Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41456

Server assertion in Item_func_hybrid_field_type::val_int() on SELECT with GROUP BY and HAVING

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 12.3.3
    • N/A
    • N/A
    • None
    • Linux x86_64 VM, kernel 5.15.0-198-generic (Ubuntu kernel build). MariaDB
      12.3.3-MariaDB-debug, source revision
      83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e.
    • Not for Release Notes

    Description

      Executing the two statements below on a fresh database makes mariadbd abort
      with SIGABRT (signal 6). The server error log identifies an assertion failure
      at sql/item_func.h:1037 in Item_func_hybrid_field_type::val_int(). The client
      reports ERROR 2013 (HY000), "Lost connection to server during query".
      Steps to reproduce:

      1. Initialize a fresh data directory for MariaDB 12.3.3 debug and start
      mariadbd with --no-defaults. The reproductions used a local Unix socket,
      --skip-networking, --skip-name-resolve, --max-connections=64,
      --max-statement-time=1, --lock-wait-timeout=1, and
      --innodb-lock-wait-timeout=1. There was no my.cnf: --no-defaults was used.
      2. Create an empty database and connect to it. No table data is required.
      3. Execute the following SQL, in order, in that database:

      CREATE TABLE v0 ( v1 TEXT UNIQUE UNIQUE , v2 BIGINT , v3 INT ) ;
      SELECT DISTINCT v3 , 63 , 16 , 66 FROM v0 WHERE v2 + 0 + 2147483647 GROUP BY v2 , v2 HAVING v2 = 86 ;
      

      Expected result:
      The server remains running and returns either a query result or a SQL error.

      Actual result:
      The server aborts while processing the SELECT. The client prints:

      ERROR 2013 (HY000) at line 2: Lost connection to server during query
      

      The server prints:

      sql/item_func.h:1037: virtual longlong Item_func_hybrid_field_type::val_int(): Assertion `!is_cond()' failed.
      mariadbd got signal 6
      

      The symbolized backtrace from the separate gcov debug build includes:

      Item_func_hybrid_field_type::val_int()  (sql/item_func.h:1037)
      Item_cache_int::cache_value()
      Type_handler_int_result::Item_val_bool(Item*) const
      make_join_select(JOIN*, SQL_SELECT*, Item*)
      JOIN::optimize_stage2()
      JOIN::optimize_inner()
      

      Attachments

        Issue Links

          Activity

            People

              Roel Roel Van de Paar
              csfuzz csfuzz
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 10m
                  10m

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.