Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3, 13.0, 13.1
-
Can result in hang or crash
Description
Test case (MTR/CLI Compatible)
--source include/have_partition.inc
|
|
|
INSTALL SONAME 'ha_connect'; |
CREATE TABLE t1 (c1 INT KEY,c2 CHAR(1),c3 long,c4 tinyint(1),KEY(c2)) ENGINE=MyISAM ROW_FORMAT=DYNAMIC PARTITION BY HASH(c1) (PARTITION p1,PARTITION p2); |
ALTER TABLE t1 ADD COLUMN c5 VARCHAR(1) CHARACTER SET 'Binary' COLLATE 'Binary',DROP COLUMN c3; |
CREATE TABLE t4 ENGINE=CONNECT AS SELECT * FROM t1; |
CREATE TABLE t5 ENGINE=CONNECT REPLACE SELECT * FROM t4; |
INSERT IGNORE INTO t4 () VALUES (),(),(); |
CREATE TRIGGER tr44 AFTER DELETE ON t4 FOR EACH ROW INSERT INTO t5 (c1) VALUES (1); |
DELETE QUICK FROM t4 ORDER BY c1; |
Leads to:
|
CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Optimized, Clang 18.1.3-11) Build 17/08/2026 |
Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x0000750de80e1f6c in ha_connect::rnd_pos (this=0x6d0d0006cb70, buf=0x6d0d0006d580 "", pos=<optimized out>)at /test/13.1_opt/storage/connect/ha_connect.cc:4282
|
|
|
[Current thread is 1 (LWP 2668498)]
|
(gdb) bt
|
#0 0x0000750de80e1f6c in ha_connect::rnd_pos (this=0x6d0d0006cb70, buf=0x6d0d0006d580 "", pos=<optimized out>)at /test/13.1_opt/storage/connect/ha_connect.cc:4282
|
#1 0x0000649dcb2cebc9 in handler::ha_rnd_pos (this=0x6d0d0006cb70, buf=0x6d0d0006d580 "", pos=<optimized out>)at /test/13.1_opt/sql/handler.cc:4086
|
#2 0x0000649dcaf77c74 in rr_from_pointers (info=0x750de96b1cb8)at /test/13.1_opt/sql/records.cc:605
|
#3 0x0000649dcafffe86 in READ_RECORD::read_record (this=0x750de96b1cb8)at /test/13.1_opt/sql/records.h:77
|
#4 Sql_cmd_delete::delete_from_single_table (this=this@entry=0x6d0d00018e00, thd=thd@entry=0x6d0d00000c70) at /test/13.1_opt/sql/sql_delete.cc:926
|
#5 0x0000649dcb0027c9 in Sql_cmd_delete::execute_inner (this=0x6d0d00018e00, thd=0x6d0d00000c70) at /test/13.1_opt/sql/sql_delete.cc:2172
|
#6 0x0000649dcb0c119b in Sql_cmd_dml::execute (this=0x6d0d00018e00, thd=0x6d0d00000c70) at /test/13.1_opt/sql/sql_select.cc:35066
|
#7 0x0000649dcb049246 in mysql_execute_command (thd=thd@entry=0x6d0d00000c70, is_called_from_prepared_stmt=false) at /test/13.1_opt/sql/sql_parse.cc:4452
|
#8 0x0000649dcb0445d2 in mysql_parse (thd=thd@entry=0x6d0d00000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x750de96b2580)at /test/13.1_opt/sql/sql_parse.cc:7968
|
#9 0x0000649dcb042b90 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x6d0d00000c70, packet=packet@entry=0x6d0d00008e61 "DELETE QUICK FROM t4 ORDER BY c1", packet_length=packet_length@entry=32, blocking=true)at /test/13.1_opt/sql/sql_parse.cc:1903
|
#10 0x0000649dcb044a51 in do_command (thd=thd@entry=0x6d0d00000c70, blocking=true) at /test/13.1_opt/sql/sql_parse.cc:1437
|
#11 0x0000649dcb17094d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x649dfe02b4c0, put_in_cache=true)at /test/13.1_opt/sql/sql_connect.cc:1514
|
#12 0x0000649dcb170782 in handle_one_connection (arg=arg@entry=0x649dfe02b4c0)at /test/13.1_opt/sql/sql_connect.cc:1426
|
#13 0x0000649dcb51c6a3 in pfs_spawn_thread (arg=0x649dfe04beb0)at /test/13.1_opt/storage/perfschema/pfs.cc:2198
|
#14 0x0000750e16e9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#15 0x0000750e16f29d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
CS 13.1.0 f4299f0bbf38820794295bd4cae427544681cbd1 (Debug, Clang 18.1.3-11) Build 17/08/2026 |
Core was generated by `/test/MD170826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x0000755e908ca484 in ha_connect::rnd_pos (this=0x6d5d600b3c40, buf=0x6d5d600b4650 "", pos=0x6d5d600a7484 "")at /test/13.1_dbg/storage/connect/ha_connect.cc:4282
|
|
|
[Current thread is 1 (LWP 2668520)]
|
(gdb) bt
|
#0 0x0000755e908ca484 in ha_connect::rnd_pos (this=0x6d5d600b3c40, buf=0x6d5d600b4650 "", pos=0x6d5d600a7484 "")at /test/13.1_dbg/storage/connect/ha_connect.cc:4282
|
#1 0x00006430ab01670b in handler::ha_rnd_pos (this=0x6d5d600b3c40, buf=0x6d5d600b4650 "", pos=0x6d5d600a7484 "")at /test/13.1_dbg/sql/handler.cc:4086
|
#2 0x00006430aaa1cf3a in rr_from_pointers (info=0x755e90bd7fc8)at /test/13.1_dbg/sql/records.cc:605
|
#3 0x00006430aaa01a86 in READ_RECORD::read_record (this=0x755e90bd7fc8)at /test/13.1_dbg/sql/records.h:77
|
#4 0x00006430aab17248 in Sql_cmd_delete::delete_from_single_table (this=0x6d5d6001b660, thd=0x6d5d60000d60)at /test/13.1_dbg/sql/sql_delete.cc:926
|
#5 0x00006430aab1bdc6 in Sql_cmd_delete::execute_inner (this=0x6d5d6001b660, thd=0x6d5d60000d60) at /test/13.1_dbg/sql/sql_delete.cc:2172
|
#6 0x00006430aac64646 in Sql_cmd_dml::execute (this=0x6d5d6001b660, thd=0x6d5d60000d60) at /test/13.1_dbg/sql/sql_select.cc:35066
|
#7 0x00006430aab9c7b6 in mysql_execute_command (thd=0x6d5d60000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:4452
|
#8 0x00006430aab92974 in mysql_parse (thd=0x6d5d60000d60, rawbuf=0x6d5d6001a490 "DELETE QUICK FROM t4 ORDER BY c1", length=32, parser_state=0x755e90bd9a80) at /test/13.1_dbg/sql/sql_parse.cc:7968
|
#9 0x00006430aab8fc9d in dispatch_command (command=COM_QUERY, thd=0x6d5d60000d60, packet=0x6d5d6000b6c1 "DELETE QUICK FROM t4 ORDER BY c1", packet_length=32, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903
|
#10 0x00006430aab93523 in do_command (thd=0x6d5d60000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
|
#11 0x00006430aad98969 in do_handle_one_connection (connect=0x6430c3bdff20, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1514
|
#12 0x00006430aad9870e in handle_one_connection (arg=0x6430c3b99850)at /test/13.1_dbg/sql/sql_connect.cc:1426
|
#13 0x0000755eb929cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#14 0x0000755eb9329d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.6 dbg 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 10.6 opt 170826 210ab6edf47fa73f3b77e974ed2e9357ccdd051c SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 10.11 dbg 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 10.11 opt 170826 0fe578244bc2904ae482d7836a7e3d4415e3482f SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 11.4 dbg 170826 77c8f791618136002e5724ca81f365134b583a29 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 11.4 opt 170826 77c8f791618136002e5724ca81f365134b583a29 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 11.8 dbg 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 11.8 opt 170826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 12.3 dbg 170826 91156c3de58762196605150ab3f756fe952592d1 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 12.3 opt 170826 91156c3de58762196605150ab3f756fe952592d1 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 13.0 dbg 170826 a848493c6fe031f23606144420c1ca1e467cbd81 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 13.0 opt 170826 a848493c6fe031f23606144420c1ca1e467cbd81 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 13.1 dbg 170826 f4299f0bbf38820794295bd4cae427544681cbd1 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
CS 13.1 opt 170826 f4299f0bbf38820794295bd4cae427544681cbd1 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
ES 11.4 dbg 060526 90f707057d44f1b5c013a0c3672fd12f32ea7085 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
ES 11.4 opt 060526 90f707057d44f1b5c013a0c3672fd12f32ea7085 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
ES 11.8 dbg 060526 1499789de285a8109d68d79347de0281865b28f4 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
ES 11.8 opt 060526 1499789de285a8109d68d79347de0281865b28f4 SIGSEGV|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|READ_RECORD::read_record
|
UBSAN IDs
opt: UBSAN|member call on address X which does not point to an object of type 'TDB'|storage/connect/ha_connect.cc|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|Sql_cmd_delete::delete_from_single_table
|
dbg: UBSAN|member call on address X which does not point to an object of type 'TDB'|storage/connect/ha_connect.cc|ha_connect::rnd_pos|handler::ha_rnd_pos|rr_from_pointers|Sql_cmd_delete::delete_from_single_table
|
