[MDEV-29747] Server crashes in check_key_in_view on 2nd execution of PS with ROWNUM Created: 2022-10-08  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Prepared Statements
Affects Version/s: 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 11.0
Fix Version/s: 10.6, 10.11, 11.0

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Dmitry Shulga
Resolution: Unresolved Votes: 0
Labels: None


 Description   

CREATE TABLE t (a INT);
INSERT INTO t VALUES (1),(2); # Optional, fails either way
CREATE VIEW v AS SELECT * FROM t;
 
PREPARE ps FROM 'DELETE v FROM v WHERE ROWNUM() < 5';
EXECUTE ps;
EXECUTE ps;
 
# Cleanup
DROP VIEW v;
DROP TABLE t;

10.6 eae037c2

#3  <signal handler called>
#4  0x000055f17afa01ee in check_key_in_view (thd=0x62b00007e218, view=0x62b0000bf6b0) at /data/src/10.6/sql/sql_view.cc:2098
#5  0x000055f17b94461c in mysql_multi_delete_prepare (thd=0x62b00007e218) at /data/src/10.6/sql/sql_delete.cc:1158
#6  0x000055f17ac667f7 in mysql_execute_command (thd=0x62b00007e218, is_called_from_prepared_stmt=true) at /data/src/10.6/sql/sql_parse.cc:4850
#7  0x000055f17accfcfd in Prepared_statement::execute (this=0x61900008c098, expanded_query=0x7fba6b327d00, open_cursor=false) at /data/src/10.6/sql/sql_prepare.cc:5207
#8  0x000055f17accb08d in Prepared_statement::execute_loop (this=0x61900008c098, expanded_query=0x7fba6b327d00, open_cursor=false, packet=0x0, packet_end=0x0) at /data/src/10.6/sql/sql_prepare.cc:4635
#9  0x000055f17acc49a1 in mysql_sql_stmt_execute (thd=0x62b00007e218) at /data/src/10.6/sql/sql_prepare.cc:3686
#10 0x000055f17ac5fb88 in mysql_execute_command (thd=0x62b00007e218, is_called_from_prepared_stmt=false) at /data/src/10.6/sql/sql_parse.cc:3962
#11 0x000055f17ac7bcd8 in mysql_parse (thd=0x62b00007e218, rawbuf=0x62b000085238 "EXECUTE ps", length=10, parser_state=0x7fba6b328a90) at /data/src/10.6/sql/sql_parse.cc:8016
#12 0x000055f17ac52638 in dispatch_command (command=COM_QUERY, thd=0x62b00007e218, packet=0x629000258219 "EXECUTE ps", packet_length=10, blocking=true) at /data/src/10.6/sql/sql_parse.cc:1896
#13 0x000055f17ac4f3ff in do_command (thd=0x62b00007e218, blocking=true) at /data/src/10.6/sql/sql_parse.cc:1409
#14 0x000055f17b0a686a in do_handle_one_connection (connect=0x608000002638, put_in_cache=true) at /data/src/10.6/sql/sql_connect.cc:1416
#15 0x000055f17b0a6200 in handle_one_connection (arg=0x6080000025b8) at /data/src/10.6/sql/sql_connect.cc:1318
#16 0x000055f17bcccc70 in pfs_spawn_thread (arg=0x617000004d98) at /data/src/10.6/storage/perfschema/pfs.cc:2201
#17 0x00007fba74afcea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
#18 0x00007fba746e9aef in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Reproducible on 10.6+, including earlier minor releases.
The test case is not applicable to pre-10.6 due to the use of ROWNUM.


Generated at Thu Feb 08 10:10:58 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.