Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40956

SIGSEGV in compare_window_funcs_by_window_specs

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 11.4, 11.8, 12.3, 13.0, 13.1
    • 11.4, 11.8, 12.3, 13.0
    • Optimizer
    • None
    • Can result in hang or crash

    Description

      CREATE TABLE t3 (c1 INT);
      DELETE HISTORY FROM t3 BEFORE SYSTEM_TIME (SELECT 1 FROM t3) + MIN(1) OVER() + MIN(1) OVER w2;
      

      Leads to:

      CS 13.0.2 be111d2cd60d035d555b71da019765cfb42ea0d3 (Optimized, Clang 22.1.8-20260621) Build 21/08/2026

      Core was generated by `/test/MD210826-mariadb-13.0.2-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x0000626ce25788e9 in compare_window_funcs_by_window_specs (win_func1=0x6d945001a640, win_func2=0x6d945001aa20, arg=0x0)at /test/13.0_opt/sql/sql_window.cc:646
       
      [Current thread is 1 (LWP 206556)]
      (gdb) bt
      #0  0x0000626ce25788e9 in compare_window_funcs_by_window_specs (win_func1=0x6d945001a640, win_func2=0x6d945001aa20, arg=0x0)at /test/13.0_opt/sql/sql_window.cc:646
      #1  bubble_sort<Item_window_func> (list_to_sort=<optimized out>, sort_func=<optimized out>, arg=<optimized out>)at /test/13.0_opt/sql/sql_list.h:667
      #2  order_window_funcs_by_window_specs (win_func_list=0x6d9450005f08)at /test/13.0_opt/sql/sql_window.cc:740
      #3  Window_funcs_computation::setup (this=0x6d945001db90, thd=0x6d9450000c70, window_funcs=0x6d9450005f08, tab=tab@entry=0x6d945001c9f8)at /test/13.0_opt/sql/sql_window.cc:3198
      #4  0x0000626ce23f51fa in JOIN::make_aggr_tables_info (this=this@entry=0x6d945001ae50) at /test/13.0_opt/sql/sql_select.cc:4335
      #5  0x0000626ce23e8a2f in JOIN::optimize_stage2 (this=this@entry=0x6d945001ae50) at /test/13.0_opt/sql/sql_select.cc:3576
      #6  0x0000626ce23e719f in JOIN::optimize_inner (this=this@entry=0x6d945001ae50)at /test/13.0_opt/sql/sql_select.cc:2789
      #7  0x0000626ce241f09b in JOIN::optimize (this=0x6d945001ae50)at /test/13.0_opt/sql/sql_select.cc:2016
      #8  Sql_cmd_dml::execute_inner (this=this@entry=0x6d945001abe0, thd=thd@entry=0x6d9450000c70) at /test/13.0_opt/sql/sql_select.cc:35073
      #9  0x0000626ce2362f99 in Sql_cmd_delete::execute_inner (this=0x6d945001abe0, thd=0x6d9450000c70) at /test/13.0_opt/sql/sql_delete.cc:2169
      #10 0x0000626ce241ec8c in Sql_cmd_dml::execute (this=0x6d945001abe0, thd=0x6d9450000c70) at /test/13.0_opt/sql/sql_select.cc:35015
      #11 0x0000626ce23a960b in mysql_execute_command (thd=thd@entry=0x6d9450000c70, is_called_from_prepared_stmt=false) at /test/13.0_opt/sql/sql_parse.cc:4446
      #12 0x0000626ce23a48fd in mysql_parse (thd=thd@entry=0x6d9450000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7595881684f0)at /test/13.0_opt/sql/sql_parse.cc:7943
      #13 0x0000626ce23a30cf in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x6d9450000c70, packet=packet@entry=0x6d9450008d91 "DELETE HISTORY FROM t3 BEFORE SYSTEM_TIME (SELECT 1 FROM t3) + MIN(1) OVER() + MIN(1) OVER w2", packet_length=packet_length@entry=93, blocking=true)at /test/13.0_opt/sql/sql_parse.cc:1903
      #14 0x0000626ce23a4d80 in do_command (thd=thd@entry=0x6d9450000c70, blocking=true) at /test/13.0_opt/sql/sql_parse.cc:1437
      #15 0x0000626ce24cd22d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x626cfb80c560, put_in_cache=true)at /test/13.0_opt/sql/sql_connect.cc:1514
      #16 0x0000626ce24cd062 in handle_one_connection (arg=arg@entry=0x626cfb80c560)at /test/13.0_opt/sql/sql_connect.cc:1426
      #17 0x0000626ce2870323 in pfs_spawn_thread (arg=0x626cfb82c950)at /test/13.0_opt/storage/perfschema/pfs.cc:2198
      #18 0x000075958c29cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #19 0x000075958c329d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      CS 13.0.2 be111d2cd60d035d555b71da019765cfb42ea0d3 (Debug, Clang 22.1.8-20260621) Build 21/08/2026

      Core was generated by `/test/MD210826-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x000064c5836ce09e in compare_window_funcs_by_window_specs (win_func1=0x73b87001cea0, win_func2=0x73b87001d280, arg=0x0)at /test/13.0_dbg/sql/sql_window.cc:646
       
      [Current thread is 1 (LWP 206690)]
      (gdb) bt
      #0  0x000064c5836ce09e in compare_window_funcs_by_window_specs (win_func1=0x73b87001cea0, win_func2=0x73b87001d280, arg=0x0)at /test/13.0_dbg/sql/sql_window.cc:646
      #1  0x000064c5836d2ca8 in bubble_sort<Item_window_func> (list_to_sort=0x73b870005fd0, sort_func=0x64c5836ce040 <compare_window_funcs_by_window_specs(Item_window_func*, Item_window_func*, void*)>, arg=0x0) at /test/13.0_dbg/sql/sql_list.h:667
      #2  0x000064c5836cd8ff in order_window_funcs_by_window_specs (win_func_list=0x73b870005fd0) at /test/13.0_dbg/sql/sql_window.cc:740
      #3  0x000064c5836cd70c in Window_funcs_computation::setup (this=0x73b870020570, thd=0x73b870000d60, window_funcs=0x73b870005fd0, tab=0x73b87001f2d8) at /test/13.0_dbg/sql/sql_window.cc:3198
      #4  0x000064c583465abc in JOIN::make_aggr_tables_info (this=0x73b87001d6b0)at /test/13.0_dbg/sql/sql_select.cc:4335
      #5  0x000064c5834553c7 in JOIN::optimize_stage2 (this=0x73b87001d6b0)at /test/13.0_dbg/sql/sql_select.cc:3576
      #6  0x000064c58345310f in JOIN::optimize_inner (this=0x73b87001d6b0)at /test/13.0_dbg/sql/sql_select.cc:2789
      #7  0x000064c583450ce6 in JOIN::optimize (this=0x73b87001d6b0)at /test/13.0_dbg/sql/sql_select.cc:2016
      #8  0x000064c58349c662 in Sql_cmd_dml::execute_inner (this=0x73b87001d440, thd=0x73b870000d60) at /test/13.0_dbg/sql/sql_select.cc:35073
      #9  0x000064c58337633a in Sql_cmd_delete::execute_inner (this=0x73b87001d440, thd=0x73b870000d60) at /test/13.0_dbg/sql/sql_delete.cc:2169
      #10 0x000064c58349c2d9 in Sql_cmd_dml::execute (this=0x73b87001d440, thd=0x73b870000d60) at /test/13.0_dbg/sql/sql_select.cc:35015
      #11 0x000064c5833eba00 in mysql_execute_command (thd=0x73b870000d60, is_called_from_prepared_stmt=false) at /test/13.0_dbg/sql/sql_parse.cc:4446
      #12 0x000064c5833e2d18 in mysql_parse (thd=0x73b870000d60, rawbuf=0x73b87001a3c0 "DELETE HISTORY FROM t3 BEFORE SYSTEM_TIME (SELECT 1 FROM t3) + MIN(1) OVER() + MIN(1) OVER w2", length=93, parser_state=0x7bb9a40dc9f0) at /test/13.0_dbg/sql/sql_parse.cc:7943
      #13 0x000064c5833e046e in dispatch_command (command=COM_QUERY, thd=0x73b870000d60, packet=0x73b87000b5f1 "DELETE HISTORY FROM t3 BEFORE SYSTEM_TIME (SELECT 1 FROM t3) + MIN(1) OVER() + MIN(1) OVER w2", packet_length=93, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1903
      #14 0x000064c5833e379a in do_command (thd=0x73b870000d60, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1437
      #15 0x000064c5835b575e in do_handle_one_connection (connect=0x64c5c231c6f0, put_in_cache=true) at /test/13.0_dbg/sql/sql_connect.cc:1514
      #16 0x000064c5835b5541 in handle_one_connection (arg=0x64c5c22fb050)at /test/13.0_dbg/sql/sql_connect.cc:1426
      #17 0x00007bb9a829cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #18 0x00007bb9a8329d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.11  dbg  210826  6415902490b1b0a9a500cee9bc0a41c342190605  No bug found                  
      CS  10.11  opt  210826  6415902490b1b0a9a500cee9bc0a41c342190605  No bug found                  
      CS  11.4   dbg  210826  1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc  m_alloced_field_count|SIGABRT|Create_tmp_table::start|create_tmp_table|JOIN::create_postjoin_aggr_table|JOIN::make_aggr_tables_info
      CS  11.4   opt  210826  1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      CS  11.8   dbg  210826  d26f9ab217a7fcf9d4eccc62c01020ff275ff42e  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      CS  11.8   opt  210826  d26f9ab217a7fcf9d4eccc62c01020ff275ff42e  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      CS  12.3   dbg  210826  add63991988734383c5e942de2a19c6c45f511f7  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      CS  12.3   opt  210826  add63991988734383c5e942de2a19c6c45f511f7  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      CS  13.0   dbg  210826  be111d2cd60d035d555b71da019765cfb42ea0d3  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      CS  13.0   opt  210826  be111d2cd60d035d555b71da019765cfb42ea0d3  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      CS  13.1   dbg  210826  ff09eefbe4e8b57846435ee4a928f17e49f0fdfc  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      CS  13.1   opt  210826  ff09eefbe4e8b57846435ee4a928f17e49f0fdfc  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      ES  10.6   dbg  210826  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  10.6   opt  210826  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  
      ES  11.4   dbg  210826  3b34189bfe675c18c4ced3ef531d016ea74c76f4  m_alloced_field_count|SIGABRT|Create_tmp_table::start|create_tmp_table|JOIN::create_postjoin_aggr_table|JOIN::make_aggr_tables_info
      ES  11.4   opt  210826  3b34189bfe675c18c4ced3ef531d016ea74c76f4  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      ES  11.8   dbg  210826  4694e931d10fecf733c34f83ea2146d31b708eb3  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      ES  11.8   opt  210826  4694e931d10fecf733c34f83ea2146d31b708eb3  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      ES  12.3   dbg  210826  f513f503feacabfb219d4a6f965b5f72b86d4db0  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      ES  12.3   opt  210826  f513f503feacabfb219d4a6f965b5f72b86d4db0  SIGSEGV|compare_window_funcs_by_window_specs|bubble_sort<Item_window_func>|order_window_funcs_by_window_specs|Window_funcs_computation::setup
      

      Attachments

        Activity

          People

            psergei Sergei Petrunia
            saahil Saahil Alam
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 1.5h
                1.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.