[MDEV-32408] Segmentation fault at /mariadb-11.3.0/sql/sql_select.cc:32270 Created: 2023-10-10  Updated: 2023-10-16  Resolved: 2023-10-16

Status: Closed
Project: MariaDB Server
Component/s: Optimizer, Server
Affects Version/s: 11.3.0
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: None
Environment:

Ubuntu 20.04

Issue Links:
Duplicate

 Description   

Run these queries in release build:

CREATE TABLE t0 ( c11 INT , c25 INT ) ;
INSERT INTO t0 VALUES ( DEFAULT , DEFAULT ) , ( DEFAULT , DEFAULT ) ;
DELETE FROM t0 WHERE EXISTS ( SELECT c11 = RAND ( ) * RTRIM ( c11 ) / EXP ( c11 ) AS c35 FROM t0 WHERE -115 = + NULLIF ( 35 , 117 NOT IN ( RAND ( ) * TRUNCATE ( -59 , -2 ) - TRUNCATE ( 57 , 2 ) = 78 ) ) EXCEPT ALL SELECT c11 + 29 AS c47 FROM t0 WHERE c11 < 43 AND c25 < 48 GROUP BY c11 , c11 , c11 WITH ROLLUP ) = 84 OR SQRT ( ~ EXP ( t0 . c25 ) + CONVERT ( c11 , UNSIGNED ) % RAND ( ) ) - t0 . c25 ;

Will trigger Segmentation fault.
GDB info:
Thread 16 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd242e300 (LWP 3254)]
0x0000000000c9cdfc in AGGR_OP::end_send (this=this@entry=0x0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:32270
32270 TABLE *table= join_tab->table;
(gdb) p join_tab
Cannot access memory at address 0x0

#0 0x0000000000c9cdfc in AGGR_OP::end_send (this=this@entry=0x0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:32270
#1 0x0000000000c388f1 in sub_select_postjoin_aggr (join=0x6290000b5218, join_tab=0x6290000c07a8, end_of_records=true) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23128
#2 0x0000000000c4536c in do_select (join=0x6290000b5218, procedure=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#3 JOIN::exec_inner (this=0x6290000b5218) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#4 0x0000000000c428e9 in JOIN::exec (this=0x6290000b5218) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#5 0x0000000000df0df7 in st_select_lex_unit::exec_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:2389
#6 0x00000000015d8bb5 in subselect_union_engine::exec (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4187
#7 0x00000000015b3edc in Item_subselect::exec (this=0x6290000b19a8) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#8 0x00000000015bda3d in Item_exists_subselect::val_int (this=0x6290000b19a8) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1840
#9 0x00000000013ae22f in Arg_comparator::compare_int_signed (this=0x6290000b1cf0) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:944
#10 0x00000000013b5ea2 in Arg_comparator::compare (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#11 Item_func_eq::val_int (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#12 0x00000000010d6cd1 in Type_handler_int_result::Item_val_bool (this=<optimized out>, item=0x0) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082
#13 0x00000000013dc493 in Item_cond_or::val_int (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5542
#14 0x0000000000c9dd1c in evaluate_join_record (join=join@entry=0x6290000b2bd8, join_tab=0x62b00016c218, join_tab@entry=0x6290000b9238, error=error@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23545
#15 0x0000000000be340f in sub_select (join=0x6290000b2bd8, join_tab=0x6290000b9238, end_of_records=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
#16 0x0000000000c45121 in do_select (join=0x6290000b2bd8, procedure=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#17 JOIN::exec_inner (this=0x6290000b2bd8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#18 0x0000000000c428e9 in JOIN::exec (this=this@entry=0x6290000b2bd8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#19 0x0000000000cc4813 in Sql_cmd_dml::execute_inner (this=<optimized out>, thd=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:33413
#20 0x0000000000a51126 in Sql_cmd_delete::execute_inner (this=<optimized out>, thd=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_delete.cc:1799
#21 0x0000000000cc40b2 in Sql_cmd_dml::execute (this=0x6290000b2ac8, thd=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:33350
#22 0x0000000000b2ce82 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4361
#23 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd1c15a80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#24 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#25 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#26 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#27 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x608001b3bc38) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#28 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000005118) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#29 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#30 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

 Comments   
Comment by Alice Sherepa [ 2023-10-16 ]

Thank you for the report! This is the same as MDEV-32321

Version: '10.5.23-MariaDB-debug-log'  
mariadbd: /10.5/src/sql/sql_select.cc:20861: enum_nested_loop_state sub_select_postjoin_aggr(JOIN*, JOIN_TAB*, bool): Assertion `aggr != __null' failed.
 
231016 17:58:25 [ERROR] mysqld got signal 6 ;
 
 
 
 
 
Server version: 10.5.23-MariaDB-debug-log source revision: b04af64882f233e3937f729aac321de504db3f63
 
 
 
/lib/x86_64-linux-gnu/libc.so.6(+0x33fd6)[0x7f5e32c1cfd6]
 
sql/sql_select.cc:20863(sub_select_postjoin_aggr(JOIN*, st_join_table*, bool))[0x55bb5ab0b105]
 
sql/sql_select.cc:21120(sub_select(JOIN*, st_join_table*, bool))[0x55bb5ab0bd24]
 
sql/sql_select.cc:20698(do_select(JOIN*, Procedure*))[0x55bb5ab0a424]
 
sql/sql_select.cc:4602(JOIN::exec_inner())[0x55bb5aa94972]
 
sql/sql_select.cc:4383(JOIN::exec())[0x55bb5aa91f7c]
 
sql/sql_union.cc:2252(st_select_lex_unit::exec())[0x55bb5acc3509]
 
sql/item_subselect.cc:4084(subselect_union_engine::exec())[0x55bb5b452b3f]
 
sql/item_subselect.cc:794(Item_subselect::exec())[0x55bb5b42cae2]
 
sql/item_subselect.cc:1753(Item_exists_subselect::val_int())[0x55bb5b4373a5]
 
sql/item_cmpfunc.cc:952(Arg_comparator::compare_int_signed())[0x55bb5b2c2265]
 
sql/item_cmpfunc.h:102(Arg_comparator::compare())[0x55bb5b306acc]
 
sql/item_cmpfunc.cc:1795(Item_func_eq::val_int())[0x55bb5b2cc3c3]
 
sql/sql_type.cc:5082(Type_handler_int_result::Item_val_bool(Item*) const)[0x55bb5af9cb92]
 
sql/item.h:1498(Item::val_bool())[0x55bb5a6e2dce]
 
sql/item_cmpfunc.cc:5552(Item_cond_or::val_int())[0x55bb5b2ef894]
 
sql/opt_range.h:1728(SQL_SELECT::skip_record(THD*))[0x55bb5acea1af]
 
sql/sql_delete.cc:220(record_should_be_deleted(THD*, TABLE*, SQL_SELECT*, Explain_delete*, bool))[0x55bb5b6b57e9]
 
sql/sql_delete.cc:740(mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*))[0x55bb5b6ba32e]
 
sql/sql_parse.cc:4889(mysql_execute_command(THD*))[0x55bb5a9c1667]
 
sql/sql_parse.cc:8120(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55bb5a9d7977]
 
sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55bb5a9ad3a5]
 
sql/sql_parse.cc:1375(do_command(THD*))[0x55bb5a9a9d0d]
 
sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x55bb5ae0895b]
 
sql/sql_connect.cc:1320(handle_one_connection)[0x55bb5ae082bf]
 
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55bb5ba94aba]
 
 
 
 
 
Trying to get some variables.
 
Some pointers may be invalid and cause the dump to abort.
 
Query (0x62b0000852a8): DELETE FROM t0 WHERE EXISTS ( SELECT c11 = RAND ( ) * RTRIM ( c11 ) / EXP ( c11 ) AS c35 FROM t0 WHERE -115 = + NULLIF ( 35 , 117 NOT IN ( RAND ( ) * TRUNCATE ( -59 , -2 ) - TRUNCATE ( 57 , 2 ) = 78 ) ) EXCEPT ALL SELECT c11 + 29 AS c47 FROM t0 WHERE c11 < 43 AND c25 < 48 GROUP BY c11 , c11 , c11 WITH ROLLUP ) = 84 OR SQRT ( ~ EXP ( t0 . c25 ) + CONVERT ( c11 , UNSIGNED ) % RAND ( ) ) - t0 . c25

Generated at Thu Feb 08 10:31:08 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.