[MDEV-22000] Server crashes in st_select_lex::inc_in_sum_expr upon DECLARE with group function Created: 2020-03-22  Updated: 2020-10-27  Resolved: 2020-10-27

Status: Closed
Project: MariaDB Server
Component/s: Parser
Affects Version/s: 10.4, 10.5
Fix Version/s: 10.4.16, 10.5.7

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Dmitry Shulga
Resolution: Duplicate Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-23094 Multiple calls to a Stored Procedure ... Closed
relates to MDEV-21999 Server crashes in LEX::create_item_id... Closed
relates to MDEV-22039 Server crashes in MYSQLparse upon IF ... Closed

 Description   

--delimiter $
--error ER_INVALID_GROUP_FUNC_USE
BEGIN NOT ATOMIC DECLARE a INT DEFAULT 0 IN ( SELECT 1 ) OR MIN(2); END $
--delimiter ;

10.4 81f70001

#3  <signal handler called>
#4  0x000055e3730a72dc in st_select_lex::inc_in_sum_expr (this=0x0) at /data/src/10.4/sql/sql_lex.cc:2915
#5  0x000055e3733940a5 in MYSQLparse (thd=0x7fd1dc000af0) at /data/src/10.4/sql/sql_yacc.yy:11914
#6  0x000055e3730f003a in parse_sql (thd=0x7fd1dc000af0, parser_state=0x7fd1f82af160, creation_ctx=0x0, do_pfs_digest=true) at /data/src/10.4/sql/sql_parse.cc:10206
#7  0x000055e3730ea85e in mysql_parse (thd=0x7fd1dc000af0, rawbuf=0x7fd1dc0132f0 "BEGIN NOT ATOMIC DECLARE a INT DEFAULT 0 IN ( SELECT 1 ) OR MIN(2); END", length=71, parser_state=0x7fd1f82af160, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:7853
#8  0x000055e3730d5bd0 in dispatch_command (command=COM_QUERY, thd=0x7fd1dc000af0, packet=0x7fd1dc136171 "BEGIN NOT ATOMIC DECLARE a INT DEFAULT 0 IN ( SELECT 1 ) OR MIN(2); END ", packet_length=72, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1842
#9  0x000055e3730d425d in do_command (thd=0x7fd1dc000af0) at /data/src/10.4/sql/sql_parse.cc:1360
#10 0x000055e37325d70f in do_handle_one_connection (connect=0x55e37671b540) at /data/src/10.4/sql/sql_connect.cc:1412
#11 0x000055e37325d45e in handle_one_connection (arg=0x55e37671b540) at /data/src/10.4/sql/sql_connect.cc:1316
#12 0x000055e373c65d6d in pfs_spawn_thread (arg=0x55e37662f2b0) at /data/src/10.4/storage/perfschema/pfs.cc:1869
#13 0x00007fd1ff88d4a4 in start_thread (arg=0x7fd1f82b0700) at pthread_create.c:456
#14 0x00007fd1fd9c1d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

Reproducible on 10.4-10.5, debug and non-debug.
Not reproducible on 10.3.



 Comments   
Comment by Dmitry Shulga [ 2020-10-27 ]

This issue was fixed in https://jira.mariadb.org/browse/MDEV-23094

Generated at Thu Feb 08 09:11:26 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.