Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41717

SIGSEGV in Field_vector::store in Column_stat::get_stat_values on stale statistics for a VECTOR column

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      CREATE TABLE t1 (c INT);
      INSERT INTO t1 VALUES (1);
      ANALYZE TABLE t1 PERSISTENT FOR ALL;
      SET max_session_mem_used=1;
      CREATE OR REPLACE TABLE t1 (c VECTOR(1));
      SET max_session_mem_used=DEFAULT;
      SELECT * FROM t1;
      

      Leads to:

      CS 13.2.0 327437ade1d6dc6e4e57a6f1723b4abe4ac6c4b4 (Optimized, Clang 18.1.3-11) Build 19/10/2026

      Core was generated by `/test/MD191026-mariadb-13.2.0-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005a923031b429 in Field_vector::store (this=0x7575ac028a50, from=0x7575ac03bcd5 "1", length=1, cs=0x5a9231483080 <my_charset_bin>)at /test/13.2_opt/sql/sql_type_vector.cc:339
       
      [Current thread is 1 (LWP 1884288)]
      (gdb) bt
      #0  0x00005a923031b429 in Field_vector::store (this=0x7575ac028a50, from=0x7575ac03bcd5 "1", length=1, cs=0x5a9231483080 <my_charset_bin>)at /test/13.2_opt/sql/sql_type_vector.cc:339
      #1  0x00005a92301f0b1d in Column_stat::get_stat_values (this=this@entry=0x7d767c0fdc90, read_stats=read_stats@entry=0x7575ac028a00, mem_root=mem_root@entry=0x7575ac028618, want_histograms=true)at /test/13.2_opt/sql/sql_statistics.cc:1218
      #2  0x00005a92301e9855 in read_statistics_for_table (thd=0x7575ac000c70, table=0x7575ac0280c0, stat_tables=0x7d767c0fb360, force_reload=false, want_histograms=<optimized out>)at /test/13.2_opt/sql/sql_statistics.cc:3097
      #3  read_statistics_for_tables (thd=0x7575ac000c70, tables=<optimized out>, force_reload=false) at /test/13.2_opt/sql/sql_statistics.cc:3358
      #4  0x00005a92300d78b7 in open_and_lock_tables (thd=thd@entry=0x7575ac000c70, options=<optimized out>, tables=0x7575ac018330, derived=true, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x7d767c0fea50)at /test/13.2_opt/sql/sql_base.cc:6062
      #5  0x00005a923014cea7 in open_and_lock_tables (thd=0x7575ac000c70, tables=0x7575ac018330, derived=true, flags=0)at /test/13.2_opt/sql/sql_base.h:545
      #6  execute_sqlcom_select (thd=thd@entry=0x7575ac000c70, all_tables=0x7575ac018330) at /test/13.2_opt/sql/sql_parse.cc:6186
      #7  0x00005a9230148a83 in mysql_execute_command (thd=thd@entry=0x7575ac000c70, is_called_from_prepared_stmt=false) at /test/13.2_opt/sql/sql_parse.cc:4038
      #8  0x00005a9230143e12 in mysql_parse (thd=thd@entry=0x7575ac000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7d767c0ff580)at /test/13.2_opt/sql/sql_parse.cc:8005
      #9  0x00005a92301423c8 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7575ac000c70, packet=packet@entry=0x7575ac008e31 "SELECT * FROM t1", packet_length=packet_length@entry=16, blocking=true)at /test/13.2_opt/sql/sql_parse.cc:1903
      #10 0x00005a9230144291 in do_command (thd=thd@entry=0x7575ac000c70, blocking=true) at /test/13.2_opt/sql/sql_parse.cc:1437
      #11 0x00005a92302726ad in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5a9251d89ce0, put_in_cache=true)at /test/13.2_opt/sql/sql_connect.cc:1514
      #12 0x00005a92302724e2 in handle_one_connection (arg=arg@entry=0x5a9251d89ce0)at /test/13.2_opt/sql/sql_connect.cc:1426
      #13 0x00005a9230620613 in pfs_spawn_thread (arg=0x5a9251daabc0)at /test/13.2_opt/storage/perfschema/pfs.cc:2198
      #14 0x00007d7684e9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #15 0x00007d7684f29ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      CS 13.2.0 327437ade1d6dc6e4e57a6f1723b4abe4ac6c4b4 (Debug, Clang 18.1.3-11) Build 19/10/2026

      Core was generated by `/test/MD191026-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x000059c2780df1e6 in Field_vector::store (this=0x75847808c460, from=0x75847804eab5 "1", length=1, cs=0x59c279a57620 <my_charset_bin>)at /test/13.2_dbg/sql/sql_type_vector.cc:339
       
      [Current thread is 1 (LWP 1884111)]
      (gdb) bt
      #0  0x000059c2780df1e6 in Field_vector::store (this=0x75847808c460, from=0x75847804eab5 "1", length=1, cs=0x59c279a57620 <my_charset_bin>)at /test/13.2_dbg/sql/sql_type_vector.cc:339
      #1  0x000059c277f939be in Field::store_text (this=0x75847808c460, to=0x75847804eab5 "1", length=1, cs=0x59c279a57620 <my_charset_bin>)at /test/13.2_dbg/sql/field.h:999
      #2  0x000059c2781df5f4 in Field::store_from_statistical_minmax_field (this=0x75847808c460, stat_field=0x75847804f550, str=0x7d8590066d30, mem=0x75847804ffb8) at /test/13.2_dbg/sql/field.cc:2088
      #3  0x000059c277ed1335 in Column_stat::get_stat_values (this=0x7d8590067500, read_stats=0x75847808c3e0, mem_root=0x75847804ffb8, want_histograms=true)at /test/13.2_dbg/sql/sql_statistics.cc:1218
      #4  0x000059c277ec75d4 in read_statistics_for_table (thd=0x758478000d60, table=0x758478087e40, stat_tables=0x7d85900682f0, force_reload=false, want_histograms=true) at /test/13.2_dbg/sql/sql_statistics.cc:3097
      #5  0x000059c277ec6f08 in read_statistics_for_tables (thd=0x758478000d60, tables=0x75847801ab90, force_reload=false)at /test/13.2_dbg/sql/sql_statistics.cc:3358
      #6  0x000059c277ec689c in read_statistics_for_tables_if_needed (thd=0x758478000d60, tables=0x75847801ab90)at /test/13.2_dbg/sql/sql_statistics.cc:3217
      #7  0x000059c277ce2813 in open_and_lock_tables (thd=0x758478000d60, options=@0x7584780069e4: {m_options = DDL_options_st::OPT_NONE}, tables=0x75847801ab90, derived=true, flags=0, prelocking_strategy=0x7d859006ac50) at /test/13.2_dbg/sql/sql_base.cc:6062
      #8  0x000059c277cf251e in open_and_lock_tables (thd=0x758478000d60, tables=0x75847801ab90, derived=true, flags=0)at /test/13.2_dbg/sql/sql_base.h:545
      #9  0x000059c277dbd04e in execute_sqlcom_select (thd=0x758478000d60, all_tables=0x75847801ab90) at /test/13.2_dbg/sql/sql_parse.cc:6186
      #10 0x000059c277db2286 in mysql_execute_command (thd=0x758478000d60, is_called_from_prepared_stmt=false) at /test/13.2_dbg/sql/sql_parse.cc:4038
      #11 0x000059c277daa274 in mysql_parse (thd=0x758478000d60, rawbuf=0x75847801a460 "SELECT * FROM t1", length=16, parser_state=0x7d859006ca80) at /test/13.2_dbg/sql/sql_parse.cc:8005
      #12 0x000059c277da763d in dispatch_command (command=COM_QUERY, thd=0x758478000d60, packet=0x75847800b691 "SELECT * FROM t1", packet_length=16, blocking=true) at /test/13.2_dbg/sql/sql_parse.cc:1903
      #13 0x000059c277daae23 in do_command (thd=0x758478000d60, blocking=true)at /test/13.2_dbg/sql/sql_parse.cc:1437
      #14 0x000059c277fb34c9 in do_handle_one_connection (connect=0x59c284270390, put_in_cache=true) at /test/13.2_dbg/sql/sql_connect.cc:1514
      #15 0x000059c277fb326e in handle_one_connection (arg=0x59c284272c30)at /test/13.2_dbg/sql/sql_connect.cc:1426
      #16 0x00007d859149cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #17 0x00007d8591529ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed
      CS  10.11  dbg  061026  76ed5b7ea0c9cddfe9386aee4a5ff42a2adf1593  No bug found
      CS  10.11  opt  061026  76ed5b7ea0c9cddfe9386aee4a5ff42a2adf1593  No bug found
      CS  11.4   dbg  061026  b6398296aeeeb253bdb3d1dd1620d2bb03836bf7  No bug found
      CS  11.4   opt  061026  b6398296aeeeb253bdb3d1dd1620d2bb03836bf7  No bug found
      CS  11.8   dbg  221026  c20c21d7a1cda67e803548a5bd7e46f1483733f9  No bug found
      CS  11.8   opt  221026  c20c21d7a1cda67e803548a5bd7e46f1483733f9  No bug found
      CS  12.3   dbg  221026  dec45ff9f3d0443e0e648fdc477629d0419ba8fd  No bug found
      CS  12.3   opt  221026  dec45ff9f3d0443e0e648fdc477629d0419ba8fd  No bug found
      CS  13.0   dbg  061026  620a4b5624222048fece7fe1789978ae0675cae2  No bug found
      CS  13.0   opt  061026  620a4b5624222048fece7fe1789978ae0675cae2  No bug found
      CS  13.1   dbg  221026  2ed5f627f289588f5b0e37303946ce7d425e8284  No bug found
      CS  13.1   opt  221026  2ed5f627f289588f5b0e37303946ce7d425e8284  No bug found
      CS  13.2   dbg  191026  327437ade1d6dc6e4e57a6f1723b4abe4ac6c4b4  SIGSEGV|Field_vector::store|Field::store_text|Field::store_from_statistical_minmax_field|Column_stat::get_stat_values
      CS  13.2   opt  191026  327437ade1d6dc6e4e57a6f1723b4abe4ac6c4b4  SIGSEGV|Field_vector::store|Column_stat::get_stat_values|read_statistics_for_table|read_statistics_for_tables
      ES  11.4   dbg  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  No bug found
      ES  11.4   opt  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  No bug found
      ES  11.8   dbg  060526  1499789de285a8109d68d79347de0281865b28f4  No bug found
      ES  11.8   opt  060526  1499789de285a8109d68d79347de0281865b28f4  No bug found
      ES  12.3   dbg  280926  082387a5f3cbb877157998bb4baa95928f4aa121  No bug found
      ES  12.3   opt  280926  082387a5f3cbb877157998bb4baa95928f4aa121  No bug found
      

      Attachments

        Activity

          People

            serg Sergei Golubchik
            ramesh Ramesh Sivaraman
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 0.5h
                0.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.