|
May be related to MDEV-28384, however this bug is in 10.6+ only and the testcase looks different (no GROUP_CONCAT/COUNT and this testcase uses DELETE instead of SELECT). Reproduces on InnoDB and MyISAM.
CREATE TABLE t (c1 SET('1','2','3'),c2 BINARY);
|
INSERT INTO t VALUES (0,0);
|
DELETE FROM t WHERE c2<c1;
|
Leads to:
|
11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)
|
/test/11.0_dbg_san/strings/ctype-bin.c:89:12: runtime error: null pointer passed as argument 2, which is declared to never be null
|
|
11.0.2 a79abb6517f2fa68b48e61aa3354a0631e3a63f7 (Debug)
|
/test/11.0_dbg_san/strings/ctype-bin.c:89:12: runtime error: null pointer passed as argument 2, which is declared to never be null
|
#0 0x5575bfed62c1 in my_strnncoll_binary /test/11.0_dbg_san/strings/ctype-bin.c:89
|
#1 0x5575bfed62fc in my_strnncollsp_binary /test/11.0_dbg_san/strings/ctype-bin.c:128
|
#2 0x5575bc6b37a3 in charset_info_st::strnncollsp(char const*, unsigned long, char const*, unsigned long) const /test/11.0_dbg_san/include/m_ctype.h:1018
|
#3 0x5575bc6b37a3 in sortcmp(Binary_string const*, Binary_string const*, charset_info_st const*) /test/11.0_dbg_san/sql/sql_string.cc:868
|
#4 0x5575bda5602f in Arg_comparator::compare_string() /test/11.0_dbg_san/sql/item_cmpfunc.cc:777
|
#5 0x5575bda55b76 in Arg_comparator::compare() /test/11.0_dbg_san/sql/item_cmpfunc.h:103
|
#6 0x5575bda55b76 in Item_func_lt::val_int() /test/11.0_dbg_san/sql/item_cmpfunc.cc:1831
|
#7 0x5575bbdc6102 in SQL_SELECT::skip_record(THD*) /test/11.0_dbg_san/sql/opt_range.h:1913
|
#8 0x5575bbdc6102 in record_should_be_deleted /test/11.0_dbg_san/sql/sql_delete.cc:221
|
#9 0x5575bbde138d in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /test/11.0_dbg_san/sql/sql_delete.cc:819
|
#10 0x5575bc0bb3e4 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:4811
|
#11 0x5575bc0db5e6 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:7999
|
#12 0x5575bc0eb37a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
|
#13 0x5575bc0f917f in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
|
#14 0x5575bcabd459 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
|
#15 0x5575bcabe974 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
|
#16 0x149656c64b42 in start_thread nptl/pthread_create.c:442
|
#17 0x149656cf69ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
|
Setup:
Compiled with GCC >=7.5.0 (I use GCC 11.3.0) and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1
|
Bug confirmed present in:
MariaDB: 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.3 (dbg), 10.11.3 (opt), 11.0.2 (dbg), 11.0.2 (opt)
Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.39 (dbg), 10.3.39 (opt), 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt)
|