[MDEV-13020] Server crashes in Item_func_nextval::val_int upon selecting NEXT or PREVIOUS VALUE for a view Created: 2017-06-07  Updated: 2020-08-25  Resolved: 2017-07-06

Status: Closed
Project: MariaDB Server
Component/s: Sequences, Views
Affects Version/s: 10.3
Fix Version/s: 10.3.1

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-13016 Testing SEQUENCE object phase 2 Closed

 Description   

CREATE OR REPLACE VIEW v AS SELECT 1 AS f;
SELECT NEXT VALUE FOR v;

10.3 86b9417035295

#3  <signal handler called>
#4  0x0000555cb13e28fd in Item_func_nextval::val_int (this=0x7f5adc014fb8) at /data/src/10.3/sql/item_func.cc:6772
#5  0x0000555cb1271377 in Type_handler::Item_send_longlong (this=0x555cb26f0ef0 <type_handler_longlong>, item=0x7f5adc014fb8, protocol=0x7f5adc001098, buf=0x7f5aed0b1260) at /data/src/10.3/sql/sql_type.cc:5052
#6  0x0000555cb1274cfa in Type_handler_longlong::Item_send (this=0x555cb26f0ef0 <type_handler_longlong>, item=0x7f5adc014fb8, protocol=0x7f5adc001098, buf=0x7f5aed0b1260) at /data/src/10.3/sql/sql_type.h:1840
#7  0x0000555cb0fdd092 in Item::send (this=0x7f5adc014fb8, protocol=0x7f5adc001098, buffer=0x7f5aed0b1260) at /data/src/10.3/sql/item.h:724
#8  0x0000555cb0fd8fcc in Protocol::send_result_set_row (this=0x7f5adc001098, row_items=0x7f5adc004f00) at /data/src/10.3/sql/protocol.cc:985
#9  0x0000555cb105ab18 in select_send::send_data (this=0x7f5adc016df8, items=...) at /data/src/10.3/sql/sql_class.cc:2829
#10 0x0000555cb10f3365 in JOIN::exec_inner (this=0x7f5adc016e18) at /data/src/10.3/sql/sql_select.cc:3361
#11 0x0000555cb10f2dd8 in JOIN::exec (this=0x7f5adc016e18) at /data/src/10.3/sql/sql_select.cc:3280
#12 0x0000555cb10f3f73 in mysql_select (thd=0x7f5adc000b00, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f5adc016df8, unit=0x7f5adc004698, select_lex=0x7f5adc004dd8) at /data/src/10.3/sql/sql_select.cc:3673
#13 0x0000555cb10e8914 in handle_select (thd=0x7f5adc000b00, lex=0x7f5adc0045d0, result=0x7f5adc016df8, setup_tables_done_option=0) at /data/src/10.3/sql/sql_select.cc:373
#14 0x0000555cb10b4e0e in execute_sqlcom_select (thd=0x7f5adc000b00, all_tables=0x7f5adc0149a0) at /data/src/10.3/sql/sql_parse.cc:6465
#15 0x0000555cb10ab19c in mysql_execute_command (thd=0x7f5adc000b00) at /data/src/10.3/sql/sql_parse.cc:3581
#16 0x0000555cb10b8860 in mysql_parse (thd=0x7f5adc000b00, rawbuf=0x7f5adc0148c8 "SELECT NEXT VALUE FOR v", length=23, parser_state=0x7f5aed0b3200, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7927
#17 0x0000555cb10a6518 in dispatch_command (command=COM_QUERY, thd=0x7f5adc000b00, packet=0x7f5adc088651 "", packet_length=23, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1817
#18 0x0000555cb10a4ec1 in do_command (thd=0x7f5adc000b00) at /data/src/10.3/sql/sql_parse.cc:1380
#19 0x0000555cb11f23f4 in do_handle_one_connection (connect=0x555cb4409e50) at /data/src/10.3/sql/sql_connect.cc:1354
#20 0x0000555cb11f2181 in handle_one_connection (arg=0x555cb4409e50) at /data/src/10.3/sql/sql_connect.cc:1260
#21 0x0000555cb164ea8d in pfs_spawn_thread (arg=0x555cb4369660) at /data/src/10.3/storage/perfschema/pfs.cc:1862
#22 0x00007f5af4b3e494 in start_thread (arg=0x7f5aed0b4700) at pthread_create.c:333
#23 0x00007f5af2ec193f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Also reproducible on bb-10.2-ext 3d428e017d

Expectedly, same happens with PREVIOUS VALUE, pasting the stack trace to make it searchable.

#3  <signal handler called>
#4  0x0000563fe0b45f2b in Item_func_lastval::val_int (this=0x7f9c6c014fc8) at /data/src/10.3/sql/item_func.cc:6869
#5  0x0000563fe09d4377 in Type_handler::Item_send_longlong (this=0x563fe1e53ef0 <type_handler_longlong>, item=0x7f9c6c014fc8, protocol=0x7f9c6c001098, buf=0x7f9c7d264260) at /data/src/10.3/sql/sql_type.cc:5052
#6  0x0000563fe09d7cfa in Type_handler_longlong::Item_send (this=0x563fe1e53ef0 <type_handler_longlong>, item=0x7f9c6c014fc8, protocol=0x7f9c6c001098, buf=0x7f9c7d264260) at /data/src/10.3/sql/sql_type.h:1840
#7  0x0000563fe0740092 in Item::send (this=0x7f9c6c014fc8, protocol=0x7f9c6c001098, buffer=0x7f9c7d264260) at /data/src/10.3/sql/item.h:724
#8  0x0000563fe073bfcc in Protocol::send_result_set_row (this=0x7f9c6c001098, row_items=0x7f9c6c004f00) at /data/src/10.3/sql/protocol.cc:985
#9  0x0000563fe07bdb18 in select_send::send_data (this=0x7f9c6c016e10, items=...) at /data/src/10.3/sql/sql_class.cc:2829
#10 0x0000563fe0856365 in JOIN::exec_inner (this=0x7f9c6c016e30) at /data/src/10.3/sql/sql_select.cc:3361
#11 0x0000563fe0855dd8 in JOIN::exec (this=0x7f9c6c016e30) at /data/src/10.3/sql/sql_select.cc:3280
#12 0x0000563fe0856f73 in mysql_select (thd=0x7f9c6c000b00, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f9c6c016e10, unit=0x7f9c6c004698, select_lex=0x7f9c6c004dd8) at /data/src/10.3/sql/sql_select.cc:3673
#13 0x0000563fe084b914 in handle_select (thd=0x7f9c6c000b00, lex=0x7f9c6c0045d0, result=0x7f9c6c016e10, setup_tables_done_option=0) at /data/src/10.3/sql/sql_select.cc:373
#14 0x0000563fe0817e0e in execute_sqlcom_select (thd=0x7f9c6c000b00, all_tables=0x7f9c6c0149b0) at /data/src/10.3/sql/sql_parse.cc:6465
#15 0x0000563fe080e19c in mysql_execute_command (thd=0x7f9c6c000b00) at /data/src/10.3/sql/sql_parse.cc:3581
#16 0x0000563fe081b860 in mysql_parse (thd=0x7f9c6c000b00, rawbuf=0x7f9c6c0148c8 "SELECT PREVIOUS VALUE FOR v", length=27, parser_state=0x7f9c7d266200, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7927
#17 0x0000563fe0809518 in dispatch_command (command=COM_QUERY, thd=0x7f9c6c000b00, packet=0x7f9c6c088651 "", packet_length=27, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1817
#18 0x0000563fe0807ec1 in do_command (thd=0x7f9c6c000b00) at /data/src/10.3/sql/sql_parse.cc:1380
#19 0x0000563fe09553f4 in do_handle_one_connection (connect=0x563fe311de50) at /data/src/10.3/sql/sql_connect.cc:1354
#20 0x0000563fe0955181 in handle_one_connection (arg=0x563fe311de50) at /data/src/10.3/sql/sql_connect.cc:1260
#21 0x0000563fe0db1a8d in pfs_spawn_thread (arg=0x563fe307d660) at /data/src/10.3/storage/perfschema/pfs.cc:1862
#22 0x00007f9c84cf1494 in start_thread (arg=0x7f9c7d267700) at pthread_create.c:333
#23 0x00007f9c8307493f in clone () from /lib/x86_64-linux-gnu/libc.so.6



 Comments   
Comment by Michael Widenius [ 2017-07-06 ]

The problem was that we didn't check on open of sequence if the table is a view, which is not allowed.
We are now generating a proper error message for this case.

Comment by Michael Widenius [ 2017-07-06 ]

Fix pushed to bb-10.2-ext

Generated at Thu Feb 08 08:02:17 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.