[MDEV-32392] Segmentation fault at /mariadb-11.3.0/sql/sql_select.cc:14639 Created: 2023-10-10  Updated: 2023-10-11  Resolved: 2023-10-11

Status: Closed
Project: MariaDB Server
Component/s: Server
Affects Version/s: 11.3.0
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: None
Environment:

Ubuntu 20.04

Issue Links:
Duplicate

 Description   

Run these queries in release build:

CREATE TABLE t0 ( c36 VARCHAR ( 72 ) , INDEX i0 ( c36 ( 10 ) ) ) ;
INSERT INTO t0 VALUES ( 123 ) , ( 7 ) ;
ALTER TABLE t0 ADD COLUMN c34 INT AFTER c36 ;
INSERT INTO t0 VALUES ( 5 , 36 ) , ( 37 , 70 ) ;
SELECT t1 . c36 AS c50 , t0 . c34 AS c44 , -101 AS c56 FROM ( t0 , t0 AS t1 ) UNION SELECT RAND ( ) <= EXISTS ( SELECT t2 . c34 AS c37 FROM t0 AS t2 JOIN t0 INNER JOIN t0 AS t3 USING ( c34 , c36 ) ON t2 . c36 = t3 . c34 EXCEPT SELECT c36 + ( SELECT c36 AS c55 FROM t0 WHERE t0 . c36 >= 95.303926 = RAND ( ) / TRIM( t0 . c34 FROM 'Z\'<bvJ]#1)?(STg:+ecV\'2CK
#N3unVs@?8' ) = 128 GROUP BY c36 , c34 HAVING c36 = -87 LIMIT 1 ) AS c49 FROM t0 WHERE c34 < -33 LIMIT 50 ) >> ~ EXP ( t0 . c34 ) AS c16 , -90 AS c31 , -73 AS c22 FROM t0 WHERE c36 < 46 ;

Will trigger Segmentation fault.
GDB info:
Thread 17 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd1c17300 (LWP 2592)]
0x0000000000c684a2 in rr_unlock_row (tab=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:14639
14639 info->table->file->unlock_row();

#0 0x0000000000c684a2 in rr_unlock_row (tab=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:14639
#1 0x0000000000c9e243 in evaluate_join_record (join=<optimized out>, join@entry=0x6290000bbb30, join_tab=<optimized out>, join_tab@entry=0x62d0000df298, error=error@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23711
#2 0x0000000000be3396 in sub_select (join=0x6290000bbb30, join_tab=0x62d0000df298, end_of_records=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
#3 0x0000000000c9e284 in evaluate_join_record (join=join@entry=0x6290000bbb30, join_tab=<optimized out>, join_tab@entry=0x62d0000dee20, error=error@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#4 0x0000000000be3396 in sub_select (join=0x6290000bbb30, join_tab=0x62d0000dee20, end_of_records=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
#5 0x0000000000c45121 in do_select (join=0x6290000bbb30, procedure=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#6 JOIN::exec_inner (this=0x6290000bbb30) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#7 0x0000000000c428e9 in JOIN::exec (this=0x6290000bbb30) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#8 0x0000000000df0df7 in st_select_lex_unit::exec_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:2389
#9 0x00000000015d8bb5 in subselect_union_engine::exec (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4187
#10 0x00000000015b3edc in Item_subselect::exec (this=0x6290000b77e0) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#11 0x00000000015bda3d in Item_exists_subselect::val_int (this=0x6290000b77e0) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1840
#12 0x00000000014c3f06 in Item::to_longlong_null (this=0x6290000b77e0) at /home/wx/mariadb-11.3.0/sql/item.h:1452
#13 Func_handler_shift_right_int_to_ulonglong::to_longlong_null (this=<optimized out>, item=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_func.cc:2223
#14 0x0000000001413062 in Item_handled_func::Handler_int::val_int (this=0x8, item=0x6290000b7cf0) at /home/wx/mariadb-11.3.0/sql/item_func.h:696
#15 0x0000000001412fd6 in Item_handled_func::Handler_int::val_real (this=0x8, item=0xc3200015801) at /home/wx/mariadb-11.3.0/sql/item_func.h:682
#16 0x00000000013b09df in Arg_comparator::compare_real (this=0x6290000b7e68) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:848
#17 0x00000000013b62ab in Arg_comparator::compare (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#18 Item_func_le::val_int (this=0x6290000b7db0) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1827
#19 0x00000000013552b8 in Item::save_int_in_field (this=0x6290000b7db0, field=0x6190000c03b8, no_conversions=false) at /home/wx/mariadb-11.3.0/sql/item.cc:6843
#20 0x00000000013554a9 in Item::save_in_field (this=0x6290000b7db0, field=0x6190000c03b8, no_conversions=false) at /home/wx/mariadb-11.3.0/sql/item.cc:6853
#21 0x00000000009d9dc9 in fill_record (thd=<optimized out>, table=<optimized out>, ptr=0x62000006b998, values=..., ignore_errors=<optimized out>, use_value=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_base.cc:9320
#22 0x0000000000de507b in select_unit::send_data (this=0x6290000ba408, values=...) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:122
#23 0x0000000000c36f9a in select_result_sink::send_data_with_check (this=0x8, items=..., u=<optimized out>, sent=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_class.h:5842
#24 end_send (join=0x6290000baed8, join_tab=0x62d0000d6fe0, end_of_records=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:24710
#25 0x0000000000c9e284 in evaluate_join_record (join=join@entry=0x6290000baed8, join_tab=<optimized out>, join_tab@entry=0x62d0000d6b68, error=error@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#26 0x0000000000be340f in sub_select (join=0x6290000baed8, join_tab=0x62d0000d6b68, end_of_records=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
#27 0x0000000000c45121 in do_select (join=0x6290000baed8, procedure=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#28 JOIN::exec_inner (this=0x6290000baed8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#29 0x0000000000c428e9 in JOIN::exec (this=0x6290000baed8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#30 0x0000000000df0df7 in st_select_lex_unit::exec_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:2389
#31 0x0000000000de4314 in st_select_lex_unit::exec (this=this@entry=0x62b0001704a8) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:2292
#32 0x0000000000dde8ef in mysql_union (thd=thd@entry=0x62b00016c218, lex=lex@entry=0x62b0001703c8, result=result@entry=0x6290000ba3d8, unit=unit@entry=0x62b0001704a8, setup_tables_done_option=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:45
#33 0x0000000000be42e3 in handle_select (thd=thd@entry=0x62b00016c218, lex=lex@entry=0x62b0001703c8, result=<optimized out>, result@entry=0x6290000ba3d8, setup_tables_done_option=108370615584084, setup_tables_done_option@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:618
#34 0x0000000000b3df18 in execute_sqlcom_select (thd=0x62b00016c218, all_tables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#35 0x0000000000b2cd51 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#36 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd1c15a80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#37 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#38 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#39 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#40 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x608001425fb8) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#41 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000006618) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#42 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#43 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

 Comments   
Comment by Alice Sherepa [ 2023-10-11 ]

Thanks! This is the same as MDEV-32290

mysqld: /10.4/src/sql/sql_select.cc:20659: enum_nested_loop_state sub_select_cache(JOIN*, JOIN_TAB*, bool): Assertion `cache != __null' failed.
 
231011 17:26:49 [ERROR] mysqld got signal 6 ;
 
Server version: 10.4.32-MariaDB-debug-log source revision: 0c7af6a2a19343cb9d4fedbd7165b8f73bc4cf96
 
 
 
/lib/x86_64-linux-gnu/libc.so.6(+0x22729)[0x7f49f9e6a729]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7f49f9e7bfd6]
 
sql/sql_select.cc:20661(sub_select_cache(JOIN*, st_join_table*, bool))[0x5556900571a5]
 
sql/sql_select.cc:21129(evaluate_join_record(JOIN*, st_join_table*, int))[0x5556900598b9]
 
sql/sql_select.cc:20902(sub_select(JOIN*, st_join_table*, bool))[0x5556900581ee]
 
sql/sql_select.cc:20423(do_select(JOIN*, Procedure*))[0x555690055f94]
 
sql/sql_select.cc:4605(JOIN::exec_inner())[0x55568ffe3adc]
 
sql/sql_select.cc:4388(JOIN::exec())[0x55568ffe110c]
 
sql/sql_union.cc:1603(st_select_lex_unit::exec())[0x5556901d9a6a]
 
sql/item_subselect.cc:4049(subselect_union_engine::exec())[0x5556909268d9]
 
sql/item_subselect.cc:758(Item_subselect::exec())[0x555690900d58]
 
sql/item_subselect.cc:1717(Item_exists_subselect::val_int())[0x55569090b5ab]
 
sql/item_func.cc:2135(Item_func_shift_right::val_int())[0x55569083f1c8]
 
sql/item_func.cc:756(Item_int_func::val_real())[0x55569082c0e1]
 
sql/item_cmpfunc.cc:854(Arg_comparator::compare_real())[0x55569079bb13]
 
sql/item_cmpfunc.h:104(Arg_comparator::compare())[0x5556907df64e]
 
sql/item_cmpfunc.cc:1836(Item_func_le::val_int())[0x5556907a7abb]
 
sql/item.cc:6713(Item::save_int_in_field(Field*, bool))[0x5556907539e3]
 
sql/sql_type.cc:3843(Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const)[0x55569048a2a6]
 
sql/item.cc:6723(Item::save_in_field(Field*, bool))[0x555690753bc7]
 
sql/sql_base.cc:8939(fill_record(THD*, TABLE*, Field**, List<Item>&, bool, bool))[0x55568fd9daed]
 
sql/sql_union.cc:130(select_unit::send_data(List<Item>&))[0x5556901ca11f]
 
sql/sql_select.cc:22098(end_send(JOIN*, st_join_table*, bool))[0x55569006150b]
 
sql/sql_select.cc:21129(evaluate_join_record(JOIN*, st_join_table*, int))[0x5556900598b9]
 
sql/sql_select.cc:20941(sub_select(JOIN*, st_join_table*, bool))[0x555690058854]
 
sql/sql_select.cc:20423(do_select(JOIN*, Procedure*))[0x555690055f94]
 
sql/sql_select.cc:4605(JOIN::exec_inner())[0x55568ffe3adc]
 
sql/sql_select.cc:4388(JOIN::exec())[0x55568ffe110c]
 
sql/sql_union.cc:1603(st_select_lex_unit::exec())[0x5556901d9a6a]
 
sql/sql_union.cc:42(mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long))[0x5556901c9170]
 
sql/sql_select.cc:432(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55568ffb5aa9]
 
sql/sql_parse.cc:6475(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55568ff21be4]
 
sql/sql_parse.cc:3978(mysql_execute_command(THD*))[0x55568ff0f35b]
 
sql/sql_parse.cc:8012(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55568ff2b0bf]
 
sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55568ff014e5]
 
sql/sql_parse.cc:1378(do_command(THD*))[0x55568fefe010]
 
sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x55569030bdeb]
 
sql/sql_connect.cc:1325(handle_one_connection)[0x55569030b68f]
 
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x555690fb6274]
 
nptl/pthread_create.c:478(start_thread)[0x7f49fa396609]
 
 
 
Query (0x62b0000a1290): SELECT t1 . c36 AS c50 , t0 . c34 AS c44 , -101 AS c56 FROM ( t0 , t0 AS t1 ) UNION SELECT RAND ( ) <= EXISTS ( SELECT t2 . c34 AS c37 FROM t0 AS t2 JOIN t0 INNER JOIN t0 AS t3 USING ( c34 , c36 ) ON t2 . c36 = t3 . c34 EXCEPT SELECT c36 + ( SELECT c36 AS c55 FROM t0 WHERE t0 . c36 >= 95.303926 = RAND ( ) / TRIM( t0 . c34 FROM 'Z\'<bvJ]#1)?(STg:+ecV\'2CK
 
#N3unVs@?8' ) = 128 GROUP BY c36 , c34 HAVING c36 = -87 LIMIT 1 ) AS c49 FROM t0 WHERE c34 < -33 LIMIT 50 ) >> ~ EXP ( t0 . c34 ) AS c16 , -90 AS c31 , -73 AS c22 FROM t0 WHERE c36 < 46

Generated at Thu Feb 08 10:31:00 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.