[MDEV-29733] SIGSEGV in Item_equal::val_int (from Item_equal::val_int and Type_handler_int_result::Item_val_bool) and UBSAN: downcast of address X which does not point to an object of type 'Item_field' on SELECT Created: 2022-10-07  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 11.0, 11.1
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: regression-10.4


 Description    

CREATE TABLE t(c INT UNIQUE,c2 TEXT) ENGINE=InnoDB;
 
INSERT INTO t(c2) VALUES (1);
 
SELECT * FROM t GROUP BY c HAVING (SELECT c2 WHERE 0>c2 IS NULL=(1<c) OR c2='');

Leads to:

10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Optimized)

 
Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
[Current thread is 1 (Thread 0x14abf8097700 (LWP 4153582))]
 
(gdb) bt
 
#0  0x00005611eb67d1e1 in Item_equal::val_int (this=0x14ab8c049718) at /test/10.11_opt/sql/item_cmpfunc.cc:7196
 
#1  Item_equal::val_int (this=0x14ab8c049718) at /test/10.11_opt/sql/item_cmpfunc.cc:7179
 
#2  0x00005611eb58d164 in Type_handler_int_result::Item_val_bool (this=<optimized out>, item=<optimized out>) at /test/10.11_opt/sql/sql_type.cc:5091
 
#3  0x00005611eb67aa45 in Item_cond_or::val_int (this=0x14ab8c012b38) at /test/10.11_opt/sql/item_cmpfunc.cc:5448
 
#4  0x00005611eb476e58 in JOIN::exec_inner (this=0x14ab8c046bb8) at /test/10.11_opt/sql/sql_select.cc:4671
 
#5  0x00005611eb477b08 in JOIN::exec (this=0x14ab8c046bb8) at /test/10.11_opt/sql/sql_select.cc:4591
 
#6  0x00005611eb71bc06 in subselect_single_select_engine::exec (this=0x14ab8c0135c0) at /test/10.11_opt/sql/item_subselect.cc:4145
 
#7  0x00005611eb71b25c in Item_subselect::exec (this=0x14ab8c013438) at /test/10.11_opt/sql/item_subselect.cc:855
 
#8  0x00005611eb71ad44 in Item_singlerow_subselect::val_str (this=0x14ab8c013438, str=0x14ab8c049ba0) at /test/10.11_opt/sql/item_subselect.cc:1527
 
#9  0x00005611eb6581e5 in Item_cache_str::cache_value (this=0x14ab8c049ab0) at /test/10.11_opt/sql/item.cc:10476
 
#10 0x00005611eb66dd04 in Item_cache_wrapper::cache (this=0x14ab8c049a10) at /test/10.11_opt/sql/item.cc:8881
 
#11 Item_cache_wrapper::val_int (this=0x14ab8c049a10) at /test/10.11_opt/sql/item.cc:8935
 
#12 Item_cache_wrapper::val_int (this=0x14ab8c049a10) at /test/10.11_opt/sql/item.cc:8918
 
#13 0x00005611eb467f81 in end_send_group (join=0x14ab8c013ef0, join_tab=<optimized out>, end_of_records=<optimized out>) at /test/10.11_opt/sql/sql_select.cc:23150
 
#14 0x00005611eb47759f in do_select (procedure=<optimized out>, join=0x14ab8c013ef0) at /test/10.11_opt/sql/sql_select.cc:21311
 
#15 JOIN::exec_inner (this=0x14ab8c013ef0) at /test/10.11_opt/sql/sql_select.cc:4813
 
#16 0x00005611eb477b08 in JOIN::exec (this=this@entry=0x14ab8c013ef0) at /test/10.11_opt/sql/sql_select.cc:4591
 
#17 0x00005611eb475d11 in mysql_select (thd=0x14ab8c000c58, tables=0x14ab8c010f00, fields=@0x14ab8c010bc8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14ab8c010eb8, last = 0x14ab8c014740, elements = 2}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x14ab8c011720, having=0x14ab8c013438, proc_param=0x0, select_options=<optimized out>, result=0x14ab8c013ec8, unit=0x14ab8c004cd0, select_lex=0x14ab8c010928) at /test/10.11_opt/sql/sql_select.cc:5071
 
#18 0x00005611eb476457 in handle_select (thd=thd@entry=0x14ab8c000c58, lex=lex@entry=0x14ab8c004bf8, result=result@entry=0x14ab8c013ec8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_opt/sql/sql_select.cc:582
 
#19 0x00005611eb3f8051 in execute_sqlcom_select (thd=0x14ab8c000c58, all_tables=0x14ab8c010f00) at /test/10.11_opt/sql/sql_parse.cc:6261
 
#20 0x00005611eb405d48 in mysql_execute_command (thd=0x14ab8c000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:3945
 
#21 0x00005611eb3f3205 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x14ab8c000c58) at /test/10.11_opt/sql/sql_parse.cc:8037
 
#22 mysql_parse (thd=0x14ab8c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7959
 
#23 0x00005611eb3fed6a in dispatch_command (command=COM_QUERY, thd=0x14ab8c000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_class.h:1345
 
#24 0x00005611eb400cb2 in do_command (thd=0x14ab8c000c58, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407
 
#25 0x00005611eb51a17f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5611ee5104e8, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1416
 
#26 0x00005611eb51a45d in handle_one_connection (arg=0x5611ee5104e8) at /test/10.11_opt/sql/sql_connect.cc:1318
 
#27 0x000014ac0fb18609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#28 0x000014ac0f704133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.11.0 6ebdd3013a18b01dbecec76b870810329eb76586 (Debug)

 
Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
[Current thread is 1 (Thread 0x15488dad6700 (LWP 4152893))]
 
(gdb) bt
 
#0  0x0000564d95b3fbab in Item_equal::val_int (this=0x15482806ae10) at /test/10.11_dbg/sql/item_cmpfunc.cc:7196
 
#1  0x0000564d95a05eb0 in Type_handler_int_result::Item_val_bool (this=<optimized out>, item=<optimized out>) at /test/10.11_dbg/sql/sql_type.cc:5091
 
#2  0x0000564d956dde7a in Item::val_bool (this=0x15482806ae10) at /test/10.11_dbg/sql/item.h:1687
 
#3  0x0000564d95b4135f in Item_cond_or::val_int (this=0x154828015508) at /test/10.11_dbg/sql/item_cmpfunc.cc:5448
 
#4  0x0000564d9589a696 in JOIN::exec_inner (this=this@entry=0x154828068108) at /test/10.11_dbg/sql/sql_select.cc:4671
 
#5  0x0000564d9589b826 in JOIN::exec (this=0x154828068108) at /test/10.11_dbg/sql/sql_select.cc:4591
 
#6  0x0000564d95c07aec in subselect_single_select_engine::exec (this=0x154828015f90) at /test/10.11_dbg/sql/item_subselect.cc:4145
 
#7  0x0000564d95c0713a in Item_subselect::exec (this=0x154828015e08) at /test/10.11_dbg/sql/item_subselect.cc:855
 
#8  0x0000564d95c05864 in Item_singlerow_subselect::val_str (this=0x154828015e08, str=0x15482806b2a0) at /test/10.11_dbg/sql/item_subselect.cc:1527
 
#9  0x0000564d956ddf21 in Item::str_result (this=<optimized out>, tmp=<optimized out>) at /test/10.11_dbg/sql/item.h:1780
 
#10 0x0000564d95b16693 in Item_cache_str::cache_value (this=0x15482806b1b0) at /test/10.11_dbg/sql/item.cc:10476
 
#11 0x0000564d95b2ef26 in Item_cache_wrapper::cache (this=0x15482806b110) at /test/10.11_dbg/sql/item.cc:8881
 
#12 Item_cache_wrapper::val_int (this=0x15482806b110) at /test/10.11_dbg/sql/item.cc:8935
 
#13 0x0000564d95887b95 in end_send_group (join=0x1548280168c0, join_tab=<optimized out>, end_of_records=<optimized out>) at /test/10.11_dbg/sql/sql_select.cc:23150
 
#14 0x0000564d95864fa3 in sub_select (join=0x1548280168c0, join_tab=0x154828069e38, end_of_records=true) at /test/10.11_dbg/sql/sql_select.cc:21708
 
#15 0x0000564d9589b2c3 in do_select (procedure=<optimized out>, join=0x1548280168c0) at /test/10.11_dbg/sql/sql_select.cc:21311
 
#16 JOIN::exec_inner (this=this@entry=0x1548280168c0) at /test/10.11_dbg/sql/sql_select.cc:4813
 
#17 0x0000564d9589b826 in JOIN::exec (this=this@entry=0x1548280168c0) at /test/10.11_dbg/sql/sql_select.cc:4591
 
#18 0x0000564d958995aa in mysql_select (thd=thd@entry=0x154828000d48, tables=0x1548280138d0, fields=@0x154828013598: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x154828013888, last = 0x154828017118, elements = 2}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x1548280140f0, having=0x154828015e08, proc_param=0x0, select_options=2164525824, result=0x154828016898, unit=0x154828004f80, select_lex=0x1548280132f8) at /test/10.11_dbg/sql/sql_select.cc:5071
 
#19 0x0000564d95899da0 in handle_select (thd=thd@entry=0x154828000d48, lex=lex@entry=0x154828004ea8, result=result@entry=0x154828016898, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_dbg/sql/sql_select.cc:582
 
#20 0x0000564d95803d94 in execute_sqlcom_select (thd=thd@entry=0x154828000d48, all_tables=0x1548280138d0) at /test/10.11_dbg/sql/sql_parse.cc:6261
 
#21 0x0000564d95810109 in mysql_execute_command (thd=thd@entry=0x154828000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:3945
 
#22 0x0000564d957fe03c in mysql_parse (thd=thd@entry=0x154828000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x15488dad5330) at /test/10.11_dbg/sql/sql_parse.cc:8037
 
#23 0x0000564d9580b66d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154828000d48, packet=packet@entry=0x15482800aed9 "", packet_length=packet_length@entry=79, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345
 
#24 0x0000564d9580dd97 in do_command (thd=0x154828000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
 
#25 0x0000564d95971fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x564d98fbaf98, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
 
#26 0x0000564d959724c3 in handle_one_connection (arg=0x564d98fbaf98) at /test/10.11_dbg/sql/sql_connect.cc:1318
 
#27 0x00001548ab74e609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#28 0x00001548ab33a133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.6.10 (dbg), 10.6.10 (opt), 10.7.6 (dbg), 10.7.6 (opt), 10.8.5 (dbg), 10.8.5 (opt), 10.9.3 (dbg), 10.9.3 (opt), 10.10.2 (dbg), 10.10.2 (opt), 10.11.0 (dbg), 10.11.0 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.37 (dbg), 10.3.37 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

 Comments   
Comment by Roel Van de Paar [ 2022-10-07 ]

UBSAN Reports the following for the testcase in the description:

10.11.0 fe1f8f2c6b6f3b8e3383168225f9ae7853028947 (Optimized, UBASAN)

 
/test/10.11_opt_san/sql/item_cmpfunc.h:3479:23: runtime error: downcast of address 0x629000099e28 which does not point to an object of type 'Item_field'
 
0x629000099e28: note: object is of type 'Item_copy_string'
 
 00 00 00 00  78 9a ce 5c 2e 56 00 00  ff ff 00 00 27 00 00 00  20 b9 2d 64 2e 56 00 00  02 00 00 00
 
              ^~~~~~~~~~~~~~~~~~~~~~~
 
              vptr for 'Item_copy_string'
 
    #0 0x562e5949f244 in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field() /test/10.11_opt_san/sql/item_cmpfunc.h:3479
 
    #1 0x562e5949f244 in Item_equal::val_int() /test/10.11_opt_san/sql/item_cmpfunc.cc:7194
 
    #2 0x562e589c0128 in Type_handler_int_result::Item_val_bool(Item*) const /test/10.11_opt_san/sql/sql_type.cc:5091
 
    #3 0x562e593e3f2d in Item_cond_or::val_int() /test/10.11_opt_san/sql/item_cmpfunc.cc:5448
 
    #4 0x562e580ab945 in JOIN::exec_inner() /test/10.11_opt_san/sql/sql_select.cc:4672
 
    #5 0x562e580b20a9 in JOIN::exec() /test/10.11_opt_san/sql/sql_select.cc:4590
 
    #6 0x562e59b46e82 in subselect_single_select_engine::exec() /test/10.11_opt_san/sql/item_subselect.cc:4145
 
    #7 0x562e59b3c652 in Item_subselect::exec() /test/10.11_opt_san/sql/item_subselect.cc:855
 
    #8 0x562e59b33ec1 in Item_singlerow_subselect::val_str(String*) /test/10.11_opt_san/sql/item_subselect.cc:1527
 
    #9 0x562e5924622e in Item_cache_str::cache_value() /test/10.11_opt_san/sql/item.cc:10476
 
    #10 0x562e5938c087 in Item_cache_wrapper::cache() /test/10.11_opt_san/sql/item.cc:8881
 
    #11 0x562e592fa2fc in Item_cache_wrapper::val_int() /test/10.11_opt_san/sql/item.cc:8935
 
    #12 0x562e57fca232 in end_send_group(JOIN*, st_join_table*, bool) /test/10.11_opt_san/sql/sql_select.cc:23148
 
    #13 0x562e580acff6 in do_select /test/10.11_opt_san/sql/sql_select.cc:21310
 
    #14 0x562e580acff6 in JOIN::exec_inner() /test/10.11_opt_san/sql/sql_select.cc:4812
 
    #15 0x562e580b20a9 in JOIN::exec() /test/10.11_opt_san/sql/sql_select.cc:4590
 
    #16 0x562e580a04d1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_opt_san/sql/sql_select.cc:5070
 
    #17 0x562e580a4093 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_opt_san/sql/sql_select.cc:581
 
    #18 0x562e57cb1c2f in execute_sqlcom_select /test/10.11_opt_san/sql/sql_parse.cc:6261
 
    #19 0x562e57d0253b in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:3945
 
    #20 0x562e57c82500 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8035
 
    #21 0x562e57cd70ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
 
    #22 0x562e57ce23fd in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
 
    #23 0x562e585cb4cd in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1418
 
    #24 0x562e585cdb3c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1312
 
    #25 0x1497f8d8a608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #26 0x1497f7fff132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
/test/10.11_opt_san/sql/item_cmpfunc.h:3480:19: runtime error: member access within address 0x629000099e28 which does not point to an object of type 'Item_field'
 
0x629000099e28: note: object is of type 'Item_copy_string'
 
 00 00 00 00  78 9a ce 5c 2e 56 00 00  ff ff 00 00 27 00 00 00  20 b9 2d 64 2e 56 00 00  02 00 00 00
 
              ^~~~~~~~~~~~~~~~~~~~~~~
 
              vptr for 'Item_copy_string'
 
    #0 0x562e5949ec4d in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field() /test/10.11_opt_san/sql/item_cmpfunc.h:3480
 
    #1 0x562e5949ec4d in Item_equal::val_int() /test/10.11_opt_san/sql/item_cmpfunc.cc:7194
 
    #2 0x562e589c0128 in Type_handler_int_result::Item_val_bool(Item*) const /test/10.11_opt_san/sql/sql_type.cc:5091
 
    #3 0x562e593e3f2d in Item_cond_or::val_int() /test/10.11_opt_san/sql/item_cmpfunc.cc:5448
 
    #4 0x562e580ab945 in JOIN::exec_inner() /test/10.11_opt_san/sql/sql_select.cc:4672
 
    #5 0x562e580b20a9 in JOIN::exec() /test/10.11_opt_san/sql/sql_select.cc:4590
 
    #6 0x562e59b46e82 in subselect_single_select_engine::exec() /test/10.11_opt_san/sql/item_subselect.cc:4145
 
    #7 0x562e59b3c652 in Item_subselect::exec() /test/10.11_opt_san/sql/item_subselect.cc:855
 
    #8 0x562e59b33ec1 in Item_singlerow_subselect::val_str(String*) /test/10.11_opt_san/sql/item_subselect.cc:1527
 
    #9 0x562e5924622e in Item_cache_str::cache_value() /test/10.11_opt_san/sql/item.cc:10476
 
    #10 0x562e5938c087 in Item_cache_wrapper::cache() /test/10.11_opt_san/sql/item.cc:8881
 
    #11 0x562e592fa2fc in Item_cache_wrapper::val_int() /test/10.11_opt_san/sql/item.cc:8935
 
    #12 0x562e57fca232 in end_send_group(JOIN*, st_join_table*, bool) /test/10.11_opt_san/sql/sql_select.cc:23148
 
    #13 0x562e580acff6 in do_select /test/10.11_opt_san/sql/sql_select.cc:21310
 
    #14 0x562e580acff6 in JOIN::exec_inner() /test/10.11_opt_san/sql/sql_select.cc:4812
 
    #15 0x562e580b20a9 in JOIN::exec() /test/10.11_opt_san/sql/sql_select.cc:4590
 
    #16 0x562e580a04d1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_opt_san/sql/sql_select.cc:5070
 
    #17 0x562e580a4093 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_opt_san/sql/sql_select.cc:581
 
    #18 0x562e57cb1c2f in execute_sqlcom_select /test/10.11_opt_san/sql/sql_parse.cc:6261
 
    #19 0x562e57d0253b in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:3945
 
    #20 0x562e57c82500 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8035
 
    #21 0x562e57cd70ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
 
    #22 0x562e57ce23fd in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
 
    #23 0x562e585cb4cd in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1418
 
    #24 0x562e585cdb3c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1312
 
    #25 0x1497f8d8a608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #26 0x1497f7fff132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

10.11.0 fe1f8f2c6b6f3b8e3383168225f9ae7853028947 (Debug, UBASAN)

 
/test/10.11_dbg_san/sql/item_cmpfunc.h:3479:23: runtime error: downcast of address 0x62900009f038 which does not point to an object of type 'Item_field'
 
0x62900009f038: note: object is of type 'Item_copy_string'
 
 00 00 00 00  f8 83 f9 45 04 56 00 00  ff ff 00 00 27 00 00 00  40 1f f6 4d 04 56 00 00  02 00 00 00
 
              ^~~~~~~~~~~~~~~~~~~~~~~
 
              vptr for 'Item_copy_string'
 
    #0 0x560442253435 in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field() /test/10.11_dbg_san/sql/item_cmpfunc.h:3479
 
    #1 0x560442253435 in Item_equal::val_int() /test/10.11_dbg_san/sql/item_cmpfunc.cc:7194
 
    #2 0x5604416a0cfe in Type_handler_int_result::Item_val_bool(Item*) const /test/10.11_dbg_san/sql/sql_type.cc:5091
 
    #3 0x56043fe3535d in Item::val_bool() /test/10.11_dbg_san/sql/item.h:1687
 
    #4 0x560442250f2c in Item_cond_or::val_int() /test/10.11_dbg_san/sql/item_cmpfunc.cc:5448
 
    #5 0x560440be67c1 in JOIN::exec_inner() /test/10.11_dbg_san/sql/sql_select.cc:4672
 
    #6 0x560440bee1c6 in JOIN::exec() /test/10.11_dbg_san/sql/sql_select.cc:4590
 
    #7 0x560442af203e in subselect_single_select_engine::exec() /test/10.11_dbg_san/sql/item_subselect.cc:4145
 
    #8 0x560442b025c9 in Item_subselect::exec() /test/10.11_dbg_san/sql/item_subselect.cc:855
 
    #9 0x560442adeb30 in Item_singlerow_subselect::val_str(String*) /test/10.11_dbg_san/sql/item_subselect.cc:1527
 
    #10 0x56043fe35bac in Item::str_result(String*) /test/10.11_dbg_san/sql/item.h:1780
 
    #11 0x56044207346c in Item_cache_str::cache_value() /test/10.11_dbg_san/sql/item.cc:10476
 
    #12 0x5604421f05ec in Item_cache_wrapper::cache() (/test/UBASAN_MD010922-mariadb-10.11.0-linux-x86_64-dbg/bin/mariadbd+0xa30f5ec)
 
    #13 0x56044214ad2e in Item_cache_wrapper::val_int() /test/10.11_dbg_san/sql/item.cc:8935
 
    #14 0x560440b1d86d in end_send_group(JOIN*, st_join_table*, bool) /test/10.11_dbg_san/sql/sql_select.cc:23148
 
    #15 0x560440a0e1ed in sub_select(JOIN*, st_join_table*, bool) /test/10.11_dbg_san/sql/sql_select.cc:21708
 
    #16 0x560440bec96c in do_select /test/10.11_dbg_san/sql/sql_select.cc:21310
 
    #17 0x560440bec96c in JOIN::exec_inner() /test/10.11_dbg_san/sql/sql_select.cc:4812
 
    #18 0x560440bee1c6 in JOIN::exec() /test/10.11_dbg_san/sql/sql_select.cc:4590
 
    #19 0x560440bdbbec in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_dbg_san/sql/sql_select.cc:5070
 
    #20 0x560440be03bd in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_dbg_san/sql/sql_select.cc:581
 
    #21 0x560440764b58 in execute_sqlcom_select /test/10.11_dbg_san/sql/sql_parse.cc:6261
 
    #22 0x5604407c5352 in mysql_execute_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:3945
 
    #23 0x560440732c88 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_dbg_san/sql/sql_parse.cc:8035
 
    #24 0x56044079f85f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1894
 
    #25 0x5604407b1a70 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1407
 
    #26 0x560441222b41 in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1418
 
    #27 0x56044122532c in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1312
 
    #28 0x149198235608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #29 0x1491974aa132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
/test/10.11_dbg_san/sql/item_cmpfunc.h:3480:19: runtime error: member access within address 0x62900009f038 which does not point to an object of type 'Item_field'
 
0x62900009f038: note: object is of type 'Item_copy_string'
 
 00 00 00 00  f8 83 f9 45 04 56 00 00  ff ff 00 00 27 00 00 00  40 1f f6 4d 04 56 00 00  02 00 00 00
 
              ^~~~~~~~~~~~~~~~~~~~~~~
 
              vptr for 'Item_copy_string'
 
    #0 0x560442253464 in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field() /test/10.11_dbg_san/sql/item_cmpfunc.h:3480
 
    #1 0x560442253464 in Item_equal::val_int() /test/10.11_dbg_san/sql/item_cmpfunc.cc:7194
 
    #2 0x5604416a0cfe in Type_handler_int_result::Item_val_bool(Item*) const /test/10.11_dbg_san/sql/sql_type.cc:5091
 
    #3 0x56043fe3535d in Item::val_bool() /test/10.11_dbg_san/sql/item.h:1687
 
    #4 0x560442250f2c in Item_cond_or::val_int() /test/10.11_dbg_san/sql/item_cmpfunc.cc:5448
 
    #5 0x560440be67c1 in JOIN::exec_inner() /test/10.11_dbg_san/sql/sql_select.cc:4672
 
    #6 0x560440bee1c6 in JOIN::exec() /test/10.11_dbg_san/sql/sql_select.cc:4590
 
    #7 0x560442af203e in subselect_single_select_engine::exec() /test/10.11_dbg_san/sql/item_subselect.cc:4145
 
    #8 0x560442b025c9 in Item_subselect::exec() /test/10.11_dbg_san/sql/item_subselect.cc:855
 
    #9 0x560442adeb30 in Item_singlerow_subselect::val_str(String*) /test/10.11_dbg_san/sql/item_subselect.cc:1527
 
    #10 0x56043fe35bac in Item::str_result(String*) /test/10.11_dbg_san/sql/item.h:1780
 
    #11 0x56044207346c in Item_cache_str::cache_value() /test/10.11_dbg_san/sql/item.cc:10476
 
    #12 0x5604421f05ec in Item_cache_wrapper::cache() (/test/UBASAN_MD010922-mariadb-10.11.0-linux-x86_64-dbg/bin/mariadbd+0xa30f5ec)
 
    #13 0x56044214ad2e in Item_cache_wrapper::val_int() /test/10.11_dbg_san/sql/item.cc:8935
 
    #14 0x560440b1d86d in end_send_group(JOIN*, st_join_table*, bool) /test/10.11_dbg_san/sql/sql_select.cc:23148
 
    #15 0x560440a0e1ed in sub_select(JOIN*, st_join_table*, bool) /test/10.11_dbg_san/sql/sql_select.cc:21708
 
    #16 0x560440bec96c in do_select /test/10.11_dbg_san/sql/sql_select.cc:21310
 
    #17 0x560440bec96c in JOIN::exec_inner() /test/10.11_dbg_san/sql/sql_select.cc:4812
 
    #18 0x560440bee1c6 in JOIN::exec() /test/10.11_dbg_san/sql/sql_select.cc:4590
 
    #19 0x560440bdbbec in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_dbg_san/sql/sql_select.cc:5070
 
    #20 0x560440be03bd in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_dbg_san/sql/sql_select.cc:581
 
    #21 0x560440764b58 in execute_sqlcom_select /test/10.11_dbg_san/sql/sql_parse.cc:6261
 
    #22 0x5604407c5352 in mysql_execute_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:3945
 
    #23 0x560440732c88 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_dbg_san/sql/sql_parse.cc:8035
 
    #24 0x56044079f85f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1894
 
    #25 0x5604407b1a70 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1407
 
    #26 0x560441222b41 in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1418
 
    #27 0x56044122532c in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1312
 
    #28 0x149198235608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #29 0x1491974aa132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

Setup:

Compiled with GCC >=7.5.0 (I use GCC 9.4.0) and:
 
    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
 
Set before execution:
 
    export UBSAN_OPTIONS=print_stacktrace=1

Comment by Roel Van de Paar [ 2022-10-07 ]

psergei Is this another bug in name resolution? Thanks

Comment by Roel Van de Paar [ 2023-06-26 ]

Two additional stacks can be seen with this testcase

CREATE TABLE t (c BLOB) ENGINE=InnoDB;
 
INSERT INTO t VALUES (0),((SELECT * FROM t AS v2 GROUP BY (0+1) HAVING ((SELECT 1 GROUP BY c HAVING (c=''))='')));

Additional UniqueID's/stacks observed with this testcase:

SIGSEGV|Item_equal::val_int|Item_equal::val_int|JOIN::exec_inner|JOIN::exec
 
SIGSEGV|Item_equal::val_int|JOIN::exec_inner|JOIN::exec|subselect_single_select_engine::exec
 
UBSAN|downcast of address X which does not point to an object of type 'Item_field'|sql/item_cmpfunc.h|Item_equal_iterator<List_iterator_fast,|Item_equal::val_int|JOIN::exec_inner|JOIN::exec

Generated at Thu Feb 08 10:10:52 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.