[MDEV-30932] UBSAN: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in Item_func_mul::int_op and Item_func_round::int_op Created: 2023-03-27 Updated: 2023-07-19 Resolved: 2023-06-29 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Data types |
| Affects Version/s: | 10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 11.0, 11.1 |
| Fix Version/s: | 10.8.8, 10.4.31, 10.5.22, 10.6.15, 10.9.8, 10.10.6, 10.11.5 |
| Type: | Bug | Priority: | Critical |
| Reporter: | Roel Van de Paar | Assignee: | Alexander Barkov |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | UBSAN, affects-tests | ||
| Issue Links: |
|
||||||||
| Description |
|
Similar to MDEV-30931 but in a different function
Leads to:
Setup:
Bug confirmed present in: |
| Comments |
| Comment by Roel Van de Paar [ 2023-03-29 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
This testcase has the same stack on debug, but a different stack on optimized builds.
Leads to:
Bug confirmed present in: All UniqueID's seen with this testcases including two new ones (the first two):
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Roel Van de Paar [ 2023-03-31 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Three additional stacks can be observed with this testcase
Leads to the following stacks/UniqueID's:
Across versions and build types | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Roel Van de Paar [ 2023-04-24 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Another testcase which has a previously seen stack on debug, but a different stack on optimized builds:
Leads to the following stacks/UniqueID's:
Across versions and build types. The second one is new. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Roel Van de Paar [ 2023-05-09 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
This testcase:
Gives the following additional stacks/UniqueID's:
Across versions and build types. Both are new. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Roel Van de Paar [ 2023-06-15 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Another testcase which leads to new stacks
Gives the following stacks/UniqueID's:
Across versions and build types. Both are new. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Roel Van de Paar [ 2023-06-15 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Another testcase which leads to new stacks
Gives the following stacks/UniqueID's:
Across versions and build types. Both are new. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Roel Van de Paar [ 2023-06-15 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Note: the last two testcases are in Item_func_round::int_op rather than in Item_func_mul::int_op | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Roel Van de Paar [ 2023-06-15 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
This variation to the last testcase above
Gives the following stacks/UniqueID's:
Across versions and build types. Both are new. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Alexander Barkov [ 2023-06-28 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Changed Priority to Critical, as according to Roel, it keeps popping up in new forms and terminates various SAN tests. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Roel Van de Paar [ 2023-06-28 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
MTR testcase which shows the issue on 10.6. Note that 10.4 have other startup SAN issues so MTR pre-fails on those.
Leads to:
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Roel Van de Paar [ 2023-06-28 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Two problem lines highlighted
|