that was never added.
For `SUM(v)`, both rows become NULL instead of 1 and 3.
Reproduce:
USE h76;
SELECT v,
SUM(v) OVER (
ORDER BY v
ROWS BETWEEN 9223372036854775808 PRECEDING AND CURRENT ROW
) AS s
FROM t ORDER BY v;
Crash:
Server version: 11.8.8-MariaDB-debug source revision: 46a8eb42a520193686d9a16d4cea4b3e002917e4
The information page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/
contains instructions to obtain a better version of the backtrace below.
Following these instructions will help MariaDB developers provide a fix quicker.
Attempting backtrace. Include this in the bug report.
(note: Retrieving this information may fail)
Thread pointer: 0x778fc4000dc8
stack_bottom = 0x7f900c1a9000 thread_stack 0x49000
addr2line: DWARF error: invalid or unhandled FORM value: 0x23
/home/mysql/mariadb/bld/sql/mariadbd(my_print_stacktrace+0x53)[0x5599f1887f43]
/home/mysql/mariadb/bld/sql/mariadbd(handle_fatal_signal+0x2df)[0x5599f092388f]
libc_sigaction.c:0(__restore_rt)[0x7f9010733520]
nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7f90107879fc]
posix/raise.c:27(__GI_raise)[0x7f9010733476]
stdlib/abort.c:81(__GI_abort)[0x7f90107197f3]
intl/loadmsgcat.c:1177(_nl_load_domain)[0x7f901071971b]
/lib/x86_64-linux-gnu/libc.so.6(+0x39e96)[0x7f901072ae96]
addr2line: DWARF error: invalid or unhandled FORM value: 0x23
/home/mysql/mariadb/bld/sql/mariadbd(_Z16get_frame_cursorP3THDP11Window_specb+0x9b6)[0x5599f078dcc6]
/home/mysql/mariadb/bld/sql/mariadbd(_Z37get_window_functions_required_cursorsP3THDR4ListI16Item_window_funcEPS1_I14Cursor_managerE+0x147e)[0x5599f07901de]
/home/mysql/mariadb/bld/sql/mariadbd(_ZN18Window_func_runner4execEP3THDP5TABLEP9SORT_INFO+0x11d)[0x5599f079357d]
/home/mysql/mariadb/bld/sql/mariadbd(_ZN24Window_funcs_computation4execEP4JOINb+0xff)[0x5599f07950ef]
/home/mysql/mariadb/bld/sql/mariadbd(_ZN7AGGR_OP8end_sendEv+0x3dc)[0x5599f03919bc]
/home/mysql/mariadb/bld/sql/mariadbd(_Z24sub_select_postjoin_aggrP4JOINP13st_join_tableb+0x178)[0x5599f0334378]
/home/mysql/mariadb/bld/sql/mariadbd(_Z10sub_selectP4JOINP13st_join_tableb+0x2bc)[0x5599f02edf1c]
sql_select.cc:0(do_select(JOIN*, Procedure*))[0x5599f0341479]
/home/mysql/mariadb/bld/sql/mariadbd(_ZN4JOIN10exec_innerEv+0x14bf)[0x5599f033f99f]
/home/mysql/mariadb/bld/sql/mariadbd(_ZN4JOIN4execEv+0x2b1)[0x5599f033e0c1]
/home/mysql/mariadb/bld/sql/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0xbdc)[0x5599f02f01ac]
/home/mysql/mariadb/bld/sql/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0x31b)[0x5599f02ef39b]
sql_parse.cc:0(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5599f024cdbf]
/home/mysql/mariadb/bld/sql/mariadbd(_Z21mysql_execute_commandP3THDb+0x54f4)[0x5599f023f634]
/home/mysql/mariadb/bld/sql/mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x680)[0x5599f022cdb0]
/home/mysql/mariadb/bld/sql/mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x24ea)[0x5599f022777a]
/home/mysql/mariadb/bld/sql/mariadbd(_Z10do_commandP3THDb+0xec9)[0x5599f022e4a9]
/home/mysql/mariadb/bld/sql/mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x3da)[0x5599f05b1eda]
/home/mysql/mariadb/bld/sql/mariadbd(handle_one_connection+0x1ed)[0x5599f05b19ed]
/home/mysql/mariadb/bld/sql/mariadbd(+0x1743346)[0x5599f0ede346]
nptl/pthread_create.c:442(start_thread)[0x7f9010785ac3]
x86_64/clone.S:102(_GI__clone)[0x7f9010816a84]
Connection ID (thread ID): 4
Status: NOT_KILLED
Query (0x778fc4048bf0): SELECT v,
SUM(v) OVER (
ORDER BY v
ROWS BETWEEN 9223372036854775808 PRECEDING AND CURRENT ROW
) AS s
FROM t ORDER BY v
Attachments
Issue Links
- duplicates
-
MDEV-30682 Assertion `(longlong) n_rows >= 0' failed in get_frame_cursor on SELECT
-
- Confirmed
-