[MDEV-28206]  SIGSEGV in Item_field::fix_fields when using LEAD...OVER Created: 2022-04-01  Updated: 2023-05-17  Resolved: 2022-12-02

Status: Closed
Project: MariaDB Server
Component/s: Optimizer - Window functions, Stored routines
Affects Version/s: 10.6, 10.7, 10.8, 10.9, 10.10, 10.11
Fix Version/s: 10.11.2, 10.6.12, 10.7.8, 10.8.7, 10.9.5, 10.10.3

Type: Bug Priority: Critical
Reporter: Peter Bennett Assignee: Daniel Black
Resolution: Fixed Votes: 1
Labels: not-10.5, regression-10.6

Attachments: Zip Archive wicenrfid_bug_report.zip    
Issue Links:
Problem/Incident
is caused by MDEV-25631 Crash executing query with VIEW, aggr... Closed
Relates
relates to MDEV-31296 Crash in Item_func::fix_fields when p... Closed

 Description   

On second select, server crashes.



 Comments   
Comment by Daniel Black [ 2022-04-01 ]

10.7-f78fdf087f73512df741ba5f098b0e78f791db38 source buildtest.sql

 
ERROR 2013 (HY000) at line 66 in file: 'buildtest.sql': Lost connection to server during query
 
 
220401 13:32:02 [ERROR] mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
 
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x7f47a4123fe0): SELECT OpenStatus
   INTO LocalOpenStatus
   FROM (SELECT StageID,
                OpenStatus,
                STGSTL.StageStatusTimeStamp,
                COALESCE(LEAD(STGSTL.StageStatusTimeStamp) OVER (PARTITION BY STGSTL.StageID ORDER BY STGSTL.StageStatusTimeStamp),DVS.EndDate,EVT.EndDate) AS NextStatusTimeStamp
         FROM (stagestatustimeline STGSTL STRAIGHT_JOIN stages STG USING (StageID) STRAIGHT_JOIN divisions DVS USING (DivisionID) STRAIGHT_JOIN events EVT USING (EventID))
               STRAIGHT_JOIN stagestatuses STGST ON(STGSTL.StageStatus = STGST.StatusName)) SUB1
   WHERE  NAME_CONST('TimeStampQuery',TIMESTAMP'2022-04-01 07:32:02.280839') >= StageStatusTimeStamp AND  NAME_CONST('TimeStampQuery',TIMESTAMP'2022-04-01 07:32:02.280839') < NextStatusTimeStamp
   AND StageID =  NAME_CONST('StageIDQuery',4000)

Thread 5 (Thread 0x7f48202df640 (LWP 133204)):
#0  Item_field::fix_fields (this=0x7f47a410afe8, thd=0x7f47a4000c58, reference=<optimized out>) at /home/dan/repos/mariadb-server-10.7/sql/item.cc:6123
        table_list = <optimized out>
        outer_fixed = false
        from_field = <optimized out>
        select = <optimized out>
#1  0x00000000009a5b19 in Item::fix_fields_if_needed (this=0x7f47a410afe8, thd=0x7f47a4000c58, ref=0x7f47a410cc30) at /home/dan/repos/mariadb-server-10.7/sql/item.h:1144
No locals.
#2  Item_func::fix_fields (this=0x7f47a410cbb8, thd=0x7f47a4000c58, ref=<optimized out>) at /home/dan/repos/mariadb-server-10.7/sql/item_func.cc:347
        item = <optimized out>
        buff = "0di\001\000\000\000\000p\263\017\244G\177\000\000p\243- H\177\000\000\327F\222\000\000\000\000\000Hdi\001\000\000\000\000\230\332\017\244G\177\000\000\240\243- H\177\000\000hƉ\000\000\000\000\000\360\326\017\244G\177\000\000\000\000\000\000\000\000\000\000\220di\001\000\000\000\000\220di\001\000\000\000\000\000\244- H\177\000\000\347h\232\000\000\000\000\000\003\000\000\000\000\000\000\000\020\244- H\177\000\000\366O\005\001\000\000\000\000\b\000\000\000\000\000\000\000\360\326\017\244G\177\000\000\360\331\017\244G\177\000\000\360\331\017\244G\177\000\000\b\327\017\244G\177\000\000\000\000\000\000\000\000\000\000X\f\000\244G\177\000\000\bU\022\244G\177\000\000\030"...
        arg_end = <optimized out>
        arg = 0x7f47a410cc30
#3  0x0000000000985bbc in Item::fix_fields_if_needed (this=0x7f47a410cbb8, thd=0x7f47a4000c58, ref=0x7f47a4124490) at /home/dan/repos/mariadb-server-10.7/sql/item.h:1144
No locals.
#4  Item::fix_fields_if_needed_for_scalar (this=0x7f47a410cbb8, thd=0x7f47a4000c58, ref=0x7f47a4124490) at /home/dan/repos/mariadb-server-10.7/sql/item.h:1148
No locals.
#5  Item::fix_fields_if_needed_for_bool (this=0x7f47a410cbb8, thd=0x7f47a4000c58, ref=0x7f47a4124490) at /home/dan/repos/mariadb-server-10.7/sql/item.h:1152
No locals.
#6  Item_cond::fix_fields (this=0x7f47a4124380, thd=0x7f47a4000c58, ref=<optimized out>) at /home/dan/repos/mariadb-server-10.7/sql/item_cmpfunc.cc:4898
        type = <optimized out>
        buff = "/\345\225\000\000\000\000"
        li = {<base_list_iterator> = {list = 0x7f47a4124430, el = 0x7f47a4124488, prev = <optimized out>, current = 0x7f47a4124488}, <No data fields>}
        item = 0x7f47a410cbb8
        is_and_cond = <optimized out>
#7  0x00000000006d2d2a in Item::fix_fields_if_needed (this=0x7f47a4124380, thd=0x7f47a4000c58, ref=0x7f47a4125198) at /home/dan/repos/mariadb-server-10.7/sql/item.h:1144
No locals.
#8  Item::fix_fields_if_needed_for_scalar (this=0x7f47a4124380, thd=0x7f47a4000c58, ref=0x7f47a4125198) at /home/dan/repos/mariadb-server-10.7/sql/item.h:1148
No locals.
#9  Item::fix_fields_if_needed_for_bool (this=0x7f47a4124380, thd=0x7f47a4000c58, ref=0x7f47a4125198) at /home/dan/repos/mariadb-server-10.7/sql/item.h:1152
No locals.
#10 setup_conds (thd=0x7f47a4000c58, tables=<optimized out>, leaves=<optimized out>, conds=conds@entry=0x7f47a4125198) at /home/dan/repos/mariadb-server-10.7/sql/sql_base.cc:8474
        table = <optimized out>
        select_lex = 0x7f47a40f7278
        it_is_update = false
        derived = 0x7f47a4102da8
        save_is_item_list_lookup = <optimized out>
#11 0x000000000076a99b in setup_without_group (thd=0x7f47a4000c58, ref_pointer_array={m_array = 0x7f47a410cfa0, m_size = 27}, tables=0x7f47a40fdb90, leaves=<error reading variable: Cannot access memory at address 0x0>, fields=@0x7f47a40f7518: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7f47a40f9278, last = 0x7f47a40fd760, elements = 4}, <No data fields>}, all_fields=@0x7f47a41250b0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7f47a41258b0, last = 0x7f47a40fd760, elements = 8}, <No data fields>}, conds=0x7f47a4125198, order=0x0, group=0x0, win_specs=@0x7f47a40f76b0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7f47a410d418, last = 0x7f47a410d418, elements = 1}, <No data fields>}, win_funcs=@0x7f47a40f76c8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7f47a40fd610, last = 0x7f47a40fd610, elements = 1}, <No data fields>}, hidden_group_fields=0x7f47a412505f, reserved=0x7f47a40f7634) at /home/dan/repos/mariadb-server-10.7/sql/sql_select.cc:833
        select = 0x7f47a40f7278
        save_allow_sum_func = {buffer = {0}}
        res = <optimized out>
        save_place = <optimized out>
        saved_non_agg_field_used = <optimized out>
#12 0x0000000000769d99 in JOIN::prepare (this=0x7f47a4124d48, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7f47a40f7278, unit_arg=0x7f47a41025b0) at /home/dan/repos/mariadb-server-10.7/sql/sql_select.cc:1403
        trace_wrapper = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe68a20 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_prepare = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe68a20 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_steps = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe689a8 <vtable for Json_writer_array+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        li = <optimized out>
        tbl = <optimized out>
        real_og_num = <optimized out>
        save_place = NO_MATTER
        with_clause = <optimized out>
        res = <optimized out>
        with_elem = <optimized out>
#13 0x00000000007eabdb in st_select_lex_unit::prepare_join (this=this@entry=0x7f47a41025b0, thd_arg=0x7f47a4000c58, sl=sl@entry=0x7f47a40f7278, tmp_result=tmp_result@entry=0x7f47a4124c60, additional_options=additional_options@entry=0, is_union_select=false) at /home/dan/repos/mariadb-server-10.7/sql/sql_union.cc:1091
        derived = 0x7f47a4102da8
        join = 0x7f47a4124d48
        can_skip_order_by = false
#14 0x00000000007e72ad in st_select_lex_unit::prepare (this=0x7f47a41025b0, derived_arg=0x7f47a4102da8, sel_result=0x7f47a40fb7a0, additional_options=139945671753136) at /home/dan/repos/mariadb-server-10.7/sql/sql_union.cc:1484
        lex_select_save = 0x7f47a40f6bc8
        first_sl = 0x7f47a40f7278
        instantiate_tmp_table = <optimized out>
        have_except_all_or_intersect_all = false
        have_intersect = false
        have_except = false
        union_part_count = 0
        is_rec_result_table_created = false
        is_recursive = false
        single_tvc_wo_order = <optimized out>
        sl = 0x7f47a40f7278
        is_union_select = <optimized out>
        tmp_result = <optimized out>
        single_tvc = <optimized out>
#15 0x00000000006f6455 in mysql_derived_prepare (thd=0x7f47a4000c58, lex=<optimized out>, derived=0x7f47a4102da8) at /home/dan/repos/mariadb-server-10.7/sql/sql_derived.cc:855
        res = <optimized out>
        unit = 0x7f47a41025b0
        first_select = <optimized out>
        keep_row_order = false
#16 0x00000000006f7b94 in mysql_handle_single_derived (lex=lex@entry=0x7f47a40fb7a0, derived=derived@entry=0x7f47a4102da8, phases=phases@entry=2) at /home/dan/repos/mariadb-server-10.7/sql/sql_derived.cc:200
        phase_flag = <optimized out>
        phase = 1
        res = false
        allowed_phases = <optimized out>
#17 0x000000000080fea4 in TABLE_LIST::handle_derived (this=0x7f47a4102da8, lex=0x7f47a40fb7a0, phases=2) at /home/dan/repos/mariadb-server-10.7/sql/table.cc:9262
        unit = <optimized out>
#18 0x00000000007107af in LEX::handle_list_of_derived (table_list=<optimized out>, this=<optimized out>, phases=<optimized out>) at /home/dan/repos/mariadb-server-10.7/sql/sql_lex.h:4471
        tl = 0x7f47a4102da8
        tl = <optimized out>
#19 st_select_lex::handle_derived (this=<optimized out>, lex=0x7f47a40fb7a0, phases=2) at /home/dan/repos/mariadb-server-10.7/sql/sql_lex.cc:5015
No locals.
#20 0x0000000000769a1a in JOIN::prepare (this=this@entry=0x7f47a41246a8, tables_init=<optimized out>, tables_init@entry=0x7f47a4102da8, conds_init=<optimized out>, conds_init@entry=0x7f47a41244e0, og_num=og_num@entry=0, order_init=<optimized out>, order_init@entry=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7f47a40f6bc8, unit_arg=0x7f47a40fb878) at /home/dan/repos/mariadb-server-10.7/sql/sql_select.cc:1301
        trace_wrapper = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe68a20 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_prepare = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe68a20 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_steps = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe689a8 <vtable for Json_writer_array+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        li = <optimized out>
        tbl = <optimized out>
        real_og_num = <optimized out>
        save_place = <optimized out>
        with_clause = <optimized out>
        res = <optimized out>
        with_elem = <optimized out>
#21 0x0000000000766519 in mysql_select (thd=thd@entry=0x7f47a4000c58, tables=0x7f47a40f7278, fields=@0x7f47a40f6e68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7f47a40f7188, last = 0x7f47a40f7188, elements = 1}, <No data fields>}, conds=0x0, og_num=2752493472, order=0x7f47a40d7db0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x7f47a40f71c8, unit=0x7f47a40fb878, select_lex=0x7f47a40f6bc8) at /home/dan/repos/mariadb-server-10.7/sql/sql_select.cc:4984
        free_join = true
        err = 0
        join = 0x7f47a41246a8
#22 0x00000000007662e0 in handle_select (thd=thd@entry=0x7f47a4000c58, lex=lex@entry=0x7f47a40fb7a0, result=result@entry=0x7f47a40f71c8, setup_tables_done_option=setup_tables_done_option@entry=0) at /home/dan/repos/mariadb-server-10.7/sql/sql_select.cc:545
        unit = <optimized out>
        select_lex = 0x7f47a40f6bc8
        res = <optimized out>
#23 0x000000000073735a in execute_sqlcom_select (thd=thd@entry=0x7f47a4000c58, all_tables=0x7f47a4102da8) at /home/dan/repos/mariadb-server-10.7/sql/sql_parse.cc:6268
        save_protocol = 0x0
        result = 0x7f47a40f71c8
        lex = 0x7f47a40fb7a0
        res = <optimized out>
#24 0x0000000000731d59 in mysql_execute_command (thd=0x7f47a4000c58, is_called_from_prepared_stmt=<optimized out>) at /home/dan/repos/mariadb-server-10.7/sql/sql_parse.cc:3959
        privileges_requested = <optimized out>
        ots = {ctx = 0x7f47a4004a48, traceable = false}
        up_result = 0
        res = 0
        lex = <optimized out>
        select_lex = 0x7f47a40f6bc8
        have_table_map_for_update = <optimized out>
        unit = 0x7f47a40fb878
        first_table = 0x7f47a4102da8
        all_tables = 0x7f47a40f7278
        orig_binlog_format = <optimized out>
        orig_current_stmt_binlog_format = <optimized out>
        rpl_filter = <optimized out>
        error = <optimized out>
        wsrep_error_label = <optimized out>
#25 0x000000000069e967 in sp_instr_stmt::exec_core (this=0x7f47a4104b30, thd=0x0, nextp=0x7f48202dca64) at /home/dan/repos/mariadb-server-10.7/sql/sp_head.cc:3778
        res = <optimized out>
#26 0x000000000069dbea in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x7f47a4104b78, thd=thd@entry=0x7f47a4000c58, nextp=0x0, nextp@entry=0x7f48202dca64, open_tables=<optimized out>, instr=instr@entry=0x7f47a4104b30) at /home/dan/repos/mariadb-server-10.7/sql/sp_head.cc:3503
        ots = {ctx = 0x7f47a4004a48, traceable = false}
        trace_command = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe68a20 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_command_steps = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe689a8 <vtable for Json_writer_array+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        res = <optimized out>
        parent_unsafe_rollback_flags = 0
        parent_modified_non_trans_table = <optimized out>
#27 0x000000000069e404 in sp_instr_stmt::execute (this=0x7f47a4104b30, thd=0x7f47a4000c58, nextp=0x7f48202dca64) at /home/dan/repos/mariadb-server-10.7/sql/sp_head.cc:3684
        log_slow = <optimized out>
        query_backup = {string = {str = 0x7f47a4013010 "SELECT stageopenstatusattime(4000, @stage_test) \"LocalOpenStatus\"", length = 65}, cs = 0x160fff0 <my_charset_latin1>}
        backup_state = {auto_inc_interval_for_cur_row = {interval_min = 0, interval_values = 0, interval_max = 0, next = 0x0}, auto_inc_intervals_forced = {head = 0x0, tail = 0x0, current = 0x0, elements = 0}, savepoints = 0x0, option_bits = 8388608, first_successful_insert_id_in_prev_stmt = 0, first_successful_insert_id_in_cur_stmt = 17462691659723300096, insert_id_for_cur_row = 139947754244666, limit_found_rows = 32, tmp_tables_size = 0, client_capabilities = 7, cuted_fields = 32, sent_row_count = 0, examined_row_count = 0, affected_rows = 0, bytes_sent_old = 2441, tmp_tables_used = 0, tmp_tables_disk_used = 0, query_plan_fsort_passes = 0, query_plan_flags = 256, in_sub_stmt = 49647216, enable_slow_log = false, last_insert_id_used = false, count_cuted_fields = 268164352}
        save_enable_slow_log = true
        res = <optimized out>
#28 0x0000000000698577 in sp_head::execute (this=this@entry=0x7f47a40f5740, thd=thd@entry=0x7f47a4000c58, merge_da_on_success=true) at /home/dan/repos/mariadb-server-10.7/sql/sp_head.cc:1437
        state = {m_discarded = 48 '0', m_in_prepare = 75 'K', m_no_index_used = 16 '\020', m_no_good_index_used = 164 '\244', m_flags = 32583, m_class = 0x0, m_thread = 0x0, m_timer_start = 0, m_timer = 0x0, m_statement = 0x0, m_lock_time = 0, m_rows_sent = 0, m_rows_examined = 0, m_created_tmp_disk_tables = 0, m_created_tmp_tables = 0, m_select_full_join = 0, m_select_full_range_join = 0, m_select_range = 0, m_select_range_check = 0, m_select_scan = 0, m_sort_merge_passes = 0, m_sort_range = 0, m_sort_rows = 0, m_sort_scan = 0, m_digest = 0x0, m_schema_name = '\000' <repeats 191 times>, m_schema_name_length = 0, m_cs_number = 0, m_parent_sp_share = 0x0, m_parent_prepared_stmt = 0x0}
        parent_digest = 0x7f47a4004798
        psi_info = <optimized out>
        parent_locker = 0x0
        old_query = {string = {str = 0x7f47a4013010 "SELECT stageopenstatusattime(4000, @stage_test) \"LocalOpenStatus\"", length = 65}, cs = <synthetic pointer>}
        saved_cur_db_name_buf = '\000' <repeats 201 times>
        saved_cur_db_name = {str = 0x7f48202dccf0 "", length = 202}
        execute_mem_root = {free = 0x7f47a4123ca8, used = 0x0, pre_alloc = 0x0, min_malloc = 32, block_size = 8184, block_num = 5, first_block_usage = 0, flags = 0, error_handler = 0x812e50 <sql_alloc_error_handler()>, psi_key = 0}
        execute_arena = {_vptr$Query_arena = 0xe754f0 <vtable for Query_arena+16>, free_list = 0x0, mem_root = 0x7f48202dc900, state = Query_arena::STMT_INITIALIZED_FOR_SP}
        backup_arena = {_vptr$Query_arena = 0xe754f0 <vtable for Query_arena+16>, free_list = 0x7f47a41226e8, mem_root = 0x7f47a4013a80, state = Query_arena::STMT_INITIALIZED_FOR_SP}
        old_change_list = {change_list = {<base_ilist> = {first = 0x7f47a4000d20, last = {_vptr$ilink = 0xe64030 <vtable for ilink+16>, prev = 0x7f47a4000d18, next = 0x0}}, <No data fields>}}
        old_packet = {<Charset> = {m_charset = 0x15ed150 <my_charset_bin>}, <Binary_string> = {<Sql_alloc> = {<No data fields>}, Ptr = 0x7f47a400c5c8 "\003def", str_length = 0, Alloced_length = 16392, extra_alloc = 0, alloced = true, thread_specific = false}, <No data fields>}
        sp_wi = {m_warn_root = {free = 0x0, used = 0x0, pre_alloc = 0x0, min_malloc = 32, block_size = 2040, block_num = 4, first_block_usage = 0, flags = 0, error_handler = 0x812e50 <sql_alloc_error_handler()>, psi_key = 0}, m_warn_list = {<I_P_List_counter> = {m_counter = 0}, <I_P_List_fast_push_back<Sql_condition>> = {m_last = 0x7f48202dcc50}, m_first = 0x0}, m_warn_count = {0, 0, 0}, m_current_statement_warn_count = 0, m_current_row_for_warning = 0, m_warn_id = 55, m_error_condition = 0x0, m_allow_unlimited_warnings = false, initialized = true, m_read_only = false, m_next_in_da = 0x7f47a4006c38, m_prev_in_da = 0x7f47a4006cf8, m_marked_sql_conditions = {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15b9828 <end_of_list>, last = 0x7f48202dcc98, elements = 0}, <No data fields>}}
        cur_db_changed = false
        ip = <optimized out>
        err_status = false
        ctx = 0x7f47a41218b0
        user_var_events_alloc_saved = 0x0
        status_backup_mask = 192
        saved_creation_ctx = 0x7f47a4122800
        save_reprepare_observer = 0x0
        da = 0x7f47a40069f8
        old_arena = 0x7f47a4000c70
        old_query_id = 53
        old_lex = 0x7f47a4004dc8
        save_sql_mode = 1411383296
        save_abort_on_warning = false
        old_server_status = 0
        old_derived_tables = <optimized out>
        old_rec_tables = <optimized out>
        i = <optimized out>
#29 0x000000000069a6ac in sp_head::execute_function (this=0x7f47a40f5740, thd=0x7f47a4000c58, argp=<optimized out>, argcount=<optimized out>, return_value_fld=0x7f47a410feb8, func_ctx=0x7f47a4013a78, call_arena=0x7f47a4014310) at /home/dan/repos/mariadb-server-10.7/sql/sp_head.cc:2168
        psi_state = {m_flags = 2752649344, m_thread = 0x7f47a41218a0, m_timer_start = 3, m_timer = 0x0, m_sp_share = 0x0}
        locker = 0x0
        buf = '\000' <repeats 64 times>, "\211\t\000\000\000\000\000\000\200:\001\244G\177\000"
        binlog_buf = {<Charset> = {m_charset = 0x15ed150 <my_charset_bin>}, <Binary_string> = {<Sql_alloc> = {<No data fields>}, Ptr = 0x7f48202dd080 "", str_length = 80, Alloced_length = 80, extra_alloc = 0, alloced = false, thread_specific = false}, <No data fields>}
        backup_arena = {_vptr$Query_arena = 0xe754f0 <vtable for Query_arena+16>, free_list = 0x7f47a4014bc8, mem_root = 0x7f47a40069b8, state = Query_arena::STMT_CONVENTIONAL_EXECUTION}
        need_binlog_call = false
        binlog_save_options = 139945671875112
        octx = 0x0
        err_status = <optimized out>
        arg_no = <optimized out>
        save_security_ctx = <optimized out>
#30 0x000000000095f2fd in Item_sp::execute_impl (this=0x7f47a4013a18, thd=0x7f47a4000c58, args=0x7f47a40139e8, arg_count=2) at /home/dan/repos/mariadb-server-10.7/sql/item.cc:2923
        statement_state = {auto_inc_interval_for_cur_row = {interval_min = 0, interval_values = 0, interval_max = 0, next = 0x0}, auto_inc_intervals_forced = {head = 0x0, tail = 0x0, current = 0x0, elements = 0}, savepoints = 0x0, option_bits = 2147748608, first_successful_insert_id_in_prev_stmt = 0, first_successful_insert_id_in_cur_stmt = 0, insert_id_for_cur_row = 0, limit_found_rows = 1, tmp_tables_size = 0, client_capabilities = 124570805892, cuted_fields = 0, sent_row_count = 0, examined_row_count = 0, affected_rows = 0, bytes_sent_old = 2441, tmp_tables_used = 0, tmp_tables_disk_used = 0, query_plan_fsort_passes = 0, query_plan_flags = 256, in_sub_stmt = 0, enable_slow_log = true, last_insert_id_used = false, count_cuted_fields = CHECK_FIELD_IGNORE}
        save_security_ctx = 0x7f47a4002ab8
        access = <optimized out>
        err_status = <optimized out>
#31 0x000000000095f12e in Item_sp::execute (this=0x7f47a4013a18, thd=0x7f47a4000c58, null_value=0x7f47a40139d4, args=0x0, arg_count=2752493472) at /home/dan/repos/mariadb-server-10.7/sql/item.cc:2837
No locals.
#32 0x00000000009bf82b in Item_func_sp::execute (this=<optimized out>) at /home/dan/repos/mariadb-server-10.7/sql/item_func.cc:6625
No locals.
#33 Item_func_sp::val_str (this=0x7f47a4013970, str=0x7f48202dd330) at /home/dan/repos/mariadb-server-10.7/sql/item_func.h:3907
        buf = {<Charset> = {m_charset = 0x15ed150 <my_charset_bin>}, <Binary_string> = {<Sql_alloc> = {<No data fields>}, Ptr = 0x7f48202dd290 "\330:\001\244G\177", str_length = 0, Alloced_length = 20, extra_alloc = 0, alloced = false, thread_specific = false}, <No data fields>}
        buff = "\330:\001\244G\177\000\000p9\001\244G\177\000\000\260\322- "
#34 0x00000000008a8bae in Type_handler::Item_send_str (this=<optimized out>, item=0x0, protocol=0x7f47a40011b8, buf=0x7f47a40fb7a0) at /home/dan/repos/mariadb-server-10.7/sql/sql_type.cc:7468
        res = <optimized out>
#35 0x0000000000679c09 in Protocol::send_result_set_row (this=0x7f47a40011b8, row_items=<optimized out>) at /home/dan/repos/mariadb-server-10.7/sql/protocol.cc:1328
        item = 0x7f47a4013970
        value_buffer = {<Value> = {<st_value> = {m_type = DYN_COL_NULL, value = {m_longlong = 0, m_double = 0, m_time = {year = 0, month = 0, day = 0, hour = 0, minute = 0, second = 0, second_part = 0, neg = 0 '\000', time_type = MYSQL_TIMESTAMP_DATE}}, m_string = {<Charset> = {m_charset = 0x15ed150 <my_charset_bin>}, <Binary_string> = {<Sql_alloc> = {<No data fields>}, Ptr = 0x7f48202dd390 "\240\323- H\177", str_length = 766, Alloced_length = 766, extra_alloc = 0, alloced = false, thread_specific = false}, <No data fields>}, m_decimal = {<st_decimal_t> = {intg = 23, frac = 0, len = 9, sign = 0 '\000', buf = 0x7f48202dd368}, buffer = {15, 0, 539874272, 32584, 6783922, 0, 539874228, 32584, 539874392}}}, <No data fields>}, buffer = "\240\323- H\177\000\000\236=\223\000\000\000\000\000\340\323- H\177\000\000C\202g", '\000' <repeats 13 times>, "\370\324- H\177\000\000\340\323- H\177\000\000jr\246\000\000\000\000\000\005\000\000\000\000\000\000\000(\230[\001\000\000\000\000\370\324- H\177\000\000\350\016\000\244G\177\000\000@\324- H\177\000\000.q\246", '\000' <repeats 17 times>, "\005\000\000\003\000\335\373\017\213\361W\362\001\217\346\000\000\000\000\000(\230[\001\000\000\000\000\270\021\000\244G\177\000\000\230\063\001\244G\177\000\000\000\000\000\000\000\000\000\000\320\326- H\177\000\000)\226g", '\000' <repeats 13 times>...}
        it = {<base_list_iterator> = {list = <optimized out>, el = 0x7f47a4014370, prev = <synthetic pointer>, current = <synthetic pointer>}, <No data fields>}
#36 0x00000000006e3aef in select_send::send_data (this=0x7f47a4016fa8, items=@0x7f47a40f7278: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x0, last = 0x7f47a41025c8, elements = 2752521648}, <No data fields>}) at /home/dan/repos/mariadb-server-10.7/sql/sql_class.cc:3113
        protocol = 0x7f47a40011b8
#37 0x000000000077eb37 in select_result_sink::send_data_with_check (this=0x0, items=@0x7f47a40f7278: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x0, last = 0x7f47a41025c8, elements = 2752521648}, <No data fields>}, u=<optimized out>, sent=0) at /home/dan/repos/mariadb-server-10.7/sql/sql_class.h:5616
No locals.
#38 JOIN::exec_inner (this=this@entry=0x7f47a410f860) at /home/dan/repos/mariadb-server-10.7/sql/sql_select.cc:4617
        trace_wrapper = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe68a20 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_exec = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe68a20 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_steps = {<Json_writer_struct> = {_vptr$Json_writer_struct = 0xe689a8 <vtable for Json_writer_array+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        columns_list = 0x7f47a4013398
#39 0x00000000007665e6 in JOIN::exec (this=0x7f47a410f860) at /home/dan/repos/mariadb-server-10.7/sql/sql_select.cc:4529
No locals.
#40 mysql_select (thd=thd@entry=0x7f47a4000c58, tables=<optimized out>, fields=<optimized out>, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x7f47a4016fa8, unit=0x7f47a4004ea0, select_lex=0x7f47a40130f8) at /home/dan/repos/mariadb-server-10.7/sql/sql_select.cc:5009
        free_join = <optimized out>
        err = <optimized out>
        join = 0x7f47a410f860
#41 0x00000000007662e0 in handle_select (thd=thd@entry=0x7f47a4000c58, lex=lex@entry=0x7f47a4004dc8, result=result@entry=0x7f47a4016fa8, setup_tables_done_option=setup_tables_done_option@entry=0) at /home/dan/repos/mariadb-server-10.7/sql/sql_select.cc:545
        unit = <optimized out>
        select_lex = 0x7f47a40130f8
        res = <optimized out>
#42 0x000000000073735a in execute_sqlcom_select (thd=thd@entry=0x7f47a4000c58, all_tables=0x0) at /home/dan/repos/mariadb-server-10.7/sql/sql_parse.cc:6268
        save_protocol = 0x0
        result = 0x7f47a4016fa8
        lex = 0x7f47a4004dc8
        res = <optimized out>
#43 0x0000000000731d59 in mysql_execute_command (thd=thd@entry=0x7f47a4000c58, is_called_from_prepared_stmt=<optimized out>) at /home/dan/repos/mariadb-server-10.7/sql/sql_parse.cc:3959
        privileges_requested = <optimized out>
        ots = {ctx = 0x7f47a4004a48, traceable = false}
        up_result = 0
        res = 0
        lex = <optimized out>
        select_lex = 0x7f47a40130f8
        have_table_map_for_update = <optimized out>
        unit = 0x7f47a4004ea0
        first_table = 0x0
        all_tables = 0x7f47a40f7278
        orig_binlog_format = <optimized out>
        orig_current_stmt_binlog_format = <optimized out>
        rpl_filter = <optimized out>
        error = <optimized out>
        wsrep_error_label = <optimized out>
#44 0x000000000072dd67 in mysql_parse (thd=thd@entry=0x7f47a4000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7f48202de5a0) at /home/dan/repos/mariadb-server-10.7/sql/sql_parse.cc:8043
        found_semicolon = <optimized out>
        error = <optimized out>
        lex = 0x7f47a4004dc8
        err = <optimized out>
#45 0x000000000072c286 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f47a4000c58, packet=packet@entry=0x7f47a4008599 "", packet_length=packet_length@entry=65, blocking=false) at /home/dan/repos/mariadb-server-10.7/sql/sql_parse.cc:1910
        parser_state = {m_lip = {lookahead_token = -1, lookahead_yylval = 0x0, m_thd = 0x7f47a4000c58, m_ptr = 0x7f47a4013052 "\n", m_tok_start = 0x7f47a4013052 "\n", m_tok_end = 0x7f47a4013052 "\n", m_end_of_query = 0x7f47a4013051 "", m_tok_start_prev = 0x7f47a4013051 "", m_buf = 0x7f47a4013010 "SELECT stageopenstatusattime(4000, @stage_test) \"LocalOpenStatus\"", m_buf_length = 65, m_echo = true, m_echo_saved = true, m_cpp_buf = 0x7f47a40130b0 "SELECT stageopenstatusattime(4000, @stage_test) \"LocalOpenStatus\"", m_cpp_ptr = 0x7f47a40130f1 "", m_cpp_tok_start = 0x7f47a40130f1 "", m_cpp_tok_start_prev = 0x7f47a40130f1 "", m_cpp_tok_end = 0x7f47a40130f1 "", m_body_utf8 = 0x0, m_body_utf8_ptr = 0x7f47a409ebee "", m_cpp_utf8_processed_ptr = 0x0, next_state = MY_LEX_END, found_semicolon = 0x0, ignore_space = false, stmt_prepare_mode = false, multi_statements = true, yylineno = 1, m_digest = 0x0, in_comment = NO_COMMENT, in_comment_saved = NO_COMMENT, m_cpp_text_start = 0x7f47a40130e1 "LocalOpenStatus\"", m_cpp_text_end = 0x7f47a40130f0 "\"", m_underscore_cs = 0x0}, m_yacc = {yacc_yyss = 0x0, yacc_yyvs = 0x0, m_set_signal_info = {m_item = {0x0 <repeats 13 times>}}, m_lock_type = TL_READ_DEFAULT, m_mdl_type = MDL_SHARED_READ}, m_digest_psi = 0x0}
        packet_end = <optimized out>
        drop_more_results = false
        do_end_of_statement = true
        error = false
        net = <optimized out>
#46 0x000000000072e1be in do_command (thd=0x7f47a4000c58, blocking=true) at /home/dan/repos/mariadb-server-10.7/sql/sql_parse.cc:1407
        net = <optimized out>
        packet = 0x7f47a4008598 "\002"
        command = COM_QUERY
        packet_length = 66
        return_value = <optimized out>
#47 0x00000000008379be in do_handle_one_connection (connect=<optimized out>, connect@entry=0x35663e8, put_in_cache=<optimized out>) at /home/dan/repos/mariadb-server-10.7/sql/sql_connect.cc:1418
        create_user = true
        thr_create_utime = <optimized out>
        thd = 0x0
#48 0x00000000008377dd in handle_one_connection (arg=arg@entry=0x35663e8) at /home/dan/repos/mariadb-server-10.7/sql/sql_connect.cc:1312
        connect = 0x35663e8
#49 0x0000000000b2af4e in pfs_spawn_thread (arg=0x34deac8) at /home/dan/repos/mariadb-server-10.7/storage/perfschema/pfs.cc:2201
        typed_arg = 0x34deac8
        klass = <optimized out>
        pfs = <optimized out>
        user_start_routine = 0x837760 <handle_one_connection(void*)>
        user_arg = 0x35663e8
#50 0x00007f48227a5b1a in start_thread () from /lib64/libc.so.6
No symbol table info available.
#51 0x00007f482282a650 in clone3 () from /lib64/libc.so.6

Comment by Roel Van de Paar [ 2022-06-26 ]

vk4ypb Thank you for logging this bug. I tried to replay the attached SQL including the crashing query, but some things are missing. Could you please make a single SQL trace which leads to the given crash? Even if it is very long, we have tools to reduce the same to a minimal testcase. Please also include all table defitions as well as user defintions and their GRANT statemetns like 'wicen'@'%'. Thank you

Comment by Peter Bennett [ 2022-07-01 ]

Hi Roel,

Just unzip the contents of the ZIP file to a new directory - say /tmp/test

Then as root in a clean install of mariadb , run mysql then :

source buildtest.sql

This fails for me every time.

Peter.

As below:

root@wicenNUC:/tmp/test# mysql
 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
 
Your MariaDB connection id is 33
 
Server version: 10.10.0-MariaDB-1:10.10.0+maria~jammy-log mariadb.org binary distribution
 
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
 
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 
MariaDB [(none)]> source buildtest.sql
 
Query OK, 0 rows affected (0.000 sec)
 
Query OK, 11 rows affected (0.121 sec)
 
Query OK, 1 row affected (0.002 sec)
 
Database changed
 
Query OK, 0 rows affected, 1 warning (0.002 sec)
 
Query OK, 0 rows affected (0.002 sec)
 
Query OK, 0 rows affected (0.025 sec)
 
Query OK, 0 rows affected, 1 warning (0.007 sec)
 
Query OK, 0 rows affected (0.018 sec)
 
Query OK, 0 rows affected, 1 warning (0.002 sec)
 
Query OK, 3 rows affected (0.004 sec)
 
Records: 3  Duplicates: 0  Warnings: 0
 
Query OK, 0 rows affected, 1 warning (0.010 sec)
 
Query OK, 0 rows affected (0.022 sec)
 
Query OK, 0 rows affected, 1 warning (0.007 sec)
 
Query OK, 0 rows affected (0.018 sec)
 
Query OK, 6 rows affected (0.003 sec)
 
Records: 6  Duplicates: 0  Warnings: 0
 
+-----------------------------+---------+----------+-----------------------------------------+
| Table                       | Op      | Msg_type | Msg_text                                |
+-----------------------------+---------+----------+-----------------------------------------+
| wicen_rfid.divisionstatuses | analyze | status   | Engine-independent statistics collected |
| wicen_rfid.divisionstatuses | analyze | status   | OK                                      |
+-----------------------------+---------+----------+-----------------------------------------+
2 rows in set (0.014 sec)
 
Query OK, 0 rows affected, 1 warning (0.013 sec)
 
Query OK, 0 rows affected (0.065 sec)
 
Query OK, 0 rows affected, 1 warning (0.006 sec)
 
Query OK, 0 rows affected (0.021 sec)
 
Query OK, 6 rows affected (0.004 sec)
 
Records: 6  Duplicates: 0  Warnings: 0
 
+--------------------------+---------+----------+-----------------------------------------+
| Table                    | Op      | Msg_type | Msg_text                                |
+--------------------------+---------+----------+-----------------------------------------+
| wicen_rfid.stagestatuses | analyze | status   | Engine-independent statistics collected |
| wicen_rfid.stagestatuses | analyze | status   | OK                                      |
+--------------------------+---------+----------+-----------------------------------------+
2 rows in set (0.020 sec)
 
Query OK, 0 rows affected, 1 warning (0.006 sec)
 
Query OK, 0 rows affected (0.027 sec)
 
Query OK, 0 rows affected, 1 warning (0.008 sec)
 
Query OK, 0 rows affected, 1 warning (0.020 sec)
 
Query OK, 0 rows affected (0.007 sec)
 
Query OK, 0 rows affected, 1 warning (0.006 sec)
 
Query OK, 0 rows affected (0.021 sec)
 
Query OK, 0 rows affected, 1 warning (0.006 sec)
 
Query OK, 0 rows affected (0.025 sec)
 
Query OK, 6 rows affected (0.005 sec)
 
Records: 6  Duplicates: 0  Warnings: 0
 
+-------------------------------+---------+----------+-----------------------------------------+
| Table                         | Op      | Msg_type | Msg_text                                |
+-------------------------------+---------+----------+-----------------------------------------+
| wicen_rfid.checkpointstatuses | analyze | status   | Engine-independent statistics collected |
| wicen_rfid.checkpointstatuses | analyze | status   | OK                                      |
+-------------------------------+---------+----------+-----------------------------------------+
2 rows in set (0.009 sec)
 
Query OK, 0 rows affected, 1 warning (0.006 sec)
 
Query OK, 0 rows affected (0.032 sec)
 
Query OK, 1 row affected (0.004 sec)
 
Query OK, 1 row affected (0.008 sec)
 
Query OK, 1 row affected (0.004 sec)
 
Query OK, 1 row affected (0.003 sec)
 
Query OK, 1 row affected (0.003 sec)
 
Query OK, 2 rows affected (0.004 sec)
 
Records: 2  Duplicates: 0  Warnings: 0
 
Query OK, 0 rows affected (0.000 sec)
 
+-----------------+
| LocalOpenStatus |
+-----------------+
| N               |
+-----------------+
1 row in set (0.003 sec)
 
ERROR 2013 (HY000) at line 66 in file: 'buildtest.sql': Lost connection to server during query
 
MariaDB [wicen_rfid]> 

Comment by Alice Sherepa [ 2022-07-01 ]

Thank you! I reproduced on 10.6-10.10, with InnoDB/Myisam, with ps/sp/function, with different window functions (e.g. SUM over () instead of LEAD over (ORDER BY i))

 
CREATE TABLE t1 ( a int, i int) ;
 
CREATE TABLE t2 ( a int);
INSERT INTO t2 VALUES (4000);
 
execute immediate  "SELECT lead(i) over (ORDER BY i) FROM t1 natural join t2;";

10.6 1ae8160710744d7e6322

220701 17:23:55 [ERROR] mysqld got signal 11 ;
 
Server version: 10.6.9-MariaDB-debug-log
 
sql/signal_handler.cc:236(handle_fatal_signal)[0x55964106d722]
sigaction.c:0(__restore_rt)[0x7fcae3b40420]
sql/item.cc:6122(Item_field::fix_fields(THD*, Item**))[0x5596410f8c3c]
sql/item.h:1144(Item::fix_fields_if_needed(THD*, Item**))[0x55964054e89f]
sql/item_func.cc:347(Item_func::fix_fields(THD*, Item**))[0x5596411c4930]
sql/item.h:1144(Item::fix_fields_if_needed(THD*, Item**))[0x55964054e89f]
sql/item.h:1148(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x55964054e8d9]
sql/item.h:1153(Item::fix_fields_if_needed_for_bool(THD*, Item**))[0x5596406875f5]
sql/sql_base.cc:8333(setup_on_expr(THD*, TABLE_LIST*, bool))[0x55964067dc14]
sql/sql_base.cc:8452(setup_conds(THD*, TABLE_LIST*, List<TABLE_LIST>&, Item**))[0x55964067e86c]
sql/sql_select.cc:842(setup_without_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<TABLE_LIST>&, List<Item>&, List<Item>&, Item**, st_order*, st_order*, List<Window_spec>&, List<Item_window_func>&, bool*, unsigned int*))[0x5596408b0488]
sql/sql_select.cc:1414(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x5596408b7b6c]
sql/sql_select.cc:4997(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5596408de01d]
sql/sql_select.cc:554(handle_select(THD*, LEX*, select_result*, unsigned long))[0x5596408ae5d1]
sql/sql_parse.cc:6255(execute_sqlcom_select(THD*, TABLE_LIST*))[0x559640812c82]
sql/sql_parse.cc:3945(mysql_execute_command(THD*, bool))[0x55964080187c]
sql/sql_prepare.cc:5205(Prepared_statement::execute(String*, bool))[0x55964087448e]
sql/sql_prepare.cc:4633(Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*))[0x55964086f6b2]
sql/sql_prepare.cc:5357(Prepared_statement::execute_immediate(char const*, unsigned int))[0x5596408756c2]
sql/sql_prepare.cc:3096(mysql_sql_stmt_execute_immediate(THD*))[0x5596408659d3]
sql/sql_parse.cc:3952(mysql_execute_command(THD*, bool))[0x559640801899]
sql/sql_parse.cc:8029(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55964081df28]
sql/sql_parse.cc:1898(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5596407f417c]
sql/sql_parse.cc:1409(do_command(THD*, bool))[0x5596407f0ef1]
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x559640c5b2b0]
sql/sql_connect.cc:1314(handle_one_connection)[0x559640c5ab3c]
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x5596418d2aaa]
nptl/pthread_create.c:478(start_thread)[0x7fcae3b34609]
??:0(clone)[0x7fcae3705133]
 
Query (0x62b0000c4d18): SELECT lead(i) over (ORDER BY i) FROM t1 natural join t2

Comment by Peter Bennett [ 2022-09-08 ]

Hi Guys,

This seems to have stalled, but this issue is preventing our project from using the versions as mentioned. Any news on determining the cause of this?

Comment by Roel Van de Paar [ 2022-09-13 ]

vk4ypb I gave the SQL trace another go based on your input. This is against a 100% clean MariaDB installation. Here is what I got/saw:

10.10.2 87e8463e0454a04c2bbaa38d44227c491fb07dc1 (Debug)

10.10.2-dbg>source buildtest.sql
ERROR 1064 (42000) at line 2 in file: 'buildtest.sql': You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'source wicen_rfid.sql' at line 1
ERROR 1064 (42000) at line 5 in file: 'buildtest.sql': You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'source eventtemplates.sql' at line 1
... etc.

Debugging this further, I found that for some reason it does not like the source ....sql; commands in buildtest.sql, but it is unclear why. With this I was able to flow the SQL into a usable (and thus reducable) SQL trace. Result in next comment.

Comment by Roel Van de Paar [ 2022-09-14 ]

Simplified testcase of original testcase:

CREATE TABLE t(c1 INT) ENGINE=InnoDB;
DELIMITER //
CREATE FUNCTION f() RETURNS INT READS SQL DATA BEGIN DECLARE v INT;SELECT 1 INTO v FROM (SELECT c1,COALESCE(LEAD(a2.c1) OVER (PARTITION BY a2.c1 ORDER BY a2.c1),a2.c1) AS a1 FROM (t a2 JOIN t a3 USING (c1))) a4; RETURN 1; END;//
DELIMITER ;
SELECT f(),f();

Leads to:

10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Optimized)

Core was generated by `/test/MD190822-mariadb-10.11.0-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00005611e5753a6e in Item_field::fix_fields (this=0x1492e8025a50, thd=
    0x1492e8000c58, reference=0x1492e8025e30)
    at /test/10.11_opt/sql/item.cc:6147
 
warning: Source file is more recent than executable.
6147	    if (!thd->lex->current_select->no_wrap_view_item &&
[Current thread is 1 (Thread 0x14931c604700 (LWP 2585678))]
(gdb) bt
#0  0x00005611e5753a6e in Item_field::fix_fields (this=0x1492e8025a50, thd=0x1492e8000c58, reference=0x1492e8025e30) at /test/10.11_opt/sql/item.cc:6147
#1  0x00005611e5796d7d in Item::fix_fields_if_needed (ref=0x1492e8025e30, thd=0x1492e8000c58, this=0x1492e8025a50) at /test/10.11_opt/sql/item.h:1142
#2  Item::fix_fields_if_needed (ref=0x1492e8025e30, thd=0x1492e8000c58, this=0x1492e8025a50) at /test/10.11_opt/sql/item.h:1142
#3  Item_func::fix_fields (ref=<optimized out>, thd=0x1492e8000c58, this=0x1492e8025db8) at /test/10.11_opt/sql/item_func.cc:347
#4  Item_func::fix_fields (this=0x1492e8025db8, thd=0x1492e8000c58, ref=<optimized out>) at /test/10.11_opt/sql/item_func.cc:314
#5  0x00005611e547fe1f in Item::fix_fields_if_needed (ref=0x1492e8074128, thd=0x1492e8000c58, this=0x1492e8025db8) at /test/10.11_opt/sql/item.h:1142
#6  Item::fix_fields_if_needed (ref=0x1492e8074128, thd=0x1492e8000c58, this=0x1492e8025db8) at /test/10.11_opt/sql/item.h:1142
#7  Item::fix_fields_if_needed_for_scalar (ref=0x1492e8074128, thd=0x1492e8000c58, this=0x1492e8025db8) at /test/10.11_opt/sql/item.h:1148
#8  Item::fix_fields_if_needed_for_bool (ref=0x1492e8074128, thd=0x1492e8000c58, this=0x1492e8025db8) at /test/10.11_opt/sql/item.h:1152
#9  setup_conds (thd=thd@entry=0x1492e8000c58, tables=tables@entry=0x1492e8022710, leaves=@0x1492e8022458: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1492e8074290, last = 0x1492e80742a0, elements = 2}, <No data fields>}, conds=conds@entry=0x1492e8074128) at /test/10.11_opt/sql/sql_base.cc:8801
#10 0x00005611e554c1aa in setup_without_group (reserved=0x1492e80225fc, hidden_group_fields=0x1492e8073fef, win_funcs=@0x1492e8022690: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1492e8021fc8, last = 0x1492e8021fc8, elements = 1}, <No data fields>}, win_specs=@0x1492e8022678: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1492e8026040, last = 0x1492e8026040, elements = 1}, <No data fields>}, group=0x0, order=0x0, conds=0x1492e8074128, all_fields=@0x1492e8074040: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1492e80746c0, last = 0x1492e80226b0, elements = 5}, <No data fields>}, fields=@0x1492e80224e0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1492e801dfd0, last = 0x1492e80226b0, elements = 2}, <No data fields>}, leaves=@0x1492e8022458: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1492e8074290, last = 0x1492e80742a0, elements = 2}, <No data fields>}, tables=0x1492e8022710, ref_pointer_array=<optimized out>, thd=0x1492e8000c58) at /test/10.11_opt/sql/sql_select.cc:884
#11 JOIN::prepare (this=this@entry=0x1492e8073cb0, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=<optimized out>, having_init=<optimized out>, proc_param_init=<optimized out>, select_lex_arg=<optimized out>, unit_arg=<optimized out>) at /test/10.11_opt/sql/sql_select.cc:1456
#12 0x00005611e55ad764 in st_select_lex_unit::prepare_join (this=0x1492e8024260, thd_arg=0x1492e8000c58, sl=0x1492e8022240, tmp_result=0x1492e8073bc8, additional_options=<optimized out>, is_union_select=<optimized out>) at /test/10.11_opt/sql/sql_union.cc:1112
#13 0x00005611e55b076c in st_select_lex_unit::prepare (this=this@entry=0x1492e8024260, derived_arg=derived_arg@entry=0x1492e8024a60, sel_result=sel_result@entry=0x1492e8073bc8, additional_options=additional_options@entry=0) at /test/10.11_opt/sql/sql_union.cc:1505
#14 0x00005611e54a2c3c in mysql_derived_prepare (thd=0x1492e8000c58, lex=<optimized out>, derived=0x1492e8024a60) at /test/10.11_opt/sql/sql_derived.cc:855
#15 0x00005611e54a1630 in mysql_handle_single_derived (lex=lex@entry=0x1492e8020220, derived=derived@entry=0x1492e8024a60, phases=phases@entry=2) at /test/10.11_opt/sql/sql_derived.cc:200
#16 0x00005611e55d684e in TABLE_LIST::handle_derived (this=this@entry=0x1492e8024a60, lex=lex@entry=0x1492e8020220, phases=phases@entry=2) at /test/10.11_opt/sql/table.cc:9434
#17 0x00005611e54bdf77 in LEX::handle_list_of_derived (phases=2, table_list=<optimized out>, this=0x1492e8020220) at /test/10.11_opt/sql/table.h:2814
#18 st_select_lex::handle_derived (this=<optimized out>, lex=0x1492e8020220, phases=phases@entry=2) at /test/10.11_opt/sql/sql_lex.cc:4988
#19 0x00005611e554bca1 in JOIN::prepare (this=0x1492e80735e8, tables_init=<optimized out>, conds_init=<optimized out>, og_num=0, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x1492e801d8f0, unit_arg=0x1492e80202f8) at /test/10.11_opt/sql/sql_select.cc:1354
#20 0x00005611e555e60f in mysql_select (thd=0x1492e8000c58, tables=0x1492e8024a60, fields=@0x1492e801db90: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1492e801dde8, last = 0x1492e801dde8, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x1492e801ddf8, unit=0x1492e80202f8, select_lex=0x1492e801d8f0) at /test/10.11_opt/sql/sql_select.cc:5045
#21 0x00005611e555e8b7 in handle_select (thd=thd@entry=0x1492e8000c58, lex=lex@entry=0x1492e8020220, result=result@entry=0x1492e801ddf8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_opt/sql/sql_select.cc:581
#22 0x00005611e54e05b1 in execute_sqlcom_select (thd=0x1492e8000c58, all_tables=0x1492e8024a60) at /test/10.11_opt/sql/sql_parse.cc:6261
#23 0x00005611e54ee1f8 in mysql_execute_command (thd=0x1492e8000c58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_opt/sql/sql_parse.cc:3945
#24 0x00005611e5435afb in sp_instr_stmt::exec_core (this=0x1492e8023d98, thd=<optimized out>, nextp=0x14931c6019a4) at /test/10.11_opt/sql/sp_head.cc:3856
#25 0x00005611e543ead6 in sp_lex_keeper::reset_lex_and_exec_core (this=0x1492e8023de0, thd=0x1492e8000c58, nextp=<optimized out>, open_tables=<optimized out>, instr=0x1492e8023d98) at /test/10.11_opt/sql/sp_head.cc:3581
#26 0x00005611e543f447 in sp_instr_stmt::execute (this=0x1492e8023d98, thd=0x1492e8000c58, nextp=0x14931c6019a4) at /test/10.11_opt/sql/sp_head.cc:3762
#27 0x00005611e5438fe6 in sp_head::execute (this=0x1492e801c1e0, thd=0x1492e8000c58, merge_da_on_success=true) at /test/10.11_opt/sql/sp_head.cc:1458
#28 0x00005611e543b39d in sp_head::execute_function (this=0x1492e801c1e0, thd=thd@entry=0x1492e8000c58, argp=argp@entry=0x0, argcount=argcount@entry=0, return_value_fld=<optimized out>, func_ctx=func_ctx@entry=0x1492e8011970, call_arena=<optimized out>) at /test/10.11_opt/sql/sp_head.cc:2190
#29 0x00005611e574b1b1 in Item_sp::execute_impl (this=0x1492e8011910, thd=0x1492e8000c58, args=0x0, arg_count=0) at /test/10.11_opt/sql/item.cc:2922
#30 0x00005611e574b343 in Item_sp::execute (this=this@entry=0x1492e8011910, thd=0x1492e8000c58, null_value=null_value@entry=0x1492e80118cc, args=<optimized out>, arg_count=<optimized out>) at /test/10.11_opt/sql/item.cc:2836
#31 0x00005611e57a4d27 in Item_func_sp::execute (this=this@entry=0x1492e8011868) at /test/10.11_opt/sql/item_func.cc:6631
#32 0x00005611e57b5d05 in Item_func_sp::val_int (this=0x1492e8011868) at /test/10.11_opt/sql/item_func.h:3880
#33 0x00005611e56890cd in Type_handler::Item_send_long (this=<optimized out>, item=0x1492e8011868, protocol=0x1492e80011d8, buf=<optimized out>) at /test/10.11_opt/sql/sql_type.cc:7487
#34 0x00005611e54199fe in Protocol::send_result_set_row (this=this@entry=0x1492e80011d8, row_items=row_items@entry=0x1492e8010a38) at /test/10.11_opt/sql/protocol.cc:1332
#35 0x00005611e5491547 in select_send::send_data (this=0x1492e8013d38, items=@0x1492e8010a38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1492e8011810, last = 0x1492e8012250, elements = 2}, <No data fields>}) at /test/10.11_opt/sql/sql_class.cc:3099
#36 0x00005611e555fb3f in select_result_sink::send_data_with_check (u=<optimized out>, sent=0, items=<optimized out>, this=<optimized out>) at /test/10.11_opt/sql/sql_class.h:5679
#37 select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/10.11_opt/sql/sql_class.h:5669
#38 JOIN::exec_inner (this=0x1492e8013d60) at /test/10.11_opt/sql/sql_select.cc:4678
#39 0x00005611e555ff68 in JOIN::exec (this=this@entry=0x1492e8013d60) at /test/10.11_opt/sql/sql_select.cc:4590
#40 0x00005611e555e171 in mysql_select (thd=0x1492e8000c58, tables=0x0, fields=@0x1492e8010a38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1492e8011810, last = 0x1492e8012250, elements = 2}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x1492e8013d38, unit=0x1492e8004cd0, select_lex=0x1492e8010798) at /test/10.11_opt/sql/sql_select.cc:5070
#41 0x00005611e555e8b7 in handle_select (thd=thd@entry=0x1492e8000c58, lex=lex@entry=0x1492e8004bf8, result=result@entry=0x1492e8013d38, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_opt/sql/sql_select.cc:581
#42 0x00005611e54e05b1 in execute_sqlcom_select (thd=0x1492e8000c58, all_tables=0x0) at /test/10.11_opt/sql/sql_parse.cc:6261
#43 0x00005611e54ee1f8 in mysql_execute_command (thd=0x1492e8000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:3945
#44 0x00005611e54db7b5 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x1492e8000c58) at /test/10.11_opt/sql/sql_parse.cc:8035
#45 mysql_parse (thd=0x1492e8000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7957
#46 0x00005611e54e72ca in dispatch_command (command=COM_QUERY, thd=0x1492e8000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_class.h:1339
#47 0x00005611e54e91f2 in do_command (thd=0x1492e8000c58, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407
#48 0x00005611e560146f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5611e7c91af8, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1418
#49 0x00005611e560174d in handle_one_connection (arg=0x5611e7c91af8) at /test/10.11_opt/sql/sql_connect.cc:1312
#50 0x000014933544a609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#51 0x0000149335036133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Debug)

Core was generated by `/test/MD190822-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000561fa3ebe6b7 in Item_field::fix_fields (this=0x14f34c030500, thd=
    0x14f34c000db8, reference=0x14f34c0308e0)
    at /test/10.11_dbg/sql/item.cc:6147
 
warning: Source file is more recent than executable.
6147	    if (!thd->lex->current_select->no_wrap_view_item &&
[Current thread is 1 (Thread 0x14f38ce0e700 (LWP 2585665))]
(gdb) bt
#0  0x0000561fa3ebe6b7 in Item_field::fix_fields (this=0x14f34c030500, thd=0x14f34c000db8, reference=0x14f34c0308e0) at /test/10.11_dbg/sql/item.cc:6147
#1  0x0000561fa3f126c2 in Item::fix_fields_if_needed (ref=0x14f34c0308e0, thd=0x14f34c000db8, this=<optimized out>) at /test/10.11_dbg/sql/item.h:1144
#2  Item_func::fix_fields (this=0x14f34c030868, thd=0x14f34c000db8, ref=<optimized out>) at /test/10.11_dbg/sql/item_func.cc:347
#3  0x0000561fa3b1e972 in Item::fix_fields_if_needed (ref=0x14f34c0a9118, thd=0x14f34c000db8, this=0x14f34c030868) at /test/10.11_dbg/sql/item.h:1152
#4  Item::fix_fields_if_needed_for_scalar (ref=0x14f34c0a9118, thd=0x14f34c000db8, this=0x14f34c030868) at /test/10.11_dbg/sql/item.h:1148
#5  Item::fix_fields_if_needed_for_bool (ref=0x14f34c0a9118, thd=0x14f34c000db8, this=0x14f34c030868) at /test/10.11_dbg/sql/item.h:1152
#6  setup_conds (thd=thd@entry=0x14f34c000db8, tables=tables@entry=0x14f34c02d150, leaves=@0x14f34c02ce98: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f34c0a9280, last = 0x14f34c0a9290, elements = 2}, <No data fields>}, conds=conds@entry=0x14f34c0a9118) at /test/10.11_dbg/sql/sql_base.cc:8801
#7  0x0000561fa3c15f0f in setup_without_group (reserved=0x14f34c02d03c, hidden_group_fields=0x14f34c0a8fdf, win_funcs=@0x14f34c02d0d0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f34c02c998, last = 0x14f34c02c998, elements = 1}, <No data fields>}, win_specs=@0x14f34c02d0b8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f34c030af0, last = 0x14f34c030af0, elements = 1}, <No data fields>}, group=0x0, order=0x0, conds=0x14f34c0a9118, all_fields=@0x14f34c0a9030: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f34c0a96b0, last = 0x14f34c02d0f0, elements = 5}, <No data fields>}, fields=@0x14f34c02cf20: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f34c026b60, last = 0x14f34c02d0f0, elements = 2}, <No data fields>}, leaves=@0x14f34c02ce98: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f34c0a9280, last = 0x14f34c0a9290, elements = 2}, <No data fields>}, tables=0x14f34c02d150, ref_pointer_array=<optimized out>, thd=0x14f34c000db8) at /test/10.11_dbg/sql/sql_select.cc:884
#8  JOIN::prepare (this=this@entry=0x14f34c0a8c98, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x14f34c02cc80, unit_arg=0x14f34c02ed10) at /test/10.11_dbg/sql/sql_select.cc:1456
#9  0x0000561fa3c9609d in st_select_lex_unit::prepare_join (this=this@entry=0x14f34c02ed10, thd_arg=0x14f34c000db8, sl=sl@entry=0x14f34c02cc80, tmp_result=tmp_result@entry=0x14f34c0a8bb0, additional_options=additional_options@entry=0, is_union_select=is_union_select@entry=false) at /test/10.11_dbg/sql/sql_union.cc:1112
#10 0x0000561fa3c99a45 in st_select_lex_unit::prepare (this=this@entry=0x14f34c02ed10, derived_arg=derived_arg@entry=0x14f34c02f510, sel_result=0x14f34c0a8bb0, additional_options=additional_options@entry=0) at /test/10.11_dbg/sql/sql_union.cc:1505
#11 0x0000561fa3b4e696 in mysql_derived_prepare (thd=0x14f34c000db8, lex=<optimized out>, derived=0x14f34c02f510) at /test/10.11_dbg/sql/sql_derived.cc:855
#12 0x0000561fa3b4cbf1 in mysql_handle_single_derived (lex=lex@entry=0x14f34c02abf0, derived=derived@entry=0x14f34c02f510, phases=phases@entry=2) at /test/10.11_dbg/sql/sql_derived.cc:200
#13 0x0000561fa3cc3b6c in TABLE_LIST::handle_derived (this=this@entry=0x14f34c02f510, lex=lex@entry=0x14f34c02abf0, phases=phases@entry=2) at /test/10.11_dbg/sql/table.cc:9434
#14 0x0000561fa3b6d2dd in LEX::handle_list_of_derived (phases=2, table_list=<optimized out>, this=0x14f34c02abf0) at /test/10.11_dbg/sql/table.h:2814
#15 st_select_lex::handle_derived (this=<optimized out>, lex=0x14f34c02abf0, phases=phases@entry=2) at /test/10.11_dbg/sql/sql_lex.cc:4988
#16 0x0000561fa3c15964 in JOIN::prepare (this=this@entry=0x14f34c0a85c8, tables_init=tables_init@entry=0x14f34c02f510, conds_init=conds_init@entry=0x0, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x14f34c026480, unit_arg=0x14f34c02acc8) at /test/10.11_dbg/sql/sql_select.cc:1354
#17 0x0000561fa3c2d184 in mysql_select (thd=thd@entry=0x14f34c000db8, tables=0x14f34c02f510, fields=@0x14f34c026720: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f34c026978, last = 0x14f34c026978, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x14f34c026988, unit=0x14f34c02acc8, select_lex=0x14f34c026480) at /test/10.11_dbg/sql/sql_select.cc:5045
#18 0x0000561fa3c2d3a2 in handle_select (thd=thd@entry=0x14f34c000db8, lex=lex@entry=0x14f34c02abf0, result=result@entry=0x14f34c026988, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_dbg/sql/sql_select.cc:581
#19 0x0000561fa3b975a6 in execute_sqlcom_select (thd=thd@entry=0x14f34c000db8, all_tables=0x14f34c02f510) at /test/10.11_dbg/sql/sql_parse.cc:6261
#20 0x0000561fa3ba38c7 in mysql_execute_command (thd=0x14f34c000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:3945
#21 0x0000561fa3acd03a in sp_instr_stmt::exec_core (this=0x14f34c02e7d8, thd=<optimized out>, nextp=0x14f38ce0b804) at /test/10.11_dbg/sql/sp_head.cc:3856
#22 0x0000561fa3adab74 in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x14f34c02e820, thd=thd@entry=0x14f34c000db8, nextp=nextp@entry=0x14f38ce0b804, open_tables=open_tables@entry=false, instr=instr@entry=0x14f34c02e7d8) at /test/10.11_dbg/sql/sp_head.cc:3581
#23 0x0000561fa3adb2ef in sp_instr_stmt::execute (this=0x14f34c02e7d8, thd=0x14f34c000db8, nextp=0x14f38ce0b804) at /test/10.11_dbg/sql/sp_head.cc:3762
#24 0x0000561fa3ad322a in sp_head::execute (this=this@entry=0x14f34c024d70, thd=thd@entry=0x14f34c000db8, merge_da_on_success=merge_da_on_success@entry=true) at /test/10.11_dbg/sql/sp_head.cc:1458
#25 0x0000561fa3ad661d in sp_head::execute_function (this=0x14f34c024d70, thd=thd@entry=0x14f34c000db8, argp=argp@entry=0x0, argcount=argcount@entry=0, return_value_fld=<optimized out>, func_ctx=func_ctx@entry=0x14f34c014f90, call_arena=0x14f34c015950) at /test/10.11_dbg/sql/sp_head.cc:2190
#26 0x0000561fa3eb417b in Item_sp::execute_impl (this=this@entry=0x14f34c014f30, thd=thd@entry=0x14f34c000db8, args=args@entry=0x0, arg_count=arg_count@entry=0) at /test/10.11_dbg/sql/item.cc:2922
#27 0x0000561fa3eb4375 in Item_sp::execute (this=this@entry=0x14f34c014f30, thd=0x14f34c000db8, null_value=null_value@entry=0x14f34c014eec, args=args@entry=0x0, arg_count=arg_count@entry=0) at /test/10.11_dbg/sql/item.cc:2836
#28 0x0000561fa3f2c00d in Item_func_sp::execute (this=this@entry=0x14f34c014e88) at /test/10.11_dbg/sql/item_func.cc:6631
#29 0x0000561fa3f40857 in Item_func_sp::val_int (this=0x14f34c014e88) at /test/10.11_dbg/sql/item_func.h:3880
#30 0x0000561fa3db4e51 in Type_handler::Item_send_long (this=<optimized out>, item=0x14f34c014e88, protocol=0x14f34c0013c0, buf=<optimized out>) at /test/10.11_dbg/sql/sql_type.cc:7487
#31 0x0000561fa3dbdd77 in Type_handler_long::Item_send (this=<optimized out>, item=<optimized out>, protocol=<optimized out>, buf=<optimized out>) at /test/10.11_dbg/sql/sql_type.h:5687
#32 0x0000561fa3a72d38 in Item::send (this=0x14f34c014e88, protocol=0x14f34c0013c0, buffer=0x14f38ce0c040) at /test/10.11_dbg/sql/item.h:1227
#33 0x0000561fa3aa9be9 in Protocol::send_result_set_row (this=this@entry=0x14f34c0013c0, row_items=row_items@entry=0x14f34c013f58) at /test/10.11_dbg/sql/protocol.cc:1332
#34 0x0000561fa3b37931 in select_send::send_data (this=0x14f34c017458, items=@0x14f34c013f58: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f34c014e30, last = 0x14f34c015970, elements = 2}, <No data fields>}) at /test/10.11_dbg/sql/sql_class.cc:3099
#35 0x0000561fa3c2ddc5 in select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/10.11_dbg/sql/sql_class.h:5679
#36 JOIN::exec_inner (this=this@entry=0x14f34c017480) at /test/10.11_dbg/sql/sql_select.cc:4678
#37 0x0000561fa3c2ee28 in JOIN::exec (this=this@entry=0x14f34c017480) at /test/10.11_dbg/sql/sql_select.cc:4590
#38 0x0000561fa3c2cbac in mysql_select (thd=thd@entry=0x14f34c000db8, tables=0x0, fields=@0x14f34c013f58: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f34c014e30, last = 0x14f34c015970, elements = 2}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x14f34c017458, unit=0x14f34c004ff0, select_lex=0x14f34c013cb8) at /test/10.11_dbg/sql/sql_select.cc:5070
#39 0x0000561fa3c2d3a2 in handle_select (thd=thd@entry=0x14f34c000db8, lex=lex@entry=0x14f34c004f18, result=result@entry=0x14f34c017458, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_dbg/sql/sql_select.cc:581
#40 0x0000561fa3b975a6 in execute_sqlcom_select (thd=thd@entry=0x14f34c000db8, all_tables=0x0) at /test/10.11_dbg/sql/sql_parse.cc:6261
#41 0x0000561fa3ba38c7 in mysql_execute_command (thd=thd@entry=0x14f34c000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:3945
#42 0x0000561fa3b91882 in mysql_parse (thd=thd@entry=0x14f34c000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14f38ce0d330) at /test/10.11_dbg/sql/sql_parse.cc:8035
#43 0x0000561fa3b9ee6a in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14f34c000db8, packet=packet@entry=0x14f34c00b6e9 "", packet_length=packet_length@entry=14, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1339
#44 0x0000561fa3ba1574 in do_command (thd=0x14f34c000db8, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
#45 0x0000561fa3d031da in do_handle_one_connection (connect=<optimized out>, connect@entry=0x561fa7de3328, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1418
#46 0x0000561fa3d036e3 in handle_one_connection (arg=0x561fa7de3328) at /test/10.11_dbg/sql/sql_connect.cc:1312
#47 0x000014f3a5e81609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#48 0x000014f3a5a6d133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.6.10 (dbg), 10.6.10 (opt), 10.7.6 (dbg), 10.7.6 (opt), 10.8.5 (opt), 10.9.2 (dbg), 10.9.2 (opt), 10.10.2 (dbg), 10.10.2 (opt), 10.11.0 (dbg), 10.11.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.37 (dbg), 10.3.37 (opt), 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.8.5 (dbg)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

Comment by Roel Van de Paar [ 2022-09-14 ]

Testcase by Alice simplified a bit further

CREATE TABLE t (c INT);
EXECUTE IMMEDIATE "SELECT LEAD(c) OVER (ORDER BY c) FROM t NATURAL JOIN t AS a;";

Or

EXECUTE IMMEDIATE "SELECT LEAD(c) OVER (ORDER BY c) FROM (SELECT 1 AS c) AS a NATURAL JOIN (SELECT 1 AS c) AS b;";

When removing only the NATURAL idiom, we get:

10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Debug)

ERROR 1052 (23000): Column 'c' in field list is ambiguous

For both testcases (without crash), and the following works seemingly normally:

EXECUTE IMMEDIATE "SELECT LEAD(a.c) OVER (ORDER BY a.c) FROM (SELECT 1 AS c) AS a JOIN (SELECT 1 AS c) AS b;";

With as output:

10.11.0 bc563f1a4b0b38de3b41fd0f0d3d8b7f1aacbd8b (Debug)

+-------------------------------+
| LEAD(a.c) OVER (ORDER BY a.c) |
+-------------------------------+
|                          NULL |
+-------------------------------+
1 row in set (0.003 sec)

Comment by Roel Van de Paar [ 2022-09-14 ]

UniqueID's seen thus far (opt+dbg, one each):

SIGSEGV|Item_field::fix_fields|Item::fix_fields_if_needed|Item::fix_fields_if_needed|Item_func::fix_fields
SIGSEGV|Item_field::fix_fields|Item::fix_fields_if_needed|Item_func::fix_fields|Item::fix_fields_if_needed

As per stacks above. Both testcases, though different in format, lead to the same stacks.

Comment by Peter Bennett [ 2022-09-15 ]

Thanks guys for taking a further look at my issue. Hopefully now that you can reproduce at will a fix shall present itself.

Comment by Roel Van de Paar [ 2022-10-07 ]

Also see MDEV-29731 which, though the testcase does not look related, produces in some cases a similar stack.

Comment by Peter Bennett [ 2022-11-27 ]

Hi Guys, Just checking to see if any further progress has been made on this issue?
Thanks.
Peter.

Comment by Nick Narsing [ 2022-11-28 ]

I'm also experiencing the same issue with ROW_NUMBER() OVER(ORDER BY SUM(...) DESC, MAX(...)) in 10.6 and 10.8, and it's known not to occur in 10.4. Maybe this affects all window functions?

I dumped a backtrace with gdb and saw the exact same failure with Item_field::fix_fields in sql/item.cc at line 6115 (for 10.6-devel, "if (!thd->lex->current_select->no_wrap_view_item &&")

Like with Peter, this is also preventing my project from moving to 10.6 and beyond.

Comment by Daniel Black [ 2022-11-29 ]

10.6-fdc582fd983206ef9da531cc3e617fbf4db324d6

Thread 19 "mysqld" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f8c4451d640 (LWP 152304)]
0x0000000000d31d3c in Item_field::fix_fields (this=0x7f8ba003eab0, thd=0x7f8ba0000dc8, reference=0x7f8ba003eec8) at /home/dan/repos/mariadb-server-10.6/sql/item.cc:6117
6117	        thd->lex == select->parent_lex &&
(gdb) bt
#0  0x0000000000d31d3c in Item_field::fix_fields (this=0x7f8ba003eab0, thd=0x7f8ba0000dc8, reference=0x7f8ba003eec8) at /home/dan/repos/mariadb-server-10.6/sql/item.cc:6117
...>
 
(gdb) info locals
table_list = 0x7f8ba003cc18
from_field = 0x7f8ba0037af8
outer_fixed = false
select = 0x0
(gdb) list
6112	        goto mark_non_agg_field;
6113	    }
6114	
6115	    if (!thd->lex->current_select->no_wrap_view_item &&
6116	        thd->lex->in_sum_func &&
6117	        thd->lex == select->parent_lex &&
6118	        thd->lex->in_sum_func->nest_level == 
6119	        select->nest_level)
6120	      set_if_bigger(thd->lex->in_sum_func->max_arg_level,
6121	                    select->nest_level);
 
(gdb) p *context
$3 = {<Sql_alloc> = {<No data fields>}, outer_context = 0x0, table_list = 0x0, first_name_resolution_table = 0x7f8ba003cc18, last_name_resolution_table = 0x7f8ba003cc18, natural_join_first_table = 0x0, select_lex = 0x0, error_processor = 0xd41f40 <dummy_error_processor(THD*, void*)>, error_processor_data = 0x0, resolve_in_select_list = false, ignored_tables = 0x0, security_ctx = 0x0}

select is context->select_lex.

Comment by Daniel Black [ 2022-11-29 ]

shulga, can you please review https://github.com/MariaDB/server/pull/2350.

Removing MDEV-29731 as related as despite stack similarities the values in the stack are quite different.

Comment by Peter Bennett [ 2022-11-29 ]

Thaks Daniel for taking a look at this and providing a fix. I have looked at the code change to item.cc and have manually applied this to my local 10.11 copy and tested my system and all good!!! Thanks heaps.

I presume that this now goes through some sort of QA process. What would be the normal timeframe for this to get through to the main code release?

Peter.

Comment by Daniel Black [ 2022-11-30 ]

Thanks for testing vk4ypb. I did test your original case attached here so I was pretty comfortable with it. Thanks for the nag.

I'm hoping shulga is available to review this within ~1 week otherwise find another reviewer. As you see its quite a simple fix.

The next scheduled release is 2023-04-27, however if there's an out of bound release (maybe MDEV-29988), I'll ask to have this included too.

Comment by Dmitry Shulga [ 2022-12-02 ]

The patch looks good for me

Generated at Thu Feb 08 09:58:54 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.