[MDEV-40842] SIGSEGV in ha_connect::rnd_pos on DELETE ORDER BY w/ AFTER DELETE trigger - Jira

XML

Word

Printable

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.11, 11.4, 11.8, 12.3, 13.0, 13.1
Fix Version/s: 10.11, 11.4, 11.8, 12.3, 13.0
Component/s: Storage Engine - Connect
Labels:
- UBSAN

Bug Category:
Can result in hang or crash

Description

Test case (MTR/CLI Compatible)

--source include/have_partition.inc

INSTALL SONAME 'ha_connect';

CREATE TABLE t1 (c1 INT    KEY,c2 CHAR(1),c3 long,c4 tinyint(1),KEY(c2)) ENGINE=MyISAM ROW_FORMAT=DYNAMIC PARTITION BY HASH(c1) (PARTITION p1,PARTITION p2);

ALTER TABLE t1 ADD COLUMN c5 VARCHAR(1) CHARACTER SET 'Binary' COLLATE 'Binary',DROP COLUMN c3;

CREATE  TABLE t4 ENGINE=CONNECT AS SELECT * FROM t1;

CREATE  TABLE t5 ENGINE=CONNECT REPLACE SELECT * FROM t4;

INSERT IGNORE INTO t4 () VALUES (),(),();

CREATE TRIGGER tr44 AFTER DELETE ON t4 FOR EACH ROW INSERT INTO t5 (c1) VALUES (1);

DELETE QUICK FROM t4 ORDER BY c1;

Leads to:

CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Optimized, Clang 18.1.3-11) Build 17/08/2026
Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000750de80e1f6c in ha_connect::rnd_pos (this=0x6d0d0006cb70, buf=0x6d0d0006d580 "", pos=<optimized out>)at /test/13.1_opt/storage/connect/ha_connect.cc:4282

[Current thread is 1 (LWP 2668498)]
(gdb) bt
#0 0x0000750de80e1f6c in ha_connect::rnd_pos (this=0x6d0d0006cb70, buf=0x6d0d0006d580 "", pos=<optimized out>)at /test/13.1_opt/storage/connect/ha_connect.cc:4282
#1 0x0000649dcb2cebc9 in handler::ha_rnd_pos (this=0x6d0d0006cb70, buf=0x6d0d0006d580 "", pos=<optimized out>)at /test/13.1_opt/sql/handler.cc:4086
#2 0x0000649dcaf77c74 in rr_from_pointers (info=0x750de96b1cb8)at /test/13.1_opt/sql/records.cc:605
#3 0x0000649dcafffe86 in READ_RECORD::read_record (this=0x750de96b1cb8)at /test/13.1_opt/sql/records.h:77
#4 Sql_cmd_delete::delete_from_single_table (this=this@entry=0x6d0d00018e00, thd=thd@entry=0x6d0d00000c70) at /test/13.1_opt/sql/sql_delete.cc:926
#5 0x0000649dcb0027c9 in Sql_cmd_delete::execute_inner (this=0x6d0d00018e00, thd=0x6d0d00000c70) at /test/13.1_opt/sql/sql_delete.cc:2172
#6 0x0000649dcb0c119b in Sql_cmd_dml::execute (this=0x6d0d00018e00, thd=0x6d0d00000c70) at /test/13.1_opt/sql/sql_select.cc:35066
#7 0x0000649dcb049246 in mysql_execute_command (thd=thd@entry=0x6d0d00000c70, is_called_from_prepared_stmt=false) at /test/13.1_opt/sql/sql_parse.cc:4452
#8 0x0000649dcb0445d2 in mysql_parse (thd=thd@entry=0x6d0d00000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x750de96b2580)at /test/13.1_opt/sql/sql_parse.cc:7968
#9 0x0000649dcb042b90 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x6d0d00000c70, packet=packet@entry=0x6d0d00008e61 "DELETE QUICK FROM t4 ORDER BY c1", packet_length=packet_length@entry=32, blocking=true)at /test/13.1_opt/sql/sql_parse.cc:1903
#10 0x0000649dcb044a51 in do_command (thd=thd@entry=0x6d0d00000c70, blocking=true) at /test/13.1_opt/sql/sql_parse.cc:1437
#11 0x0000649dcb17094d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x649dfe02b4c0, put_in_cache=true)at /test/13.1_opt/sql/sql_connect.cc:1514
#12 0x0000649dcb170782 in handle_one_connection (arg=arg@entry=0x649dfe02b4c0)at /test/13.1_opt/sql/sql_connect.cc:1426
#13 0x0000649dcb51c6a3 in pfs_spawn_thread (arg=0x649dfe04beb0)at /test/13.1_opt/storage/perfschema/pfs.cc:2198
#14 0x0000750e16e9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#15 0x0000750e16f29d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Debug, Clang 18.1.3-11) Build 17/08/2026
Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000755e908ca484 in ha_connect::rnd_pos (this=0x6d5d600b3c40, buf=0x6d5d600b4650 "", pos=0x6d5d600a7484 "")at /test/13.1_dbg/storage/connect/ha_connect.cc:4282

[Current thread is 1 (LWP 2668520)]
(gdb) bt
#0 0x0000755e908ca484 in ha_connect::rnd_pos (this=0x6d5d600b3c40, buf=0x6d5d600b4650 "", pos=0x6d5d600a7484 "")at /test/13.1_dbg/storage/connect/ha_connect.cc:4282
#1 0x00006430ab01670b in handler::ha_rnd_pos (this=0x6d5d600b3c40, buf=0x6d5d600b4650 "", pos=0x6d5d600a7484 "")at /test/13.1_dbg/sql/handler.cc:4086
#2 0x00006430aaa1cf3a in rr_from_pointers (info=0x755e90bd7fc8)at /test/13.1_dbg/sql/records.cc:605
#3 0x00006430aaa01a86 in READ_RECORD::read_record (this=0x755e90bd7fc8)at /test/13.1_dbg/sql/records.h:77
#4 0x00006430aab17248 in Sql_cmd_delete::delete_from_single_table (this=0x6d5d6001b660, thd=0x6d5d60000d60)at /test/13.1_dbg/sql/sql_delete.cc:926
#5 0x00006430aab1bdc6 in Sql_cmd_delete::execute_inner (this=0x6d5d6001b660, thd=0x6d5d60000d60) at /test/13.1_dbg/sql/sql_delete.cc:2172
#6 0x00006430aac64646 in Sql_cmd_dml::execute (this=0x6d5d6001b660, thd=0x6d5d60000d60) at /test/13.1_dbg/sql/sql_select.cc:35066
#7 0x00006430aab9c7b6 in mysql_execute_command (thd=0x6d5d60000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:4452
#8 0x00006430aab92974 in mysql_parse (thd=0x6d5d60000d60, rawbuf=0x6d5d6001a490 "DELETE QUICK FROM t4 ORDER BY c1", length=32, parser_state=0x755e90bd9a80) at /test/13.1_dbg/sql/sql_parse.cc:7968
#9 0x00006430aab8fc9d in dispatch_command (command=COM_QUERY, thd=0x6d5d60000d60, packet=0x6d5d6000b6c1 "DELETE QUICK FROM t4 ORDER BY c1", packet_length=32, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903
#10 0x00006430aab93523 in do_command (thd=0x6d5d60000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
#11 0x00006430aad98969 in do_handle_one_connection (connect=0x6430c3bdff20, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1514
#12 0x00006430aad9870e in handle_one_connection (arg=0x6430c3b99850)at /test/13.1_dbg/sql/sql_connect.cc:1426
#13 0x0000755eb929cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#14 0x0000755eb9329d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 10.6 opt 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 10.11 dbg 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 10.11 opt 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 11.4 dbg 170826 77c8f791618136002e5724ca81f365134b583a29 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 11.4 opt 170826 77c8f791618136002e5724ca81f365134b583a29 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 11.8 dbg 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 11.8 opt 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 12.3 dbg 170826 91156c3de58762196605150ab3f756fe952592d1 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 12.3 opt 170826 91156c3de58762196605150ab3f756fe952592d1 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 13.0 dbg 170826 a848493c6fe031f23606144420c1ca1e467cbd81 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 13.0 opt 170826 a848493c6fe031f23606144420c1ca1e467cbd81 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 13.1 dbg 170826 f4299f0bbf38820794295bd4cae427544681cbd1 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
CS 13.1 opt 170826 f4299f0bbf38820794295bd4cae427544681cbd1 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
ES 11.4 dbg 060526 90f707057d44f1b5c013a0c3672fd12f32ea7085 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
ES 11.4 opt 060526 90f707057d44f1b5c013a0c3672fd12f32ea7085 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
ES 11.8 dbg 060526 1499789de285a8109d68d79347de0281865b28f4 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record
ES 11.8 opt 060526 1499789de285a8109d68d79347de0281865b28f4 SIGSEGV\|ha_connect::rnd_pos\|handler::ha_rnd_pos\|rr_from_pointers\|READ_RECORD::read_record

UBSAN IDs

opt: UBSAN|member call on address X which does not point to an object of type 'TDB'|storage/connect/ha_connect.cc|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|Sql_cmd_delete::delete_from_single_table

dbg: UBSAN|member call on address X which does not point to an object of type 'TDB'|storage/connect/ha_connect.cc|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|Sql_cmd_delete::delete_from_single_table

Attachments

Activity

People

Assignee:: Oleksandr Byelkin

Reporter:: Ramesh Sivaraman

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2026-08-19 10:49

Updated:: 2026-08-19 12:18

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

40m

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.