Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41439

SIGSEGV in iterate_trigger_fields_and_run_func on DELETE after a failed re-prepare of a trigger statement

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 11.4, 11.8, 12.3, 13.0, 13.1, 13.2
    • 11.4, 11.8, 12.3, 13.0, 13.1
    • Triggers
    • None
    • Can result in hang or crash

    Description

      --source include/have_innodb.inc
      INSTALL SONAME 'simple_password_check';
      CREATE TABLE t1 (a INT) ENGINE=INNODB;
      CREATE TABLE t2 (a INT) ENGINE=INNODB;
      CREATE TRIGGER tr AFTER DELETE ON t1 FOR EACH ROW INSERT INTO t2 VALUES (OLD.a + @@simple_password_check_minimal_length);
      INSERT INTO t1 VALUES (1),(2);
      DELETE FROM t1 LIMIT 1;
      UNINSTALL SONAME 'simple_password_check';
      ALTER TABLE t2 FORCE;
      --ERROR ER_UNKNOWN_SYSTEM_VARIABLE
      DELETE FROM t1;
      DELETE FROM t1;
      

      Leads to:

      CS 11.4.13 b6398296aeeeb253bdb3d1dd1620d2bb03836bf7 (Optimized, Clang 18.1.3-11) Build 06/10/2026

      Core was generated by `/test/MD061026-mariadb-11.4.13-linux-x86_64-opt/bin/mariadbd --no-defaults --lo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  Table_triggers_list::mark_fields_used(trg_event_type)::$_0::operator()(Item_trigger_field*) const (trg_field=0x0, this=<optimized out>)at /test/11.4_opt/sql/sql_trigger.cc:2650
       
      [Current thread is 1 (LWP 2201706)]
      (gdb) bt
      #0  Table_triggers_list::mark_fields_used(trg_event_type)::$_0::operator()(Item_trigger_field*) const (trg_field=0x0, this=<optimized out>)at /test/11.4_opt/sql/sql_trigger.cc:2650
      #1  iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_used(trg_event_type)::$_0>(SQL_I_List<SQL_I_List<Item_trigger_field> >&, Table_triggers_list::mark_fields_used(trg_event_type)::$_0) (trg_table_fields=<optimized out>, fn={this = 0x70cdc403a0e0})at /test/11.4_opt/sql/sql_trigger.cc:895
      #2  Table_triggers_list::mark_fields_used (this=0x70cdc403a0e0, event=<optimized out>) at /test/11.4_opt/sql/sql_trigger.cc:2645
      #3  0x00005689d2dd7ea9 in TABLE::mark_columns_needed_for_delete (this=0x70cdc403b5e8) at /test/11.4_opt/sql/table.cc:7948
      #4  0x00005689d2ca8ed2 in Sql_cmd_delete::delete_from_single_table (this=this@entry=0x70cdc4018308, thd=thd@entry=0x70cdc4000c68)at /test/11.4_opt/sql/sql_delete.cc:799
      #5  0x00005689d2cab5f4 in Sql_cmd_delete::execute_inner (this=0x70cdc4018308, thd=0x70cdc4000c68) at /test/11.4_opt/sql/sql_delete.cc:1915
      #6  0x00005689d2d5ef2b in Sql_cmd_dml::execute (this=0x70cdc4018308, thd=0x70cdc4000c68) at /test/11.4_opt/sql/sql_select.cc:34835
      #7  0x00005689d2ceba9c in mysql_execute_command (thd=thd@entry=0x70cdc4000c68, is_called_from_prepared_stmt=false) at /test/11.4_opt/sql/sql_parse.cc:4451
      #8  0x00005689d2ce7402 in mysql_parse (thd=thd@entry=0x70cdc4000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x78cec03a9600)at /test/11.4_opt/sql/sql_parse.cc:7928
      #9  0x00005689d2ce58e5 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x70cdc4000c68, packet=packet@entry=0x70cdc40087f9 "DELETE FROM t1", packet_length=packet_length@entry=14, blocking=true)at /test/11.4_opt/sql/sql_parse.cc:1925
      #10 0x00005689d2ce7881 in do_command (thd=thd@entry=0x70cdc4000c68, blocking=true) at /test/11.4_opt/sql/sql_parse.cc:1433
      #11 0x00005689d2e04f9d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5689e9ea6418, put_in_cache=true)at /test/11.4_opt/sql/sql_connect.cc:1508
      #12 0x00005689d2e04dc6 in handle_one_connection (arg=arg@entry=0x5689e9ea6418)at /test/11.4_opt/sql/sql_connect.cc:1420
      #13 0x00005689d315806e in pfs_spawn_thread (arg=0x5689e9e34c38)at /test/11.4_opt/storage/perfschema/pfs.cc:2201
      #14 0x000078cec3c9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #15 0x000078cec3d29ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      CS 11.4.13 b6398296aeeeb253bdb3d1dd1620d2bb03836bf7 (Debug, Clang 18.1.3-11) Build 06/10/2026

      Core was generated by `/test/MD061026-mariadb-11.4.13-linux-x86_64-dbg/bin/mariadbd --no-defaults --lo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x000060c31cfc1ad7 in iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_used(trg_event_type)::$_0>(SQL_I_List<SQL_I_List<Item_trigger_field> >&, Table_triggers_list::mark_fields_used(trg_event_type)::$_0) (trg_table_fields=..., fn=...) at /test/11.4_dbg/sql/sql_trigger.cc:889
       
      [Current thread is 1 (LWP 2201976)]
      (gdb) bt
      #0  0x000060c31cfc1ad7 in iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_used(trg_event_type)::$_0>(SQL_I_List<SQL_I_List<Item_trigger_field> >&, Table_triggers_list::mark_fields_used(trg_event_type)::$_0) (trg_table_fields=@0x750f04046230: {<Sql_alloc> = {<No data fields>}, elements = 1, first = 0x750f040593d8, next = 0x750f04047558}, fn={this = 0x750f0404ea20}) at /test/11.4_dbg/sql/sql_trigger.cc:889
      #1  0x000060c31cfc1a0a in Table_triggers_list::mark_fields_used (this=0x750f0404ea20, event=TRG_EVENT_DELETE)at /test/11.4_dbg/sql/sql_trigger.cc:2645
      #2  0x000060c31d007074 in TABLE::mark_columns_needed_for_delete (this=0x750f0403abe8) at /test/11.4_dbg/sql/table.cc:7948
      #3  0x000060c31ce0586e in Sql_cmd_delete::delete_from_single_table (this=0x750f0401aaf8, thd=0x750f04000d58)at /test/11.4_dbg/sql/sql_delete.cc:799
      #4  0x000060c31ce09eee in Sql_cmd_delete::execute_inner (this=0x750f0401aaf8, thd=0x750f04000d58) at /test/11.4_dbg/sql/sql_delete.cc:1915
      #5  0x000060c31cf34b11 in Sql_cmd_dml::execute (this=0x750f0401aaf8, thd=0x750f04000d58) at /test/11.4_dbg/sql/sql_select.cc:34835
      #6  0x000060c31ce7790f in mysql_execute_command (thd=0x750f04000d58, is_called_from_prepared_stmt=false) at /test/11.4_dbg/sql/sql_parse.cc:4451
      #7  0x000060c31ce6dbc4 in mysql_parse (thd=0x750f04000d58, rawbuf=0x750f04019bf0 "DELETE FROM t1", length=14, parser_state=0x7d1000c6cb30) at /test/11.4_dbg/sql/sql_parse.cc:7928
      #8  0x000060c31ce6b089 in dispatch_command (command=COM_QUERY, thd=0x750f04000d58, packet=0x750f0400afe9 "DELETE FROM t1", packet_length=14, blocking=true) at /test/11.4_dbg/sql/sql_parse.cc:1925
      #9  0x000060c31ce6e773 in do_command (thd=0x750f04000d58, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1433
      #10 0x000060c31d056e79 in do_handle_one_connection (connect=0x60c32766cfe8, put_in_cache=true) at /test/11.4_dbg/sql/sql_connect.cc:1508
      #11 0x000060c31d056c12 in handle_one_connection (arg=0x60c3277361c8)at /test/11.4_dbg/sql/sql_connect.cc:1420
      #12 0x00007d100349cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #13 0x00007d1003529ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed
      CS  10.11  dbg  061026  76ed5b7ea0c9cddfe9386aee4a5ff42a2adf1593  No bug found
      CS  10.11  opt  061026  76ed5b7ea0c9cddfe9386aee4a5ff42a2adf1593  No bug found
      CS  11.4   dbg  061026  b6398296aeeeb253bdb3d1dd1620d2bb03836bf7  SIGSEGV|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete|Sql_cmd_delete::delete_from_single_table
      CS  11.4   opt  061026  b6398296aeeeb253bdb3d1dd1620d2bb03836bf7  SIGSEGV|Table_triggers_list::mark_fields_usedsql_trigger.cc|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete
      CS  11.8   dbg  061026  dddbd5ff427894941fee3d7528ca2058e026b82e  SIGSEGV|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete|Sql_cmd_delete::delete_from_single_table
      CS  11.8   opt  061026  dddbd5ff427894941fee3d7528ca2058e026b82e  SIGSEGV|Table_triggers_list::mark_fields_usedsql_trigger.cc|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete
      CS  12.3   dbg  061026  07b869588831fb9ebc6364c77cba105d6cca3b77  SIGSEGV|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete|Sql_cmd_delete::delete_from_single_table
      CS  12.3   opt  061026  07b869588831fb9ebc6364c77cba105d6cca3b77  SIGSEGV|Table_triggers_list::mark_fields_usedsql_trigger.cc|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete
      CS  13.0   dbg  061026  620a4b5624222048fece7fe1789978ae0675cae2  SIGSEGV|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete|Sql_cmd_delete::delete_from_single_table
      CS  13.0   opt  061026  620a4b5624222048fece7fe1789978ae0675cae2  SIGSEGV|Table_triggers_list::mark_fields_usedsql_trigger.cc|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete
      CS  13.1   dbg  061026  87e62ca17270e163a6d41b3fc8d6f4d440f1bb88  SIGSEGV|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete|Sql_cmd_delete::delete_from_single_table
      CS  13.1   opt  061026  87e62ca17270e163a6d41b3fc8d6f4d440f1bb88  SIGSEGV|Table_triggers_list::mark_fields_usedsql_trigger.cc|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete
      CS  13.2   dbg  061026  9d7ab2c0092df4bc73b64b915464aecf7e5fe6c4  SIGSEGV|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete|Sql_cmd_delete::delete_from_single_table
      CS  13.2   opt  061026  9d7ab2c0092df4bc73b64b915464aecf7e5fe6c4  SIGSEGV|Table_triggers_list::mark_fields_usedsql_trigger.cc|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete
      ES  11.4   dbg  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  SIGSEGV|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete|Sql_cmd_delete::delete_from_single_table
      ES  11.4   opt  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  SIGSEGV|Table_triggers_list::mark_fields_usedsql_trigger.cc|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete
      ES  11.8   dbg  060526  1499789de285a8109d68d79347de0281865b28f4  SIGSEGV|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete|Sql_cmd_delete::delete_from_single_table
      ES  11.8   opt  060526  1499789de285a8109d68d79347de0281865b28f4  SIGSEGV|Table_triggers_list::mark_fields_usedsql_trigger.cc|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete
      ES  12.3   dbg  280926  082387a5f3cbb877157998bb4baa95928f4aa121  SIGSEGV|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete|Sql_cmd_delete::delete_from_single_table
      ES  12.3   opt  280926  082387a5f3cbb877157998bb4baa95928f4aa121  SIGSEGV|Table_triggers_list::mark_fields_usedsql_trigger.cc|iterate_trigger_fields_and_run_func<Table_triggers_list::mark_fields_usedsql_trigger.cc|Table_triggers_list::mark_fields_used|TABLE::mark_columns_needed_for_delete
      

      Attachments

        Activity

          People

            shulga Dmitry Shulga
            ramesh Ramesh Sivaraman
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 0.5h
                0.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.