Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Duplicate
-
12.3.2
-
None
-
Not for Release Notes
Description
MariaDB 12.3.2 terminates the server process while evaluating a query that
uses `NTILE()` with `PARTITION BY` and `ORDER BY`. The server exits with code
136 (`SIGFPE`, signal 8) instead of returning a result or an SQL error.
The crash occurs in the window-function execution path:
```text
|
compute_window_func
|
Window_func_runner::exec
|
Window_funcs_sort::exec
|
Item::save_int_in_field
|
```
|
|
This is a server crash and is independent of client timeout handling.
- How to repeat
The crash is independently reproducible with the following reduced schema and
data. No repository files or pre-existing database are required:
```sql
DROP DATABASE IF EXISTS ntile_crash_test;
CREATE DATABASE ntile_crash_test;
USE ntile_crash_test;
CREATE TABLE t1 (
c1 INT PRIMARY KEY AUTO_INCREMENT,
c2 VARCHAR(255) NOT NULL
);
CREATE TABLE t3 (
c9 BIGINT,
c10 LONGTEXT,
c14 SET('x', 'y', 'z')
);
INSERT INTO t1 (c2)
WITH RECURSIVE n AS (
SELECT 1 AS i
UNION ALL
SELECT i + 1 FROM n WHERE i < 100
)
SELECT 'sample_value' FROM n;
SET @partition_value = CONVERT(UNHEX('73616D706C655F6B4D686C42484173393169337A44693571346E35796C57456A68374A626C4474307A4F4B5064365737634E70663855636B625A4A4C5244495A7765496C4B53794867624A3249453172726A6D4152465232564A67594B444B4C456B6E7731693070436F677939695330305176454E75434A41577278486E673874426A4C56724F4A4C5237526C4F306B3958734F7830534648376237326E677751794E334430367934313837476E776E6F386E524846325738744452666F64326E74684368455A33376D43544E73534759646C6E6250537A4B706848333168624F477A4336396952327968547559684446714A716C3437435347743671787158703161336F79594E356233464957696C6F41326838754C7044446C697362416C567A5757516B7A38704E746C4B6C577552505645313978416D6E4B7136615075475A6E79434369356944674E486C477A624F48725058496537566E67754B3364355374554A4974465345726E795A42764232394B77476F4134704F37456D657A647635377264344C42466357654F456B6B7935487A4E5A754C4D486661624547365537327063444B4D4D59644D335347304667785A63747370525162776538357A4F4F53595359714A32346770596162455357524E5761545737573844564861344334644D494B315355716346473442664665666D6661584967366E494C7459756A6379614968564D5A5357414C7A66525936677830434267694C594C73686B4C6537654E444F715137616F756C6276624E7051487639364243715048436E56415871536263455936734239555151744562766639554F665276315130626362716556546151386735366D38474678645951394A456E6948345065583464597364494A37346F59707838747576496D6A375938747A795753313457357978565A634965305331434F6734736E5331783754597673676E68726E5738687750684B73666D7A4E347A396A356F6A364149564D517458554F6C73616372334B446B784B7152503475645A6C5436723743536B6971416E30473554785164424C3034444C646C643638635749664C375A424D7031385142334B64305A384454574C343751364D6666573764764B48373832316E533043684C4E337A61667357376F50507A6E4F534454424E394F49793267554B63575164467364597A716E53306C7833425266736D687A794F374C62644E304E384767776F42516C357A59746155516F7358484C3457693036514D6676734E556F48795030387365504E46744350585761586E716B4246785968526D65337363664B747170726E46474D7363586356446135464D4C596A43796749537570696B307334306654484D6368736361473939685958707649635658455851514D796D7030496761615342526C6F49386B38694E5466394266583969564658485247684D315838474A575A48326A6C4F726F4F584E41316B7738324F72494E6B4A7755496B5A7865386A6C654C784841773532375970383450757A456D315A3932416B324A6D70536362544541774C35616A75546E30655334757A6F7963756444795172413545705868595565585248647564786C45316D3959457A70443232584775784F415261436233766D616E46696834656F664149786773444B42786B5853307A523445636E506A457869314669514B527836447668397263334F69455763726A47366766764A496E426431776469366C5A6A76336569333142325A514E6B7A33794F416F324446686E314776665138695263775434664B526C66766C656B4A6E70653534654948664E5074773642584766716B56736A736B4D334E6A66657A4E36744A73425768394C38745A66486861326D726F62737544564643524568453564514A59647176736B7435614C5A506B6F36617145484D35634B754D6C7A643756336C796F655235715235775A676558743550784770697855727A39567536325536445A4B776352516B6559726B3674566C727070796368746A6F554476566B424C68324854345A6C6B61646A44425061584A3966584451644F676658375A72715761773635497275496D304D54434D6C3936427731764270424454423476746B4F465638456F467A736A43693879326357646553635A6E576F4A306E54786A5043384443536778553269456957445975') USING utf8mb4);
INSERT INTO t3 VALUES (51, @partition_value, 'x,y,z');
```
Then run this minimized query. It removes the outer expressions, subqueries,
aggregates, and other window functions from the original crashing statement.
|
|
```sql
|
USE ntile_crash_test;
|
|
|
SELECT NTILE(8) OVER ( |
PARTITION BY q2_col_1
|
ORDER BY q2_col_2 DESC
|
) AS tile_no
|
FROM (
|
SELECT t3.c10 AS q2_col_1,
|
t3.c14 AS q2_col_2,
|
t3.c9 / NULLIF(46, 0) AS q2_col_3 |
FROM t1 AS t2
|
CROSS JOIN t3 AS t3
|
WHERE t2.c2 <> 'sample_58' |
) AS q;
|
```
|
On the affected version with the reduced data above, the server process exits
while executing this statement. A client observes a lost connection rather
than a query error.
- Expected result
The query should return its rows, or MariaDB should report a regular SQL
error. A valid `NTILE(8)` result must never terminate the server.
- Actual result
MariaDB prints:
|
|
```text
|
mariadbd got signal 8 |
Sorry, we probably made a mistake, and this is a bug. |
```
|
|
The container exits with status `136` and `OOMKilled=false`.
Attachments
Issue Links
- duplicates
-
-
- Closed
-