Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41827

SIGSEGV in Item_trigger_row::cleanup on condition pushdown of row = NEW into derived table in trigger

    XMLWordPrintable

Details

    • Bug
    • Status: In Review (View Workflow)
    • Critical
    • Resolution: Unresolved
    • 13.2
    • 13.2
    • Triggers
    • Not for Release Notes
    • Q1/2027 Server Development

    Description

      CREATE TABLE t (a INT, b INT);
      CREATE TRIGGER tr BEFORE INSERT ON t FOR EACH ROW DO (SELECT 1 FROM (SELECT DISTINCT a, b FROM t) d WHERE (a, b) = NEW);
      INSERT INTO t VALUES (1,2);
      

      Leads to

      MDEV-34723 CS 13.2.0 89cc41d5c46e1e322148d861e2b13527a7dd6306 (Debug, Clang 18.1.3-11) Build 22/10/2026

      Core was generated by `/test/mtest/MDEV-34723/MD221026-mariadb-13.2.0-linux-x86_64-dbg/bin/mariadbd --'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x0000637e343eec14 in Item_trigger_row::cleanup (this=0x6e8e8c0a0ac0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/item.h:8069
       
      [Current thread is 1 (LWP 4154824)]
      (gdb) bt
      #0  0x0000637e343eec14 in Item_trigger_row::cleanup (this=0x6e8e8c0a0ac0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/item.h:8069
      #1  0x0000637e33e94c8a in Item::delete_self (this=0x6e8e8c0a0ac0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/item.h:2700
      #2  0x0000637e33e7f7e9 in Query_arena::free_items (this=0x6e8e8c000d78)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_class.cc:4359
      #3  0x0000637e33e7f64c in THD::cleanup_after_query (this=0x6e8e8c000d60)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_class.cc:2637
      #4  0x0000637e33debf84 in sp_head::execute (this=0x6e8e8c035700, thd=0x6e8e8c000d60, merge_da_on_success=false)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_head.cc:1440
      #5  0x0000637e33deda17 in sp_head::execute_trigger (this=0x6e8e8c035700, thd=0x6e8e8c000d60, db_name=0x6e8e8c039028, table_name=0x6e8e8c039038, grant_info=0x6e8e8c03cf58)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sp_head.cc:1863
      #6  0x0000637e3408681c in Table_triggers_list::process_triggers (this=0x6e8e8c03c980, thd=0x6e8e8c000d60, event=TRG_EVENT_INSERT, time_type=TRG_ACTION_BEFORE, old_row_is_record1=true, skip_row_indicator=0x768f7f90ef2f, fields_in_update_stmt=0x0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_trigger.cc:2918
      #7  0x0000637e33e615bd in fill_record_n_invoke_before_triggers (thd=0x6e8e8c000d60, table=0x6e8e8c032c90, ptr=0x6e8e8c03c560, values=@0x6e8e8c01b240: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6e8e8c01b300, last = 0x6e8e8c01b3b0, elements = 2}, <No data fields>}, ignore_errors=false, event=TRG_EVENT_INSERT, skip_row_indicator=0x768f7f90ef2f)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_base.cc:9946
      #8  0x0000637e33eb9734 in mysql_insert (thd=0x6e8e8c000d60, table_list=0x6e8e8c01a5e0, fields=@0x6e8e8c0062d0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x637e35dcbda0 <end_of_list>, last = 0x6e8e8c0062d0, elements = 0}, <No data fields>}, values_list=@0x6e8e8c006318: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6e8e8c01b3c0, last = 0x6e8e8c01b3c0, elements = 1}, <No data fields>}, update_fields=@0x6e8e8c006300: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x637e35dcbda0 <end_of_list>, last = 0x6e8e8c006300, elements = 0}, <No data fields>}, update_values=@0x6e8e8c0062e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x637e35dcbda0 <end_of_list>, last = 0x6e8e8c0062e8, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_insert.cc:1193
      #9  0x0000637e33f2af3b in mysql_execute_command (thd=0x6e8e8c000d60, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:4549
      #10 0x0000637e33f20a84 in mysql_parse (thd=0x6e8e8c000d60, rawbuf=0x6e8e8c01a4d0 "INSERT INTO t VALUES (1,2)", length=26, parser_state=0x768f7f910a80)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:8005
      #11 0x0000637e33f1de4d in dispatch_command (command=COM_QUERY, thd=0x6e8e8c000d60, packet=0x6e8e8c00b701 "INSERT INTO t VALUES (1,2)", packet_length=26, blocking=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:1903
      #12 0x0000637e33f21633 in do_command (thd=0x6e8e8c000d60, blocking=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_parse.cc:1437
      #13 0x0000637e34127d29 in do_handle_one_connection (connect=0x637e593063a0, put_in_cache=true)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_connect.cc:1514
      #14 0x0000637e34127ace in handle_one_connection (arg=0x637e593efbd0)at /test/mtest/MDEV-34723/bb-MDEV-34723-rucha_dbg/sql/sql_connect.cc:1426
      #15 0x0000768fa589cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #16 0x0000768fa5929ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Attachments

        Issue Links

          Activity

            People

              shulga Dmitry Shulga
              ramesh Ramesh Sivaraman
              Ramesh Sivaraman Ramesh Sivaraman
              Dmitry Shulga Dmitry Shulga
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Time Spent - 3.5h Remaining Estimate - 1d 1h
                  1d 1h
                  Logged:
                  Time Spent - 3.5h Remaining Estimate - 1d 1h
                  3.5h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.