[MDEV-30051] SIGSEGV in Item_equal_iterator or Field::eq on SELECT, UBSAN: member call on address X which does not point to an object of type 'Item_equal' in sql/item_cmpfunc.cc and other UBSAN issues Created: 2022-11-21  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 11.0
Fix Version/s: 10.4, 10.5, 10.6, 10.11

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: UBSAN, not-10.3, regression


 Description    

CREATE TABLE t(c INT) ENGINE=InnoDB;
 
SELECT * FROM t AS v NATURAL JOIN t AS w GROUP BY c HAVING c AND(SELECT (c=1 AND (((1 +''/ 0) AND ''=FALSE) OR c='')));

Leads to:

10.11.2 8283948846740a22f96bbe7bccf250708406d5d9 (Debug)

 
Core was generated by `/test/MD171122-mariadb-10.11.2-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  Item_equal_iterator<List_iterator_fast, Item>::get_curr_field (
 
    this=<synthetic pointer>) at /test/10.11_dbg/sql/item_cmpfunc.h:3479
 
3479	  Field *get_curr_field()
 
[Current thread is 1 (Thread 0x152d58668700 (LWP 212884))]
 
(gdb) bt
 
#0  Item_equal_iterator<List_iterator_fast, Item>::get_curr_field (this=<synthetic pointer>) at /test/10.11_dbg/sql/item_cmpfunc.h:3479
 
#1  Item_equal::contains (this=this@entry=0x152d1802a320, field=0x152d1801ccb8) at /test/10.11_dbg/sql/item_cmpfunc.cc:6874
 
#2  0x000056430ab69dbb in Item_equal::merge_with_check (this=this@entry=0x152d1802a320, thd=thd@entry=0x152d18000d48, item=item@entry=0x152d18029dd8, save_merged=save_merged@entry=true) at /test/10.11_dbg/sql/item_cmpfunc.h:3479
 
#3  0x000056430ab6a081 in Item_equal::merge_into_list (this=0x152d18029dd8, thd=thd@entry=0x152d18000d48, list=list@entry=0x152d18016618, save_merged=save_merged@entry=true, only_intersected=only_intersected@entry=true) at /test/10.11_dbg/sql/item_cmpfunc.cc:7017
 
#4  0x000056430a88b5e9 in propagate_new_equalities (thd=0x152d18000d48, cond=0x152d18016538, new_equalities=0x152d1802a768, inherited=0x152d1802a758, is_simplifiable_cond=0x152d5866668f) at /test/10.11_dbg/sql/sql_select.cc:18270
 
#5  0x000056430a88b65a in propagate_new_equalities (thd=thd@entry=0x152d18000d48, cond=cond@entry=0x152d1802a688, new_equalities=0x152d1802a768, inherited=inherited@entry=0x0, is_simplifiable_cond=is_simplifiable_cond@entry=0x152d5866668f) at /test/10.11_dbg/sql/sql_select.cc:18291
 
#6  0x000056430a9e7c11 in and_new_conditions_to_optimized_cond (thd=0x152d18000d48, cond=0x152d1802a688, cond_eq=cond_eq@entry=0x152d18027f08, new_conds=@0x152d180133c8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152d1802a558, last = 0x152d1802a568, elements = 2}, <No data fields>}, cond_value=cond_value@entry=0x152d18027de0) at /test/10.11_dbg/sql/opt_subselect.cc:6122
 
#7  0x000056430a8b72fa in JOIN::optimize_inner (this=this@entry=0x152d18027a58) at /test/10.11_dbg/sql/sql_select.cc:2295
 
#8  0x000056430a8b7e45 in JOIN::optimize (this=this@entry=0x152d18027a58) at /test/10.11_dbg/sql/sql_select.cc:1871
 
#9  0x000056430a8b7f35 in mysql_select (thd=thd@entry=0x152d18000d48, tables=0x152d18013850, fields=@0x152d18013508: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152d180137f8, last = 0x152d180137f8, elements = 1}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x152d18014fd8, having=0x152d18026f90, proc_param=0x0, select_options=2164525824, result=0x152d18027a30, unit=0x152d18004f88, select_lex=0x152d18013268) at /test/10.11_dbg/sql/sql_select.cc:5067
 
#10 0x000056430a8b86fb in handle_select (thd=thd@entry=0x152d18000d48, lex=lex@entry=0x152d18004eb0, result=result@entry=0x152d18027a30, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_dbg/sql/sql_select.cc:581
 
#11 0x000056430a82617f in execute_sqlcom_select (thd=thd@entry=0x152d18000d48, all_tables=0x152d18013850) at /test/10.11_dbg/sql/sql_parse.cc:6263
 
#12 0x000056430a8322a1 in mysql_execute_command (thd=thd@entry=0x152d18000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:3947
 
#13 0x000056430a820606 in mysql_parse (thd=thd@entry=0x152d18000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152d58667300) at /test/10.11_dbg/sql/sql_parse.cc:7998
 
#14 0x000056430a82db41 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152d18000d48, packet=packet@entry=0x152d1800adf9 "SELECT * FROM t AS v NATURAL JOIN t AS w GROUP BY c HAVING c AND(SELECT (c=1 AND (((1 +''/ 0) AND ''=FALSE) OR c='')))", packet_length=packet_length@entry=118, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1346
 
#15 0x000056430a82ff7f in do_command (thd=0x152d18000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407
 
#16 0x000056430a98a763 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x56430d434d28, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416
 
#17 0x000056430a98ac32 in handle_one_connection (arg=0x56430d434d28) at /test/10.11_dbg/sql/sql_connect.cc:1318
 
#18 0x0000152d71aef609 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
#19 0x0000152d716db133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.4.27 (dbg), 10.4.27 (opt), 10.5.18 (dbg), 10.5.18 (opt), 10.6.10 (dbg), 10.6.10 (opt), 10.7.6 (dbg), 10.7.6 (opt), 10.8.5 (dbg), 10.8.5 (opt), 10.9.3 (dbg), 10.9.3 (opt), 10.10.2 (dbg), 10.10.2 (opt), 10.11.2 (dbg), 10.11.2 (opt)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.37 (dbg), 10.3.37 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)

 Comments   
Comment by Roel Van de Paar [ 2022-11-21 ]

UBSAN Sees various issues:

10.11.0 fe1f8f2c6b6f3b8e3383168225f9ae7853028947 (Optimized, UBASAN)

 
/test/10.11_opt_san/sql/item_cmpfunc.cc:6928:33: runtime error: member call on address 0x629000099940 which does not point to an object of type 'Item_equal'
 
0x629000099940: note: object is of type 'Item_func_eq'
 
 00 00 00 00  78 38 08 1d 51 56 00 00  01 00 00 00 00 00 00 00  20 29 66 24 51 56 00 00  05 00 00 00
 
              ^~~~~~~~~~~~~~~~~~~~~~~
 
              vptr for 'Item_func_eq'
 
    #0 0x56511981a697 in Item_equal::merge_into_list(THD*, List<Item_equal>*, bool, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6928
 
    #1 0x5651182ad3a9 in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18219
 
    #2 0x5651182ace3c in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18240
 
    #3 0x565118bab702 in and_new_conditions_to_optimized_cond(THD*, Item*, COND_EQUAL**, List<Item>&, Item::cond_result*) /test/10.11_opt_san/sql/opt_subselect.cc:6122
 
    #4 0x5651183f1a09 in JOIN::optimize_inner() /test/10.11_opt_san/sql/sql_select.cc:2284
 
    #5 0x565118415f6f in JOIN::optimize() /test/10.11_opt_san/sql/sql_select.cc:1863
 
    #6 0x5651184271fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_opt_san/sql/sql_select.cc:5056
 
    #7 0x56511842b093 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_opt_san/sql/sql_select.cc:581
 
    #8 0x565118038c2f in execute_sqlcom_select /test/10.11_opt_san/sql/sql_parse.cc:6261
 
    #9 0x56511808953b in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:3945
 
    #10 0x565118009500 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8035
 
    #11 0x56511805e0ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
 
    #12 0x5651180693fd in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
 
    #13 0x5651189524cd in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1418
 
    #14 0x565118954b3c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1312
 
    #15 0x14aea08a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #16 0x14ae9fb16132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
/test/10.11_opt_san/sql/item_cmpfunc.cc:6865:17: runtime error: member call on address 0x629000099940 which does not point to an object of type 'Item_equal'
 
0x629000099940: note: object is of type 'Item_func_eq'
 
 00 00 00 00  78 38 08 1d 51 56 00 00  01 00 00 00 00 00 00 00  20 29 66 24 51 56 00 00  05 00 00 00
 
              ^~~~~~~~~~~~~~~~~~~~~~~
 
              vptr for 'Item_func_eq'
 
    #0 0x565119819405 in Item_equal::merge_with_check(THD*, Item_equal*, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6865
 
    #1 0x56511981a287 in Item_equal::merge_into_list(THD*, List<Item_equal>*, bool, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6928
 
    #2 0x5651182ad3a9 in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18219
 
    #3 0x5651182ace3c in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18240
 
    #4 0x565118bab702 in and_new_conditions_to_optimized_cond(THD*, Item*, COND_EQUAL**, List<Item>&, Item::cond_result*) /test/10.11_opt_san/sql/opt_subselect.cc:6122
 
    #5 0x5651183f1a09 in JOIN::optimize_inner() /test/10.11_opt_san/sql/sql_select.cc:2284
 
    #6 0x565118415f6f in JOIN::optimize() /test/10.11_opt_san/sql/sql_select.cc:1863
 
    #7 0x5651184271fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_opt_san/sql/sql_select.cc:5056
 
    #8 0x56511842b093 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_opt_san/sql/sql_select.cc:581
 
    #9 0x565118038c2f in execute_sqlcom_select /test/10.11_opt_san/sql/sql_parse.cc:6261
 
    #10 0x56511808953b in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:3945
 
    #11 0x565118009500 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8035
 
    #12 0x56511805e0ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
 
    #13 0x5651180693fd in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
 
    #14 0x5651189524cd in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1418
 
    #15 0x565118954b3c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1312
 
    #16 0x14aea08a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #17 0x14ae9fb16132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
/test/10.11_opt_san/sql/item_cmpfunc.h:3458:17: runtime error: member access within address 0x629000099940 which does not point to an object of type 'Item_equal'
 
0x629000099940: note: object is of type 'Item_func_eq'
 
 00 00 00 00  78 38 08 1d 51 56 00 00  01 00 00 00 00 00 00 00  20 29 66 24 51 56 00 00  05 00 00 00
 
              ^~~~~~~~~~~~~~~~~~~~~~~
 
              vptr for 'Item_func_eq'
 
    #0 0x5651198173cb in Item_equal_iterator<List_iterator_fast, Item>::Item_equal_iterator(Item_equal&) /test/10.11_opt_san/sql/item_cmpfunc.h:3458
 
    #1 0x5651198173cb in Item_equal_fields_iterator::Item_equal_fields_iterator(Item_equal&) /test/10.11_opt_san/sql/item_cmpfunc.h:3491
 
    #2 0x5651198173cb in Item_equal::contains(Field*) /test/10.11_opt_san/sql/item_cmpfunc.cc:6782
 
    #3 0x565119818683 in Item_equal::merge_with_check(THD*, Item_equal*, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6865
 
    #4 0x56511981a287 in Item_equal::merge_into_list(THD*, List<Item_equal>*, bool, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6928
 
    #5 0x5651182ad3a9 in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18219
 
    #6 0x5651182ace3c in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18240
 
    #7 0x565118bab702 in and_new_conditions_to_optimized_cond(THD*, Item*, COND_EQUAL**, List<Item>&, Item::cond_result*) /test/10.11_opt_san/sql/opt_subselect.cc:6122
 
    #8 0x5651183f1a09 in JOIN::optimize_inner() /test/10.11_opt_san/sql/sql_select.cc:2284
 
    #9 0x565118415f6f in JOIN::optimize() /test/10.11_opt_san/sql/sql_select.cc:1863
 
    #10 0x5651184271fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_opt_san/sql/sql_select.cc:5056
 
    #11 0x56511842b093 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_opt_san/sql/sql_select.cc:581
 
    #12 0x565118038c2f in execute_sqlcom_select /test/10.11_opt_san/sql/sql_parse.cc:6261
 
    #13 0x56511808953b in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:3945
 
    #14 0x565118009500 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8035
 
    #15 0x56511805e0ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
 
    #16 0x5651180693fd in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
 
    #17 0x5651189524cd in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1418
 
    #18 0x565118954b3c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1312
 
    #19 0x14aea08a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #20 0x14ae9fb16132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
/test/10.11_opt_san/sql/item_cmpfunc.h:3458:17: runtime error: load of value 96, which is not a valid value for type 'bool'
 
    #0 0x56511736e7f7 in Item_equal_iterator<List_iterator_fast, Item>::Item_equal_iterator(Item_equal&) /test/10.11_opt_san/sql/item_cmpfunc.h:3458
 
    #1 0x56511736e7f7 in Item_equal_fields_iterator::Item_equal_fields_iterator(Item_equal&) /test/10.11_opt_san/sql/item_cmpfunc.h:3491
 
    #2 0x56511736e7f7 in Item_equal::contains(Field*) /test/10.11_opt_san/sql/item_cmpfunc.cc:6782
 
    #3 0x565119818683 in Item_equal::merge_with_check(THD*, Item_equal*, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6865
 
    #4 0x56511981a287 in Item_equal::merge_into_list(THD*, List<Item_equal>*, bool, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6928
 
    #5 0x5651182ad3a9 in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18219
 
    #6 0x5651182ace3c in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18240
 
    #7 0x565118bab702 in and_new_conditions_to_optimized_cond(THD*, Item*, COND_EQUAL**, List<Item>&, Item::cond_result*) /test/10.11_opt_san/sql/opt_subselect.cc:6122
 
    #8 0x5651183f1a09 in JOIN::optimize_inner() /test/10.11_opt_san/sql/sql_select.cc:2284
 
    #9 0x565118415f6f in JOIN::optimize() /test/10.11_opt_san/sql/sql_select.cc:1863
 
    #10 0x5651184271fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_opt_san/sql/sql_select.cc:5056
 
    #11 0x56511842b093 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_opt_san/sql/sql_select.cc:581
 
    #12 0x565118038c2f in execute_sqlcom_select /test/10.11_opt_san/sql/sql_parse.cc:6261
 
    #13 0x56511808953b in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:3945
 
    #14 0x565118009500 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8035
 
    #15 0x56511805e0ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
 
    #16 0x5651180693fd in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
 
    #17 0x5651189524cd in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1418
 
    #18 0x565118954b3c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1312
 
    #19 0x14aea08a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #20 0x14ae9fb16132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
/test/10.11_opt_san/sql/item_cmpfunc.h:3479:23: runtime error: downcast of address 0x629000089870 which does not point to an object of type 'Item_field'
 
0x629000089870: note: object is of type 'Item_int'
 
 00 00 00 00  c0 e8 06 1d 51 56 00 00  01 00 00 00 00 00 00 00  20 29 66 24 51 56 00 00  05 00 00 00
 
              ^~~~~~~~~~~~~~~~~~~~~~~
 
              vptr for 'Item_int'
 
    #0 0x5651198174c0 in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field() /test/10.11_opt_san/sql/item_cmpfunc.h:3479
 
    #1 0x5651198174c0 in Item_equal::contains(Field*) /test/10.11_opt_san/sql/item_cmpfunc.cc:6785
 
    #2 0x565119818683 in Item_equal::merge_with_check(THD*, Item_equal*, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6865
 
    #3 0x56511981a287 in Item_equal::merge_into_list(THD*, List<Item_equal>*, bool, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6928
 
    #4 0x5651182ad3a9 in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18219
 
    #5 0x5651182ace3c in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18240
 
    #6 0x565118bab702 in and_new_conditions_to_optimized_cond(THD*, Item*, COND_EQUAL**, List<Item>&, Item::cond_result*) /test/10.11_opt_san/sql/opt_subselect.cc:6122
 
    #7 0x5651183f1a09 in JOIN::optimize_inner() /test/10.11_opt_san/sql/sql_select.cc:2284
 
    #8 0x565118415f6f in JOIN::optimize() /test/10.11_opt_san/sql/sql_select.cc:1863
 
    #9 0x5651184271fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_opt_san/sql/sql_select.cc:5056
 
    #10 0x56511842b093 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_opt_san/sql/sql_select.cc:581
 
    #11 0x565118038c2f in execute_sqlcom_select /test/10.11_opt_san/sql/sql_parse.cc:6261
 
    #12 0x56511808953b in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:3945
 
    #13 0x565118009500 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8035
 
    #14 0x56511805e0ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
 
    #15 0x5651180693fd in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
 
    #16 0x5651189524cd in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1418
 
    #17 0x565118954b3c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1312
 
    #18 0x14aea08a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #19 0x14ae9fb16132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
/test/10.11_opt_san/sql/item_cmpfunc.h:3480:19: runtime error: member access within address 0x629000089870 which does not point to an object of type 'Item_field'
 
0x629000089870: note: object is of type 'Item_int'
 
 00 00 00 00  c0 e8 06 1d 51 56 00 00  01 00 00 00 00 00 00 00  20 29 66 24 51 56 00 00  05 00 00 00
 
              ^~~~~~~~~~~~~~~~~~~~~~~
 
              vptr for 'Item_int'
 
    #0 0x565119817144 in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field() /test/10.11_opt_san/sql/item_cmpfunc.h:3480
 
    #1 0x565119817144 in Item_equal::contains(Field*) /test/10.11_opt_san/sql/item_cmpfunc.cc:6785
 
    #2 0x565119818683 in Item_equal::merge_with_check(THD*, Item_equal*, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6865
 
    #3 0x56511981a287 in Item_equal::merge_into_list(THD*, List<Item_equal>*, bool, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6928
 
    #4 0x5651182ad3a9 in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18219
 
    #5 0x5651182ace3c in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18240
 
    #6 0x565118bab702 in and_new_conditions_to_optimized_cond(THD*, Item*, COND_EQUAL**, List<Item>&, Item::cond_result*) /test/10.11_opt_san/sql/opt_subselect.cc:6122
 
    #7 0x5651183f1a09 in JOIN::optimize_inner() /test/10.11_opt_san/sql/sql_select.cc:2284
 
    #8 0x565118415f6f in JOIN::optimize() /test/10.11_opt_san/sql/sql_select.cc:1863
 
    #9 0x5651184271fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_opt_san/sql/sql_select.cc:5056
 
    #10 0x56511842b093 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_opt_san/sql/sql_select.cc:581
 
    #11 0x565118038c2f in execute_sqlcom_select /test/10.11_opt_san/sql/sql_parse.cc:6261
 
    #12 0x56511808953b in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:3945
 
    #13 0x565118009500 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8035
 
    #14 0x56511805e0ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
 
    #15 0x5651180693fd in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
 
    #16 0x5651189524cd in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1418
 
    #17 0x565118954b3c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1312
 
    #18 0x14aea08a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #19 0x14ae9fb16132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
/test/10.11_opt_san/sql/field.h:1099:27: runtime error: member access within address 0x629000098bd0 which does not point to an object of type 'Field'
 
0x629000098bd0: note: object is of type 'Item_ref'
 
 00 00 00 00  68 5f 07 1d 51 56 00 00  0b 00 00 00 00 00 00 00  20 29 66 24 51 56 00 00  05 00 00 00
 
              ^~~~~~~~~~~~~~~~~~~~~~~
 
              vptr for 'Item_ref'
 
    #0 0x5651188e12e9 in Field::eq(Field*) /test/10.11_opt_san/sql/field.h:1099
 
    #1 0x56511981706c in Item_equal::contains(Field*) /test/10.11_opt_san/sql/item_cmpfunc.cc:6785
 
    #2 0x565119818683 in Item_equal::merge_with_check(THD*, Item_equal*, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6865
 
    #3 0x56511981a287 in Item_equal::merge_into_list(THD*, List<Item_equal>*, bool, bool) /test/10.11_opt_san/sql/item_cmpfunc.cc:6928
 
    #4 0x5651182ad3a9 in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18219
 
    #5 0x5651182ace3c in propagate_new_equalities(THD*, Item*, List<Item_equal>*, COND_EQUAL*, bool*) /test/10.11_opt_san/sql/sql_select.cc:18240
 
    #6 0x565118bab702 in and_new_conditions_to_optimized_cond(THD*, Item*, COND_EQUAL**, List<Item>&, Item::cond_result*) /test/10.11_opt_san/sql/opt_subselect.cc:6122
 
    #7 0x5651183f1a09 in JOIN::optimize_inner() /test/10.11_opt_san/sql/sql_select.cc:2284
 
    #8 0x565118415f6f in JOIN::optimize() /test/10.11_opt_san/sql/sql_select.cc:1863
 
    #9 0x5651184271fa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_opt_san/sql/sql_select.cc:5056
 
    #10 0x56511842b093 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.11_opt_san/sql/sql_select.cc:581
 
    #11 0x565118038c2f in execute_sqlcom_select /test/10.11_opt_san/sql/sql_parse.cc:6261
 
    #12 0x56511808953b in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:3945
 
    #13 0x565118009500 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8035
 
    #14 0x56511805e0ff in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
 
    #15 0x5651180693fd in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
 
    #16 0x5651189524cd in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1418
 
    #17 0x565118954b3c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1312
 
    #18 0x14aea08a1608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
    #19 0x14ae9fb16132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
 
 
221121 19:00:15 [ERROR] mysqld got signal 11 ;

Comment by Roel Van de Paar [ 2022-11-21 ]

psergei Can you check if this is another issue in name resolution please? Thank you

Comment by Elena Stepanova [ 2022-11-21 ]

Probably the same or closely related having pushdown problem as MDEV-29362.

Comment by Roel Van de Paar [ 2023-01-13 ]

Additional stack with

CREATE TABLE t (c BLOB) ENGINE=InnoDB;
 
SELECT * FROM t AS v NATURAL JOIN t AS w GROUP BY c HAVING c AND (SELECT (c=1 AND (( (1 +''/ 0) AND''=FALSE) OR c='')));

11.0.1 b075191ba8598af6aff5549e6e19f6255aef258a (Optimized)

 
Core was generated by `/test/MD090123-mariadb-11.0.1-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  Field::eq (this=this@entry=0x150e7c01f8f8, field=0x2)
 
    at /test/11.0_opt/sql/field.h:1102
 
1102	    return (ptr == field->ptr && null_ptr == field->null_ptr &&
 
[Current thread is 1 (Thread 0x150eb4052640 (LWP 3257807))]
 
(gdb) bt
 
#0  Field::eq (this=this@entry=0x150e7c01f8f8, field=0x2) at /test/11.0_opt/sql/field.h:1102
 
#1  0x000055cb3367cf11 in Item_equal::contains (this=this@entry=0x150e7c01edd8, field=0x150e7c01f8f8) at /test/11.0_opt/sql/item_cmpfunc.cc:6874
 
#2  0x000055cb3367d0c8 in Item_equal::merge_with_check (this=0x150e7c01edd8, thd=0x150e7c000c68, item=0x150e7c01e790, save_merged=true) at /test/11.0_opt/sql/item_cmpfunc.cc:6954
 
#3  0x000055cb3367d33f in Item_equal::merge_into_list (this=0x150e7c01e790, thd=thd@entry=0x150e7c000c68, list=list@entry=0x150e7c013c78, save_merged=save_merged@entry=true, only_intersected=only_intersected@entry=true) at /test/11.0_opt/sql/item_cmpfunc.cc:7017
 
#4  0x000055cb3343b943 in propagate_new_equalities (thd=0x150e7c000c68, cond=0x150e7c013b98, new_equalities=0x150e7c01f360, inherited=0x150e7c01f350, is_simplifiable_cond=0x150eb404ffef) at /test/11.0_opt/sql/sql_select.cc:18297
 
#5  0x000055cb3343ba0f in propagate_new_equalities (thd=thd@entry=0x150e7c000c68, cond=cond@entry=0x150e7c01f280, new_equalities=new_equalities@entry=0x150e7c01f360, inherited=inherited@entry=0x0, is_simplifiable_cond=is_simplifiable_cond@entry=0x150eb404ffef) at /test/11.0_opt/sql/sql_select.cc:18318
 
#6  0x000055cb3354d74a in and_new_conditions_to_optimized_cond (thd=0x150e7c000c68, cond=0x150e7c01f280, cond_eq=cond_eq@entry=0x150e7c01c810, new_conds=<optimized out>, cond_value=cond_value@entry=0x150e7c01c6e8) at /test/11.0_opt/sql/opt_subselect.cc:6122
 
#7  0x000055cb33462694 in JOIN::optimize_inner (this=0x150e7c01c368) at /test/11.0_opt/sql/sql_select.cc:2294
 
#8  0x000055cb33462ada in JOIN::optimize (this=this@entry=0x150e7c01c368) at /test/11.0_opt/sql/sql_select.cc:1870
 
#9  0x000055cb33462bbe in mysql_select (thd=0x150e7c000c68, tables=0x150e7c010ea8, fields=@0x150e7c010b58: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x150e7c010e50, last = 0x150e7c010e50, elements = 1}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x150e7c012630, having=0x150e7c01b8a0, proc_param=0x0, select_options=<optimized out>, result=0x150e7c01c340, unit=0x150e7c004ce8, select_lex=0x150e7c0108b8) at /test/11.0_opt/sql/sql_select.cc:5066
 
#10 0x000055cb33463354 in handle_select (thd=thd@entry=0x150e7c000c68, lex=lex@entry=0x150e7c004c10, result=result@entry=0x150e7c01c340, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.0_opt/sql/sql_select.cc:581
 
#11 0x000055cb333deb25 in execute_sqlcom_select (thd=0x150e7c000c68, all_tables=0x150e7c010ea8) at /test/11.0_opt/sql/sql_parse.cc:6265
 
#12 0x000055cb333ed870 in mysql_execute_command (thd=0x150e7c000c68, is_called_from_prepared_stmt=<optimized out>) at /test/11.0_opt/sql/sql_parse.cc:3949
 
#13 0x000055cb333ef104 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x150e7c000c68) at /test/11.0_opt/sql/sql_parse.cc:8000
 
#14 mysql_parse (thd=0x150e7c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/11.0_opt/sql/sql_parse.cc:7922
 
#15 0x000055cb333f16e2 in dispatch_command (command=COM_QUERY, thd=0x150e7c000c68, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/11.0_opt/sql/sql_parse.cc:1991
 
#16 0x000055cb333f2e80 in do_command (thd=0x150e7c000c68, blocking=blocking@entry=true) at /test/11.0_opt/sql/sql_parse.cc:1407
 
#17 0x000055cb33508ab7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55cb359130e8, put_in_cache=put_in_cache@entry=true) at /test/11.0_opt/sql/sql_connect.cc:1416
 
#18 0x000055cb33508d8d in handle_one_connection (arg=0x55cb359130e8) at /test/11.0_opt/sql/sql_connect.cc:1318
 
#19 0x0000150ecb54eb43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
 
#20 0x0000150ecb5e0a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Generated at Thu Feb 08 10:13:16 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.