SELECT * FROM (SELECT 1 AS c) AS a WHERE c IN (SELECT 1) GROUP BY c, c HAVING NOT c;

Core was generated by `/test/MD310522-mariadb-10.10.0-linux-x86_64-opt/bin/mysqld --no-defaults --core'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x000055c86b1cfd0e in Item_func_not::fix_fields (this=0x1491b0013820, thd=

    0x1491b0000c58, ref=0x0) at /test/10.10_opt/sql/item_cmpfunc.cc:6445

[Current thread is 1 (Thread 0x1491e4804700 (LWP 2260955))]

(gdb) bt

#0  0x000055c86b1cfd0e in Item_func_not::fix_fields (this=0x1491b0013820, thd=0x1491b0000c58, ref=0x0) at /test/10.10_opt/sql/item_cmpfunc.cc:6445

#1  0x000055c86af36ec2 in st_select_lex::pushdown_from_having_into_where (this=0x1491b0010988, thd=0x1491b0000c58, having=0x0) at /test/10.10_opt/sql/sql_lex.cc:11256

#2  0x000055c86afc09a9 in JOIN::optimize_inner (this=0x1491b0018c70) at /test/10.10_opt/sql/sql_select.cc:2259

#3  0x000055c86afc3b13 in JOIN::optimize (this=this@entry=0x1491b0018c70) at /test/10.10_opt/sql/sql_select.cc:1845

#4  0x000055c86afc3bfe in mysql_select (thd=0x1491b0000c58, tables=0x1491b0011c90, fields=@0x1491b0010c28: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1491b0010f18, last = 0x1491b0010f18, elements = 1}, <No data fields>}, conds=0x1491b00131c0, og_num=2, order=0x0, group=0x1491b0013548, having=0x1491b0013820, proc_param=0x0, select_options=<optimized out>, result=0x1491b0014188, unit=0x1491b0004cb8, select_lex=0x1491b0010988) at /test/10.10_opt/sql/sql_select.cc:5030

#5  0x000055c86afc4397 in handle_select (thd=thd@entry=0x1491b0000c58, lex=lex@entry=0x1491b0004be0, result=result@entry=0x1491b0014188, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.10_opt/sql/sql_select.cc:578

#6  0x000055c86af479b1 in execute_sqlcom_select (thd=0x1491b0000c58, all_tables=0x1491b0011c90) at /test/10.10_opt/sql/sql_parse.cc:6260

#7  0x000055c86af5552d in mysql_execute_command (thd=0x1491b0000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.10_opt/sql/sql_parse.cc:3944

#8  0x000055c86af42bb5 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x1491b0000c58) at /test/10.10_opt/sql/sql_parse.cc:8036

#9  mysql_parse (thd=0x1491b0000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.10_opt/sql/sql_parse.cc:7958

#10 0x000055c86af4e6ca in dispatch_command (command=COM_QUERY, thd=0x1491b0000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.10_opt/sql/sql_class.h:1364

#11 0x000055c86af505f2 in do_command (thd=0x1491b0000c58, blocking=blocking@entry=true) at /test/10.10_opt/sql/sql_parse.cc:1407

#12 0x000055c86b0668af in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55c86e75a1a8, put_in_cache=put_in_cache@entry=true) at /test/10.10_opt/sql/sql_connect.cc:1418

#13 0x000055c86b066b8d in handle_one_connection (arg=0x55c86e75a1a8) at /test/10.10_opt/sql/sql_connect.cc:1312

#14 0x00001491fd647609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#15 0x00001491fd233133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

SELECT * FROM (SELECT 1 AS c) AS a GROUP BY c, c HAVING NOT c;

SELECT * FROM (SELECT 1 AS c) AS a GROUP BY c HAVING NOT c;

Core was generated by `/test/MD090123-mariadb-11.0.1-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x0000558ebb538901 in Item_func_not::fix_fields (ref=0x0, 

    thd=0x14a108000c68, this=0x14a108012538)

    at /test/11.0_opt/sql/item_cmpfunc.cc:6547

6547	      rc= (*ref= new_item)->fix_fields(thd, ref);

[Current thread is 1 (Thread 0x14a14c08d640 (LWP 702036))]

(gdb) bt

#0  0x0000558ebb538901 in Item_func_not::fix_fields (ref=0x0, thd=0x14a108000c68, this=0x14a108012538) at /test/11.0_opt/sql/item_cmpfunc.cc:6547

#1  Item_func_not::fix_fields (this=0x14a108012538, thd=0x14a108000c68, ref=0x0) at /test/11.0_opt/sql/item_cmpfunc.cc:6534

#2  0x0000558ebb29884a in st_select_lex::pushdown_from_having_into_where (this=0x14a108010848, thd=0x14a108000c68, having=0x0) at /test/11.0_opt/sql/sql_lex.cc:11250

#3  0x0000558ebb326a61 in JOIN::optimize_inner (this=0x14a108012ef8) at /test/11.0_opt/sql/sql_select.cc:2290

#4  0x0000558ebb327ada in JOIN::optimize (this=this@entry=0x14a108012ef8) at /test/11.0_opt/sql/sql_select.cc:1870

#5  0x0000558ebb327bbe in mysql_select (thd=0x14a108000c68, tables=0x14a108011b90, fields=@0x14a108010ae8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14a108010de0, last = 0x14a108010de0, elements = 1}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x14a1080123d8, having=0x14a108012538, proc_param=0x0, select_options=<optimized out>, result=0x14a108012ed0, unit=0x14a108004ce8, select_lex=0x14a108010848) at /test/11.0_opt/sql/sql_select.cc:5066

#6  0x0000558ebb328354 in handle_select (thd=thd@entry=0x14a108000c68, lex=lex@entry=0x14a108004c10, result=result@entry=0x14a108012ed0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.0_opt/sql/sql_select.cc:581

#7  0x0000558ebb2a3b25 in execute_sqlcom_select (thd=0x14a108000c68, all_tables=0x14a108011b90) at /test/11.0_opt/sql/sql_parse.cc:6265

#8  0x0000558ebb2b2870 in mysql_execute_command (thd=0x14a108000c68, is_called_from_prepared_stmt=<optimized out>) at /test/11.0_opt/sql/sql_parse.cc:3949

#9  0x0000558ebb2b4104 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x14a108000c68) at /test/11.0_opt/sql/sql_parse.cc:8000

#10 mysql_parse (thd=0x14a108000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/11.0_opt/sql/sql_parse.cc:7922

#11 0x0000558ebb2b66e2 in dispatch_command (command=COM_QUERY, thd=0x14a108000c68, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/11.0_opt/sql/sql_parse.cc:1991

#12 0x0000558ebb2b7e80 in do_command (thd=0x14a108000c68, blocking=blocking@entry=true) at /test/11.0_opt/sql/sql_parse.cc:1407

#13 0x0000558ebb3cdab7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x558ebd379c38, put_in_cache=put_in_cache@entry=true) at /test/11.0_opt/sql/sql_connect.cc:1416

#14 0x0000558ebb3cdd8d in handle_one_connection (arg=0x558ebd379c38) at /test/11.0_opt/sql/sql_connect.cc:1318

#15 0x000014a16434fb43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#16 0x000014a1643e1a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

2023-01-13 19:37:21 0 [Note] /test/UBASAN_MD070123-mariadb-10.11.2-linux-x86_64-dbg/bin/mysqld: ready for connections.

Version: '10.11.2-MariaDB-debug'  socket: '/test/UBASAN_MD070123-mariadb-10.11.2-linux-x86_64-dbg/socket.sock'  port: 11398  MariaDB Server

/test/10.11_dbg_san/sql/item_cmpfunc.cc:6547:16: runtime error: store to null pointer of type 'struct Item *'

    #0 0x5587b5810657 in Item_func_not::fix_fields(THD*, Item**) /test/10.11_dbg_san/sql/item_cmpfunc.cc:6547

    #1 0x5587b3d7ce8a in st_select_lex::pushdown_from_having_into_where(THD*, Item*) /test/10.11_dbg_san/sql/sql_lex.cc:11250

    #2 0x5587b424d6ef in JOIN::optimize_inner() /test/10.11_dbg_san/sql/sql_select.cc:2291

    #3 0x5587b425289f in JOIN::optimize() /test/10.11_dbg_san/sql/sql_select.cc:1870

    #4 0x5587b4252ebd in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_dbg_san/sql/sql_select.cc:5066

    #5 0x5587b4257632 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/10.11_dbg_san/sql/sql_select.cc:581

    #6 0x5587b3df3b1c in execute_sqlcom_select /test/10.11_dbg_san/sql/sql_parse.cc:6265

    #7 0x5587b3e54419 in mysql_execute_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:3949

    #8 0x5587b3e83a74 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_dbg_san/sql/sql_parse.cc:8000

    #9 0x5587b3e937d2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1894

    #10 0x5587b3ea159c in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1407

    #11 0x5587b483f495 in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1416

    #12 0x5587b48409b0 in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1318

    #13 0x15338e139b42 in start_thread nptl/pthread_create.c:442

    #14 0x15338e1cb9ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)

230113 19:37:22 [ERROR] mysqld got signal 11 ;

Core was generated by `/test/MDEV-7850_MD161223-mariadb-11.4.0-linux-x86_64-dbg/bin/mariadbd --no-defa'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x000055ae08a128c7 in Item_func_not::fix_fields (this=0x1466e1c41b10, 

    thd=0x1466e0000d58, 

    ref=<error reading variable: Cannot access memory at address 0x1467900732a8>) at /test/bb-11.4-MDEV-7850_dbg/sql/item_cmpfunc.cc:6545

6545	      rc= (*ref= new_item)->fix_fields(thd, ref);

[Current thread is 1 (LWP 802528)]

(gdb) bt

#0  0x000055ae08a128c7 in Item_func_not::fix_fields (this=0x1466e1c41b10, thd=0x1466e0000d58, ref=<error reading variable: Cannot access memory at address 0x1467900732a8>) at /test/bb-11.4-MDEV-7850_dbg/sql/item_cmpfunc.cc:6545

Backtrace stopped: Cannot access memory at address 0x146790073308