Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41825

SIGSEGV in THD::sp_fix_func_item when a ROW variable's DEFAULT is an EXISTS subquery

    XMLWordPrintable

Details

    • Bug
    • Status: In Review (View Workflow)
    • Critical
    • Resolution: Unresolved
    • 13.2
    • 13.2
    • Stored routines
    • None
    • Not for Release Notes
    • Q4/2026 Server Development

    Description

      DELIMITER |
      BEGIN NOT ATOMIC DECLARE r ROW(a INT) DEFAULT EXISTS(SELECT 1); SELECT r.a; END|
      DELIMITER ;
      

      Leads to

      MDEV-34723 CS 13.2.0 89cc41d5c46e1e322148d861e2b13527a7dd6306 (Optimized, Clang 18.1.3-11) Build 22/10/2026

      Core was generated by `/test/mtest/MDEV-34723/MD221026-mariadb-13.2.0-linux-x86_64-opt/bin/mariadbd --'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  THD::sp_fix_func_item (this=0x686194000c70, it_addr=0x0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sp_head.cc:408
       
      [Current thread is 1 (LWP 4179916)]
      (gdb) bt
      #0  THD::sp_fix_func_item (this=0x686194000c70, it_addr=0x0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sp_head.cc:408
      #1  THD::sp_fix_func_item_for_assignment (this=0x686194000c70, to=0x68619401ac40, it_addr=0x0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sp_head.cc:437
      #2  0x00005735bc00005c in Field::sp_prepare_and_store_item (this=0x68619401ac40, thd=0x686194000c70, value=0x0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/field.cc:1525
      #3  0x00005735bbe12bed in Virtual_tmp_table::sp_set_all_fields_from_item (this=0x68619401a2d0, thd=0x686194000c70, value=0x686194023790)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sql_select.cc:23301
      #4  0x00005735bc002da2 in Field_row::sp_prepare_and_store_item (this=0x68619401a060, thd=0x686194000c70, value=<optimized out>)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/field.cc:2865
      #5  0x00005735bbcf55d7 in THD::sp_eval_expr (this=0x686194000c70, result_field=0x686194000c70, expr_item_ptr=0x0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sp_head.cc:462
      #6  0x00005735bbd03494 in sp_rcontext::set_variable (this=0x686194019600, thd=0x686194000c70, idx=0, value=0x686194023a60)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sp_rcontext.cc:676
      #7  0x00005735bbf50050 in sp_instr_set::exec_core (this=0x686194023990, thd=0x686194000c70, nextp=0x7062a835e704)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sp_instr.cc:1339
      #8  0x00005735bbf4e38a in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x6861940239c8, thd=thd@entry=0x686194000c70, nextp=nextp@entry=0x7062a835e704, open_tables=true, instr=instr@entry=0x686194023990, rerun_the_same_instr=<optimized out>)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sp_instr.cc:420
      #9  0x00005735bbf4e9b6 in sp_lex_keeper::validate_lex_and_exec_core (this=0x6861940239c8, thd=0x686194000c70, nextp=0x7062a835e704, open_tables=<optimized out>, instr=0x686194023990)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sp_instr.cc:624
      #10 0x00005735bbcf75aa in sp_head::execute (this=this@entry=0x686194021c90, thd=thd@entry=0x686194000c70, merge_da_on_success=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sp_head.cc:1347
      #11 0x00005735bbcf8f4b in sp_head::execute_procedure (this=0x686194021c90, thd=0x686194000c70, args=0x686194006220)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sp_head.cc:2422
      #12 0x00005735bbda4cd4 in do_execute_sp (thd=thd@entry=0x686194000c70, sp=0x686194000c70)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sql_parse.cc:3099
      #13 0x00005735bbda7a4a in mysql_execute_command (thd=thd@entry=0x686194000c70, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sql_parse.cc:5703
      #14 0x00005735bbda18e2 in mysql_parse (thd=thd@entry=0x686194000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7062a835f580)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sql_parse.cc:8005
      #15 0x00005735bbd9fe98 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x686194000c70, packet=packet@entry=0x686194008ea1 "BEGIN NOT ATOMIC DECLARE r ROW(a INT) DEFAULT EXISTS(SELECT 1); SELECT r.a; END", packet_length=packet_length@entry=79, blocking=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sql_parse.cc:1903
      #16 0x00005735bbda1d61 in do_command (thd=thd@entry=0x686194000c70, blocking=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sql_parse.cc:1437
      #17 0x00005735bbece9bd in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5735cde10d70, put_in_cache=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sql_connect.cc:1514
      #18 0x00005735bbece7f2 in handle_one_connection (arg=arg@entry=0x5735cde10d70)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/sql/sql_connect.cc:1426
      #19 0x00005735bc27cd83 in pfs_spawn_thread (arg=0x5735cde31760)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_opt/storage/perfschema/pfs.cc:2198
      #20 0x00007062ab69cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #21 0x00007062ab729ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      MDEV-34723 CS 13.2.0 89cc41d5c46e1e322148d861e2b13527a7dd6306 (Debug, Clang 18.1.3-11) Build 22/10/2026

      mariadbd: /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/field.cc:1521: virtual bool Field::sp_prepare_and_store_item(THD *, Item **): Assertion `value' failed.
      

      MDEV-34723 CS 13.2.0 89cc41d5c46e1e322148d861e2b13527a7dd6306 (Debug, Clang 18.1.3-11) Build 22/10/2026

      Core was generated by `/test/mtest/MDEV-34723/MD221026-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd --'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 687298)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x000075219464527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x00007521946288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x000075219462881b in __assert_fail_base (fmt=0x7521947d1208 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5b62af27c34d "value", file=file@entry=0x5b62af1c9ad0 "/test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/field.cc", line=line@entry=1521, function=function@entry=0x5b62af1c9dd5 "virtual bool Field::sp_prepare_and_store_item(THD *, Item **)") at ./assert/assert.c:96
      #6  0x000075219463b517 in __assert_fail (assertion=0x5b62af27c34d "value", file=0x5b62af1c9ad0 "/test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/field.cc", line=1521, function=0x5b62af1c9dd5 "virtual bool Field::sp_prepare_and_store_item(THD *, Item **)") at ./assert/assert.c:105
      #7  0x00005b62ae3d7a93 in Field::sp_prepare_and_store_item (this=0x6d205c01dba0, thd=0x6d205c000d60, value=0x0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/field.cc:1521
      #8  0x00005b62ae0623d2 in Virtual_tmp_table::sp_set_all_fields_from_item (this=0x6d205c01d070, thd=0x6d205c000d60, value=0x6d205c026000)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_select.cc:23301
      #9  0x00005b62ae3dc83a in Field_row::sp_prepare_and_store_item (this=0x6d205c01ce00, thd=0x6d205c000d60, value=0x6d205c0262d8)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/field.cc:2865
      #10 0x00005b62ade689f8 in THD::sp_eval_expr (this=0x6d205c000d60, result_field=0x6d205c01ce00, expr_item_ptr=0x6d205c0262d8)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_head.cc:462
      #11 0x00005b62ade83c6e in sp_rcontext::set_variable (this=0x6d205c01c1e0, thd=0x6d205c000d60, idx=0, value=0x6d205c0262d8)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_rcontext.cc:676
      #12 0x00005b62ae284fb2 in sp_instr_set::exec_core (this=0x6d205c026200, thd=0x6d205c000d60, nextp=0x75216d0b3a48)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_instr.cc:1339
      #13 0x00005b62ae282316 in sp_lex_keeper::reset_lex_and_exec_core (this=0x6d205c026240, thd=0x6d205c000d60, nextp=0x75216d0b3a48, open_tables=true, instr=0x6d205c026200, rerun_the_same_instr=false)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_instr.cc:420
      #14 0x00005b62ae282afc in sp_lex_keeper::validate_lex_and_exec_core (this=0x6d205c026240, thd=0x6d205c000d60, nextp=0x75216d0b3a48, open_tables=true, instr=0x6d205c026200)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_instr.cc:624
      #15 0x00005b62ae284f1e in sp_instr_set::execute (this=0x6d205c026200, thd=0x6d205c000d60, nextp=0x75216d0b3a48)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_instr.cc:1326
      #16 0x00005b62ade6baec in sp_head::execute (this=0x6d205c0244f0, thd=0x6d205c000d60, merge_da_on_success=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_head.cc:1347
      #17 0x00005b62ade6e54e in sp_head::execute_procedure (this=0x6d205c0244f0, thd=0x6d205c000d60, args=0x6d205c0062e8)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_head.cc:2422
      #18 0x00005b62adfa5a5b in do_execute_sp (thd=0x6d205c000d60, sp=0x6d205c0244f0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:3099
      #19 0x00005b62adfb0a33 in mysql_execute_command (thd=0x6d205c000d60, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:5703
      #20 0x00005b62adfa0a84 in mysql_parse (thd=0x6d205c000d60, rawbuf=0x6d205c01a4d0 "BEGIN NOT ATOMIC DECLARE r ROW(a INT) DEFAULT EXISTS(SELECT 1); SELECT r.a; END", length=79, parser_state=0x75216d0b5a80)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:8005
      #21 0x00005b62adf9de4d in dispatch_command (command=COM_QUERY, thd=0x6d205c000d60, packet=0x6d205c00b701 "BEGIN NOT ATOMIC DECLARE r ROW(a INT) DEFAULT EXISTS(SELECT 1); SELECT r.a; END", packet_length=79, blocking=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:1903
      #22 0x00005b62adfa1633 in do_command (thd=0x6d205c000d60, blocking=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:1437
      #23 0x00005b62ae1a7d29 in do_handle_one_connection (connect=0x5b62ba54d3a0, put_in_cache=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_connect.cc:1514
      #24 0x00005b62ae1a7ace in handle_one_connection (arg=0x5b62ba636bd0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_connect.cc:1426
      #25 0x000075219469cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #26 0x0000752194729ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Attachments

        Issue Links

          Activity

            People

              shulga Dmitry Shulga
              ramesh Ramesh Sivaraman
              Ramesh Sivaraman Ramesh Sivaraman
              Dmitry Shulga Dmitry Shulga
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Time Spent - 0.5h Remaining Estimate - 2d
                  2d
                  Logged:
                  Time Spent - 0.5h Remaining Estimate - 2d
                  0.5h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.