|
Two additional stacks with this testcase:
CREATE TABLE t (c CHAR(8) NOT NULL) ENGINE=InnoDB;
|
INSERT INTO t VALUES(1);
|
SELECT * FROM (SELECT * FROM t) AS a JOIN t WINDOW b AS (PARTITION BY t.c AND 1 BETWEEN (SELECT * FROM t GROUP BY t.c WINDOW d AS (PARTITION BY t.c)) AND 1);
|
Leads to:
|
10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Optimized)
|
Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 my_hash_sort_simple (cs=0x55f3c8be6d60 <my_charset_latin1>,
|
key=0x14ff940541d1 <error: Cannot access memory at address 0x14ff940541d1>, len=<optimized out>, nr1=0x14ff2009e170, nr2=0x14ff2009e178)
|
at /test/10.11_opt/strings/ctype-simple.c:391
|
[Current thread is 1 (Thread 0x14ff200a0700 (LWP 1742694))]
|
(gdb) bt
|
#0 my_hash_sort_simple (cs=0x55f3c8be6d60 <my_charset_latin1>, key=0x14ff940541d1 <error: Cannot access memory at address 0x14ff940541d1>, len=<optimized out>, nr1=0x14ff2009e170, nr2=0x14ff2009e178) at /test/10.11_opt/strings/ctype-simple.c:391
|
#1 0x000055f3c7fc5200 in my_ci_hash_sort (nr2=0x14ff2009e178, nr1=0x14ff2009e170, len=<optimized out>, key=0x14ff940541d1 <error: Cannot access memory at address 0x14ff940541d1>, ci=0x55f3c8be6d60 <my_charset_latin1>) at /test/10.11_opt/include/m_ctype.h:1317
|
#2 hp_rec_hashnr (keydef=keydef@entry=0x14fe9405ad78, rec=rec@entry=0x14fe9405a150 "\375\001") at /test/10.11_opt/storage/heap/hp_hash.c:319
|
#3 0x000055f3c7fc8466 in hp_write_key (info=<optimized out>, keyinfo=0x14fe9405ad78, record=0x14fe9405a150 "\375\001", recpos=0x14fe9405bea8 "\200\276\005\224\376\024") at /test/10.11_opt/storage/heap/hp_write.c:349
|
#4 0x000055f3c7fc7f94 in heap_write (info=0x14fe9405b198, record=0x14fe9405a150 "\375\001") at /test/10.11_opt/storage/heap/hp_write.c:52
|
#5 0x000055f3c7fc3330 in ha_heap::write_row (this=0x14fe94059c00, buf=<optimized out>) at /test/10.11_opt/storage/heap/ha_heap.cc:239
|
#6 0x000055f3c7b76ba8 in handler::ha_write_tmp_row (buf=0x14fe9405a150 "\375\001", this=0x14fe94059c00) at /test/10.11_opt/include/mysql/psi/mysql_thread.h:795
|
#7 end_write (join=0x14fe94047518, join_tab=0x14fe940551d0, end_of_records=<optimized out>) at /test/10.11_opt/sql/sql_select.cc:23258
|
#8 0x000055f3c7c5cfb9 in JOIN_CACHE::generate_full_extensions (rec_ptr=0x14fe9405a558 "\001", this=0x14fe94053240) at /test/10.11_opt/sql/sql_join_cache.cc:2478
|
#9 JOIN_CACHE::generate_full_extensions (this=0x14fe94053240, rec_ptr=0x14fe9405a558 "\001") at /test/10.11_opt/sql/sql_join_cache.cc:2461
|
#10 0x000055f3c7c5d3be in JOIN_CACHE::join_matching_records (this=0x14fe94053240, skip_last=false) at /test/10.11_opt/sql/sql_join_cache.cc:2370
|
#11 0x000055f3c7c5cc01 in JOIN_CACHE::join_records (this=this@entry=0x14fe94053240, skip_last=skip_last@entry=false) at /test/10.11_opt/sql/sql_join_cache.cc:2151
|
#12 0x000055f3c7b5dfaa in sub_select_cache (join=0x14fe94047518, join_tab=0x14fe94054e18, end_of_records=<optimized out>) at /test/10.11_opt/sql/sql_select.cc:21538
|
#13 0x000055f3c7b8c59f in do_select (procedure=<optimized out>, join=0x14fe94047518) at /test/10.11_opt/sql/sql_select.cc:21311
|
#14 JOIN::exec_inner (this=0x14fe94047518) at /test/10.11_opt/sql/sql_select.cc:4813
|
#15 0x000055f3c7b8cb08 in JOIN::exec (this=this@entry=0x14fe94047518) at /test/10.11_opt/sql/sql_select.cc:4591
|
#16 0x000055f3c7b8ad11 in mysql_select (thd=0x14fe94000c58, tables=0x14fe94012490, fields=@0x14fe94010c68: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14fe94010f58, last = 0x14fe940486c0, elements = 2}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x14fe94014328, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14fe940474f0, unit=0x14fe94004cd0, select_lex=0x14fe940109c8) at /test/10.11_opt/sql/sql_select.cc:5071
|
#17 0x000055f3c7b8b457 in handle_select (thd=thd@entry=0x14fe94000c58, lex=lex@entry=0x14fe94004bf8, result=result@entry=0x14fe940474f0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_opt/sql/sql_select.cc:582
|
#18 0x000055f3c7b0d051 in execute_sqlcom_select (thd=0x14fe94000c58, all_tables=0x14fe94012490) at /test/10.11_opt/sql/sql_parse.cc:6261
|
#19 0x000055f3c7b1ad48 in mysql_execute_command (thd=0x14fe94000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:3945
|
#20 0x000055f3c7b08205 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x14fe94000c58) at /test/10.11_opt/sql/sql_parse.cc:8037
|
#21 mysql_parse (thd=0x14fe94000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7959
|
#22 0x000055f3c7b13d6a in dispatch_command (command=COM_QUERY, thd=0x14fe94000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_class.h:1345
|
#23 0x000055f3c7b15cb2 in do_command (thd=0x14fe94000c58, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407
|
#24 0x000055f3c7c2f17f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55f3caed3528, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1416
|
#25 0x000055f3c7c2f45d in handle_one_connection (arg=0x55f3caed3528) at /test/10.11_opt/sql/sql_connect.cc:1318
|
#26 0x000014ff39aee609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#27 0x000014ff396da133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
|
10.4.27 3e3cfa893481abe9524a1657c4246fa9f91d4826 (Optimized)
|
Core was generated by `/test/MD190922-mariadb-10.4.27-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 my_hash_sort_simple (cs=0x55f0bbb11360 <my_charset_latin1>,
|
key=0x146548053e79 <error: Cannot access memory at address 0x146548053e79>, len=<optimized out>, nr1=0x146490fe0240, nr2=0x146490fe0248)
|
at /test/10.4_opt/strings/ctype-simple.c:392
|
[Current thread is 1 (Thread 0x146490fe3700 (LWP 1742948))]
|
(gdb) bt
|
#0 my_hash_sort_simple (cs=0x55f0bbb11360 <my_charset_latin1>, key=0x146548053e79 <error: Cannot access memory at address 0x146548053e79>, len=<optimized out>, nr1=0x146490fe0240, nr2=0x146490fe0248) at /test/10.4_opt/strings/ctype-simple.c:392
|
#1 0x000055f0bafcc950 in hp_rec_hashnr (keydef=keydef@entry=0x14644805b278, rec=rec@entry=0x14644805a670 "\375\001") at /test/10.4_opt/storage/heap/hp_hash.c:309
|
#2 0x000055f0bafcfba6 in hp_write_key (info=<optimized out>, keyinfo=0x14644805b278, record=0x14644805a670 "\375\001", recpos=0x14644805c378 "0\b") at /test/10.4_opt/storage/heap/hp_write.c:349
|
#3 0x000055f0bafcf6e4 in heap_write (info=0x14644805b678, record=0x14644805a670 "\375\001") at /test/10.4_opt/storage/heap/hp_write.c:52
|
#4 0x000055f0bafcaad0 in ha_heap::write_row (this=0x14644805a180, buf=<optimized out>) at /test/10.4_opt/storage/heap/ha_heap.cc:235
|
#5 0x000055f0babb0a75 in handler::ha_write_tmp_row (buf=<optimized out>, this=0x14644805a180) at /test/10.4_opt/include/mysql/psi/mysql_thread.h:788
|
#6 end_write (join=0x14644804c1f0, join_tab=0x146448055e70, end_of_records=<optimized out>) at /test/10.4_opt/sql/sql_select.cc:22118
|
#7 0x000055f0bac7bf99 in JOIN_CACHE::generate_full_extensions (rec_ptr=0x14644805aa48 "\001", this=0x1464480569d0) at /test/10.4_opt/sql/sql_join_cache.cc:2472
|
#8 JOIN_CACHE::generate_full_extensions (this=0x1464480569d0, rec_ptr=0x14644805aa48 "\001") at /test/10.4_opt/sql/sql_join_cache.cc:2455
|
#9 0x000055f0bac7c326 in JOIN_CACHE::join_matching_records (this=0x1464480569d0, skip_last=false) at /test/10.4_opt/sql/sql_join_cache.cc:2364
|
#10 0x000055f0bac7bb60 in JOIN_CACHE::join_records (this=this@entry=0x1464480569d0, skip_last=skip_last@entry=false) at /test/10.4_opt/sql/sql_join_cache.cc:2147
|
#11 0x000055f0bab9975a in sub_select_cache (join=0x14644804c1f0, join_tab=0x146448055ac8, end_of_records=<optimized out>) at /test/10.4_opt/sql/sql_select.cc:20462
|
#12 0x000055f0babc61c8 in do_select (procedure=<optimized out>, join=0x14644804c1f0) at /test/10.4_opt/sql/sql_select.cc:20222
|
#13 JOIN::exec_inner (this=0x14644804c1f0) at /test/10.4_opt/sql/sql_select.cc:4565
|
#14 0x000055f0babc66b6 in JOIN::exec (this=this@entry=0x14644804c1f0) at /test/10.4_opt/sql/sql_select.cc:4347
|
#15 0x000055f0babc4746 in mysql_select (thd=0x146448000c48, tables=0x146448011ab8, wild_num=1, fields=@0x146448010140: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x146448010590, last = 0x146448015e38, elements = 2}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x146448013fc0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x146448015948, unit=0x146448004820, select_lex=0x14644800fff8) at /test/10.4_opt/sql/sql_select.cc:4786
|
#16 0x000055f0babc512a in handle_select (thd=thd@entry=0x146448000c48, lex=lex@entry=0x146448004760, result=result@entry=0x146448015948, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.4_opt/sql/sql_select.cc:436
|
#17 0x000055f0bab52641 in execute_sqlcom_select (thd=0x146448000c48, all_tables=0x146448011ab8) at /test/10.4_opt/sql/sql_parse.cc:6450
|
#18 0x000055f0bab608d3 in mysql_execute_command (thd=0x146448000c48) at /test/10.4_opt/sql/sql_parse.cc:3964
|
#19 0x000055f0bab62de2 in mysql_parse (thd=0x146448000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_parse.cc:7996
|
#20 0x000055f0bab6579a in dispatch_command (command=COM_QUERY, thd=0x146448000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_class.h:1207
|
#21 0x000055f0bab672ef in do_command (thd=0x146448000c48) at /test/10.4_opt/sql/sql_parse.cc:1378
|
#22 0x000055f0bac52cde in do_handle_one_connection (connect=0x55f0be65ef38) at /test/10.4_opt/sql/sql_connect.cc:1420
|
#23 0x000055f0bac52d6d in handle_one_connection (arg=<optimized out>) at /test/10.4_opt/sql/sql_connect.cc:1324
|
#24 0x00001464abf1c609 in start_thread (arg=<optimized out>) at pthread_create.c:477
|
#25 0x00001464abb08133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
Bug confirmed present in:
MariaDB: 10.3.37 (dbg), 10.3.37 (opt), 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.6.10 (dbg), 10.6.10 (opt), 10.7.6 (dbg), 10.7.6 (opt), 10.8.5 (dbg), 10.8.5 (opt), 10.9.3 (dbg), 10.9.3 (opt), 10.10.2 (dbg), 10.10.2 (opt), 10.11.0 (dbg), 10.11.0 (opt)
Bug (or feature/syntax) confirmed not present in:
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)
It also produces two assertions on other versions. All UniqueID's seen for this testcase:
SIGSEGV|my_hash_sort_simple|hp_rec_hashnr|hp_write_key|heap_write
|
SIGSEGV|my_hash_sort_simple|my_ci_hash_sort|hp_rec_hashnr|hp_write_key
|
field->table == table|SIGABRT|Create_tmp_table::finalize|create_tmp_table|JOIN::create_postjoin_aggr_table|JOIN::make_aggr_tables_info
|
field->table == table|SIGABRT|create_tmp_table|JOIN::create_postjoin_aggr_table|JOIN::make_aggr_tables_info|JOIN::optimize_stage2
|
|