[MDEV-32396] Segmentation fault at /mariadb-11.3.0/sql/sql_select.cc:27583 Created: 2023-10-10  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Optimizer - Window functions, Server
Affects Version/s: 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3.0
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Oleksandr Byelkin
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Ubuntu 20.04


 Description   

Run these queries in release build:

CREATE TABLE t0 ( CONSTRAINT cc0 UNIQUE i0 ( c24 ) , c24 INT ) ;
INSERT INTO t0 VALUES ( -87 ) , ( -61 ) ;
CREATE UNIQUE INDEX i1 ON t0 ( c24 ) ;
INSERT INTO t0 VALUES ( -128 ) , ( 86 ) ;
SELECT COUNT( DISTINCT c25 , c25 < -102 AND c25 < -84 AND c24 < 49 AND c24 < -29 OR c24 = ( IF ( c24 , t0 . c24 = SUBSTRING( t1 . c25 , 'lDO<]uhHvA-bB%S^x?A"w\'5YWeZP#t6%#;!Iy9^?[x#)j' , '?j2[uT(.SDz' ) IS NOT TRUE , -42 ) ) IS UNKNOWN ) OVER ( ORDER BY t0 . c24 , ( t1 . c25 + ( SELECT c24 AS c62 FROM t0 WHERE t1 . c25 >= -39.140759 = RAND ( ) / TRIM( t0 . c24 FROM 'LNc@@u*lKO' ) = 73 GROUP BY c24 , c25 HAVING c24 = 62 LIMIT 1 ) ) ) << RAND ( ) & TRIM( TRAILING FROM t1 . c25 ) = ANY ( SELECT c25 AS c22 FROM t0 HAVING c24 = + EXISTS ( SELECT -18 AS c44 ) ) AS c22 FROM ( SELECT c24 AS c25 FROM t0 ) AS t1 JOIN t0 ON t0 . c24 = t1 . c25 GROUP BY c25 , c24 ;

Will trigger Segmentation fault.
GDB info:
Thread 16 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd242e300 (LWP 2721)]
0x0000000000ca7a01 in setup_order (thd=thd@entry=0x62b00016c218, ref_pointer_array=..., tables=tables@entry=0x6290000c5cd0, fields=..., all_fields=...,
order=0x6290000942c0, from_window_spec=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:27583
27583 Item * const item= *order->item;

#0 0x0000000000ca7a01 in setup_order (thd=thd@entry=0x62b00016c218, ref_pointer_array=..., tables=tables@entry=0x6290000cada0, fields=..., all_fields=..., order=0x629000094310, from_window_spec=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:27583
#1 0x000000000111e6f1 in setup_windows (thd=<optimized out>, ref_pointer_array=..., tables=<optimized out>, fields=..., all_fields=..., win_specs=..., win_funcs=...) at /home/wx/mariadb-11.3.0/sql/sql_window.cc:241
#2 0x0000000000bf3a8a in setup_without_group (thd=<optimized out>, ref_pointer_array=..., tables=0x6290000cada0, leaves=..., fields=..., all_fields=..., conds=0x6290000ceb30, order=0x0, group=0x6290000cdb08, win_specs=..., win_funcs=..., hidden_group_fields=<optimized out>, reserved=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:955
#3 JOIN::prepare (this=0x6290000ce6a0, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=<optimized out>, having_init=<optimized out>, proc_param_init=<optimized out>, select_lex_arg=<optimized out>, unit_arg=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1531
#4 0x0000000000be4c97 in mysql_select (thd=<optimized out>, thd@entry=0x62b00016c218, tables=0x7fffd1c13400, fields=..., conds=0xd1c13403, og_num=0, order=0x166c380 <sql_print_error(char const*, ...)>, group=0x6290000cdb08, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x6290000ce670, unit=0x62b0001704a8, select_lex=0x6290000917d0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5224
#5 0x0000000000be4596 in handle_select (thd=thd@entry=0x62b00016c218, lex=<optimized out>, lex@entry=0x62b0001703c8, result=<optimized out>, result@entry=0x6290000ce670, setup_tables_done_option=<optimized out>, setup_tables_done_option@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#6 0x0000000000b3df18 in execute_sqlcom_select (thd=0x62b00016c218, all_tables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#7 0x0000000000b2cd51 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#8 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd1c15a80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#9 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#10 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#11 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#12 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x60800151d7b8) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#13 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000006618) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#14 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#15 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

 Comments   
Comment by Alice Sherepa [ 2023-11-02 ]

Thanks! I repeated on 10.4-11.2

CREATE TABLE t0 ( a int) ;
 
INSERT INTO t0 VALUES ( -87 ) , ( -61 ) ,( -128 ) , ( 86 ) ;
 
 
 
SELECT COUNT(b) OVER (ORDER BY t0.a) FROM ( SELECT a AS b FROM t0 ) AS t1 JOIN t0 ON t0.a = t1.b GROUP BY a;


mysqld: /10.4/src/sql/sql_array.h:64: Element_type& Bounds_checked_array<Element_type>::operator[](size_t) [with Element_type = Item*; size_t = long unsigned int]: Assertion n < m_size' failed.
 
231102 17:19:28 [ERROR] mysqld got signal 6 ;
 
 
 
Server version: 10.4.32-MariaDB-debug-log source revision: b4de67da451b580989843fd63c0d248f7b8b3a53
 
 
 
sql/signal_handler.cc:235(handle_fatal_signal)[0x55cd223bf5db]
 
sigaction.c:0(__restore_rt)[0x7ffbfc44d420]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7ffbfbf26fd6]
 
sql/sql_array.h:65(Bounds_checked_array<Item*>::operator[](unsigned long))[0x55cd21aa076d]
 
sql/sql_select.cc:24913(find_order_in_list(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, st_order*, List<Item>&, List<Item>&, bool, bool, bool))[0x55cd21d68cad]
 
sql/sql_select.cc:24978(setup_order(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<Item>&, List<Item>&, st_order*, bool))[0x55cd21d6937f]
 
sql/sql_window.cc:247(setup_windows(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<Item>&, List<Item>&, List<Window_spec>&, List<Item_window_func>&))[0x55cd221bd807]
 
sql/sql_select.cc:761(setup_without_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<TABLE_LIST>&, List<Item>&, List<Item>&, Item**, st_order*, st_order*, List<Window_spec>&, List<Item_window_func>&, bool*))[0x55cd21cab015]
 
sql/sql_select.cc:1355(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x55cd21cb2505]
 
sql/sql_select.cc:4809(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55cd21cd7dd1]
 
sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55cd21ca8ac8]
 
sql/sql_parse.cc:6475(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55cd21c14830]
 
sql/sql_parse.cc:3978(mysql_execute_command(THD*))[0x55cd21c01fa7]
 
sql/sql_parse.cc:8013(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55cd21c1dd6f]
 
sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55cd21bf4131]
 
sql/sql_parse.cc:1378(do_command(THD*))[0x55cd21bf0c5c]
 
sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x55cd2200055f]
 
sql/sql_connect.cc:1325(handle_one_connection)[0x55cd21fffe03]
 
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55cd22c9c498]
 
nptl/pthread_create.c:478(start_thread)[0x7ffbfc441609]
 
 
 
Query (0x62b0000a1290): SELECT COUNT(b) OVER (ORDER BY t0.a) FROM ( SELECT a AS b FROM t0 ) AS t1 JOIN t0 ON t0.a = t1.b GROUP BY a

on non-debug:

 
 
231102 16:17:34 [ERROR] mysqld got signal 11 ;
 
Server version: 11.1.2-MariaDB source revision: 9bc25d98209df6810f7a7d5e7dd3ae677a313ab5
 
 
 
sql/signal_handler.cc:241(handle_fatal_signal)[0x559d9cab21f7]
 
sigaction.c:0(__restore_rt)[0x7f51699ec420]
 
sql/sql_select.cc:27581(setup_order(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<Item>&, List<Item>&, st_order*, bool))[0x559d9c8afbee]
 
sql/sql_window.cc:240(setup_windows(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<Item>&, List<Item>&, List<Window_spec>&, List<Item_window_func>&))[0x559d9ca106a5]
 
sql/sql_select.cc:955(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x559d9c8bcd88]
 
sql/sql_select.cc:5217(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x559d9c8d39c2]
 
sql/sql_select.cc:640(handle_select(THD*, LEX*, select_result*, unsigned long long))[0x559d9c8d3cc4]
 
sql/sql_parse.cc:6041(execute_sqlcom_select(THD*, TABLE_LIST*))[0x559d9c6f55f1]
 
sql/sql_parse.cc:3954(mysql_execute_command(THD*, bool))[0x559d9c863910]
 
sql/sql_parse.cc:7787(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x559d9c86591b]
 
sql/sql_parse.cc:1951(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x559d9c867d58]
 
sql/sql_parse.cc:1407(do_command(THD*, bool))[0x559d9c869283]
 
sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x559d9c9760c7]
 
sql/sql_connect.cc:1324(handle_one_connection)[0x559d9c976364]
 
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x559d9cd01e5c]
 
nptl/pthread_create.c:478(start_thread)[0x7f51699e0609]
 
 
 
Query (0x7f50e0010c40): SELECT COUNT( DISTINCT c25 , c25 < -102 AND c25 < -84 AND c24 < 49 AND c24 < -29 OR c24 = ( IF ( c24 , t0 . c24 = SUBSTRING( t1 . c25 , 'a' , 'b' ) IS NOT TRUE , -42 ) ) IS UNKNOWN ) OVER 
( ORDER BY t0 . c24 , ( t1 . c25 + ( SELECT c24 AS c62 FROM t0 WHERE t1 . c25 >= -39.140759 = RAND ( ) / TRIM( t0 . c24 FROM 'b' ) = 73 GROUP BY c24 , c25 HAVING c24 = 62 LIMIT 1 ) ) ) 
<< RAND ( ) & TRIM( TRAILING FROM t1 . c25 ) = ANY ( SELECT c25 AS c22 FROM t0 HAVING c24 = + EXISTS ( SELECT -18 AS c44 ) ) AS c22 FROM ( SELECT c24 AS c25 FROM t0 ) AS t1 JOIN t0 ON t0 . c24 = t1 . c25
 
 GROUP BY c25 , c24
 
 
 



CREATE TABLE t0 ( a int) ;
 
INSERT INTO t0 VALUES ( -87 ) , ( -61 ) ,( -128 ) , ( 86 ) ;
 
 
 
SELECT COUNT(b) OVER (ORDER BY t1.b)=ANY ( SELECT b FROM t0  ) 
FROM ( SELECT a AS b FROM t0 ) AS t1 JOIN t0 ON t0.a = t1.b GROUP BY a;


 
 
mysqld: /10.4/src/sql/item_subselect.cc:1831: virtual longlong Item_in_subselect::val_int(): Assertion 0' failed.
 
231102 17:25:31 [ERROR] mysqld got signal 6 ;
 
 
 
Server version: 10.4.32-MariaDB-debug-log source revision: b4de67da451b580989843fd63c0d248f7b8b3a53
 
 
 
/lib/x86_64-linux-gnu/libc.so.6(+0x22729)[0x7f8dcc11a729]
 
/lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7f8dcc12bfd6]
 
sql/item_subselect.cc:1832(Item_in_subselect::val_int())[0x56326ca2a439]
 
sql/item.cc:6718(Item::save_int_in_field(Field*, bool))[0x56326c87112b]
 
sql/sql_type.cc:3847(Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const)[0x56326c5a875a]
 
sql/item.cc:6728(Item::save_in_field(Field*, bool))[0x56326c87130f]
 
sql/item.h:3284(Item_result_field::save_in_result_field(bool))[0x56326bebf659]
 
sql/sql_select.cc:26211(copy_funcs(Item**, THD const*))[0x56326c19bce5]
 
sql/sql_select.cc:22374(end_write(JOIN*, st_join_table*, bool))[0x56326c17fcc0]
 
sql/sql_select.cc:29651(AGGR_OP::put_record(bool))[0x56326c1b63b9]
 
sql/sql_select.h:1085(AGGR_OP::put_record())[0x56326c1c5e87]
 
sql/sql_select.cc:20627(sub_select_postjoin_aggr(JOIN*, st_join_table*, bool))[0x56326c172e9b]
 
sql/sql_join_cache.cc:2528(JOIN_CACHE::generate_full_extensions(unsigned char*))[0x56326c4db372]
 
sql/sql_join_cache.cc:2420(JOIN_CACHE::join_matching_records(bool))[0x56326c4dabd5]
 
sql/sql_join_cache.cc:2173(JOIN_CACHE::join_records(bool))[0x56326c4d8f33]
 
sql/sql_select.cc:20685(sub_select_cache(JOIN*, st_join_table*, bool))[0x56326c17317a]
 
sql/sql_select.cc:20867(sub_select(JOIN*, st_join_table*, bool))[0x56326c173904]
 
sql/sql_select.cc:20445(do_select(JOIN*, Procedure*))[0x56326c172004]
 
sql/sql_select.cc:4625(JOIN::exec_inner())[0x56326c0ffa46]
 
sql/sql_select.cc:4408(JOIN::exec())[0x56326c0fd076]
 
sql/sql_select.cc:4848(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x56326c101252]
 
sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x56326c0d1ac8]
 
sql/sql_parse.cc:6475(execute_sqlcom_select(THD*, TABLE_LIST*))[0x56326c03d830]
 
sql/sql_parse.cc:3978(mysql_execute_command(THD*))[0x56326c02afa7]
 
sql/sql_parse.cc:8013(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x56326c046d6f]
 
sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x56326c01d131]
 
sql/sql_parse.cc:1378(do_command(THD*))[0x56326c019c5c]
 
sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x56326c42955f]
 
sql/sql_connect.cc:1325(handle_one_connection)[0x56326c428e03]
 
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x56326d0c5498]
 
nptl/pthread_create.c:478(start_thread)[0x7f8dcc646609]
 
 
 
Query (0x62b0000a1290): SELECT COUNT(b) OVER (ORDER BY t1.b)=ANY ( SELECT b FROM t0  ) 
FROM ( SELECT a AS b FROM t0 ) AS t1 JOIN t0 ON t0.a = t1.b GROUP BY a

also please check the initial test case.
it is supposed to return ERROR 42000: This version of MariaDB doesn't yet support 'COUNT(DISTINCT) aggregate as window function'

Comment by Sergei Petrunia [ 2023-11-09 ]

Looks like a problem in Name Resolution. Or at least, the first problem is in name resolution.

Generated at Thu Feb 08 10:31:02 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.