[MDEV-40912] SIGSEGV in mrn_generic_ft_clear on INFORMATION_SCHEMA.TABLES query over a Mroonga MATCH() AGAINST() view - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.11, 11.4, 11.8, 12.3, 13.0, 13.1
Fix Version/s: 10.11, 11.4, 11.8, 12.3, 13.0
Component/s: Storage Engine - Mroonga
Labels:
- ASAN
- use-after-poison

Bug Category:
Can result in hang or crash

Description

INSTALL SONAME 'ha_mroonga';

CREATE TABLE t1 (c1 INT) ENGINE=Mroonga;

CREATE VIEW v1 AS SELECT MATCH(c1) AGAINST ('') FROM t1;

SELECT * FROM information_schema.TABLES;

Leads to:

CS 13.0.2 be111d2cd60d035d555b71da019765cfb42ea0d3 (Debug, Clang 22.1.8-20260621) Build 21/08/2026
Core was generated by `/test/MD210826-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000077dad7108938 in mrn_generic_ft_clear (handler=0x8f8f8f8f8f8f8f8f)at /test/13.0_dbg/storage/mroonga/ha_mroonga.cpp:2127

[Current thread is 1 (LWP 1496040)]
(gdb) bt
#0 0x000077dad7108938 in mrn_generic_ft_clear (handler=0x8f8f8f8f8f8f8f8f)at /test/13.0_dbg/storage/mroonga/ha_mroonga.cpp:2127
#1 0x000077dad71088db in ha_mroonga::generic_reset (this=0x77d9e5700630)at /test/13.0_dbg/storage/mroonga/ha_mroonga.cpp:12200
#2 0x000077dad7108c20 in ha_mroonga::storage_reset (this=0x77d9e5700630)at /test/13.0_dbg/storage/mroonga/ha_mroonga.cpp:12239
#3 0x000077dad7108d40 in ha_mroonga::reset (this=0x77d9e5700630)at /test/13.0_dbg/storage/mroonga/ha_mroonga.cpp:12255
#4 0x00006254102c7532 in handler::ha_reset (this=0x77d9e5700630)at /test/13.0_dbg/sql/handler.cc:8117
#5 0x000062540fde9282 in close_thread_table (thd=0x77d9e4000d60, table_ptr=0x77d9e4000ed0) at /test/13.0_dbg/sql/sql_base.cc:1070
#6 0x000062540fde99ac in close_thread_tables (thd=0x77d9e4000d60)at /test/13.0_dbg/sql/sql_base.cc:1010
#7 0x000062540ff8580e in fill_schema_table_by_open (thd=0x77d9e4000d60, mem_root=0x7fdaf747dc50, is_show_fields_or_keys=false, table=0x77d9e56bda80, schema_table=0x625411936a28 <schema_tables+2952>, orig_db_name=0x77d9e4021f70, orig_table_name=0x77d9e4022000, open_tables_state_backup=0x7fdaf747dcb8, can_deadlock=false)at /test/13.0_dbg/sql/sql_show.cc:5020
#8 0x000062540ff84fe8 in get_all_tables (thd=0x77d9e4000d60, tables=0x77d9e401ab40, cond=0x0) at /test/13.0_dbg/sql/sql_show.cc:5727
#9 0x000062540ff91014 in get_schema_tables_result (join=0x77d9e401c7b0, executed_place=PROCESSED_BY_JOIN_EXEC)at /test/13.0_dbg/sql/sql_show.cc:9937
#10 0x000062540ff31ef7 in JOIN::exec_inner (this=0x77d9e401c7b0)at /test/13.0_dbg/sql/sql_select.cc:5086
#11 0x000062540ff314a3 in JOIN::exec (this=0x77d9e401c7b0)at /test/13.0_dbg/sql/sql_select.cc:4913
#12 0x000062540ff0f5cb in mysql_select (thd=0x77d9e4000d60, tables=0x77d9e401ab40, fields=@0x77d9e401a728: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x77d9e401aaa0, last = 0x77d9e401f200, elements = 23}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2701396736, result=0x77d9e401c780, unit=0x77d9e4005280, select_lex=0x77d9e401a470) at /test/13.0_dbg/sql/sql_select.cc:5439
#13 0x000062540ff0f12d in handle_select (thd=0x77d9e4000d60, lex=0x77d9e40051a0, result=0x77d9e401c780, setup_tables_done_option=0)at /test/13.0_dbg/sql/sql_select.cc:636
#14 0x000062540feb9af6 in execute_sqlcom_select (thd=0x77d9e4000d60, all_tables=0x77d9e401ab40) at /test/13.0_dbg/sql/sql_parse.cc:6217
#15 0x000062540feaff28 in mysql_execute_command (thd=0x77d9e4000d60, is_called_from_prepared_stmt=false) at /test/13.0_dbg/sql/sql_parse.cc:3991
#16 0x000062540fea8d18 in mysql_parse (thd=0x77d9e4000d60, rawbuf=0x77d9e401a3c0 "SELECT * FROM information_schema.TABLES", length=39, parser_state=0x7fdaf74809f0)at /test/13.0_dbg/sql/sql_parse.cc:7943
#17 0x000062540fea646e in dispatch_command (command=COM_QUERY, thd=0x77d9e4000d60, packet=0x77d9e400b5f1 "SELECT * FROM information_schema.TABLES", packet_length=39, blocking=true) at /test/13.0_dbg/sql/sql_parse.cc:1903
#18 0x000062540fea979a in do_command (thd=0x77d9e4000d60, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1437
#19 0x000062541007b75e in do_handle_one_connection (connect=0x62544e80e880, put_in_cache=true) at /test/13.0_dbg/sql/sql_connect.cc:1514
#20 0x000062541007b541 in handle_one_connection (arg=0x62544e7ed1e0)at /test/13.0_dbg/sql/sql_connect.cc:1426
#21 0x00007fdb1d09cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#22 0x00007fdb1d129d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.11 dbg 210826 6415902490b1b0a9a500cee9bc0a41c342190605 SIGSEGV\|mrn_generic_ft_clear\|ha_mroonga::generic_reset\|ha_mroonga::storage_reset\|ha_mroonga::reset
CS 10.11 opt 210826 6415902490b1b0a9a500cee9bc0a41c342190605 No bug found
CS 11.4 dbg 210826 1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc SIGSEGV\|mrn_generic_ft_clear\|ha_mroonga::generic_reset\|ha_mroonga::storage_reset\|ha_mroonga::reset
CS 11.4 opt 210826 1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc No bug found
CS 11.8 dbg 210826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGSEGV\|mrn_generic_ft_clear\|ha_mroonga::generic_reset\|ha_mroonga::storage_reset\|ha_mroonga::reset
CS 11.8 opt 210826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e No bug found
CS 12.3 dbg 210826 add63991988734383c5e942de2a19c6c45f511f7 SIGSEGV\|mrn_generic_ft_clear\|ha_mroonga::generic_reset\|ha_mroonga::storage_reset\|ha_mroonga::reset
CS 12.3 opt 210826 add63991988734383c5e942de2a19c6c45f511f7 No bug found
CS 13.0 dbg 210826 be111d2cd60d035d555b71da019765cfb42ea0d3 SIGSEGV\|mrn_generic_ft_clear\|ha_mroonga::generic_reset\|ha_mroonga::storage_reset\|ha_mroonga::reset
CS 13.0 opt 210826 be111d2cd60d035d555b71da019765cfb42ea0d3 No bug found
CS 13.1 dbg 210826 ff09eefbe4e8b57846435ee4a928f17e49f0fdfc SIGSEGV\|mrn_generic_ft_clear\|ha_mroonga::generic_reset\|ha_mroonga::storage_reset\|ha_mroonga::reset
CS 13.1 opt 210826 ff09eefbe4e8b57846435ee4a928f17e49f0fdfc No bug found
ES 10.6 dbg 210826 fcecb2620f25965723d640decede7c018bcb1dcc SIGSEGV\|mrn_generic_ft_clear\|ha_mroonga::generic_reset\|ha_mroonga::storage_reset\|ha_mroonga::reset
ES 10.6 opt 210826 fcecb2620f25965723d640decede7c018bcb1dcc No bug found
ES 11.4 dbg 210826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 SIGSEGV\|mrn_generic_ft_clear\|ha_mroonga::generic_reset\|ha_mroonga::storage_reset\|ha_mroonga::reset
ES 11.4 opt 210826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 No bug found
ES 11.8 dbg 210826 4694e931d10fecf733c34f83ea2146d31b708eb3 SIGSEGV\|mrn_generic_ft_clear\|ha_mroonga::generic_reset\|ha_mroonga::storage_reset\|ha_mroonga::reset
ES 11.8 opt 210826 4694e931d10fecf733c34f83ea2146d31b708eb3 No bug found
ES 12.3 dbg 210826 f513f503feacabfb219d4a6f965b5f72b86d4db0 SIGSEGV\|mrn_generic_ft_clear\|ha_mroonga::generic_reset\|ha_mroonga::storage_reset\|ha_mroonga::reset
ES 12.3 opt 210826 f513f503feacabfb219d4a6f965b5f72b86d4db0 No bug found

Attachments

Activity

People

Assignee:: Oleksandr Byelkin

Reporter:: Saahil Alam

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 6 days ago 07:59

Updated:: 6 days ago 08:03

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

1.5h

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.