[MDEV-32379] Segmentation fault at /mariadb-11.3.0/sql/sql_select.cc:23188 Created: 2023-10-09  Updated: 2023-10-09  Resolved: 2023-10-09

Status: Closed
Project: MariaDB Server
Component/s: Server
Affects Version/s: 11.3.0
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: None
Environment:

Ubuntu 20.04

Issue Links:
Duplicate

 Description   

Run these queries in release build:

CREATE TABLE t0 ( c18 DECIMAL ( 12 ) DEFAULT ( -108 ) ) ;
INSERT INTO t0 VALUES ( 2 ) , ( 28 ) ;
ALTER TABLE t0 ADD COLUMN c40 INT NOT NULL AFTER c18 ;
INSERT INTO t0 VALUES ( -76 , -93 ) , ( -8 , -72 ) ;
SELECT t0 . c18 AS c18 FROM ( SELECT CONVERT ( -6932390468370636723 , UNSIGNED ) % RAND ( ) | RAND ( ) << EXP ( t0 . c40 ) / EXISTS ( SELECT t0 . c40 AS c53 FROM ( SELECT t0 . c18 AS c14 FROM t0 LEFT OUTER JOIN t0 AS t1 USING ( c18 , c40 ) ) AS t2 JOIN t0 ON t2 . c14 = t0 . c18 UNION SELECT c40 + 10 AS c3 FROM t0 WHERE RAND ( ) & TRIM( TRAILING FROM 84 ) << CONVERT ( -51 , UNSIGNED ) % RAND ( ) = t0 . c18 = ALL ( SELECT RAND ( ) % EXISTS ( SELECT 3277954112335138242 AS c46 ) AS c16 FROM t0 ) < -99 AND c18 < -2077949961864004476 ) AS c43 FROM t0 ) AS t3 JOIN t0 ON t0 . c18 = t3 . c43 ;

Will trigger Segmentation fault.

GDB info:
Thread 17 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe011a700 (LWP 45046)]
sub_select_cache (join=0x7fff98089d70, join_tab=0x7fff9809ac28,
end_of_records=false) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23188
23188 join_tab->cache->reset_join(join);
(gdb) p join_tab->cache
$2 = (JOIN_CACHE *) 0x0

#0 sub_select_cache (join=0x7fff98089d70, join_tab=0x7fff9809ac28,
end_of_records=false) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23188
#1 0x0000555555dad6d4 in evaluate_join_record (
join=join@entry=0x7fff98089d70, join_tab=join_tab@entry=0x7fff9809a7b0,
error=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#2 0x0000555555dbf7fb in sub_select (join=0x7fff98089d70,
join_tab=0x7fff9809a7b0, end_of_records=false)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
#3 0x0000555555df19b2 in do_select (procedure=<optimized out>,
join=0x7fff98089d70) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#4 JOIN::exec_inner (this=this@entry=0x7fff98089d70)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#5 0x0000555555df1d78 in JOIN::exec (this=0x7fff98089d70)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#6 0x0000555555e444bc in st_select_lex_unit::exec_inner (this=0x7fff98074780)
at /home/wx/mariadb-11.3.0/sql/sql_union.cc:2389
#7 0x0000555555e44821 in st_select_lex_unit::exec (this=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_union.cc:2292
#8 0x00005555560af942 in subselect_union_engine::exec (this=0x7fff9807a3a8)
at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4187
#9 0x00005555560b040c in Item_subselect::exec (this=0x7fff9807a200)
at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#10 0x00005555560aff63 in Item_exists_subselect::val_real (this=0x7fff9807a200)
at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1829
#11 0x000055555604cd58 in Item_func_div::real_op (this=0x7fff9807a3e0)
at /home/wx/mariadb-11.3.0/sql/item_func.cc:1503
#12 0x000055555604e25c in Item_func_hybrid_field_type::val_int_from_real_op (
this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_func.cc:853
#13 0x000055555605a2c6 in Item::to_longlong_null (this=0x7fff9807a3e0)
at /home/wx/mariadb-11.3.0/sql/item.h:1452
#14 Func_handler_shift_left_decimal_to_ulonglong::to_longlong_null (
this=<optimized out>, item=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/item_func.cc:2203
#15 0x0000555556025ab6 in Item_handled_func::Handler_int::val_int (
this=<optimized out>, item=0x7fff9807a4a0)
at /home/wx/mariadb-11.3.0/sql/item_func.h:696
#16 0x0000555555ff7aba in Item::val_decimal_from_int (this=0x7fff9807a4a0,
decimal_value=0x7fffe0117b28) at /home/wx/mariadb-11.3.0/sql/item.cc:343
#17 0x0000555555f2d79f in VDec::VDec (this=0x7fffe0117b20,
item=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
#18 0x0000555556029f33 in Func_handler_bit_or_dec_to_ulonglong::to_longlong_null (this=<optimized out>, item=0x7fff9807a558)
at /home/wx/mariadb-11.3.0/sql/item.h:2910
#19 0x0000555556025ab6 in Item_handled_func::Handler_int::val_int (
this=<optimized out>, item=0x7fff9807a558)
at /home/wx/mariadb-11.3.0/sql/item_func.h:696
#20 0x0000555556001563 in Item::save_int_in_field (this=0x7fff9807a558,
field=0x7fff98099df0, no_conversions=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/item.cc:6843
#21 0x0000555555ff36d7 in Item::save_in_field (this=0x7fff9807a558,
field=0x7fff98099df0, no_conversions=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/item.cc:6853
#22 0x0000555555d0c0ba in fill_record (thd=0x7fff98000c58,
table=0x7fff980991b0, ptr=0x7fff98099a90, values=...,
ignore_errors=ignore_errors@entry=true, use_value=use_value@entry=false)
at /home/wx/mariadb-11.3.0/sql/sql_base.cc:9320
#23 0x0000555555e412a1 in select_unit::send_data (this=0x7fff9807e2e8,
values=...) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:122
#24 0x0000555555dd9d0c in select_result_sink::send_data_with_check (
u=<optimized out>, sent=<optimized out>, items=..., this=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_class.h:5842
#25 select_result_sink::send_data_with_check (sent=<optimized out>,
u=<optimized out>, items=..., this=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_class.h:5832
#26 end_send (join=0x7fff9807e3d8, join_tab=0x7fff98092fb0,
end_of_records=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:24710
#27 0x0000555555dad6d4 in evaluate_join_record (
join=join@entry=0x7fff9807e3d8, join_tab=join_tab@entry=0x7fff98092b38,
error=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#28 0x0000555555dbf874 in sub_select (join=0x7fff9807e3d8,
join_tab=0x7fff98092b38, end_of_records=false)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
#29 0x0000555555df19b2 in do_select (procedure=<optimized out>,
join=0x7fff9807e3d8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#30 JOIN::exec_inner (this=this@entry=0x7fff9807e3d8)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#31 0x0000555555df1d78 in JOIN::exec (this=this@entry=0x7fff9807e3d8)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#32 0x0000555555defe1c in mysql_select (thd=thd@entry=0x7fff98000c58,
tables=0x7fff9807a670, fields=..., conds=0x0, og_num=0, order=0x0,
group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>,
result=0x7fff9807e2e8, unit=0x7fff9807af50, select_lex=0x7fff98013748)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
#33 0x0000555555d2f54b in mysql_derived_fill (thd=<optimized out>,
lex=0x7fff98004e08, derived=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_derived.cc:1266
#34 0x0000555555d2f1fc in mysql_handle_single_derived (lex=0x7fff98004e08,
derived=derived@entry=0x7fff9807b788, phases=phases@entry=96)
at /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200
#35 0x0000555555dbf4f0 in st_join_table::preread_init (
this=this@entry=0x7fff980a7528)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:16029
#36 0x0000555555dbf758 in sub_select (join=0x7fff9807db30,
join_tab=0x7fff980a7528, end_of_records=false)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23392
#37 0x0000555555dad6d4 in evaluate_join_record (
join=join@entry=0x7fff9807db30, join_tab=join_tab@entry=0x7fff980a70b0,
error=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#38 0x0000555555dbf7fb in sub_select (join=0x7fff9807db30,
join_tab=0x7fff980a70b0, end_of_records=false)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
#39 0x0000555555df19b2 in do_select (procedure=<optimized out>,
join=0x7fff9807db30) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#40 JOIN::exec_inner (this=this@entry=0x7fff9807db30)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#41 0x0000555555df1d78 in JOIN::exec (this=this@entry=0x7fff9807db30)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#42 0x0000555555defe1c in mysql_select (thd=thd@entry=0x7fff98000c58,
tables=0x7fff9807b788, fields=..., conds=0x0, og_num=0, order=0x0,
group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>,
result=0x7fff9807db08, unit=0x7fff98004ee8, select_lex=0x7fff98013138)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
#43 0x0000555555df0607 in handle_select (thd=thd@entry=0x7fff98000c58,
lex=lex@entry=0x7fff98004e08, result=result@entry=0x7fff9807db08,
setup_tables_done_option=setup_tables_done_option@entry=0)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#44 0x0000555555d6de41 in execute_sqlcom_select (thd=thd@entry=0x7fff98000c58,
all_tables=0x7fff9807b788) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#45 0x0000555555d7c2aa in mysql_execute_command (thd=thd@entry=0x7fff98000c58,
is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)
at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#46 0x0000555555d68c27 in mysql_parse (thd=0x7fff98000c58,
rawbuf=<optimized out>, length=<optimized out>,
parser_state=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#47 0x0000555555d74fdd in dispatch_command (command=command@entry=COM_QUERY,
thd=thd@entry=0x7fff98000c58, packet=packet@entry=0x7fff98008509 "",
packet_length=packet_length@entry=589, blocking=blocking@entry=true)
at /home/wx/mariadb-11.3.0/sql/sql_class.h:251
#48 0x0000555555d7721e in do_command (thd=0x7fff98000c58,
blocking=blocking@entry=true)
at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#49 0x0000555555e9a617 in do_handle_one_connection (connect=<optimized out>,
connect@entry=0x555557d83238, put_in_cache=put_in_cache@entry=true)
at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#50 0x0000555555e9a94d in handle_one_connection (arg=arg@entry=0x555557d83238)
at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#51 0x00005555561e658d in pfs_spawn_thread (arg=0x555557db13f8)
at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#52 0x00007ffff7b48609 in start_thread ()
from /lib/x86_64-linux-gnu/libpthread.so.0
#53 0x00007ffff7719133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

 Comments   
Comment by Alice Sherepa [ 2023-10-09 ]

Thank you! I repeated as described on 10.4-11.2, this is the same bug as MDEV-32290. I will add the test there

Version: '10.4.32-MariaDB-debug-log'  
mysqld: /10.4/src/sql/sql_select.cc:20659: enum_nested_loop_state sub_select_cache(JOIN*, JOIN_TAB*, bool): Assertion `cache != __null' failed.
 
231009 15:03:43 [ERROR] mysqld got signal 6 ;
 
 
 
Server version: 10.4.32-MariaDB-debug-log source revision: 0c7af6a2a19343cb9d4fedbd7165b8f73bc4cf96
 
 
 
/lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7f0a23d65fd6]
 
sql/sql_select.cc:20661(sub_select_cache(JOIN*, st_join_table*, bool))[0x5556ab26a1a5]
 
sql/sql_select.cc:21129(evaluate_join_record(JOIN*, st_join_table*, int))[0x5556ab26c8b9]
 
sql/sql_select.cc:20902(sub_select(JOIN*, st_join_table*, bool))[0x5556ab26b1ee]
 
sql/sql_select.cc:20423(do_select(JOIN*, Procedure*))[0x5556ab268f94]
 
sql/sql_select.cc:4605(JOIN::exec_inner())[0x5556ab1f6adc]
 
sql/sql_select.cc:4388(JOIN::exec())[0x5556ab1f410c]
 
sql/sql_union.cc:1603(st_select_lex_unit::exec())[0x5556ab3eca6a]
 
sql/item_subselect.cc:4049(subselect_union_engine::exec())[0x5556abb398d9]
 
sql/item_subselect.cc:758(Item_subselect::exec())[0x5556abb13d58]
 
sql/item_subselect.cc:1706(Item_exists_subselect::val_real())[0x5556abb1e34b]
 
sql/item_func.cc:1446(Item_func_div::real_op())[0x5556aba47254]
 
sql/item_func.cc:856(Item_func_hybrid_field_type::val_int_from_real_op())[0x5556aba4057a]
 
sql/sql_type.cc:4992(Type_handler_real_result::Item_func_hybrid_field_type_val_int(Item_func_hybrid_field_type*) const)[0x5556ab6a31fc]
 
sql/item_func.h:806(Item_func_hybrid_field_type::val_int())[0x5556ab0e4a53]
 
sql/item_func.cc:2120(Item_func_shift_left::val_int())[0x5556aba51c0c]
 
sql/item_cmpfunc.cc:4738(Item_func_bit_or::val_int())[0x5556ab9d7ac9]
 
sql/item.cc:6713(Item::save_int_in_field(Field*, bool))[0x5556ab9669e3]
 
sql/sql_type.cc:3843(Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const)[0x5556ab69d2a6]
 
sql/item.cc:6723(Item::save_in_field(Field*, bool))[0x5556ab966bc7]
 
sql/sql_base.cc:8939(fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool))[0x5556aafb0aed]
 
sql/sql_union.cc:130(select_unit::send_data(List<Item>&))[0x5556ab3dd11f]
 
sql/sql_select.cc:22098(end_send(JOIN*, st_join_table*, bool))[0x5556ab27450b]
 
sql/sql_select.cc:21129(evaluate_join_record(JOIN*, st_join_table*, int))[0x5556ab26c8b9]
 
sql/sql_select.cc:20941(sub_select(JOIN*, st_join_table*, bool))[0x5556ab26b854]
 
sql/sql_select.cc:20423(do_select(JOIN*, Procedure*))[0x5556ab268f94]
 
sql/sql_select.cc:4605(JOIN::exec_inner())[0x5556ab1f6adc]
 
sql/sql_select.cc:4388(JOIN::exec())[0x5556ab1f410c]
 
sql/sql_select.cc:4828(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5556ab1f82e8]
 
sql/sql_derived.cc:1265(mysql_derived_fill(THD*, LEX*, TABLE_LIST*))[0x5556ab04cf27]
 
sql/sql_derived.cc:200(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x5556ab04599c]
 
sql/sql_select.cc:13865(st_join_table::preread_init())[0x5556ab239cc7]
 
sql/sql_select.cc:20864(sub_select(JOIN*, st_join_table*, bool))[0x5556ab26ab63]
 
sql/sql_select.cc:21129(evaluate_join_record(JOIN*, st_join_table*, int))[0x5556ab26c8b9]
 
sql/sql_select.cc:20902(sub_select(JOIN*, st_join_table*, bool))[0x5556ab26b1ee]
 
sql/sql_select.cc:20423(do_select(JOIN*, Procedure*))[0x5556ab268f94]
 
sql/sql_select.cc:4605(JOIN::exec_inner())[0x5556ab1f6adc]
 
sql/sql_select.cc:4388(JOIN::exec())[0x5556ab1f410c]
 
sql/sql_select.cc:4828(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5556ab1f82e8]
 
sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x5556ab1c8de0]
 
sql/sql_parse.cc:6475(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5556ab134be4]
 
sql/sql_parse.cc:3978(mysql_execute_command(THD*))[0x5556ab12235b]
 
sql/sql_parse.cc:8012(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x5556ab13e0bf]
 
sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5556ab1144e5]
 
sql/sql_parse.cc:1378(do_command(THD*))[0x5556ab111010]
 
sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x5556ab51edeb]
 
sql/sql_connect.cc:1325(handle_one_connection)[0x5556ab51e68f]
 
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x5556ac1c9274]
 
nptl/pthread_create.c:478(start_thread)[0x7f0a24280609]
 
 
 
Query (0x62b0000a1290): SELECT t0 . c18 AS c18 FROM ( SELECT CONVERT ( -6932390468370636723 , UNSIGNED ) % RAND ( ) | RAND ( ) << EXP ( t0 . c40 ) / EXISTS ( SELECT t0 . c40 AS c53 FROM ( SELECT t0 . c18 AS c14 FROM t0 LEFT OUTER JOIN t0 AS t1 USING ( c18 , c40 ) ) AS t2 JOIN t0 ON t2 . c14 = t0 . c18 UNION SELECT c40 + 10 AS c3 FROM t0 WHERE RAND ( ) & TRIM( TRAILING FROM 84 ) << CONVERT ( -51 , UNSIGNED ) % RAND ( ) = t0 . c18 = ALL ( SELECT RAND ( ) % EXISTS ( SELECT 3277954112335138242 AS c46 ) AS c16 FROM t0 ) < -99 AND c18 < -2077949961864004476 ) AS c43 FROM t0 ) AS t3 JOIN t0 ON t0 . c18 = t3 . c43

Generated at Thu Feb 08 10:30:54 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.