Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
13.0, 13.1
-
Can result in hang or crash
Description
SELECT 1 FROM (SELECT JSON_ARRAY_APPEND(0,0%0,1) x) d WHERE x*x; |
Leads to:
|
CS 13.0.2 b2c4e675049e23ce8c7346985f40840fcd4e583f (Optimized, Clang 22.1.8-20260621) Build 09/09/2026 |
Core was generated by `/test/MD090926-mariadb-13.0.2-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 json_string_set_cs (s=0x7ddf50c4d400, i_cs=0x0)at /test/13.0_opt/strings/json_lib.c:43
|
 |
[Current thread is 1 (LWP 1581746)]
|
(gdb) bt
|
#0 json_string_set_cs (s=0x7ddf50c4d400, i_cs=0x0)at /test/13.0_opt/strings/json_lib.c:43
|
#1 json_find_path (je=0x75de3c01d2e8, p=0x75de3c01bcb0, p_cur_step=0x7ddf50c4d480, array_counters=0x75de3c01d268)at /test/13.0_opt/strings/json_lib.c:1533
|
#2 0x00005dee4fbe1e8b in Item_func_json_array_append::val_str (this=0x75de3c01d190, str=0x7ddf50c4d530)at /test/13.0_opt/sql/item_jsonfunc.cc:2423
|
#3 0x00005dee4fd867b8 in Item_str_func::val_real (this=0x75de3c01d2e8)at /test/13.0_opt/sql/item_strfunc.cc:157
|
#4 0x00005dee4fd53dc5 in Item_func_mul::real_op (this=0x75de3c01c7e0)at /test/13.0_opt/sql/item_func.cc:1459
|
#5 0x00005dee4fc26fc0 in Type_handler_real_result::Item_val_bool (this=<optimized out>, item=0x75de3c01bcb0)at /test/13.0_opt/sql/sql_type.cc:5320
|
#6 0x00005dee4fad4f3f in Item::eval_const_cond (this=0x75de3c01c7e0)at /test/13.0_opt/sql/item.h:1737
|
#7 Item::remove_eq_conds (this=0x75de3c01c7e0, thd=<optimized out>, cond_value=0x75de3c01b8f0, top_level_arg=<optimized out>)at /test/13.0_opt/sql/sql_select.cc:21313
|
#8 0x00005dee4fab012c in optimize_cond (join=join@entry=0x75de3c01b560, conds=0x75de3c01c7e0, join_list=<optimized out>, ignore_on_conds=false, cond_value=cond_value@entry=0x75de3c01b8f0, cond_equal=cond_equal@entry=0x75de3c01ba18, flags=1)at /test/13.0_opt/sql/sql_select.cc:20855
|
#9 0x00005dee4faacc0b in JOIN::optimize_inner (this=0x75de3c01b560)at /test/13.0_opt/sql/sql_select.cc:2478
|
#10 0x00005dee4faac22c in JOIN::optimize (this=0x75de3c01d2e8, this@entry=0x75de3c01b560) at /test/13.0_opt/sql/sql_select.cc:2016
|
#11 0x00005dee4fa2ab71 in mysql_derived_optimize (thd=0x75de3c000c70, lex=0x75de3c0050d8, derived=0x75de3c019870)at /test/13.0_opt/sql/sql_derived.cc:1081
|
#12 0x00005dee4fa2bb7a in mysql_handle_single_derived (lex=0x75de3c0050d8, derived=derived@entry=0x75de3c019870, phases=phases@entry=4)at /test/13.0_opt/sql/sql_derived.cc:235
|
#13 0x00005dee4faacedf in JOIN::optimize_inner (this=this@entry=0x75de3c01acb0)at /test/13.0_opt/sql/sql_select.cc:2583
|
#14 0x00005dee4faa6569 in JOIN::optimize (this=0x75de3c01acb0)at /test/13.0_opt/sql/sql_select.cc:2016
|
#15 mysql_select (thd=thd@entry=0x75de3c000c70, tables=<optimized out>, fields=@0x75de3c0180a8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x75de3c018380, last = 0x75de3c018380, elements = 1}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x75de3c01ac80, unit=0x75de3c0051b8, select_lex=0x75de3c017df0)at /test/13.0_opt/sql/sql_select.cc:5425
|
#16 0x00005dee4faa6000 in handle_select (thd=thd@entry=0x75de3c000c70, lex=lex@entry=0x75de3c0050d8, result=result@entry=0x75de3c01ac80, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/13.0_opt/sql/sql_select.cc:636
|
#17 0x00005dee4fa73ce7 in execute_sqlcom_select (thd=thd@entry=0x75de3c000c70, all_tables=0x75de3c019870) at /test/13.0_opt/sql/sql_parse.cc:6217
|
#18 0x00005dee4fa6f6e6 in mysql_execute_command (thd=thd@entry=0x75de3c000c70, is_called_from_prepared_stmt=false) at /test/13.0_opt/sql/sql_parse.cc:3991
|
#19 0x00005dee4fa6aa2d in mysql_parse (thd=thd@entry=0x75de3c000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7ddf50c4e4f0)at /test/13.0_opt/sql/sql_parse.cc:7943
|
#20 0x00005dee4fa691ff in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x75de3c000c70, packet=packet@entry=0x75de3c008d91 "SELECT 1 FROM (SELECT JSON_ARRAY_APPEND(0,0%0,1) x) d WHERE x*x", packet_length=packet_length@entry=63, blocking=true)at /test/13.0_opt/sql/sql_parse.cc:1903
|
#21 0x00005dee4fa6aeb0 in do_command (thd=thd@entry=0x75de3c000c70, blocking=true) at /test/13.0_opt/sql/sql_parse.cc:1437
|
#22 0x00005dee4fb9335d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5dee7a0fe580, put_in_cache=true)at /test/13.0_opt/sql/sql_connect.cc:1514
|
#23 0x00005dee4fb93192 in handle_one_connection (arg=arg@entry=0x5dee7a0fe580)at /test/13.0_opt/sql/sql_connect.cc:1426
|
#24 0x00005dee4ff36453 in pfs_spawn_thread (arg=0x5dee7a11e970)at /test/13.0_opt/storage/perfschema/pfs.cc:2198
|
#25 0x00007ddf5429cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#26 0x00007ddf54329ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
CS 13.0.2 b2c4e675049e23ce8c7346985f40840fcd4e583f (Debug, Clang 22.1.8-20260621) Build 09/09/2026 |
Core was generated by `/test/MD090926-mariadb-13.0.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 0x00005b27aa338717 in json_string_set_cs (s=0x735fcc0b9bd8, i_cs=0xa5a5a5a5a5a5a5a5) at /test/13.0_dbg/strings/json_lib.c:43
|
 |
[Current thread is 1 (LWP 1581721)]
|
(gdb) bt
|
#0 0x00005b27aa338717 in json_string_set_cs (s=0x735fcc0b9bd8, i_cs=0xa5a5a5a5a5a5a5a5) at /test/13.0_dbg/strings/json_lib.c:43
|
#1 0x00005b27aa339be2 in json_find_path (je=0x6b5e9401fb78, p=0x6b5e9401e540, p_cur_step=0x735fcc0b9d78, array_counters=0x6b5e9401faf8)at /test/13.0_dbg/strings/json_lib.c:1533
|
#2 0x00005b27a98204df in Item_func_json_array_append::val_str (this=0x6b5e9401fa20, str=0x735fcc0b9e08)at /test/13.0_dbg/sql/item_jsonfunc.cc:2423
|
#3 0x00005b27a9ab617c in Item_str_func::val_real (this=0x6b5e9401fa20)at /test/13.0_dbg/sql/item_strfunc.cc:157
|
#4 0x00005b27a9a71b7d in Item_func_mul::real_op (this=0x6b5e9401f070)at /test/13.0_dbg/sql/item_func.cc:1459
|
#5 0x00005b27a989b9d9 in Item_func_hybrid_field_type::val_real_from_real_op (this=0x6b5e9401f070) at /test/13.0_dbg/sql/item_func.h:988
|
#6 0x00005b27a9886989 in Type_handler_real_result::Item_func_hybrid_field_type_val_real (this=0x5b27ab2c1660 <type_handler_double>, item=0x6b5e9401f070)at /test/13.0_dbg/sql/sql_type.cc:5750
|
#7 0x00005b27a95b0be2 in Item_func_hybrid_field_type::val_real (this=0x6b5e9401f070) at /test/13.0_dbg/sql/item_func.h:1035
|
#8 0x00005b27a9884ded in Type_handler_real_result::Item_val_bool (this=0x5b27ab2c1660 <type_handler_double>, item=0x6b5e9401f070)at /test/13.0_dbg/sql/sql_type.cc:5320
|
#9 0x00005b27a946cc6d in Item::val_bool (this=0x6b5e9401f070)at /test/13.0_dbg/sql/item.h:1713
|
#10 0x00005b27a96918c1 in Item::eval_const_cond (this=0x6b5e9401f070)at /test/13.0_dbg/sql/item.h:1737
|
#11 0x00005b27a966dac7 in Item::remove_eq_conds (this=0x6b5e9401f070, thd=0x6b5e94000d60, cond_value=0x6b5e9401e188, top_level_arg=true)at /test/13.0_dbg/sql/sql_select.cc:21313
|
#12 0x00005b27a963f851 in optimize_cond (join=0x6b5e9401ddf0, conds=0x6b5e9401f070, join_list=0x6b5e9401adc8, ignore_on_conds=false, cond_value=0x6b5e9401e188, cond_equal=0x6b5e9401e2b0, flags=1)at /test/13.0_dbg/sql/sql_select.cc:20855
|
#13 0x00005b27a9639f3b in JOIN::optimize_inner (this=0x6b5e9401ddf0)at /test/13.0_dbg/sql/sql_select.cc:2478
|
#14 0x00005b27a9638ce6 in JOIN::optimize (this=0x6b5e9401ddf0)at /test/13.0_dbg/sql/sql_select.cc:2016
|
#15 0x00005b27a9561eef in mysql_derived_optimize (thd=0x6b5e94000d60, lex=0x6b5e940051a0, derived=0x6b5e9401c0f0)at /test/13.0_dbg/sql/sql_derived.cc:1081
|
#16 0x00005b27a956391f in mysql_handle_single_derived (lex=0x6b5e940051a0, derived=0x6b5e9401c0f0, phases=4) at /test/13.0_dbg/sql/sql_derived.cc:235
|
#17 0x00005b27a963a7be in JOIN::optimize_inner (this=0x6b5e9401d530)at /test/13.0_dbg/sql/sql_select.cc:2583
|
#18 0x00005b27a9638ce6 in JOIN::optimize (this=0x6b5e9401d530)at /test/13.0_dbg/sql/sql_select.cc:2016
|
#19 0x00005b27a963152d in mysql_select (thd=0x6b5e94000d60, tables=0x6b5e9401c0f0, fields=@0x6b5e9401a928: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6b5e9401ac00, last = 0x6b5e9401ac00, elements = 1}, <No data fields>}, conds=0x6b5e9401cad0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x6b5e9401d500, unit=0x6b5e94005280, select_lex=0x6b5e9401a670)at /test/13.0_dbg/sql/sql_select.cc:5425
|
#20 0x00005b27a963112d in handle_select (thd=0x6b5e94000d60, lex=0x6b5e940051a0, result=0x6b5e9401d500, setup_tables_done_option=0)at /test/13.0_dbg/sql/sql_select.cc:636
|
#21 0x00005b27a95dbaf6 in execute_sqlcom_select (thd=0x6b5e94000d60, all_tables=0x6b5e9401c0f0) at /test/13.0_dbg/sql/sql_parse.cc:6217
|
#22 0x00005b27a95d1f28 in mysql_execute_command (thd=0x6b5e94000d60, is_called_from_prepared_stmt=false) at /test/13.0_dbg/sql/sql_parse.cc:3991
|
#23 0x00005b27a95cad18 in mysql_parse (thd=0x6b5e94000d60, rawbuf=0x6b5e9401a580 "SELECT 1 FROM (SELECT JSON_ARRAY_APPEND(0,0%0,1) x) d WHERE x*x", length=63, parser_state=0x735fcc0bc9f0)at /test/13.0_dbg/sql/sql_parse.cc:7943
|
#24 0x00005b27a95c846e in dispatch_command (command=COM_QUERY, thd=0x6b5e94000d60, packet=0x6b5e9400b5f1 "SELECT 1 FROM (SELECT JSON_ARRAY_APPEND(0,0%0,1) x) d WHERE x*x", packet_length=63, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1903
|
#25 0x00005b27a95cb79a in do_command (thd=0x6b5e94000d60, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1437
|
#26 0x00005b27a979d75e in do_handle_one_connection (connect=0x5b27cb9506f0, put_in_cache=true) at /test/13.0_dbg/sql/sql_connect.cc:1514
|
#27 0x00005b27a979d541 in handle_one_connection (arg=0x5b27cb92f050)at /test/13.0_dbg/sql/sql_connect.cc:1426
|
#28 0x0000735fcdc9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#29 0x0000735fcdd29ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.11 dbg 090926 2753b5919a10abd32ba822877c6a1cbf602d3748 No bug found
|
CS 10.11 opt 090926 2753b5919a10abd32ba822877c6a1cbf602d3748 No bug found
|
CS 11.4 dbg 090926 42038e1145dd43b3910055c364fb720a8a152d61 No bug found
|
CS 11.4 opt 090926 42038e1145dd43b3910055c364fb720a8a152d61 No bug found
|
CS 11.8 dbg 090926 e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54 No bug found
|
CS 11.8 opt 090926 e2e060ce3d8c3ce11b6c7ba28ced0f1a30c50a54 No bug found
|
CS 12.3 dbg 090926 e9f84a1fdf7093191e55b55dc14b08b9d4ebaa20 No bug found
|
CS 12.3 opt 090926 e9f84a1fdf7093191e55b55dc14b08b9d4ebaa20 No bug found
|
CS 13.0 dbg 090926 b2c4e675049e23ce8c7346985f40840fcd4e583f SIGSEGV|json_string_set_cs|json_find_path|Item_func_json_array_append::val_str|Item_str_func::val_real
|
CS 13.0 opt 090926 b2c4e675049e23ce8c7346985f40840fcd4e583f SIGSEGV|json_string_set_cs|json_find_path|Item_func_json_array_append::val_str|Item_str_func::val_real
|
CS 13.1 dbg 090926 02c842c30dcb05a962eaac58c69920e6be3369cf SIGSEGV|json_string_set_cs|json_find_path|Item_func_json_array_append::val_str|Item_str_func::val_real
|
CS 13.1 opt 090926 02c842c30dcb05a962eaac58c69920e6be3369cf SIGSEGV|json_string_set_cs|json_find_path|Item_func_json_array_append::val_str|Item_str_func::val_real
|
ES 10.6 dbg 090926 aa3fb9800c358182ee2a1f8cca8ffbdd6d0a37eb SIGSEGV|json_string_set_cs|json_find_path|Item_func_json_array_append::val_str|Item_str_func::val_real
|
ES 10.6 opt 090926 aa3fb9800c358182ee2a1f8cca8ffbdd6d0a37eb SIGSEGV|json_string_set_cs|json_find_path|Item_func_json_array_append::val_str|Item_str_func::val_real
|
ES 11.4 dbg 090926 32807340954440071ca8ae8e2de51fb180d134c6 No bug found
|
ES 11.4 opt 090926 32807340954440071ca8ae8e2de51fb180d134c6 No bug found
|
ES 11.8 dbg 090926 c4af6f687a2dd983072457429aa2294f11957650 No bug found
|
ES 11.8 opt 090926 c4af6f687a2dd983072457429aa2294f11957650 No bug found
|
ES 12.3 dbg 090926 c3bd5108d81f19e33efb93f7b6ae971293732fd0 No bug found
|
ES 12.3 opt 090926 c3bd5108d81f19e33efb93f7b6ae971293732fd0 No bug found
|
