Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41815

SIGSEGV in Item_trigger_row::cleanup on FLUSH TABLES after a trigger runs DECLARE ROW TYPE OF cursor DEFAULT NEW

    XMLWordPrintable

Details

    • Bug
    • Status: In Review (View Workflow)
    • Critical
    • Resolution: Unresolved
    • 13.2
    • 13.2
    • Triggers
    • Not for Release Notes
    • Q1/2027 Server Development

    Description

      CREATE TABLE t1 (a INT);
      DELIMITER |
      CREATE TRIGGER tr BEFORE INSERT ON t1 FOR EACH ROW BEGIN DECLARE c CURSOR FOR SELECT 1; BEGIN DECLARE r ROW TYPE OF c DEFAULT NEW; END; END|
      DELIMITER ;
      INSERT INTO t1 VALUES (1);
      FLUSH TABLES;
      

      Leads to

      MDEV-34723 CS 13.2.0 89cc41d5c46e1e322148d861e2b13527a7dd6306 (Debug, Clang 18.1.3-11) Build 22/10/2026

      Core was generated by `/test/mtest/MDEV-34723/MD221026-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd --'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005a9328806c11 in Item_trigger_row::cleanup (this=0x6955500478b0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/item.h:8069
       
      [Current thread is 1 (LWP 2308066)]
      (gdb) bt
      #0  0x00005a9328806c11 in Item_trigger_row::cleanup (this=0x6955500478b0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/item.h:8069
      #1  0x00005a93282acc8a in Item::delete_self (this=0x6955500478b0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/item.h:2700
      #2  0x00005a9328624cf0 in sp_instr_cursor_copy_struct::~sp_instr_cursor_copy_struct (this=0x695550047a20)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_instr.h:1825
      #3  0x00005a9328624d39 in sp_instr_cursor_copy_struct::~sp_instr_cursor_copy_struct (this=0x695550047a20)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_instr.h:1823
      #4  0x00005a93282018eb in sp_head::~sp_head (this=0x695550035460)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_head.cc:925
      #5  0x00005a9328202c89 in sp_head::~sp_head (this=0x695550035460)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_head.cc:917
      #6  0x00005a9328200dbd in sp_head::destroy (sp=0x695550035460)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_head.cc:551
      #7  0x00005a9328496e59 in Trigger::~Trigger (this=0x69555003bd90)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_trigger.cc:369
      #8  0x00005a932849a6c8 in Table_triggers_list::~Table_triggers_list (this=0x69555003b840)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_trigger.cc:1562
      #9  0x00005a932869a2ae in intern_close_table (table=0x6955500329f0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/table_cache.cc:228
      #10 0x00005a932869a018 in tc_purge ()at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/table_cache.cc:324
      #11 0x00005a932826366e in purge_tables ()at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_base.cc:338
      #12 0x00005a9328263831 in close_cached_tables (thd=0x695550000d60, tables=0x0, wait_for_refresh=true, timeout=86400)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_base.cc:367
      #13 0x00005a932857fef0 in reload_acl_and_cache (thd=0x695550000d60, options=4, tables=0x0, write_to_binlog=0x71566101ebc4)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_reload.cc:370
      #14 0x00005a932834735f in mysql_execute_command (thd=0x695550000d60, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:5439
      #15 0x00005a9328338a84 in mysql_parse (thd=0x695550000d60, rawbuf=0x69555001a4d0 "FLUSH TABLES", length=12, parser_state=0x71566101fa80)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:8005
      #16 0x00005a9328335e4d in dispatch_command (command=COM_QUERY, thd=0x695550000d60, packet=0x69555000b701 "FLUSH TABLES", packet_length=12, blocking=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:1903
      #17 0x00005a9328339633 in do_command (thd=0x695550000d60, blocking=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:1437
      #18 0x00005a932853fd29 in do_handle_one_connection (connect=0x5a9348d063a0, put_in_cache=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_connect.cc:1514
      #19 0x00005a932853face in handle_one_connection (arg=0x5a9348defbd0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_connect.cc:1426
      #20 0x000071568769cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #21 0x0000715687729ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Attachments

        Issue Links

          Activity

            People

              shulga Dmitry Shulga
              ramesh Ramesh Sivaraman
              Ramesh Sivaraman Ramesh Sivaraman
              Dmitry Shulga Dmitry Shulga
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Time Spent - 0.5h Remaining Estimate - 1.5d
                  1.5d
                  Logged:
                  Time Spent - 0.5h Remaining Estimate - 1.5d
                  0.5h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.