Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40879

SIGSEGV in my_mb_wc_utf32_quick on JSON_OVERLAPS w/ character_set_connection=utf32

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 11.4, 11.8, 12.3, 13.0, 13.1
    • 11.4, 11.8, 12.3, 13.0
    • JSON
    • None
    • Can result in hang or crash

    Description

      SET character_set_connection=utf32;
      DO JSON_OVERLAPS('[{}]','[{}]');
      

      Leads to:

      CS 12.3.3 add63991988734383c5e942de2a19c6c45f511f7 (Optimized, Clang 22.1.8-20260621) Build 21/08/2026

      Core was generated by `/test/MD210826-mariadb-12.3.3-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  my_mb_wc_utf32_quick (pwc=0x773c00018068, s=0x0, e=0x773c00017d60 "")at /test/12.3_opt/strings/ctype-utf32.h:29
       
      [Current thread is 1 (LWP 2931335)]
      (gdb) bt
      #0  my_mb_wc_utf32_quick (pwc=0x773c00018068, s=0x0, e=0x773c00017d60 "")at /test/12.3_opt/strings/ctype-utf32.h:29
      #1  my_utf32_uni (cs=<optimized out>, pwc=0x773c00018068, s=0x0, e=0x773c00017d60 "") at /test/12.3_opt/strings/ctype-ucs2.c:2139
      #2  0x0000619c48151c4e in get_first_nonspace (js=0x773c00018058, c_len=0x773c00018088, t_next=<optimized out>)at /test/12.3_opt/strings/json_lib.c:754
      #3  json_scan_next (j=0x773c00018058) at /test/12.3_opt/strings/json_lib.c:1041
      #4  0x0000619c47b10c85 in json_find_overlap_with_array (js=0x773c00017fa0, value=0x773c00018058, compare_whole=false, current_mem_root=0x773c00007020, temp_je=<optimized out>, stack=<optimized out>) at /test/12.3_opt/sql/item_jsonfunc.cc:5185
      #5  check_overlaps (js=0x773c00017fa0, value=0x773c00018058, compare_whole=false, current_mem_root=0x773c00007020, temp_je=<optimized out>, stack=<optimized out>)at /test/12.3_opt/sql/item_jsonfunc.cc:5446
      #6  Item_func_json_overlaps::val_bool (this=0x773c00017e90)at /test/12.3_opt/sql/item_jsonfunc.cc:5488
      #7  0x0000619c478c3be2 in Item_func::is_null (this=0x4)at /test/12.3_opt/sql/item_func.h:248
      #8  0x0000619c47d78366 in mysql_do (thd=thd@entry=0x773c00000c70, values=<optimized out>) at /test/12.3_opt/sql/sql_do.cc:37
      #9  0x0000619c4799a4bb in mysql_execute_command (thd=thd@entry=0x773c00000c70, is_called_from_prepared_stmt=false) at /test/12.3_opt/sql/sql_parse.cc:4021
      #10 0x0000619c479944bd in mysql_parse (thd=thd@entry=0x773c00000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7f3d14bb34f0)at /test/12.3_opt/sql/sql_parse.cc:7945
      #11 0x0000619c47992c8f in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x773c00000c70, packet=packet@entry=0x773c00008d81 "DO JSON_OVERLAPS('[{}]','[{}]')", packet_length=packet_length@entry=31, blocking=true)at /test/12.3_opt/sql/sql_parse.cc:1903
      #12 0x0000619c47994940 in do_command (thd=thd@entry=0x773c00000c70, blocking=true) at /test/12.3_opt/sql/sql_parse.cc:1437
      #13 0x0000619c47abbe6d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x619c58a6d410, put_in_cache=true)at /test/12.3_opt/sql/sql_connect.cc:1514
      #14 0x0000619c47abbca2 in handle_one_connection (arg=arg@entry=0x619c58a6d410)at /test/12.3_opt/sql/sql_connect.cc:1426
      #15 0x0000619c47e5ca63 in pfs_spawn_thread (arg=0x619c58a8dc00)at /test/12.3_opt/storage/perfschema/pfs.cc:2198
      #16 0x00007f3d18e9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #17 0x00007f3d18f29d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.11  dbg  210826  6415902490b1b0a9a500cee9bc0a41c342190605  No bug found                  
      CS  10.11  opt  210826  6415902490b1b0a9a500cee9bc0a41c342190605  No bug found                  
      CS  11.4   dbg  210826  1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc  No bug found                  
      CS  11.4   opt  210826  1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc  SIGSEGV|my_mb_wc_utf32_quick|my_utf32_uni|get_first_nonspace|json_scan_next
      CS  11.8   dbg  210826  d26f9ab217a7fcf9d4eccc62c01020ff275ff42e  No bug found                  
      CS  11.8   opt  210826  d26f9ab217a7fcf9d4eccc62c01020ff275ff42e  SIGSEGV|my_mb_wc_utf32_quick|my_utf32_uni|get_first_nonspace|json_scan_next
      CS  12.3   dbg  210826  add63991988734383c5e942de2a19c6c45f511f7  No bug found                  
      CS  12.3   opt  210826  add63991988734383c5e942de2a19c6c45f511f7  SIGSEGV|my_mb_wc_utf32_quick|my_utf32_uni|get_first_nonspace|json_scan_next
      CS  13.0   dbg  210826  be111d2cd60d035d555b71da019765cfb42ea0d3  No bug found                  
      CS  13.0   opt  210826  be111d2cd60d035d555b71da019765cfb42ea0d3  SIGSEGV|my_mb_wc_utf32_quick|my_utf32_uni|get_first_nonspace|json_scan_next
      CS  13.1   dbg  210826  ff09eefbe4e8b57846435ee4a928f17e49f0fdfc  No bug found                  
      CS  13.1   opt  210826  ff09eefbe4e8b57846435ee4a928f17e49f0fdfc  SIGSEGV|my_mb_wc_utf32_quick|my_utf32_uni|get_first_nonspace|json_scan_next
      ES  10.6   dbg  210826  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  10.6   opt  210826  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  11.4   dbg  210826  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  
      ES  11.4   opt  210826  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  
      ES  11.8   dbg  210826  4694e931d10fecf733c34f83ea2146d31b708eb3  No bug found                  
      ES  11.8   opt  210826  4694e931d10fecf733c34f83ea2146d31b708eb3  No bug found                  
      ES  12.3   dbg  210826  f513f503feacabfb219d4a6f965b5f72b86d4db0  No bug found                  
      ES  12.3   opt  210826  f513f503feacabfb219d4a6f965b5f72b86d4db0  No bug found                  
      

      Attachments

        Activity

          People

            rucha174 Rucha Deodhar
            saahil Saahil Alam
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 1h
                1h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.