Server SIGSEGV in Item_func_setval::val_int / sequence_definition::truncate_value

Summary (for Jira Summary field)

Server SIGSEGV in Item_func_setval::val_int / sequence_definition::truncate_value when DEFAULT(SETVAL(...)) runs after the sequence was replaced by a plain table (MDEV-38060 NEXTVAL sibling)

Description

MDEV-38060 documents a SIGSEGV when a column default uses NEXTVAL(s) (or NEXT VALUE FOR s / Oracle s.NEXTVAL) and the sequence object s is later replaced by a normal table (CREATE OR REPLACE TABLE s ... or DROP SEQUENCE + CREATE TABLE s), then INSERT evaluates the default.

On MariaDB 12.3.2 the homologous SETVAL default still crashes, but on a different call site:

• NEXTVAL → SEQUENCE::write_lock / SEQUENCE::next_value with a null sequence object (MDEV-38060)
• SETVAL → Item_func_setval::val_int → table->s->sequence->truncate_value(...) with table->s->sequence == nullptr

Item_func_setval::val_int does update_table() then immediately dereferences table->s->sequence (only a DBUG_ASSERT guards it). After the name s no longer names a sequence, sequence is null and optimized builds SIGSEGV.

LASTVAL / PREVIOUS VALUE FOR / Oracle s.CURRVAL as default do not crash in the same scenario (they consult thd->sequences and return NULL), so a NEXTVAL-only fix for MDEV-38060 would leave SETVAL live.

How to repeat

DROP DATABASE IF EXISTS mdev_setval_replace;

CREATE DATABASE mdev_setval_replace;

USE mdev_setval_replace;

CREATE SEQUENCE s;

CREATE TABLE t (f INT DEFAULT(SETVAL(s, 1)));

CREATE OR REPLACE TABLE s (a INT);

INSERT INTO t VALUES ();

-- Expected: SQL error (not a sequence / invalid default)

-- Actual: SIGSEGV, client lost connection

Equivalent (same stack):

DROP DATABASE IF EXISTS mdev_setval_replace2;

CREATE DATABASE mdev_setval_replace2;

USE mdev_setval_replace2;

CREATE SEQUENCE s;

CREATE TABLE t (f BIGINT DEFAULT(SETVAL(s, 100)));

DROP SEQUENCE s;

CREATE TABLE s (a INT);

INSERT INTO t VALUES ();

Also crashes with three-arg SETVAL(s,1,true) and with INSERT ... ON DUPLICATE KEY UPDATE f=DEFAULT after the same replace.

Control (MDEV-38060 — already filed):

CREATE SEQUENCE s;

CREATE TABLE t (f INT DEFAULT(NEXTVAL(s)));

CREATE OR REPLACE TABLE s (a INT);

INSERT INTO t VALUES ();  -- SIGSEGV in SEQUENCE::next_value / write_lock

Non-crash controls on the same pin:

-- LASTVAL default after replace → no crash (NULL / error path)

CREATE SEQUENCE s;

CREATE TABLE t (f INT DEFAULT(LASTVAL(s)));

CREATE OR REPLACE TABLE s (a INT);

INSERT INTO t VALUES ();

-- DROP SEQUENCE without recreating a table of the same name → ER_NO_SUCH_TABLE, no crash

CREATE SEQUENCE s;

CREATE TABLE t (f INT DEFAULT(SETVAL(s,1)));

DROP SEQUENCE s;

INSERT INTO t VALUES ();

Stack (12.3.2 optimized)

mariadbd got signal 11

sequence_definition::truncate_value(...)   sql/sql_sequence.cc:~153

Item_func_setval::val_int()                sql/item_func.cc:~7355

Item::save_int_in_field / save_in_field

TABLE::update_default_fields

fill_record / mysql_insert

Suggested fix direction

Before using table->s->sequence in Item_func_setval::val_int (and ideally share the same guard with Item_func_nextval), reject non-sequence tables with ER_NOT_SEQUENCE2 (or equivalent) instead of assuming sequence is non-null. Any fix for MDEV-38060 should cover SETVAL defaults, not only NEXTVAL.