[MDEV-40837] SIGSEGV in String::append | Optimizer_context_recorder::dump_sql_script when setting character_set_results to NULL after enabling optimizer_record_context - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 13.1
Fix Version/s: 13.1
Component/s: Optimizer
Labels:
- regression-13.1

Bug Category:
Can result in hang or crash
Sprint:
Q4/2026 Server Maintenance

Description

Test case (MTR/CLI Compatible)

SET optimizer_record_context=ON;

SET SESSION character_set_results=NULL;

SELECT 1;

Leads to:

CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Optimized, Clang 18.1.3-11) Build 17/08/2026
Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 String::append (this=0x750eb458ff08, ls=0x10)at /test/13.1_opt/sql/sql_string.h:1038

[Current thread is 1 (LWP 1165904)]
(gdb) bt
#0 String::append (this=0x750eb458ff08, ls=0x10)at /test/13.1_opt/sql/sql_string.h:1038
#1 String::append (this=0x750eb458ff08, ls=<error reading variable: Cannot access memory at address 0x10>)at /test/13.1_opt/sql/sql_string.h:1042
#2 Optimizer_context_recorder::dump_sql_script (this=0x6d0d9c016920, thd=thd@entry=0x6d0d9c000c70, sql_script=@0x750eb458ff08: {<Charset> = {m_charset = 0x5a6ded9ec310 <my_charset_utf8mb3_general1400_as_ci>}, <Binary_string> = {<Sql_alloc> = {<No data fields>}, Ptr = 0x6d0d9c04e730 "SET NAMES utf8mb4;\n\nSET GLOBAL heap.OPTIMIZER_DISK_READ_COST=0;\nSET GLOBAL heap.OPTIMIZER_INDEX_BLOCK_COPY_COST=0;\nSET GLOBAL heap.OPTIMIZER_KEY_COMPARE_COST=0.011361;\nSET GLOBAL heap.OPTIMIZER_KEY_CO"..., str_length = 4095, Alloced_length = 4272, extra_alloc = 384, alloced = true, thread_specific = false}, <No data fields>})at /test/13.1_opt/sql/opt_context_store_replay.cc:950
#3 0x00005a6dec81afeb in store_optimizer_context (thd=thd@entry=0x6d0d9c000c70)at /test/13.1_opt/sql/opt_context_store_replay.cc:679
#4 0x00005a6dec634998 in mysql_execute_command (thd=thd@entry=0x6d0d9c000c70, is_called_from_prepared_stmt=<optimized out>)at /test/13.1_opt/sql/sql_parse.cc:5936
#5 0x00005a6dec62d5d2 in mysql_parse (thd=thd@entry=0x6d0d9c000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x750eb4590580)at /test/13.1_opt/sql/sql_parse.cc:7968
#6 0x00005a6dec62bb90 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x6d0d9c000c70, packet=packet@entry=0x6d0d9c008e61 "", packet_length=packet_length@entry=8, blocking=true)at /test/13.1_opt/sql/sql_parse.cc:1903
#7 0x00005a6dec62da51 in do_command (thd=thd@entry=0x6d0d9c000c70, blocking=true) at /test/13.1_opt/sql/sql_parse.cc:1437
#8 0x00005a6dec75994d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5a6e0f81e110, put_in_cache=true)at /test/13.1_opt/sql/sql_connect.cc:1514
#9 0x00005a6dec759782 in handle_one_connection (arg=arg@entry=0x5a6e0f81e110)at /test/13.1_opt/sql/sql_connect.cc:1426
#10 0x00005a6decb056a3 in pfs_spawn_thread (arg=0x5a6e0f83ec10)at /test/13.1_opt/storage/perfschema/pfs.cc:2198
#11 0x0000750eb789cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#12 0x0000750eb7929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Debug, Clang 18.1.3-11) Build 17/08/2026
Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00005c6ce8e96dd3 in String::append (this=0x76e86f910258, ls=0x10)at /test/13.1_dbg/sql/sql_string.h:1035

[Current thread is 1 (LWP 1165812)]
(gdb) bt
#0 0x00005c6ce8e96dd3 in String::append (this=0x76e86f910258, ls=0x10)at /test/13.1_dbg/sql/sql_string.h:1035
#1 0x00005c6ce8e971ad in String::append (this=0x76e86f910258, ls=<error reading variable: Cannot access memory at address 0x10>)at /test/13.1_dbg/sql/sql_string.h:1042
#2 0x00005c6ce937cc94 in Optimizer_context_recorder::dump_sql_script (this=0x76e79c019180, thd=0x76e79c000d60, sql_script=@0x76e86f910258: {<Charset> = {m_charset = 0x5c6ceae918c0 <my_charset_utf8mb3_general1400_as_ci>}, <Binary_string> = {<Sql_alloc> = {<No data fields>}, Ptr = 0x76e79c069bf0 "SET NAMES utf8mb4;\n\nSET GLOBAL heap.OPTIMIZER_DISK_READ_COST=0;\nSET GLOBAL heap.OPTIMIZER_INDEX_BLOCK_COPY_COST=0;\nSET GLOBAL heap.OPTIMIZER_KEY_COMPARE_COST=0.011361;\nSET GLOBAL heap.OPTIMIZER_KEY_CO"..., str_length = 4101, Alloced_length = 4280, extra_alloc = 384, alloced = true, thread_specific = false}, <No data fields>})at /test/13.1_dbg/sql/opt_context_store_replay.cc:950
#3 0x00005c6ce937b843 in store_optimizer_context (thd=0x76e79c000d60)at /test/13.1_dbg/sql/opt_context_store_replay.cc:679
#4 0x00005c6ce90389a1 in mysql_execute_command (thd=0x76e79c000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:5936
#5 0x00005c6ce9027974 in mysql_parse (thd=0x76e79c000d60, rawbuf=0x76e79c01a490 "SELECT 1", length=8, parser_state=0x76e86f911a80)at /test/13.1_dbg/sql/sql_parse.cc:7968
#6 0x00005c6ce9024c9d in dispatch_command (command=COM_QUERY, thd=0x76e79c000d60, packet=0x76e79c00b6c1 "", packet_length=8, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903
#7 0x00005c6ce9028523 in do_command (thd=0x76e79c000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
#8 0x00005c6ce922d969 in do_handle_one_connection (connect=0x5c6d18478da0, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1514
#9 0x00005c6ce922d70e in handle_one_connection (arg=0x5c6d184326d0)at /test/13.1_dbg/sql/sql_connect.cc:1426
#10 0x00007ee8b229cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#11 0x00007ee8b2329d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c No bug found
CS 10.6 opt 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c No bug found
CS 10.11 dbg 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f No bug found
CS 10.11 opt 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f No bug found
CS 11.4 dbg 170826 77c8f791618136002e5724ca81f365134b583a29 No bug found
CS 11.4 opt 170826 77c8f791618136002e5724ca81f365134b583a29 No bug found
CS 11.8 dbg 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e No bug found
CS 11.8 opt 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e No bug found
CS 12.3 dbg 170826 91156c3de58762196605150ab3f756fe952592d1 No bug found
CS 12.3 opt 170826 91156c3de58762196605150ab3f756fe952592d1 No bug found
CS 13.0 dbg 170826 a848493c6fe031f23606144420c1ca1e467cbd81 No bug found
CS 13.0 opt 170826 a848493c6fe031f23606144420c1ca1e467cbd81 No bug found
CS 13.1 dbg 170826 f4299f0bbf38820794295bd4cae427544681cbd1 SIGSEGV\|String::append\|String::append\|Optimizer_context_recorder::dump_sql_script\|store_optimizer_context
CS 13.1 opt 170826 f4299f0bbf38820794295bd4cae427544681cbd1 SIGSEGV\|String::append\|String::append\|Optimizer_context_recorder::dump_sql_script\|store_optimizer_context
ES 11.4 dbg 060526 90f707057d44f1b5c013a0c3672fd12f32ea7085 No bug found
ES 11.4 opt 060526 90f707057d44f1b5c013a0c3672fd12f32ea7085 No bug found
ES 11.8 dbg 060526 1499789de285a8109d68d79347de0281865b28f4 No bug found
ES 11.8 opt 060526 1499789de285a8109d68d79347de0281865b28f4 No bug found

Attachments

Activity

People

Assignee:: Sergei Petrunia

Reporter:: Ramesh Sivaraman

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2026-08-19 09:30

Updated:: 2 days ago 09:55

Time Tracking

Estimated:

Remaining:

Logged:

35m

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.