Details
-
Bug
-
Status: In Review (View Workflow)
-
Critical
-
Resolution: Unresolved
-
10.6.27
-
None
Description
mariadbd crashes with a segmentation fault while resolving a DEFAULT NEXTVAL(sequence) expression during a plain single-row INSERT ... VALUES (...) RETURNING.
Initally, I noted could be related to https://jira.mariadb.org/browse/MDEV-37172, but after upgrade to those fixed version, crash still happened.
The crash occurs directly inside `Item_func_nextval::val_int()`, called straight from Item::save_int_in_field() - there is no arithmetic on the nextval() result (i.e. not nextval(s)+nextval(s)), no SELECT/JOIN involved (i.e. not INSERT ... SELECT), and no UPDATE involved. This does not match the trigger conditions of the closest related, previously-fixed defects (see Related Issues below), and appears to be either a new defect or an unfixed regression specific to this code path / 10.6 branch.
Steps to Reproduce (minimal, unconfirmed - tested locally not reproducible)
CREATE SEQUENCE s1 START WITH 1 INCREMENT BY 1 CACHE 10;
|
|
|
CREATE TABLE t1 (
|
id BIGINT NOT NULL DEFAULT NEXTVAL(s1),
|
val VARCHAR(20),
|
PRIMARY KEY(id)
|
);
|
|
|
PREPARE stmt FROM 'INSERT INTO t1 (val) VALUES (?) RETURNING id';
|
SET @v = 'row1';
|
EXECUTE stmt USING @v;
|
SET @v = 'row2';
|
EXECUTE stmt USING @v; -- crash suspected here or on further re-execution
|
Full symbolized backtraces:
Thread 1 (Thread 0x7721bbc0b700 (LWP 940102)):
|
#0 0x00007f21f811a6d5 in pthread_kill () from /lib64/libpthread.so.0
|
#1 0x000055c2be6537e8 in handle_fatal_signal (sig=11) at /usr/src/debug/MariaDB-/src_0/sql/signal_handler.cc:298
|
#2 <signal handler called>
|
#3 Item_func_nextval::val_int() () at /usr/src/debug/MariaDB-/src_0/sql/item_func.cc:7114
|
#4 0x000055c2be67c48f in Item::save_int_in_field (this=0x7720bc0e37a0, field=0x7720bc0d9c40, no_conversions=<optimized out>) at /usr/src/debug/MariaDB-/src_0/sql/item.cc:7343
|
#5 0x000055c2be66c013 in Item::save_in_field (this=0x7720bc0e37a0, field=0x7720bc0d9c40, no_conversions=<optimized out>) at /usr/src/debug/MariaDB-/src_0/sql/item.cc:7363
|
#6 0x000055c2be4e91b9 in TABLE::update_default_fields (this=this@entry=0x7720bc0cd0e8, ignore_errors=ignore_errors@entry=false) at /usr/src/debug/MariaDB-/src_0/sql/table.cc:9247
|
#7 0x000055c2be37f52e in fill_record (thd=thd@entry=0x7720b8000c58, table_arg=table_arg@entry=0x7720bc0cd0e8, fields=..., values=..., ignore_errors=false, update=update@entry=false) at /usr/src/debug/MariaDB-/src_0/sql/sql_base.cc:8910
|
#8 0x000055c2be37f72d in fill_record_n_invoke_before_triggers (thd=0x7720b8000c58, table=0x7720bc0cd0e8, fields=..., values=..., ignore_errors=<optimized out>, event=TRG_EVENT_INSERT) at /usr/src/debug/MariaDB-/src_0/sql/sql_base.cc:9054
|
#9 0x000055c2be3b3392 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) () at /usr/src/debug/MariaDB-/src_0/sql/sql_insert.cc:1084
|
#10 0x000055c2be3e73a3 in mysql_execute_command(THD*, bool) () at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:4650
|
#11 0x000055c2be40d9d2 in Prepared_statement::execute (this=0x7720b9056a58, expanded_query=<optimized out>, open_cursor=false) at /usr/src/debug/MariaDB-/src_0/sql/sql_prepare.cc:5321
|
#12 0x000055c2be40deb7 in Prepared_statement::execute_loop (packet=<optimized out>, packet_end=<optimized out>, open_cursor=<optimized out>, expanded_query=0x7721bbc0a0e0, this=0x7720b9056a58) at /usr/src/debug/MariaDB-/src_0/sql/sql_prepare.cc:4702
|
#13 Prepared_statement::execute_loop (this=0x7720b9056a58, expanded_query=0x7721bbc0a0e0, open_cursor=<optimized out>, packet=<optimized out>, packet_end=<optimized out>) at /usr/src/debug/MariaDB-/src_0/sql/sql_prepare.cc:4634
|
#14 0x000055c2be40ed75 in mysql_stmt_execute_common (thd=0x7720b8000c58, stmt_id=<optimized out>, packet=0x7720b8d472e2 ".......................", packet_end=0x7720b8d473b8 "", cursor_flags=0, bulk_op=<optimized out>, read_types=false) at /usr/src/debug/MariaDB-/src_0/sql/sql_prepare.cc:3599
|
#15 0x000055c2be40ef5c in mysqld_stmt_execute (thd=<optimized out>, packet_arg=<optimized out>, packet_length=<optimized out>) at /usr/src/debug/MariaDB-/src_0/sql/sql_prepare.cc:3370
|
#16 0x000055c2be3ee871 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) () at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:1842
|
#17 0x000055c2be3efe8d in do_command (thd=thd@entry=0x7720b8000c58, blocking=blocking@entry=true) at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:1428
|
#18 0x000055c2be516dd5 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /usr/src/debug/MariaDB-/src_0/sql/sql_connect.cc:1393
|
#19 0x000055c2be51713d in handle_one_connection (arg=arg@entry=0x55c2c0b73d28) at /usr/src/debug/MariaDB-/src_0/sql/sql_connect.cc:1305
|
#20 0x000055c2be8a86e9 in pfs_spawn_thread (arg=0x55c2c0b73d98) at /usr/src/debug/MariaDB-/src_0/storage/perfschema/pfs.cc:2201
|
#21 0x00007f21f81131ca in start_thread () from /lib64/libpthread.so.0
|
#22 0x00007f21f7453953 in clone () from /lib64/libc.so.6
|
Related Issues
MDEV-37172 / duplicate MDEV-37735 — requires two nextval() calls combined arithmetically in one DEFAULT expression (nextval(s)+nextval(s)); crashes via Item_func_plus::int_op(). Not present here. Fixed 10.6.24-20.
MDEV-37345 — INSERT ... SELECT with subqueries/triggers; crashes via select_insert::send_data()/JOIN::exec(). Not present here (plain INSERT ... VALUES). Fix Version is 10.11.15 / 11.4.9 / 11.8.4 only — not backported to any 10.6.x release.
MDEV-28612 — "Server crash caused by concurrent inserts into table with sequence default." Same underlying symptom family and closest conceptual match (single-column nextval default, concurrent inserts), but reporter's repro used INSERT ... SELECT, and the ticket was closed as Cannot Reproduce, not fixed.
MDEV-33985 — NEXTVAL() inside a CTE/subquery in a SELECT. Not present here.
MDEV-28650 — crash after SELECT from a view. Not present here.
MDEV-39265 — crash on 2nd execution of a prepared UPDATE ... USING DEFAULT; different statement type and code path (mysql_update/open_tables/add_internal_tables). Fixed 10.6.26, not applicable.
Attachments
Issue Links
- relates to
-
-
- Closed
-
