Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40810

Window Frame Offset Uint64 Boundary

    XMLWordPrintable

Details

    • Not for Release Notes

    Description

      The grammar accepts a general numeric `literal` before ROWS
      PRECEDING/FOLLOWING. Window setup verifies only `INT_RESULT`. It does not
      enforce that the value fits the signed domain later assumed by the executor.

      `get_frame_cursor()` evaluates the offset with `val_int()` and assigns it to
      unsigned `ha_rows`. At `LLONG_MAX+1`, the stored bit pattern is `2^63`, but the
      next Debug check casts it back to `longlong` and aborts because it is negative.
      The exact source comment says this should have been handled by the parser.

      Without assertions, `Frame_n_rows_preceding::move_cursor_if_possible()`
      subtracts unsigned counters and assigns the result to `longlong`. On the
      tested x86-64 target, `2^63` becomes `LLONG_MIN`, so the code takes the
      negative catch-up path and removes an aggregate value that was never added.
      For `SUM(v)`, both rows become NULL instead of 1 and 3.

      Reproduce:
      USE h76;
      SELECT v,
      SUM(v) OVER (
      ORDER BY v
      ROWS BETWEEN 9223372036854775808 PRECEDING AND CURRENT ROW
      ) AS s
      FROM t ORDER BY v;

      Crash:
      Server version: 11.8.8-MariaDB-debug source revision: 46a8eb42a520193686d9a16d4cea4b3e002917e4

      The information page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/
      contains instructions to obtain a better version of the backtrace below.
      Following these instructions will help MariaDB developers provide a fix quicker.

      Attempting backtrace. Include this in the bug report.
      (note: Retrieving this information may fail)

      Thread pointer: 0x778fc4000dc8
      stack_bottom = 0x7f900c1a9000 thread_stack 0x49000
      addr2line: DWARF error: invalid or unhandled FORM value: 0x23
      /home/mysql/mariadb/bld/sql/mariadbd(my_print_stacktrace+0x53)[0x5599f1887f43]
      /home/mysql/mariadb/bld/sql/mariadbd(handle_fatal_signal+0x2df)[0x5599f092388f]
      libc_sigaction.c:0(__restore_rt)[0x7f9010733520]
      nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7f90107879fc]
      posix/raise.c:27(__GI_raise)[0x7f9010733476]
      stdlib/abort.c:81(__GI_abort)[0x7f90107197f3]
      intl/loadmsgcat.c:1177(_nl_load_domain)[0x7f901071971b]
      /lib/x86_64-linux-gnu/libc.so.6(+0x39e96)[0x7f901072ae96]
      addr2line: DWARF error: invalid or unhandled FORM value: 0x23
      /home/mysql/mariadb/bld/sql/mariadbd(_Z16get_frame_cursorP3THDP11Window_specb+0x9b6)[0x5599f078dcc6]
      /home/mysql/mariadb/bld/sql/mariadbd(_Z37get_window_functions_required_cursorsP3THDR4ListI16Item_window_funcEPS1_I14Cursor_managerE+0x147e)[0x5599f07901de]
      /home/mysql/mariadb/bld/sql/mariadbd(_ZN18Window_func_runner4execEP3THDP5TABLEP9SORT_INFO+0x11d)[0x5599f079357d]
      /home/mysql/mariadb/bld/sql/mariadbd(_ZN24Window_funcs_computation4execEP4JOINb+0xff)[0x5599f07950ef]
      /home/mysql/mariadb/bld/sql/mariadbd(_ZN7AGGR_OP8end_sendEv+0x3dc)[0x5599f03919bc]
      /home/mysql/mariadb/bld/sql/mariadbd(_Z24sub_select_postjoin_aggrP4JOINP13st_join_tableb+0x178)[0x5599f0334378]
      /home/mysql/mariadb/bld/sql/mariadbd(_Z10sub_selectP4JOINP13st_join_tableb+0x2bc)[0x5599f02edf1c]
      sql_select.cc:0(do_select(JOIN*, Procedure*))[0x5599f0341479]
      /home/mysql/mariadb/bld/sql/mariadbd(_ZN4JOIN10exec_innerEv+0x14bf)[0x5599f033f99f]
      /home/mysql/mariadb/bld/sql/mariadbd(_ZN4JOIN4execEv+0x2b1)[0x5599f033e0c1]
      /home/mysql/mariadb/bld/sql/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0xbdc)[0x5599f02f01ac]
      /home/mysql/mariadb/bld/sql/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0x31b)[0x5599f02ef39b]
      sql_parse.cc:0(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5599f024cdbf]
      /home/mysql/mariadb/bld/sql/mariadbd(_Z21mysql_execute_commandP3THDb+0x54f4)[0x5599f023f634]
      /home/mysql/mariadb/bld/sql/mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x680)[0x5599f022cdb0]
      /home/mysql/mariadb/bld/sql/mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x24ea)[0x5599f022777a]
      /home/mysql/mariadb/bld/sql/mariadbd(_Z10do_commandP3THDb+0xec9)[0x5599f022e4a9]
      /home/mysql/mariadb/bld/sql/mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x3da)[0x5599f05b1eda]
      /home/mysql/mariadb/bld/sql/mariadbd(handle_one_connection+0x1ed)[0x5599f05b19ed]
      /home/mysql/mariadb/bld/sql/mariadbd(+0x1743346)[0x5599f0ede346]
      nptl/pthread_create.c:442(start_thread)[0x7f9010785ac3]
      x86_64/clone.S:102(_GI__clone)[0x7f9010816a84]

      Connection ID (thread ID): 4
      Status: NOT_KILLED
      Query (0x778fc4048bf0): SELECT v,
      SUM(v) OVER (
      ORDER BY v
      ROWS BETWEEN 9223372036854775808 PRECEDING AND CURRENT ROW
      ) AS s
      FROM t ORDER BY v

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              v3rdant Xingwang Xiang
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.