Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40821

SIGSEGV in Window_funcs_sort::setup

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      CREATE TABLE t1 (c1 INT KEY);
      CREATE SEQUENCE cs1;
      DELETE HISTORY FROM t1 IGNORE INDEX (PRIMARY) BEFORE SYSTEM_TIME TIMESTAMP(SETVAL(cs1,1),SUM(1) OVER w1);
      

      Leads to:

      CS 11.8.9 da0beac410cc761be4ee52b90fded6c7fa2f8947 (Optimized, Clang 22.1.8-20260621) Build 10/08/2026

      Core was generated by `/test/MD100826-mariadb-11.8.9-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005d4e681ea22a in Window_funcs_sort::setup (this=this@entry=0x75fd7c01c1f0, thd=thd@entry=0x75fd7c000c68, sel=sel@entry=0x0, it=..., join_tab=join_tab@entry=0x75fd7c01b0a0)at /test/11.8_opt/sql/sql_window.cc:3135
       
      [Current thread is 1 (LWP 2555335)]
      (gdb) bt
      #0  0x00005d4e681ea22a in Window_funcs_sort::setup (this=this@entry=0x75fd7c01c1f0, thd=thd@entry=0x75fd7c000c68, sel=sel@entry=0x0, it=@0x7dfe98c07ba8: {<base_list_iterator> = {list = 0x75fd7c005ce8, el = 0x75fd7c005ce8, prev = 0x0, current = 0x0}, <No data fields>}, join_tab=join_tab@entry=0x75fd7c01b0a0)at /test/11.8_opt/sql/sql_window.cc:3135
      #1  0x00005d4e681eaa35 in Window_funcs_computation::setup (this=0x75fd7c01c1d0, thd=0x75fd7c000c68, window_funcs=0x75fd7c005ce8, tab=tab@entry=0x75fd7c01b0a0) at /test/11.8_opt/sql/sql_window.cc:3218
      #2  0x00005d4e6807258a in JOIN::make_aggr_tables_info (this=this@entry=0x75fd7c019528) at /test/11.8_opt/sql/sql_select.cc:4322
      #3  0x00005d4e68065edf in JOIN::optimize_stage2 (this=this@entry=0x75fd7c019528) at /test/11.8_opt/sql/sql_select.cc:3563
      #4  0x00005d4e6806464f in JOIN::optimize_inner (this=this@entry=0x75fd7c019528)at /test/11.8_opt/sql/sql_select.cc:2776
      #5  0x00005d4e6809b33b in JOIN::optimize (this=0x75fd7c019528)at /test/11.8_opt/sql/sql_select.cc:2007
      #6  Sql_cmd_dml::execute_inner (this=this@entry=0x75fd7c0192f0, thd=thd@entry=0x75fd7c000c68) at /test/11.8_opt/sql/sql_select.cc:34708
      #7  0x00005d4e67fe72a2 in Sql_cmd_delete::execute_inner (this=0x75fd7c0192f0, thd=0x75fd7c000c68) at /test/11.8_opt/sql/sql_delete.cc:2151
      #8  0x00005d4e6809af4c in Sql_cmd_dml::execute (this=0x75fd7c0192f0, thd=0x75fd7c000c68) at /test/11.8_opt/sql/sql_select.cc:34651
      #9  0x00005d4e68028c06 in mysql_execute_command (thd=thd@entry=0x75fd7c000c68, is_called_from_prepared_stmt=false) at /test/11.8_opt/sql/sql_parse.cc:4463
      #10 0x00005d4e680243fd in mysql_parse (thd=thd@entry=0x75fd7c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7dfe98c08510)at /test/11.8_opt/sql/sql_parse.cc:7951
      #11 0x00005d4e68022ae6 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x75fd7c000c68, packet=packet@entry=0x75fd7c008889 "DELETE HISTORY FROM t1 IGNORE INDEX (PRIMARY) BEFORE SYSTEM_TIME TIMESTAMP(SETVAL(cs1,1),SUM(1) OVER w1)", packet_length=packet_length@entry=104, blocking=true)at /test/11.8_opt/sql/sql_parse.cc:1923
      #12 0x00005d4e68024880 in do_command (thd=thd@entry=0x75fd7c000c68, blocking=true) at /test/11.8_opt/sql/sql_parse.cc:1431
      #13 0x00005d4e68144ffd in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5d4e8220bab8, put_in_cache=true)at /test/11.8_opt/sql/sql_connect.cc:1515
      #14 0x00005d4e68144e32 in handle_one_connection (arg=arg@entry=0x5d4e8220bab8)at /test/11.8_opt/sql/sql_connect.cc:1427
      #15 0x00005d4e684af453 in pfs_spawn_thread (arg=0x5d4e8220bb28)at /test/11.8_opt/storage/perfschema/pfs.cc:2198
      #16 0x00007dfe9c29cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #17 0x00007dfe9c329d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      CS 11.8.9 da0beac410cc761be4ee52b90fded6c7fa2f8947 (Debug, Clang 22.1.8-20260621) Build 10/08/2026

      Core was generated by `/test/MD100826-mariadb-11.8.9-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x0000613290d597c7 in Window_funcs_sort::setup (this=0x6b684c01eb40, thd=0x6b684c000d58, sel=0x0, it=..., join_tab=0x6b684c01d8f0)at /test/11.8_dbg/sql/sql_window.cc:3135
       
      [Current thread is 1 (LWP 2555347)]
      (gdb) bt
      #0  0x0000613290d597c7 in Window_funcs_sort::setup (this=0x6b684c01eb40, thd=0x6b684c000d58, sel=0x0, it=@0x73694790e738: {<base_list_iterator> = {list = 0x6b684c005da8, el = 0x6b684c005da8, prev = 0x0, current = 0x0}, <No data fields>}, join_tab=0x6b684c01d8f0) at /test/11.8_dbg/sql/sql_window.cc:3135
      #1  0x0000613290d59d73 in Window_funcs_computation::setup (this=0x6b684c01eb20, thd=0x6b684c000d58, window_funcs=0x6b684c005da8, tab=0x6b684c01d8f0) at /test/11.8_dbg/sql/sql_window.cc:3218
      #2  0x0000613290b063ec in JOIN::make_aggr_tables_info (this=0x6b684c01bd30)at /test/11.8_dbg/sql/sql_select.cc:4322
      #3  0x0000613290af5c27 in JOIN::optimize_stage2 (this=0x6b684c01bd30)at /test/11.8_dbg/sql/sql_select.cc:3563
      #4  0x0000613290af396f in JOIN::optimize_inner (this=0x6b684c01bd30)at /test/11.8_dbg/sql/sql_select.cc:2776
      #5  0x0000613290af1616 in JOIN::optimize (this=0x6b684c01bd30)at /test/11.8_dbg/sql/sql_select.cc:2007
      #6  0x0000613290b3b602 in Sql_cmd_dml::execute_inner (this=0x6b684c01baf8, thd=0x6b684c000d58) at /test/11.8_dbg/sql/sql_select.cc:34708
      #7  0x0000613290a291c9 in Sql_cmd_delete::execute_inner (this=0x6b684c01baf8, thd=0x6b684c000d58) at /test/11.8_dbg/sql/sql_delete.cc:2151
      #8  0x0000613290b3b279 in Sql_cmd_dml::execute (this=0x6b684c01baf8, thd=0x6b684c000d58) at /test/11.8_dbg/sql/sql_select.cc:34651
      #9  0x0000613290a8fe79 in mysql_execute_command (thd=0x6b684c000d58, is_called_from_prepared_stmt=false) at /test/11.8_dbg/sql/sql_parse.cc:4463
      #10 0x0000613290a87128 in mysql_parse (thd=0x6b684c000d58, rawbuf=0x6b684c019e30 "DELETE HISTORY FROM t1 IGNORE INDEX (PRIMARY) BEFORE SYSTEM_TIME TIMESTAMP(SETVAL(cs1,1),SUM(1) OVER w1)", length=104, parser_state=0x736947910a10) at /test/11.8_dbg/sql/sql_parse.cc:7951
      #11 0x0000613290a8487a in dispatch_command (command=COM_QUERY, thd=0x6b684c000d58, packet=0x6b684c00b079 "DELETE HISTORY FROM t1 IGNORE INDEX (PRIMARY) BEFORE SYSTEM_TIME TIMESTAMP(SETVAL(cs1,1),SUM(1) OVER w1)", packet_length=104, blocking=true) at /test/11.8_dbg/sql/sql_parse.cc:1923
      #12 0x0000613290a87baa in do_command (thd=0x6b684c000d58, blocking=true)at /test/11.8_dbg/sql/sql_parse.cc:1431
      #13 0x0000613290c4a63e in do_handle_one_connection (connect=0x6132b0aa4858, put_in_cache=true) at /test/11.8_dbg/sql/sql_connect.cc:1515
      #14 0x0000613290c4a421 in handle_one_connection (arg=0x6132b0b6ce28)at /test/11.8_dbg/sql/sql_connect.cc:1427
      #15 0x000073696d49cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #16 0x000073696d529d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.6   dbg  100826  0931994096b84ecc9ffc8eb3517c7e09e6e8631e  No bug found                  
      CS  10.6   opt  100826  0931994096b84ecc9ffc8eb3517c7e09e6e8631e  No bug found                  
      CS  10.11  dbg  100826  aba2caa893cdfa880dbb9a4f2d8e6dfaa7ed8ebe  No bug found                  
      CS  10.11  opt  100826  aba2caa893cdfa880dbb9a4f2d8e6dfaa7ed8ebe  No bug found                  
      CS  11.4   dbg  100826  f6418ff7b2a0ecbc158f53331735994446bed0ac  No bug found                  
      CS  11.4   opt  100826  f6418ff7b2a0ecbc158f53331735994446bed0ac  No bug found                  
      CS  11.8   dbg  100826  da0beac410cc761be4ee52b90fded6c7fa2f8947  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      CS  11.8   opt  100826  da0beac410cc761be4ee52b90fded6c7fa2f8947  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      CS  12.3   dbg  100826  6b174bfb25be06f7efdab149183665e1a36b3dd5  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      CS  12.3   opt  100826  6b174bfb25be06f7efdab149183665e1a36b3dd5  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      CS  13.0   dbg  100826  1a4bb1bbfde5fa17ba148cb62678902f11c66a1a  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      CS  13.0   opt  100826  1a4bb1bbfde5fa17ba148cb62678902f11c66a1a  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      CS  13.1   dbg  100826  a217e1000f37a429a9c1d1c308952a959276b77e  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      CS  13.1   opt  100826  a217e1000f37a429a9c1d1c308952a959276b77e  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      ES  10.6   dbg  100826  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  10.6   opt  100826  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  11.4   dbg  100826  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  
      ES  11.4   opt  100826  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  
      ES  11.8   dbg  100826  4694e931d10fecf733c34f83ea2146d31b708eb3  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      ES  11.8   opt  100826  4694e931d10fecf733c34f83ea2146d31b708eb3  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      ES  12.3   dbg  100826  ad4d36b69e4813957c35d5e148b93a51a61c91c6  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      ES  12.3   opt  100826  ad4d36b69e4813957c35d5e148b93a51a61c91c6  SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
      

      Attachments

        Issue Links

          Activity

            People

              midenok Aleksey Midenkov
              saahil Saahil Alam
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 0.25d
                  0.25d

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.