Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41880

Assertion pkg == pkg->m_top_level_lex->sphead failed in LEX::cleanup_lex_after_parse_error

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      DELIMITER $$
      CREATE PACKAGE pk PROCEDURE p(); END$$
      CREATE PACKAGE BODY pk PROCEDURE p() BEGIN SET sql_mode=ORACLE; FOR i IN 1..2 DO CREATE OR REPLACE TABLE t (a INT); SELECT 1 AS elsif FROM t; END FOR; END; END$$
      CALL pk.p()$$
      

      Leads to:

      CS 13.1.2 2ed5f627f289588f5b0e37303946ce7d425e8284 (Optimized, Clang 18.1.3-11) Build 22/10/2026

      Core was generated by `/test/MD221026-mariadb-13.1.2-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 1050682)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x00007d578ca4527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x00007d578ca288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x00007d578ca297b6 in __libc_message_impl (fmt=fmt@entry=0x7d578cbcf8f0 "%s\n") at ../sysdeps/posix/libc_fatal.c:134
      #6  0x00007d578caa90d5 in malloc_printerr (str=str@entry=0x7d578cbd2ae0 "double free or corruption (out)")at ./malloc/malloc.c:5775
      #7  0x00007d578caab200 in _int_free_merge_chunk (av=0x7d578cc04ac0 <main_arena>, p=0x755694025e90, size=8560)at ./malloc/malloc.c:4676
      #8  0x00007d578caab51a in _int_free (av=0x7d578cc04ac0 <main_arena>, p=<optimized out>, have_lock=<optimized out>) at ./malloc/malloc.c:4646
      #9  0x00007d578caadeae in __GI___libc_free (mem=0x755694025ea0)at ./malloc/malloc.c:3398
      #10 0x000063a2e203b908 in root_free (root=0x7d5789aa8c70, ptr=0x755694025ec0, size=<optimized out>) at /test/13.1_opt/mysys/my_alloc.c:75
      #11 free_root (root=0x7d5789aa8c70, MyFlags=<optimized out>)at /test/13.1_opt/mysys/my_alloc.c:515
      #12 0x000063a2e181f9b9 in sp_head::destroy (sp=<optimized out>)at /test/13.1_opt/sql/sp_head.cc:539
      #13 0x000063a2e202b03b in my_hash_free_elements (hash=0x755694044b00)at /test/13.1_opt/mysys/hash.c:135
      #14 my_hash_free (hash=0x755694044b00) at /test/13.1_opt/mysys/hash.c:157
      #15 0x000063a2e181ee39 in sp_cache::~sp_cache (this=0x10050b)at /test/13.1_opt/sql/sp_cache.cc:294
      #16 0x000063a2e181eeee in sp_cache_clear (cp=0x755694000e38)at /test/13.1_opt/sql/sp_cache.cc:132
      #17 Sp_caches::sp_caches_clear (this=0x755694000e18)at /test/13.1_opt/sql/sp_cache.cc:322
      #18 0x000063a2e18701ff in THD::cleanup (this=0x755694000c70)at /test/13.1_opt/sql/sql_class.cc:1794
      #19 0x000063a2e17c020f in unlink_thd (thd=0x10050b, thd@entry=0x755694000c70)at /test/13.1_opt/sql/mysqld.cc:3018
      #20 0x000063a2e19f7c2e in do_handle_one_connection (connect=<optimized out>, connect@entry=0x63a30e2466e0, put_in_cache=true)at /test/13.1_opt/sql/sql_connect.cc:1525
      #21 0x000063a2e19f79e2 in handle_one_connection (arg=arg@entry=0x63a30e2466e0)at /test/13.1_opt/sql/sql_connect.cc:1426
      #22 0x000063a2e1da4643 in pfs_spawn_thread (arg=0x63a30e267050)at /test/13.1_opt/storage/perfschema/pfs.cc:2198
      #23 0x00007d578ca9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #24 0x00007d578cb29ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      CS 13.1.2 2ed5f627f289588f5b0e37303946ce7d425e8284 (Debug, Clang 18.1.3-11) Build 22/10/2026

      mariadbd: /test/13.1_dbg/sql/sql_lex.cc:4137: static void LEX::cleanup_lex_after_parse_error(THD *): Assertion `pkg == pkg->m_top_level_lex->sphead' failed.
      

      CS 13.1.2 2ed5f627f289588f5b0e37303946ce7d425e8284 (Debug, Clang 18.1.3-11) Build 22/10/2026

      Core was generated by `/test/MD221026-mariadb-13.1.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 1051323)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x00007f917704527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x00007f91770288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x00007f917702881b in __assert_fail_base (fmt=0x7f91771d1208 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5b59453006e3 "pkg == pkg->m_top_level_lex->sphead", file=file@entry=0x5b59452fedfe "/test/13.1_dbg/sql/sql_lex.cc", line=line@entry=4137, function=function@entry=0x5b59453006ad "static void LEX::cleanup_lex_after_parse_error(THD *)") at ./assert/assert.c:96
      #6  0x00007f917703b517 in __assert_fail (assertion=0x5b59453006e3 "pkg == pkg->m_top_level_lex->sphead", file=0x5b59452fedfe "/test/13.1_dbg/sql/sql_lex.cc", line=4137, function=0x5b59453006ad "static void LEX::cleanup_lex_after_parse_error(THD *)") at ./assert/assert.c:105
      #7  0x00005b594411a160 in LEX::cleanup_lex_after_parse_error (thd=0x779068000d60) at /test/13.1_dbg/sql/sql_lex.cc:4137
      #8  0x00005b594417b2ef in parse_sql (thd=0x779068000d60, parser_state=0x7f9174138008, creation_ctx=0x0, do_pfs_digest=false)at /test/13.1_dbg/sql/sql_parse.cc:10359
      #9  0x00005b5944446d20 in sp_lex_instr::parse_expr (this=0x779068063a50, thd=0x779068000d60, sp=0x779068050c30, sp_instr_lex=0x0)at /test/13.1_dbg/sql/sp_instr.cc:1095
      #10 0x00005b5944446338 in sp_lex_keeper::validate_lex_and_exec_core (this=0x779068063a90, thd=0x779068000d60, nextp=0x7f91741387c8, open_tables=false, instr=0x779068063a50)at /test/13.1_dbg/sql/sp_instr.cc:572
      #11 0x00005b5944447a49 in sp_instr_stmt::execute (this=0x779068063a50, thd=0x779068000d60, nextp=0x7f91741387c8)at /test/13.1_dbg/sql/sp_instr.cc:1183
      #12 0x00005b594402fa7c in sp_head::execute (this=0x779068050c30, thd=0x779068000d60, merge_da_on_success=true)at /test/13.1_dbg/sql/sp_head.cc:1334
      #13 0x00005b594403247e in sp_head::execute_procedure (this=0x779068050c30, thd=0x779068000d60, args=0x779068006558)at /test/13.1_dbg/sql/sp_head.cc:2371
      #14 0x00005b5944168527 in do_execute_sp (thd=0x779068000d60, sp=0x779068050c30)at /test/13.1_dbg/sql/sql_parse.cc:3079
      #15 0x00005b5944168008 in Sql_cmd_call::execute (this=0x77906801ac50, thd=0x779068000d60) at /test/13.1_dbg/sql/sql_parse.cc:3317
      #16 0x00005b5944174411 in mysql_execute_command (thd=0x779068000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:5898
      #17 0x00005b5944163644 in mysql_parse (thd=0x779068000d60, rawbuf=0x77906801a4d0 "CALL pk.p()", length=11, parser_state=0x7f917413aa80) at /test/13.1_dbg/sql/sql_parse.cc:7955
      #18 0x00005b5944160a0d in dispatch_command (command=COM_QUERY, thd=0x779068000d60, packet=0x77906800b701 "", packet_length=11, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903
      #19 0x00005b59441641f3 in do_command (thd=0x779068000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
      #20 0x00005b594436b969 in do_handle_one_connection (connect=0x5b596c567b90, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1514
      #21 0x00005b594436b70e in handle_one_connection (arg=0x5b596c500540)at /test/13.1_dbg/sql/sql_connect.cc:1426
      #22 0x00007f917709cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #23 0x00007f9177129ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.11  dbg  061026  76ed5b7ea0c9cddfe9386aee4a5ff42a2adf1593  No bug found                  
      CS  10.11  opt  061026  76ed5b7ea0c9cddfe9386aee4a5ff42a2adf1593  No bug found                  
      CS  11.4   dbg  061026  b6398296aeeeb253bdb3d1dd1620d2bb03836bf7  pkg == pkg->m_top_level_lex->sphead|SIGABRT|LEX::cleanup_lex_after_parse_error|parse_sql|sp_lex_instr::parse_expr|sp_lex_keeper::validate_lex_and_exec_core
      CS  11.4   opt  061026  b6398296aeeeb253bdb3d1dd1620d2bb03836bf7  SIGABRT|__libc_message_impl|malloc_printerr|_int_free_merge_chunk|_int_free
      CS  11.8   dbg  221026  c20c21d7a1cda67e803548a5bd7e46f1483733f9  pkg == pkg->m_top_level_lex->sphead|SIGABRT|LEX::cleanup_lex_after_parse_error|parse_sql|sp_lex_instr::parse_expr|sp_lex_keeper::validate_lex_and_exec_core
      CS  11.8   opt  221026  c20c21d7a1cda67e803548a5bd7e46f1483733f9  SIGABRT|__libc_message_impl|malloc_printerr|_int_free_merge_chunk|_int_free
      CS  12.3   dbg  221026  dec45ff9f3d0443e0e648fdc477629d0419ba8fd  pkg == pkg->m_top_level_lex->sphead|SIGABRT|LEX::cleanup_lex_after_parse_error|parse_sql|sp_lex_instr::parse_expr|sp_lex_keeper::validate_lex_and_exec_core
      CS  12.3   opt  221026  dec45ff9f3d0443e0e648fdc477629d0419ba8fd  SIGABRT|__libc_message_impl|malloc_printerr|_int_free_merge_chunk|_int_free
      CS  13.0   dbg  061026  620a4b5624222048fece7fe1789978ae0675cae2  pkg == pkg->m_top_level_lex->sphead|SIGABRT|LEX::cleanup_lex_after_parse_error|parse_sql|sp_lex_instr::parse_expr|sp_lex_keeper::validate_lex_and_exec_core
      CS  13.0   opt  061026  620a4b5624222048fece7fe1789978ae0675cae2  SIGABRT|__libc_message_impl|malloc_printerr|_int_free_merge_chunk|_int_free
      CS  13.1   dbg  221026  2ed5f627f289588f5b0e37303946ce7d425e8284  pkg == pkg->m_top_level_lex->sphead|SIGABRT|LEX::cleanup_lex_after_parse_error|parse_sql|sp_lex_instr::parse_expr|sp_lex_keeper::validate_lex_and_exec_core
      CS  13.1   opt  221026  2ed5f627f289588f5b0e37303946ce7d425e8284  SIGABRT|__libc_message_impl|malloc_printerr|_int_free_merge_chunk|_int_free
      CS  13.2   dbg  191026  327437ade1d6dc6e4e57a6f1723b4abe4ac6c4b4  pkg == pkg->m_top_level_lex->sphead|SIGABRT|LEX::cleanup_lex_after_parse_error|parse_sql|sp_lex_instr::parse_expr|sp_lex_keeper::validate_lex_and_exec_core
      CS  13.2   opt  191026  327437ade1d6dc6e4e57a6f1723b4abe4ac6c4b4  SIGABRT|__libc_message_impl|malloc_printerr|_int_free_merge_chunk|_int_free
      ES  11.4   dbg  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  pkg == pkg->m_top_level_lex->sphead|SIGABRT|LEX::cleanup_lex_after_parse_error|parse_sql|sp_lex_instr::parse_expr|sp_lex_keeper::validate_lex_and_exec_core
      ES  11.4   opt  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  SIGABRT|__libc_message_impl|malloc_printerr|_int_free_merge_chunk|_int_free
      ES  11.8   dbg  060526  1499789de285a8109d68d79347de0281865b28f4  pkg == pkg->m_top_level_lex->sphead|SIGABRT|LEX::cleanup_lex_after_parse_error|parse_sql|sp_lex_instr::parse_expr|sp_lex_keeper::validate_lex_and_exec_core
      ES  11.8   opt  060526  1499789de285a8109d68d79347de0281865b28f4  SIGABRT|__libc_message_impl|malloc_printerr|_int_free_merge_chunk|_int_free
      ES  12.3   dbg  280926  082387a5f3cbb877157998bb4baa95928f4aa121  pkg == pkg->m_top_level_lex->sphead|SIGABRT|LEX::cleanup_lex_after_parse_error|parse_sql|sp_lex_instr::parse_expr|sp_lex_keeper::validate_lex_and_exec_core
      ES  12.3   opt  280926  082387a5f3cbb877157998bb4baa95928f4aa121  SIGABRT|__libc_message_impl|malloc_printerr|_int_free_merge_chunk|_int_free
      

      Attachments

        Activity

          People

            bar Alexander Barkov
            ramesh Ramesh Sivaraman
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - 0d
                0d
                Remaining:
                Time Spent - 0.5h Remaining Estimate - 0.5d
                0.5d
                Logged:
                Time Spent - 0.5h Remaining Estimate - 0.5d
                0.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.