[#MDEV-32719] Segmentation fault at /mariadb-11.3.0/sql/item.h:3690

CREATE TABLE x ( x BOOLEAN ) ;

INSERT INTO x ( x ) VALUES ( 1 ) ;

UPDATE x SET x = NULL WHERE x = ( SELECT 'x' / 'x' WHERE NULL BETWEEN ( SELECT x AS x FROM x AS x GROUP BY x ) AND 1 ) ;

INSERT INTO x ( x ) VALUES ( 1 ) , ( 1 ) ;

SELECT ( 1 + 1 ) / 1 AS x WHERE EXISTS ( SELECT 1 FROM ( SELECT x FROM x UNION SELECT x FROM x WHERE x < ( SELECT x FROM x GROUP BY x + 1 , x ) ) AS x WHERE x IN ( SELECT x FROM ( SELECT x = 'x' AND x = 1 FROM x WHERE x < ( WITH x AS ( SELECT NOT ( SELECT 1 WHERE ( SELECT x FROM x WHERE x != 1 GROUP BY x ) != x ) FROM x ) SELECT x FROM x GROUP BY x + 1 , x ) UNION SELECT x FROM x ) AS x GROUP BY x , x HAVING ( x IN ( SELECT x WHERE x = 'x' AND x IN ( SELECT x FROM x WHERE x = 'x' ) GROUP BY x HAVING ( x IN ( SELECT x WHERE x = 'x' AND x IN ( SELECT x FROM x WHERE x = 'x' ) ) AND x IS NULL AND x IN ( 1 , x = 1 AND x IN ( x NOT IN ( SELECT x ) ) , 1 , 1 , 1 ) ) ) AND x IS NULL AND x IN ( 1 , x = 1 AND x IN ( x NOT IN ( SELECT x FROM x ) ) , 1 , 1 , 1 ) ) ) ) ;

#0  0x0000555557bcdf72 in Item_field::type_handler (this=0x629000156cf8) at /home/wx/mariadb-11.3.0/sql/item.h:3690

#1  0x000055555703288f in Item_ref::type_handler (this=0x62d00002fa18) at /home/wx/mariadb-11.3.0/sql/item.h:5647

#2  0x0000555556ea63b4 in Item::result_type (this=0x62d00002fa18) at /home/wx/mariadb-11.3.0/sql/item.h:1273

#3  0x00005555570342b6 in Item_ref::check_cols (this=0x62d00002fa18, c=1) at /home/wx/mariadb-11.3.0/sql/item.h:5749

#4  0x0000555557bb02cc in Item_ref::fix_fields (this=0x62f000008b70, thd=0x62c0001d0288, reference=0x7fffe33bdd10) at /home/wx/mariadb-11.3.0/sql/item.cc:8257

#5  0x0000555557b9fa99 in Item_field::fix_fields (this=0x629000156cf8, thd=0x62c0001d0288, reference=0x62d000042730) at /home/wx/mariadb-11.3.0/sql/item.cc:6081

#6  0x0000555556f0404f in Item::fix_fields_if_needed (this=0x629000156cf8, thd=0x62c0001d0288, ref=0x62d000042730) at /home/wx/mariadb-11.3.0/sql/item.h:1147

#7  0x0000555557c6c9f2 in Item_func::fix_fields (this=0x62d0000426b0, thd=0x62c0001d0288, ref=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:349

#8  0x000055555717464e in st_select_lex::pushdown_from_having_into_where (this=0x629000156820, thd=0x62c0001d0288, having=0x62d000042770) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:11284

#9  0x00005555572c0714 in JOIN::optimize_inner (this=0x62d00002a350) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2381

#10 0x00005555572bbba6 in JOIN::optimize (this=0x62d00002a350) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944

#11 0x0000555557143851 in st_select_lex::optimize_unflattened_subqueries (this=0x6290000f6160, const_only=false) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916

#12 0x00005555577b7509 in JOIN::optimize_unflattened_subqueries (this=0x62d0000378f8) at /home/wx/mariadb-11.3.0/sql/opt_subselect.cc:5864

#13 0x00005555572c91e7 in JOIN::optimize_stage2 (this=0x62d0000378f8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:3229

#14 0x00005555572c2f34 in JOIN::optimize_inner (this=0x62d0000378f8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650

#15 0x00005555572bbba6 in JOIN::optimize (this=0x62d0000378f8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944

#16 0x0000555557143851 in st_select_lex::optimize_unflattened_subqueries (this=0x6290000f5910, const_only=true) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916

#17 0x00005555577b75f6 in JOIN::optimize_constant_subqueries (this=0x62d000035188) at /home/wx/mariadb-11.3.0/sql/opt_subselect.cc:5898

#18 0x00005555572beb79 in JOIN::optimize_inner (this=0x62d000035188) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2274

#19 0x00005555572bbba6 in JOIN::optimize (this=0x62d000035188) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944

#20 0x00005555572dd9ba in mysql_select (thd=0x62c0001d0288, tables=0x0, fields=..., conds=0x62d000034530, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2165049856, result=0x62d000035158, unit=0x62c0001d46d8, select_lex=0x6290000f5910) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235

#21 0x00005555572ad18a in handle_select (thd=0x62c0001d0288, lex=0x62c0001d45f8, result=0x62d000035158, setup_tables_done_option=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628

#22 0x00005555571ce583 in execute_sqlcom_select (thd=0x62c0001d0288, all_tables=0x6290000f6d40) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013

#23 0x00005555571becf6 in mysql_execute_command (thd=0x62c0001d0288, is_called_from_prepared_stmt=false) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912

#24 0x00005555571d95e2 in mysql_parse (thd=0x62c0001d0288, rawbuf=0x6290000f52a8 "SELECT ( 1 + 1 ) / 1 AS x WHERE EXISTS ( SELECT 1 FROM ( SELECT x FROM x UNION SELECT x FROM x WHERE x < ( SELECT x FROM x GROUP BY x + 1 , x ) ) AS x WHERE x IN ( SELECT x FROM ( SELECT x = 'x' AND x"..., length=766, parser_state=0x7fffe33c0870) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734

#25 0x00005555571b1237 in dispatch_command (command=COM_QUERY, thd=0x62c0001d0288, packet=0x6290000fa289 " SELECT ( 1 + 1 ) / 1 AS x WHERE EXISTS ( SELECT 1 FROM ( SELECT x FROM x UNION SELECT x FROM x WHERE x < ( SELECT x FROM x GROUP BY x + 1 , x ) ) AS x WHERE x IN ( SELECT x FROM ( SELECT x = 'x' AND "..., packet_length=770, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893

#26 0x00005555571adf7c in do_command (thd=0x62c0001d0288, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406

#27 0x000055555768e557 in do_handle_one_connection (connect=0x611000071548, put_in_cache=true) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445

#28 0x000055555768deb4 in handle_one_connection (arg=0x611000071408) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347

#29 0x00005555582fa350 in pfs_spawn_thread (arg=0x618000005108) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201

#30 0x00007ffff7115609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0

#31 0x00007ffff6ce8133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

Version: '10.6.16-MariaDB-debug-log'

231107 17:52:57 [ERROR] mysqld got signal 11 ;

Server version: 10.6.16-MariaDB-debug-log source revision: 90e11488ac1eafaede6e921133059bd2e08da2be

sql/signal_handler.cc:241(handle_fatal_signal)[0x564e23d55242]

sigaction.c:0(__restore_rt)[0x7f066632b420]

sql/item.h:3627(Item_field::type_handler() const)[0x564e23e0ed72]

sql/item.h:5627(Item_ref::type_handler() const)[0x564e23347adf]

sql/item.h:1278(Item::result_type() const)[0x564e23207db4]

sql/item.h:5729(Item_ref::check_cols(unsigned int))[0x564e23349506]

sql/item.cc:8225(Item_ref::fix_fields(THD*, Item**))[0x564e23df0da6]

sql/item.cc:6082(Item_field::fix_fields(THD*, Item**))[0x564e23de07d5]

sql/item.h:1152(Item::fix_fields_if_needed(THD*, Item**))[0x564e23207c9b]

sql/item_func.cc:350(Item_func::fix_fields(THD*, Item**))[0x564e23eb18fc]

sql/sql_lex.cc:11168(st_select_lex::pushdown_from_having_into_where(THD*, Item*))[0x564e2347997e]

sql/sql_select.cc:2291(JOIN::optimize_inner())[0x564e23586ba1]

sql/sql_select.cc:1870(JOIN::optimize())[0x564e235820c9]

sql/sql_lex.cc:4902(st_select_lex::optimize_unflattened_subqueries(bool))[0x564e23449503]

sql/opt_subselect.cc:5676(JOIN::optimize_unflattened_subqueries())[0x564e23a4de99]

sql/sql_select.cc:3151(JOIN::optimize_stage2())[0x564e2358f94e]

sql/sql_select.cc:2563(JOIN::optimize_inner())[0x564e23589477]

sql/sql_select.cc:1870(JOIN::optimize())[0x564e235820c9]

sql/sql_lex.cc:4902(st_select_lex::optimize_unflattened_subqueries(bool))[0x564e23449503]

sql/opt_subselect.cc:5709(JOIN::optimize_constant_subqueries())[0x564e23a4df86]

sql/sql_select.cc:2194(JOIN::optimize_inner())[0x564e2358513b]

sql/sql_select.cc:1870(JOIN::optimize())[0x564e235820c9]

sql/sql_select.cc:5100(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x564e235a40d6]

sql/sql_select.cc:561(handle_select(THD*, LEX*, select_result*, unsigned long))[0x564e235738e1]

sql/sql_parse.cc:6285(execute_sqlcom_select(THD*, TABLE_LIST*))[0x564e234d42f6]

sql/sql_parse.cc:3961(mysql_execute_command(THD*, bool))[0x564e234c2cbf]

sql/sql_parse.cc:8050(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x564e234df699]

sql/sql_parse.cc:1898(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x564e234b5369]

sql/sql_parse.cc:1409(do_command(THD*, bool))[0x564e234b20aa]

sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x564e239339a7]

sql/sql_connect.cc:1320(handle_one_connection)[0x564e23933304]

perfschema/pfs.cc:2203(pfs_spawn_thread)[0x564e245d4f66]

nptl/pthread_create.c:478(start_thread)[0x7f066631f609]

Query (0x62b0000c42a8): SELECT ( 1 + 1 ) / 1 AS x WHERE EXISTS ( SELECT 1 FROM ( SELECT x FROM x UNION SELECT x FROM x WHERE x < ( SELECT x FROM x GROUP BY x + 1 , x ) ) AS x WHERE x IN ( SELECT x FROM ( SELECT x = 'x' AND x = 1 FROM x WHERE x < ( WITH x AS ( SELECT NOT ( SELECT 1 WHERE ( SELECT x FROM x WHERE x != 1 GROUP BY x ) != x ) FROM x ) SELECT x FROM x GROUP BY x + 1 , x ) UNION SELECT x FROM x ) AS x GROUP BY x , x HAVING ( x IN ( SELECT x WHERE x = 'x' AND x IN ( SELECT x FROM x WHERE x = 'x' ) GROUP BY x HAVING ( x IN ( SELECT x WHERE x = 'x' AND x IN ( SELECT x FROM x WHERE x = 'x' ) ) AND x IS NULL AND x IN ( 1 , x = 1 AND x IN ( x NOT IN ( SELECT x ) ) , 1 , 1 , 1 ) ) ) AND x IS NULL AND x IN ( 1 , x = 1 AND x IN ( x NOT IN ( SELECT x FROM x ) ) , 1 , 1 , 1 ) ) ) )

[MDEV-32719] Segmentation fault at /mariadb-11.3.0/sql/item.h:3690 Created: 2023-11-07 Updated: 2023-11-23 Resolved: 2023-11-23
Status:	Closed
Project:	MariaDB Server
Component/s:	Server
Affects Version/s:	10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3.0
Fix Version/s:	N/A

[MDEV-32719] Segmentation fault at /mariadb-11.3.0/sql/item.h:3690 Created: 2023-11-07 Updated: 2023-11-23 Resolved: 2023-11-23