Details
-
Bug
-
Status: Open (View Workflow)
-
Critical
-
Resolution: Unresolved
-
11.4, 11.8, 12.3, 13.0, 13.1
-
Can result in hang or crash
Description
CREATE TABLE t1 (c1 INT KEY); |
CREATE SEQUENCE cs1; |
DELETE HISTORY FROM t1 IGNORE INDEX (PRIMARY) BEFORE SYSTEM_TIME TIMESTAMP(SETVAL(cs1,1),SUM(1) OVER w1); |
Leads to:
|
CS 11.8.9 da0beac410cc761be4ee52b90fded6c7fa2f8947 (Optimized, Clang 22.1.8-20260621) Build 10/08/2026 |
Core was generated by `/test/MD100826-mariadb-11.8.9-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x00005d4e681ea22a in Window_funcs_sort::setup (this=this@entry=0x75fd7c01c1f0, thd=thd@entry=0x75fd7c000c68, sel=sel@entry=0x0, it=..., join_tab=join_tab@entry=0x75fd7c01b0a0)at /test/11.8_opt/sql/sql_window.cc:3135
|
 |
[Current thread is 1 (LWP 2555335)]
|
(gdb) bt
|
#0 0x00005d4e681ea22a in Window_funcs_sort::setup (this=this@entry=0x75fd7c01c1f0, thd=thd@entry=0x75fd7c000c68, sel=sel@entry=0x0, it=@0x7dfe98c07ba8: {<base_list_iterator> = {list = 0x75fd7c005ce8, el = 0x75fd7c005ce8, prev = 0x0, current = 0x0}, <No data fields>}, join_tab=join_tab@entry=0x75fd7c01b0a0)at /test/11.8_opt/sql/sql_window.cc:3135
|
#1 0x00005d4e681eaa35 in Window_funcs_computation::setup (this=0x75fd7c01c1d0, thd=0x75fd7c000c68, window_funcs=0x75fd7c005ce8, tab=tab@entry=0x75fd7c01b0a0) at /test/11.8_opt/sql/sql_window.cc:3218
|
#2 0x00005d4e6807258a in JOIN::make_aggr_tables_info (this=this@entry=0x75fd7c019528) at /test/11.8_opt/sql/sql_select.cc:4322
|
#3 0x00005d4e68065edf in JOIN::optimize_stage2 (this=this@entry=0x75fd7c019528) at /test/11.8_opt/sql/sql_select.cc:3563
|
#4 0x00005d4e6806464f in JOIN::optimize_inner (this=this@entry=0x75fd7c019528)at /test/11.8_opt/sql/sql_select.cc:2776
|
#5 0x00005d4e6809b33b in JOIN::optimize (this=0x75fd7c019528)at /test/11.8_opt/sql/sql_select.cc:2007
|
#6 Sql_cmd_dml::execute_inner (this=this@entry=0x75fd7c0192f0, thd=thd@entry=0x75fd7c000c68) at /test/11.8_opt/sql/sql_select.cc:34708
|
#7 0x00005d4e67fe72a2 in Sql_cmd_delete::execute_inner (this=0x75fd7c0192f0, thd=0x75fd7c000c68) at /test/11.8_opt/sql/sql_delete.cc:2151
|
#8 0x00005d4e6809af4c in Sql_cmd_dml::execute (this=0x75fd7c0192f0, thd=0x75fd7c000c68) at /test/11.8_opt/sql/sql_select.cc:34651
|
#9 0x00005d4e68028c06 in mysql_execute_command (thd=thd@entry=0x75fd7c000c68, is_called_from_prepared_stmt=false) at /test/11.8_opt/sql/sql_parse.cc:4463
|
#10 0x00005d4e680243fd in mysql_parse (thd=thd@entry=0x75fd7c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7dfe98c08510)at /test/11.8_opt/sql/sql_parse.cc:7951
|
#11 0x00005d4e68022ae6 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x75fd7c000c68, packet=packet@entry=0x75fd7c008889 "DELETE HISTORY FROM t1 IGNORE INDEX (PRIMARY) BEFORE SYSTEM_TIME TIMESTAMP(SETVAL(cs1,1),SUM(1) OVER w1)", packet_length=packet_length@entry=104, blocking=true)at /test/11.8_opt/sql/sql_parse.cc:1923
|
#12 0x00005d4e68024880 in do_command (thd=thd@entry=0x75fd7c000c68, blocking=true) at /test/11.8_opt/sql/sql_parse.cc:1431
|
#13 0x00005d4e68144ffd in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5d4e8220bab8, put_in_cache=true)at /test/11.8_opt/sql/sql_connect.cc:1515
|
#14 0x00005d4e68144e32 in handle_one_connection (arg=arg@entry=0x5d4e8220bab8)at /test/11.8_opt/sql/sql_connect.cc:1427
|
#15 0x00005d4e684af453 in pfs_spawn_thread (arg=0x5d4e8220bb28)at /test/11.8_opt/storage/perfschema/pfs.cc:2198
|
#16 0x00007dfe9c29cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#17 0x00007dfe9c329d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
CS 11.8.9 da0beac410cc761be4ee52b90fded6c7fa2f8947 (Debug, Clang 22.1.8-20260621) Build 10/08/2026 |
Core was generated by `/test/MD100826-mariadb-11.8.9-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x0000613290d597c7 in Window_funcs_sort::setup (this=0x6b684c01eb40, thd=0x6b684c000d58, sel=0x0, it=..., join_tab=0x6b684c01d8f0)at /test/11.8_dbg/sql/sql_window.cc:3135
|
 |
[Current thread is 1 (LWP 2555347)]
|
(gdb) bt
|
#0 0x0000613290d597c7 in Window_funcs_sort::setup (this=0x6b684c01eb40, thd=0x6b684c000d58, sel=0x0, it=@0x73694790e738: {<base_list_iterator> = {list = 0x6b684c005da8, el = 0x6b684c005da8, prev = 0x0, current = 0x0}, <No data fields>}, join_tab=0x6b684c01d8f0) at /test/11.8_dbg/sql/sql_window.cc:3135
|
#1 0x0000613290d59d73 in Window_funcs_computation::setup (this=0x6b684c01eb20, thd=0x6b684c000d58, window_funcs=0x6b684c005da8, tab=0x6b684c01d8f0) at /test/11.8_dbg/sql/sql_window.cc:3218
|
#2 0x0000613290b063ec in JOIN::make_aggr_tables_info (this=0x6b684c01bd30)at /test/11.8_dbg/sql/sql_select.cc:4322
|
#3 0x0000613290af5c27 in JOIN::optimize_stage2 (this=0x6b684c01bd30)at /test/11.8_dbg/sql/sql_select.cc:3563
|
#4 0x0000613290af396f in JOIN::optimize_inner (this=0x6b684c01bd30)at /test/11.8_dbg/sql/sql_select.cc:2776
|
#5 0x0000613290af1616 in JOIN::optimize (this=0x6b684c01bd30)at /test/11.8_dbg/sql/sql_select.cc:2007
|
#6 0x0000613290b3b602 in Sql_cmd_dml::execute_inner (this=0x6b684c01baf8, thd=0x6b684c000d58) at /test/11.8_dbg/sql/sql_select.cc:34708
|
#7 0x0000613290a291c9 in Sql_cmd_delete::execute_inner (this=0x6b684c01baf8, thd=0x6b684c000d58) at /test/11.8_dbg/sql/sql_delete.cc:2151
|
#8 0x0000613290b3b279 in Sql_cmd_dml::execute (this=0x6b684c01baf8, thd=0x6b684c000d58) at /test/11.8_dbg/sql/sql_select.cc:34651
|
#9 0x0000613290a8fe79 in mysql_execute_command (thd=0x6b684c000d58, is_called_from_prepared_stmt=false) at /test/11.8_dbg/sql/sql_parse.cc:4463
|
#10 0x0000613290a87128 in mysql_parse (thd=0x6b684c000d58, rawbuf=0x6b684c019e30 "DELETE HISTORY FROM t1 IGNORE INDEX (PRIMARY) BEFORE SYSTEM_TIME TIMESTAMP(SETVAL(cs1,1),SUM(1) OVER w1)", length=104, parser_state=0x736947910a10) at /test/11.8_dbg/sql/sql_parse.cc:7951
|
#11 0x0000613290a8487a in dispatch_command (command=COM_QUERY, thd=0x6b684c000d58, packet=0x6b684c00b079 "DELETE HISTORY FROM t1 IGNORE INDEX (PRIMARY) BEFORE SYSTEM_TIME TIMESTAMP(SETVAL(cs1,1),SUM(1) OVER w1)", packet_length=104, blocking=true) at /test/11.8_dbg/sql/sql_parse.cc:1923
|
#12 0x0000613290a87baa in do_command (thd=0x6b684c000d58, blocking=true)at /test/11.8_dbg/sql/sql_parse.cc:1431
|
#13 0x0000613290c4a63e in do_handle_one_connection (connect=0x6132b0aa4858, put_in_cache=true) at /test/11.8_dbg/sql/sql_connect.cc:1515
|
#14 0x0000613290c4a421 in handle_one_connection (arg=0x6132b0b6ce28)at /test/11.8_dbg/sql/sql_connect.cc:1427
|
#15 0x000073696d49cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#16 0x000073696d529d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 100826 0931994096b84ecc9ffc8eb3517c7e09e6e8631e No bug found
|
CS 10.6 opt 100826 0931994096b84ecc9ffc8eb3517c7e09e6e8631e No bug found
|
CS 10.11 dbg 100826 aba2caa893cdfa880dbb9a4f2d8e6dfaa7ed8ebe No bug found
|
CS 10.11 opt 100826 aba2caa893cdfa880dbb9a4f2d8e6dfaa7ed8ebe No bug found
|
CS 11.4 dbg 100826 f6418ff7b2a0ecbc158f53331735994446bed0ac No bug found
|
CS 11.4 opt 100826 f6418ff7b2a0ecbc158f53331735994446bed0ac No bug found
|
CS 11.8 dbg 100826 da0beac410cc761be4ee52b90fded6c7fa2f8947 SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
CS 11.8 opt 100826 da0beac410cc761be4ee52b90fded6c7fa2f8947 SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
CS 12.3 dbg 100826 6b174bfb25be06f7efdab149183665e1a36b3dd5 SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
CS 12.3 opt 100826 6b174bfb25be06f7efdab149183665e1a36b3dd5 SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
CS 13.0 dbg 100826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
CS 13.0 opt 100826 1a4bb1bbfde5fa17ba148cb62678902f11c66a1a SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
CS 13.1 dbg 100826 a217e1000f37a429a9c1d1c308952a959276b77e SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
CS 13.1 opt 100826 a217e1000f37a429a9c1d1c308952a959276b77e SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
ES 10.6 dbg 100826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 10.6 opt 100826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
|
ES 11.4 dbg 100826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.4 opt 100826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
|
ES 11.8 dbg 100826 4694e931d10fecf733c34f83ea2146d31b708eb3 SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
ES 11.8 opt 100826 4694e931d10fecf733c34f83ea2146d31b708eb3 SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
ES 12.3 dbg 100826 ad4d36b69e4813957c35d5e148b93a51a61c91c6 SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
ES 12.3 opt 100826 ad4d36b69e4813957c35d5e148b93a51a61c91c6 SIGSEGV|Window_funcs_sort::setup|Window_funcs_computation::setup|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
Attachments
Issue Links
- is part of
-
MDEV-28619 Server crash and UBSAN null-pointer-use in Window_funcs_sort::setup
-
- Closed
-