Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41015

SIGSEGV in THD::is_error | Item::save_in_field | Item_trigger_field::set_value on INSERT w/ TRIGGER

    XMLWordPrintable

Details

    • Not for Release Notes
    • Q3/2026 Server Development

    Description

      Testcase is CLI/MTR compatible.

      CREATE TABLE t1 (a INT, b INT) ENGINE=MyISAM;
      DELIMITER $$
      CREATE FUNCTION f1() RETURNS INT BEGIN EXECUTE IMMEDIATE 'SELECT 1 INTO @x'; RETURN 5; END$$
      CREATE TRIGGER tr1 BEFORE INSERT ON t1 FOR EACH ROW BEGIN SET NEW.a = 999; SET NEW.b = f1(); END$$
      DELIMITER ;
      INSERT INTO t1 VALUES (1,2);
      

      Leads to:

      MDEV-39518 CS 13.1.0 3716d0c58dd4a2abdef84cee36d919b9c916802d (Debug, Clang 18.1.3-11) Build 02/09/2026

      mariadbd: /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/item.cc:10955: virtual bool Item_trigger_field::set_value(THD *, sp_rcontext *, Item **): Assertion `thd->open_tables != nullptr' failed.
      

      MDEV-39518 CS 13.1.0 3716d0c58dd4a2abdef84cee36d919b9c916802d (Debug, Clang 18.1.3-11) Build 02/09/2026

      Core was generated by `/test/mtest/MDEV-39518/MD020926-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 2260274)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x000075d0d184527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x000075d0d18288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x000075d0d182881b in __assert_fail_base (fmt=0x75d0d19d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x643828bbdb44 "thd->open_tables != nullptr", file=file@entry=0x643828bbb21b "/test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/item.cc", line=line@entry=10955, function=function@entry=0x643828bbdb60 "virtual bool Item_trigger_field::set_value(THD *, sp_rcontext *, Item **)") at ./assert/assert.c:96
      #6  0x000075d0d183b517 in __assert_fail (assertion=0x643828bbdb44 "thd->open_tables != nullptr", file=0x643828bbb21b "/test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/item.cc", line=10955, function=0x643828bbdb60 "virtual bool Item_trigger_field::set_value(THD *, sp_rcontext *, Item **)") at ./assert/assert.c:105
      #7  0x0000643827e4b71b in Item_trigger_field::set_value (this=0x6dcfb804d640, thd=0x6dcfb8000d60, it=0x6dcfb804d868)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/item.cc:10955
      #8  0x0000643827c7295b in Item_trigger_field::set_value (this=0x6dcfb804d640, thd=0x6dcfb8000d60, it=0x6dcfb804d868)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/item.h:7927
      #9  0x0000643827c6eae9 in sp_instr_set_trigger_field::exec_core (this=0x6dcfb804d7b0, thd=0x6dcfb8000d60, nextp=0x75d0d0146408)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sp_instr.cc:1725
      #10 0x0000643827c6a416 in sp_lex_keeper::reset_lex_and_exec_core (this=0x6dcfb804d7f0, thd=0x6dcfb8000d60, nextp=0x75d0d0146408, open_tables=true, instr=0x6dcfb804d7b0, rerun_the_same_instr=false)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sp_instr.cc:420
      #11 0x0000643827c6abbc in sp_lex_keeper::validate_lex_and_exec_core (this=0x6dcfb804d7f0, thd=0x6dcfb8000d60, nextp=0x75d0d0146408, open_tables=true, instr=0x6dcfb804d7b0)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sp_instr.cc:608
      #12 0x0000643827c6ea3f in sp_instr_set_trigger_field::execute (this=0x6dcfb804d7b0, thd=0x6dcfb8000d60, nextp=0x75d0d0146408)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sp_instr.cc:1717
      #13 0x000064382785642c in sp_head::execute (this=0x6dcfb804ba70, thd=0x6dcfb8000d60, merge_da_on_success=false)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sp_head.cc:1346
      #14 0x000064382785830f in sp_head::execute_trigger (this=0x6dcfb804ba70, thd=0x6dcfb8000d60, db_name=0x6dcfb80273c8, table_name=0x6dcfb80273d8, grant_info=0x6dcfb805b5c8)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sp_head.cc:1859
      #15 0x0000643827aef1ac in Table_triggers_list::process_triggers (this=0x6dcfb805b010, thd=0x6dcfb8000d60, event=TRG_EVENT_INSERT, time_type=TRG_ACTION_BEFORE, old_row_is_record1=true, skip_row_indicator=0x75d0d0146eff, fields_in_update_stmt=0x0)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sql_trigger.cc:2879
      #16 0x00006438278cb60d in fill_record_n_invoke_before_triggers (thd=0x6dcfb8000d60, table=0x6dcfb8060ea0, ptr=0x6dcfb805ac00, values=@0x6dcfb801b200: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6dcfb801b2c0, last = 0x6dcfb801b370, elements = 2}, <No data fields>}, ignore_errors=false, event=TRG_EVENT_INSERT, skip_row_indicator=0x75d0d0146eff)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sql_base.cc:9855
      #17 0x0000643827923704 in mysql_insert (thd=0x6dcfb8000d60, table_list=0x6dcfb801a5a0, fields=@0x6dcfb80062d0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x64382982f980 <end_of_list>, last = 0x6dcfb80062d0, elements = 0}, <No data fields>}, values_list=@0x6dcfb8006318: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6dcfb801b380, last = 0x6dcfb801b380, elements = 1}, <No data fields>}, update_fields=@0x6dcfb8006300: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x64382982f980 <end_of_list>, last = 0x6dcfb8006300, elements = 0}, <No data fields>}, update_values=@0x6dcfb80062e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x64382982f980 <end_of_list>, last = 0x6dcfb80062e8, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sql_insert.cc:1193
      #18 0x00006438279944bb in mysql_execute_command (thd=0x6dcfb8000d60, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sql_parse.cc:4540
      #19 0x0000643827989fd4 in mysql_parse (thd=0x6dcfb8000d60, rawbuf=0x6dcfb801a490 "INSERT INTO t1 VALUES (1,2)", length=27, parser_state=0x75d0d0148a80)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sql_parse.cc:8000
      #20 0x00006438279872fd in dispatch_command (command=COM_QUERY, thd=0x6dcfb8000d60, packet=0x6dcfb800b6c1 "INSERT INTO t1 VALUES (1,2)", packet_length=27, blocking=true)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sql_parse.cc:1903
      #21 0x000064382798ab83 in do_command (thd=0x6dcfb8000d60, blocking=true)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sql_parse.cc:1437
      #22 0x0000643827b90619 in do_handle_one_connection (connect=0x643863b7ea30, put_in_cache=true)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sql_connect.cc:1514
      #23 0x0000643827b903be in handle_one_connection (arg=0x643863b1d3d0)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_dbg/sql/sql_connect.cc:1426
      #24 0x000075d0d189cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #25 0x000075d0d1929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      MDEV-39518 CS 13.1.0 3716d0c58dd4a2abdef84cee36d919b9c916802d (Optimized, Clang 18.1.3-11) Build 02/09/2026

      Core was generated by `/test/mtest/MDEV-39518/MD020926-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  THD::is_error (this=0x0)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_class.h:5261
      5261	  inline bool is_error() const { return m_stmt_da->is_error(); }
      [Current thread is 1 (LWP 2267415)]
      (gdb) bt
      #0  THD::is_error (this=0x0)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_class.h:5261
      #1  Item::save_in_field (this=0x7424940482d0, field=0x742494026860, no_conversions=false)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/item.cc:7582
      #2  0x00006471c74f7117 in Item_trigger_field::set_value (this=0x7424940484a0, thd=0x742494000c70, it=<optimized out>)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/item.cc:10956
      #3  0x00006471c73f74c9 in Item_trigger_field::set_value (this=0x742494026860, thd=0x742494000c70, it=0x4)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/item.h:7927
      #4  sp_instr_set_trigger_field::exec_core (this=0x742494048610, thd=0x742494000c70, nextp=0x7c25cc4f2544)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sp_instr.cc:1725
      #5  0x00006471c73f48fa in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x742494048648, thd=thd@entry=0x742494000c70, nextp=nextp@entry=0x7c25cc4f2544, open_tables=true, instr=instr@entry=0x742494048610, rerun_the_same_instr=<optimized out>)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sp_instr.cc:420
      #6  0x00006471c73f4f26 in sp_lex_keeper::validate_lex_and_exec_core (this=0x742494048648, thd=0x742494000c70, nextp=0x7c25cc4f2544, open_tables=<optimized out>, instr=0x742494048610)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sp_instr.cc:608
      #7  0x00006471c719f61a in sp_head::execute (this=this@entry=0x7424940468e0, thd=thd@entry=0x742494000c70, merge_da_on_success=false)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sp_head.cc:1346
      #8  0x00006471c71a062a in sp_head::execute_trigger (this=0x7424940468e0, thd=0x742494000c70, db_name=<optimized out>, table_name=<optimized out>, grant_info=<optimized out>)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sp_head.cc:1859
      #9  0x00006471c7318e36 in Table_triggers_list::process_triggers (this=0x742494026b40, thd=0x742494000c70, event=TRG_EVENT_INSERT, time_type=<optimized out>, old_row_is_record1=<optimized out>, skip_row_indicator=0x7c25cc4f2ef8, fields_in_update_stmt=0x0)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_trigger.cc:2879
      #10 0x00006471c71e0fb1 in fill_record_n_invoke_before_triggers (thd=thd@entry=0x742494000c70, table=0x742494022430, ptr=0x742494026750, values=@0x7424940189a0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x742494018a60, last = 0x742494018b10, elements = 2}, <No data fields>}, ignore_errors=<optimized out>, event=event@entry=TRG_EVENT_INSERT, skip_row_indicator=0x7c25cc4f2ef8)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_base.cc:9855
      #11 0x00006471c720faef in mysql_insert (thd=thd@entry=0x742494000c70, table_list=0x742494017d40, fields=@0x742494006208: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6471c8540418 <end_of_list>, last = 0x742494006208, elements = 0}, <No data fields>}, values_list=@0x742494006250: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x742494018b20, last = 0x742494018b20, elements = 1}, <No data fields>}, update_fields=@0x742494006238: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6471c8540418 <end_of_list>, last = 0x742494006238, elements = 0}, <No data fields>}, update_values=@0x742494006220: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6471c8540418 <end_of_list>, last = 0x742494006220, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=<optimized out>, result=0x0)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_insert.cc:1193
      #12 0x00006471c72502ff in mysql_execute_command (thd=thd@entry=0x742494000c70, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_parse.cc:4540
      #13 0x00006471c7248c02 in mysql_parse (thd=thd@entry=0x742494000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7c25cc4f3580)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_parse.cc:8000
      #14 0x00006471c72471c0 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x742494000c70, packet=packet@entry=0x742494008e61 "INSERT INTO t1 VALUES (1,2)", packet_length=packet_length@entry=27, blocking=true)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_parse.cc:1903
      #15 0x00006471c7249081 in do_command (thd=thd@entry=0x742494000c70, blocking=true)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_parse.cc:1437
      #16 0x00006471c73752dd in do_handle_one_connection (connect=<optimized out>, connect@entry=0x647200b4b640, put_in_cache=true)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_connect.cc:1514
      #17 0x00006471c7375112 in handle_one_connection (arg=arg@entry=0x647200b4b640)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/sql/sql_connect.cc:1426
      #18 0x00006471c7721053 in pfs_spawn_thread (arg=0x647200b6c030)at /test/mtest/MDEV-39518/bb-13.1-bar-MDEV-39518_opt/storage/perfschema/pfs.cc:2198
      #19 0x00007c25d089cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #20 0x00007c25d0929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Attachments

        Issue Links

          Activity

            People

              bar Alexander Barkov
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 10m
                  10m

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.