Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41874

SIGSEGV in THD::in_stored_procedure (NULL thd->lex) in sp_instr_stmt::execute after a failed re-parse of an SP instruction is caught by an EXCEPTION handler

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      SET sql_mode=ORACLE;
      DELIMITER $$
      BEGIN 
        FOR i IN 1..3 LOOP 
          BEGIN q((SELECT a FROM t)); 
            EXCEPTION WHEN OTHERS THEN NULL; 
          END; 
          CREATE OR REPLACE TABLE t (a INT); 
        END LOOP; 
      END
      $$
      

      Leads to:

      CS 13.1.2 2ed5f627f289588f5b0e37303946ce7d425e8284 (Optimized, Clang 18.1.3-11) Build 22/10/2026

      Core was generated by `/test/MD221026-mariadb-13.1.2-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005ed6d1d2f754 in THD::in_stored_procedure (this=0x778310000c70)at /test/13.1_opt/sql/sql_class.h:6581
       
      [Current thread is 1 (LWP 2295432)]
      (gdb) bt
      #0  0x00005ed6d1d2f754 in THD::in_stored_procedure (this=0x778310000c70)at /test/13.1_opt/sql/sql_class.h:6581
      #1  THD::reset_slow_query_state (this=0x778310000c70, backup=0x7f84481311a0)at /test/13.1_opt/sql/sql_class.cc:6466
      #2  0x00005ed6d1f2ea25 in sp_instr_stmt::execute (this=0x77831002fd30, thd=0x778310000c70, nextp=0x7f8448131704)at /test/13.1_opt/sql/sp_instr.cc:1182
      #3  0x00005ed6d1cd778a in sp_head::execute (this=this@entry=0x778310021c90, thd=thd@entry=0x778310000c70, merge_da_on_success=true)at /test/13.1_opt/sql/sp_head.cc:1334
      #4  0x00005ed6d1cd908b in sp_head::execute_procedure (this=0x778310021c90, thd=0x778310000c70, args=0x778310006490)at /test/13.1_opt/sql/sp_head.cc:2371
      #5  0x00005ed6d1d840b3 in do_execute_sp (thd=thd@entry=0x778310000c70, sp=0x778310000c70) at /test/13.1_opt/sql/sql_parse.cc:3079
      #6  0x00005ed6d1d86d47 in mysql_execute_command (thd=thd@entry=0x778310000c70, is_called_from_prepared_stmt=false) at /test/13.1_opt/sql/sql_parse.cc:5654
      #7  0x00005ed6d1d80d32 in mysql_parse (thd=thd@entry=0x778310000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7f8448132580)at /test/13.1_opt/sql/sql_parse.cc:7955
      #8  0x00005ed6d1d7f2e8 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x778310000c70, packet=packet@entry=0x778310008ea1 "BEGIN \n  FOR i IN 1..3 LOOP \n    BEGIN q((SELECT a FROM t)); \n      EXCEPTION WHEN OTHERS THEN NULL; \n    END; \n    CREATE OR REPLACE TABLE t (a INT); \n  END LOOP; \nEND", packet_length=packet_length@entry=168, blocking=true)at /test/13.1_opt/sql/sql_parse.cc:1903
      #9  0x00005ed6d1d811b1 in do_command (thd=thd@entry=0x778310000c70, blocking=true) at /test/13.1_opt/sql/sql_parse.cc:1437
      #10 0x00005ed6d1eadbad in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5ed710464140, put_in_cache=true)at /test/13.1_opt/sql/sql_connect.cc:1514
      #11 0x00005ed6d1ead9e2 in handle_one_connection (arg=arg@entry=0x5ed710464140)at /test/13.1_opt/sql/sql_connect.cc:1426
      #12 0x00005ed6d225a643 in pfs_spawn_thread (arg=0x5ed710484bc0)at /test/13.1_opt/storage/perfschema/pfs.cc:2198
      #13 0x00007f8449c9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #14 0x00007f8449d29ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      CS 13.1.2 2ed5f627f289588f5b0e37303946ce7d425e8284 (Debug, Clang 18.1.3-11) Build 22/10/2026

      Core was generated by `/test/MD221026-mariadb-13.1.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005e17d75f0ce6 in THD::in_stored_procedure (this=0x6deea8000d60)at /test/13.1_dbg/sql/sql_class.h:6581
       
      [Current thread is 1 (LWP 2294661)]
      (gdb) bt
      #0  0x00005e17d75f0ce6 in THD::in_stored_procedure (this=0x6deea8000d60)at /test/13.1_dbg/sql/sql_class.h:6581
      #1  0x00005e17d75e62ad in THD::reset_slow_query_state (this=0x6deea8000d60, backup=0x75efb8178668) at /test/13.1_dbg/sql/sql_class.cc:6466
      #2  0x00005e17d795fa21 in sp_instr_stmt::execute (this=0x6deea8032610, thd=0x6deea8000d60, nextp=0x75efb8178a58)at /test/13.1_dbg/sql/sp_instr.cc:1182
      #3  0x00005e17d7547a7c in sp_head::execute (this=0x6deea80244f0, thd=0x6deea8000d60, merge_da_on_success=true)at /test/13.1_dbg/sql/sp_head.cc:1334
      #4  0x00005e17d754a47e in sp_head::execute_procedure (this=0x6deea80244f0, thd=0x6deea8000d60, args=0x6deea8006558)at /test/13.1_dbg/sql/sp_head.cc:2371
      #5  0x00005e17d7680527 in do_execute_sp (thd=0x6deea8000d60, sp=0x6deea80244f0)at /test/13.1_dbg/sql/sql_parse.cc:3079
      #6  0x00005e17d768b4dd in mysql_execute_command (thd=0x6deea8000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:5654
      #7  0x00005e17d767b644 in mysql_parse (thd=0x6deea8000d60, rawbuf=0x6deea801a4d0 "BEGIN \n  FOR i IN 1..3 LOOP \n    BEGIN q((SELECT a FROM t)); \n      EXCEPTION WHEN OTHERS THEN NULL; \n    END; \n    CREATE OR REPLACE TABLE t (a INT); \n  END LOOP; \nEND", length=168, parser_state=0x75efb817aa80) at /test/13.1_dbg/sql/sql_parse.cc:7955
      #8  0x00005e17d7678a0d in dispatch_command (command=COM_QUERY, thd=0x6deea8000d60, packet=0x6deea800b701 "BEGIN \n  FOR i IN 1..3 LOOP \n    BEGIN q((SELECT a FROM t)); \n      EXCEPTION WHEN OTHERS THEN NULL; \n    END; \n    CREATE OR REPLACE TABLE t (a INT); \n  END LOOP; \nEND", packet_length=168, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1903
      #9  0x00005e17d767c1f3 in do_command (thd=0x6deea8000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
      #10 0x00005e17d7883969 in do_handle_one_connection (connect=0x5e17e4c753c0, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1514
      #11 0x00005e17d788370e in handle_one_connection (arg=0x5e17e4c77c60)at /test/13.1_dbg/sql/sql_connect.cc:1426
      #12 0x000075efc209cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #13 0x000075efc2129ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.11  dbg  061026  76ed5b7ea0c9cddfe9386aee4a5ff42a2adf1593  No bug found                  
      CS  10.11  opt  061026  76ed5b7ea0c9cddfe9386aee4a5ff42a2adf1593  No bug found                  
      CS  11.4   dbg  061026  b6398296aeeeb253bdb3d1dd1620d2bb03836bf7  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  11.4   opt  061026  b6398296aeeeb253bdb3d1dd1620d2bb03836bf7  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  11.8   dbg  221026  c20c21d7a1cda67e803548a5bd7e46f1483733f9  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  11.8   opt  221026  c20c21d7a1cda67e803548a5bd7e46f1483733f9  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  12.3   dbg  221026  dec45ff9f3d0443e0e648fdc477629d0419ba8fd  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  12.3   opt  221026  dec45ff9f3d0443e0e648fdc477629d0419ba8fd  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  13.0   dbg  061026  620a4b5624222048fece7fe1789978ae0675cae2  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  13.0   opt  061026  620a4b5624222048fece7fe1789978ae0675cae2  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  13.1   dbg  221026  2ed5f627f289588f5b0e37303946ce7d425e8284  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  13.1   opt  221026  2ed5f627f289588f5b0e37303946ce7d425e8284  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  13.2   dbg  191026  327437ade1d6dc6e4e57a6f1723b4abe4ac6c4b4  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      CS  13.2   opt  191026  327437ade1d6dc6e4e57a6f1723b4abe4ac6c4b4  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      ES  11.4   dbg  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      ES  11.4   opt  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      ES  11.8   dbg  060526  1499789de285a8109d68d79347de0281865b28f4  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      ES  11.8   opt  060526  1499789de285a8109d68d79347de0281865b28f4  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      ES  12.3   dbg  280926  082387a5f3cbb877157998bb4baa95928f4aa121  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      ES  12.3   opt  280926  082387a5f3cbb877157998bb4baa95928f4aa121  SIGSEGV|THD::in_stored_procedure|THD::reset_slow_query_state|sp_instr_stmt::execute|sp_head::execute
      

      Attachments

        Activity

          People

            bar Alexander Barkov
            ramesh Ramesh Sivaraman
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - 0d
                0d
                Remaining:
                Time Spent - 20m Remaining Estimate - 0.5d
                0.5d
                Logged:
                Time Spent - 20m Remaining Estimate - 0.5d
                20m

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.