[MDEV-40900] Procedure with dynamic SQL crashes on an InnoDB table - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 13.1
Fix Version/s: N/A
Component/s: Prepared Statements, Stored routines
Labels:
None

Bug Category:
Can result in hang or crash
Sprint:
Q4/2026 Replic. Maintenance

Description

The below script makes the server crash:

CREATE OR REPLACE TABLE t1 (a INT) ENGINE=InnoDB;

DELIMITER $$

CREATE OR REPLACE PROCEDURE p3()

BEGIN

  EXECUTE IMMEDIATE 'INSERT INTO t1 VALUES (9)';

  INSERT INTO t1 VALUES (10);

END;

$$

CREATE OR REPLACE FUNCTION f2() RETURNS INT

BEGIN

  CALL p3();

  RETURN 0;

END;

$$

CREATE OR REPLACE PROCEDURE p1()

BEGIN

  DECLARE n INT;

  SET n= f2();

END;

$$

DELIMITER ;

CALL p1;

with the following stack trace:

#0  0x00007ffff7082e7c in __pthread_kill_implementation ()

   from /lib64/libc.so.6

#1  0x00007ffff7028f0e in raise () from /lib64/libc.so.6

#2  0x00007ffff70106d0 in abort () from /lib64/libc.so.6

#3  0x00007ffff7010639 in __assert_fail_base.cold () from /lib64/libc.so.6

#4  0x00005555557b81e9 in Prepared_statement::prepare (this=0x77ffa8100130,

    packet=0x77ffa8095760 "INSERT INTO t1 VALUES (9)", packet_len=25)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_prepare.cc:4616

#5  0x00005555557bba61 in Prepared_statement::execute_immediate (

    this=0x77ffa8100130, query=0x77ffa8095760 "INSERT INTO t1 VALUES (9)",

    query_len=25, dynamic_open_cursor=false, result_arg=0x77ffa8100280,

    cursor_arg=0x77ffa81002f0, instrs_set_placeholder=...)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_prepare.cc:5721

#6  0x00005555557b3e47 in mysql_sql_stmt_execute_immediate (

    thd=0x77ffa8000dd0, dynamic_open_cursor=false, result_arg=0x0,

    cursor_arg=0x0, instrs_set_placeholder=...)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_prepare.cc:3123

#7  0x00005555557b4038 in mysql_sql_stmt_execute_immediate (thd=0x77ffa8000dd0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_prepare.cc:3146

#8  0x000055555576a49d in mysql_execute_command (thd=0x77ffa8000dd0,

    is_called_from_prepared_stmt=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:3997

#9  0x0000555555ac1829 in sp_instr_stmt::exec_core (this=0x77ffa8095890,

    thd=0x77ffa8000dd0, nextp=0x7fffe009b2cc)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:1281

#10 0x0000555555abf6b3 in sp_lex_keeper::reset_lex_and_exec_core (

    this=0x77ffa80958d0, thd=0x77ffa8000dd0, nextp=0x7fffe009b2cc,

    open_tables=false, instr=0x77ffa8095890, rerun_the_same_instr=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:420

#11 0x0000555555abfd7d in sp_lex_keeper::validate_lex_and_exec_core (

    this=0x77ffa80958d0, thd=0x77ffa8000dd0, nextp=0x7fffe009b2cc,

    open_tables=false, instr=0x77ffa8095890)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:599

#12 0x0000555555ac134b in sp_instr_stmt::execute (this=0x77ffa8095890,

    thd=0x77ffa8000dd0, nextp=0x7fffe009b2cc)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:1183

#13 0x0000555555626f9a in sp_head::execute (this=0x77ffa8094340,

    thd=0x77ffa8000dd0, merge_da_on_success=true)

#14 0x000055555562a05f in sp_head::execute_procedure (this=0x77ffa8094340,

    thd=0x77ffa8000dd0, args=0x77ffa80bc350)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:2341

#15 0x00005555557664a7 in do_execute_sp (thd=0x77ffa8000dd0, sp=0x77ffa8094340)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:3084

#16 0x00005555557671fa in Sql_cmd_call::execute (this=0x77ffa80ba7f0,

    thd=0x77ffa8000dd0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:3322

#17 0x0000555555771977 in mysql_execute_command (thd=0x77ffa8000dd0,

    is_called_from_prepared_stmt=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:5905

#18 0x0000555555ac1829 in sp_instr_stmt::exec_core (this=0x77ffa80ba830,

    thd=0x77ffa8000dd0, nextp=0x7fffe009ca2c)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:1281

#19 0x0000555555abf6b3 in sp_lex_keeper::reset_lex_and_exec_core (

    this=0x77ffa80ba870, thd=0x77ffa8000dd0, nextp=0x7fffe009ca2c,

    open_tables=false, instr=0x77ffa80ba830, rerun_the_same_instr=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:420

#20 0x0000555555abfd7d in sp_lex_keeper::validate_lex_and_exec_core (

    this=0x77ffa80ba870, thd=0x77ffa8000dd0, nextp=0x7fffe009ca2c,

    open_tables=false, instr=0x77ffa80ba830)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:599

#21 0x0000555555ac134b in sp_instr_stmt::execute (this=0x77ffa80ba830,

    thd=0x77ffa8000dd0, nextp=0x7fffe009ca2c)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:1183

#22 0x0000555555626f9a in sp_head::execute (this=0x77ffa80b9280,

    thd=0x77ffa8000dd0, merge_da_on_success=true)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:1296

#23 0x0000555555629244 in sp_head::execute_function (this=0x77ffa80b9280,

    thd=0x77ffa8000dd0, argp=0x0, argcount=0, return_value_fld=0x77ffa80deda0,

    func_ctx=0x77ffa80de928, call_arena=0x77ffa80ceb10)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:2073

#24 0x0000555555cb3eb3 in Item_sp::execute_impl (this=0x77ffa80de8c0,

    thd=0x77ffa8000dd0, args=0x0, arg_count=0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item.cc:3110

#25 0x0000555555cb39bf in Item_sp::execute (this=0x77ffa80de8c0,

    thd=0x77ffa8000dd0, null_value=0x77ffa80de876, args=0x0, arg_count=0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item.cc:3012

#26 0x0000555555d4483b in Item_func_sp::execute (this=0x77ffa80de800)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item_func.cc:6768

#27 0x0000555555d4e376 in Item_func_sp::val_int (this=0x77ffa80de800)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item_func.h:4358

#28 0x0000555555cc22c0 in Item::save_int_in_field (this=0x77ffa80de800,

    field=0x77ffa8037300, no_conversions=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item.cc:7340

#29 0x0000555555ade55e in Type_handler_int_result::Item_save_in_field (

    this=0x5555583c9300 <type_handler_slong>, item=0x77ffa80de800,

    field=0x77ffa8037300, no_conversions=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_type.cc:4512

#30 0x0000555555cc240d in Item::save_in_field (this=0x77ffa80de800,

    field=0x77ffa8037300, no_conversions=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item.cc:7367

#31 0x0000555555c3db42 in Field::sp_prepare_and_store_item (

    this=0x77ffa8037300, thd=0x77ffa8000dd0, value=0x77ffa80dea88)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/field.cc:1527

#32 0x0000555555623fd8 in THD::sp_eval_expr (this=0x77ffa8000dd0,

    result_field=0x77ffa8037300, expr_item_ptr=0x77ffa80dea88)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:452

#33 0x000055555563ca15 in sp_rcontext::set_variable (this=0x77ffa80366f0,

    thd=0x77ffa8000dd0, idx=0, value=0x77ffa80dea88)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_rcontext.cc:676

#34 0x0000555555ac19af in sp_instr_set::exec_core (this=0x77ffa80de9d0,

    thd=0x77ffa8000dd0, nextp=0x7fffe009d9cc)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:1314

#35 0x0000555555abf6b3 in sp_lex_keeper::reset_lex_and_exec_core (

    this=0x77ffa80dea10, thd=0x77ffa8000dd0, nextp=0x7fffe009d9cc,

    open_tables=true, instr=0x77ffa80de9d0, rerun_the_same_instr=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:420

#36 0x0000555555abfd7d in sp_lex_keeper::validate_lex_and_exec_core (

    this=0x77ffa80dea10, thd=0x77ffa8000dd0, nextp=0x7fffe009d9cc,

    open_tables=true, instr=0x77ffa80de9d0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:599

#37 0x0000555555ac18ec in sp_instr_set::execute (this=0x77ffa80de9d0,

    thd=0x77ffa8000dd0, nextp=0x7fffe009d9cc)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:1301

#38 0x0000555555626f9a in sp_head::execute (this=0x77ffa80dd030,

    thd=0x77ffa8000dd0, merge_da_on_success=true)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:1296

#39 0x000055555562a05f in sp_head::execute_procedure (this=0x77ffa80dd030,

    thd=0x77ffa8000dd0, args=0x77ffa80064f0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:2341

#40 0x00005555557664a7 in do_execute_sp (thd=0x77ffa8000dd0, sp=0x77ffa80dd030)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:3084

#41 0x00005555557671fa in Sql_cmd_call::execute (this=0x77ffa8035570,

    thd=0x77ffa8000dd0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:3322

#42 0x0000555555771977 in mysql_execute_command (thd=0x77ffa8000dd0,

    is_called_from_prepared_stmt=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:5905

#43 0x0000555555777fde in mysql_parse (thd=0x77ffa8000dd0,

    rawbuf=0x77ffa80352d0 "CALL p1", length=7, parser_state=0x7fffe009ef40)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:7945

#44 0x0000555555762b6e in dispatch_command (command=COM_QUERY,

    thd=0x77ffa8000dd0, packet=0x77ffa800c3f1 "CALL p1", packet_length=7,

    blocking=true)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:1903

#45 0x000055555576127b in do_command (thd=0x77ffa8000dd0, blocking=true)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:1437

#46 0x00005555559ad47c in do_handle_one_connection (connect=0x5555596b0410,

    put_in_cache=true)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_connect.cc:1503

#47 0x00005555559ad1c9 in handle_one_connection (arg=0x5555596b0410)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_connect.cc:1415

#48 0x0000555556046528 in pfs_spawn_thread (arg=0x5555596b06b0)

    at /home/bar/maria-git/13.1.m39518.fnc4/storage/perfschema/pfs.cc:2198

#49 0x00007ffff7080f34 in start_thread () from /lib64/libc.so.6

#50 0x00007ffff710436c in __clone3 () from /lib64/libc.so.6

Attachments

Issue Links

is caused by

MDEV-39518 Allow prepared statements in stored functions in assignment right hand

Closed

Activity

People

Assignee:: Alexander Barkov

Reporter:: Alexander Barkov

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2026-08-24 11:53

Updated:: 2026-09-08 04:12

Resolved:: 2026-08-25 15:26

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.