Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-7339

Server crashes in Item_func_trig_cond::val_int

Details

    Description

      select (select 1, 2) in (select 3, 4);

      Stack trace from 5.5 revno 4390

      		 
      #2  0x00000000007e7759 in handle_fatal_signal (sig=11) at 5.5/sql/signal_handler.cc:262
      		 
      #3  <signal handler called>
      		 
      #4  0x00000000006a131f in Item_func_trig_cond::val_int (this=0x7efed9083bd0) at 5.5/sql/item_cmpfunc.h:486
      		 
      #5  0x00000000007f578d in Item::val_bool (this=0x7efed9083bd0) at 5.5/sql/item.cc:215
      		 
      #6  0x0000000000825ad5 in Item_cond_and::val_int (this=0x7efed90b3b18) at 5.5/sql/item_cmpfunc.cc:4695
      		 
      #7  0x0000000000669153 in JOIN::exec (this=0x7efed90825a8) at 5.5/sql/sql_select.cc:2277
      		 
      #8  0x0000000000883e23 in subselect_single_select_engine::exec (this=0x7efed904bb80) at 5.5/sql/item_subselect.cc:3231
      		 
      #9  0x000000000087cab6 in Item_subselect::exec (this=0x7efed904b9e0) at 5.5/sql/item_subselect.cc:655
      		 
      #10 0x000000000087cfe2 in Item_in_subselect::exec (this=0x7efed904b9e0) at 5.5/sql/item_subselect.cc:828
      		 
      #11 0x000000000087f407 in Item_in_subselect::val_bool (this=0x7efed904b9e0) at 5.5/sql/item_subselect.cc:1654
      		 
      #12 0x000000000059eab1 in Item::val_bool_result (this=0x7efed904b9e0) at 5.5/sql/item.h:981
      		 
      #13 0x000000000081baf9 in Item_in_optimizer::val_int (this=0x7efed9083008) at 5.5/sql/item_cmpfunc.cc:1747
      		 
      #14 0x00000000008066b9 in Item::send (this=0x7efed9083008, protocol=0x7efee9053628, buffer=0x7eff0446e240) at 5.5/sql/item.cc:6514
      		 
      #15 0x000000000059ad96 in Protocol::send_result_set_row (this=0x7efee9053628, row_items=0x7efee9056b70) at 5.5/sql/protocol.cc:903
      		 
      #16 0x00000000005fd8ac in select_send::send_data (this=0x7efed904bc80, items=...) at 5.5/sql/sql_class.cc:2370
      		 
      #17 0x0000000000669242 in JOIN::exec (this=0x7efed9082078) at 5.5/sql/sql_select.cc:2281
      		 
      #18 0x000000000066beb5 in mysql_select (thd=0x7efee9053060, rref_pointer_array=0x7efee9056cc8, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7efed904bc80, unit=0x7efee9056380, select_lex=0x7efee9056a58) at 5.5/sql/sql_select.cc:3094
      		 
      #19 0x0000000000662985 in handle_select (thd=0x7efee9053060, lex=0x7efee90562d0, result=0x7efed904bc80, setup_tables_done_option=0) at 5.5/sql/sql_select.cc:319
      		 
      #20 0x000000000063bfd8 in execute_sqlcom_select (thd=0x7efee9053060, all_tables=0x0) at 5.5/sql/sql_parse.cc:4689
      		 
      #21 0x00000000006351ba in mysql_execute_command (thd=0x7efee9053060) at 5.5/sql/sql_parse.cc:2234
      		 
      #22 0x000000000063e6d4 in mysql_parse (thd=0x7efee9053060, rawbuf=0x7efed904a078 "select (select 1, 2) in (select 3, 4)", length=37, parser_state=0x7eff0446f680) at 5.5/sql/sql_parse.cc:5800
      		 
      #23 0x0000000000632701 in dispatch_command (command=COM_QUERY, thd=0x7efee9053060, packet=0x7efee910e061 "", packet_length=37) at 5.5/sql/sql_parse.cc:1079
      		 
      #24 0x000000000063188d in do_command (thd=0x7efee9053060) at 5.5/sql/sql_parse.cc:793
      		 
      #25 0x00000000007339de in do_handle_one_connection (thd_arg=0x7efee9053060) at 5.5/sql/sql_connect.cc:1266
      		 
      #26 0x000000000073349d in handle_one_connection (arg=0x7efee9053060) at 5.5/sql/sql_connect.cc:1181
      		 
      #27 0x00007eff040a5b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
      		 
      #28 0x00007eff0235c20d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

      Attachments

        Issue Links

          duplicates

          Task - A task that needs to be done. MDEV-11358 Crash during SELECT (SELECT 1,2) NOT IN (SELECT 2,3);

          • Major - Major loss of function.
          • Closed

          Activity

            Descending order - Click to sort in ascending order
            sanja Oleksandr Byelkin added a comment -

            OK to push!

            sanja Oleksandr Byelkin added a comment - OK to push!
            wlad Vladislav Vaintroub added a comment - - edited

            The crash is caused by NULL pointer derefence,
            which is caused by in Item_func_trig_cond::val_int()
            which is caused by prior constructor Item_func_trig_cond(thd, col_item, get_cond_guard(i)) where the last parameter evaluates to NULL, because pushed_cond_guards is NULL.

            This is so much I could find about it. Handing back to someone who knows the code better

            wlad Vladislav Vaintroub added a comment - - edited The crash is caused by NULL pointer derefence, which is caused by in Item_func_trig_cond::val_int() which is caused by prior constructor Item_func_trig_cond(thd, col_item, get_cond_guard(i)) where the last parameter evaluates to NULL, because pushed_cond_guards is NULL. This is so much I could find about it. Handing back to someone who knows the code better

            People

              serg Sergei Golubchik
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.