[MDEV-32761] Segmentation fault at /mariadb-11.3.0/sql/sql_select.cc:18005 Created: 2023-11-10  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Server
Affects Version/s: 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1, 11.2, 11.3.0
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Xin Wen Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Ubuntu 20.04


 Description   

Run these queries in debug build:

CREATE TABLE t0 ( c55 INT , c50 INT ) ;
INSERT INTO t0 VALUES ( 48 , -126 ) , ( -123 , 118 ) ;
CREATE INDEX i0 ON t0 ( c50 ) ;
INSERT INTO t0 VALUES ( ) , ( ) ;
SELECT VAR_SAMP( c50 ) AS c11 FROM ( SELECT c50 IN ( 'Et28CWS$_' IN ( SQRT ( 104 ) BETWEEN -90 AND 26 , 63 , -82 ) , ASIN ( -46 ) = 92 , 30 ) AS c58 FROM t0 ) AS t1 JOIN t0 ON NULLIF ( LENGTH ( c58 ) , 8 ) = t0 . c55 GROUP BY c55 , c50 HAVING c55 = NULLIF ( COUNT( * ) , 68 ) ;

Will trigger Segmentation fault.
GDB info:
#0 0x0000555557335f93 in compare_fields_by_table_order (field1=0x6290001d7b68, field2=0x6290001d7420, table_join_idx=0x6290001dc690) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:18005
#1 0x0000555557c3bdcb in bubble_sort<Item> (list_to_sort=0x6290001dbba8, sort_func=0x555557335b9a <compare_fields_by_table_order(Item*, Item*, void*)>, arg=0x6290001dc690) at /home/wx/mariadb-11.3.0/sql/sql_list.h:655
#2 0x0000555557c24088 in Item_equal::sort (this=0x6290001dbaf0, compare=0x555557335b9a <compare_fields_by_table_order(Item*, Item*, void*)>, arg=0x6290001dc690) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:7057
#3 0x0000555557338156 in substitute_for_best_equal_field (thd=0x62c0001e0288, context_tab=0x1, cond=0x6290001dbc90, cond_equal=0x6290001dbd68, table_join_idx=0x6290001dc690, do_substitution=true) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:18406
#4 0x00005555572c4538 in JOIN::optimize_stage2 (this=0x6290001d8978) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2774
#5 0x00005555572c2f34 in JOIN::optimize_inner (this=0x6290001d8978) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
#6 0x00005555572bbba6 in JOIN::optimize (this=0x6290001d8978) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#7 0x00005555572dd9ba in mysql_select (thd=0x62c0001e0288, tables=0x6290000f8310, fields=..., conds=0x0, og_num=2, order=0x0, group=0x6290001d7548, having=0x6290001d7dc8, proc_param=0x0, select_options=2165049856, result=0x6290001d8948, unit=0x62c0001e46d8, select_lex=0x6290000f5540) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
#8 0x00005555572ad18a in handle_select (thd=0x62c0001e0288, lex=0x62c0001e45f8, result=0x6290001d8948, setup_tables_done_option=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#9 0x00005555571ce583 in execute_sqlcom_select (thd=0x62c0001e0288, all_tables=0x6290000f8310) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#10 0x00005555571becf6 in mysql_execute_command (thd=0x62c0001e0288, is_called_from_prepared_stmt=false) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#11 0x00005555571d95e2 in mysql_parse (thd=0x62c0001e0288, rawbuf=0x6290000f52a8 "SELECT VAR_SAMP( c50 ) AS c11 FROM ( SELECT c50 IN ( 'Et28CWS$_' IN ( SQRT ( 104 ) BETWEEN -90 AND 26 , 63 , -82 ) , ASIN ( -46 ) = 92 , 30 ) AS c58 FROM t0 ) AS t1 JOIN t0 ON NULLIF ( LENGTH ( c58 ) "..., length=275, parser_state=0x7fffd162c870) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#12 0x00005555571b1237 in dispatch_command (command=COM_QUERY, thd=0x62c0001e0288, packet=0x6290000fa289 "SELECT VAR_SAMP( c50 ) AS c11 FROM ( SELECT c50 IN ( 'Et28CWS$_' IN ( SQRT ( 104 ) BETWEEN -90 AND 26 , 63 , -82 ) , ASIN ( -46 ) = 92 , 30 ) AS c58 FROM t0 ) AS t1 JOIN t0 ON NULLIF ( LENGTH ( c58 ) "..., packet_length=278, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#13 0x00005555571adf7c in do_command (thd=0x62c0001e0288, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#14 0x000055555768e557 in do_handle_one_connection (connect=0x61100004ea48, put_in_cache=true) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#15 0x000055555768deb4 in handle_one_connection (arg=0x61100004e908) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#16 0x00005555582fa350 in pfs_spawn_thread (arg=0x618000005508) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#17 0x00007ffff7115609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#18 0x00007ffff6ce8133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

 Comments   
Comment by Alice Sherepa [ 2023-11-10 ]

Thanks! I repeated on 10.4-11.3

Version: '10.4.32-MariaDB-debug-log'  
231110 13:11:56 [ERROR] mysqld got signal 11 ;
 
 
 
Server version: 10.4.32-MariaDB-debug-log source revision: 62d80652be7c19f4ad2bf68d6ffbb4e1eb1d77ea
 
 
 
sql/signal_handler.cc:235(handle_fatal_signal)[0x55f725b301e9]
 
sigaction.c:0(__restore_rt)[0x7fb3340d9420]
 
sql/sql_select.cc:15824(compare_fields_by_table_order(Item*, Item*, void*))[0x55f725495e70]
 
sql/sql_list.h:655(void bubble_sort<Item>(List<Item>*, int (*)(Item*, Item*, void*), void*))[0x55f725c529c3]
 
sql/item_cmpfunc.cc:6927(Item_equal::sort(int (*)(Item*, Item*, void*), void*))[0x55f725c3bb2a]
 
sql/sql_select.cc:16223(substitute_for_best_equal_field(THD*, st_join_table*, Item*, COND_EQUAL*, void*, bool))[0x55f725498134]
 
sql/sql_select.cc:2533(JOIN::optimize_stage2())[0x55f72542fbb6]
 
sql/sql_select.cc:2414(JOIN::optimize_inner())[0x55f72542e4fa]
 
sql/sql_select.cc:1731(JOIN::optimize())[0x55f725427205]
 
sql/sql_select.cc:4832(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55f7254481ef]
 
sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55f725418c56]
 
sql/sql_parse.cc:6475(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55f72537fc5c]
 
sql/sql_parse.cc:3978(mysql_execute_command(THD*))[0x55f72536d3d3]
 
sql/sql_parse.cc:8014(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55f7253891d7]
 
sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55f72535f563]
 
sql/sql_parse.cc:1378(do_command(THD*))[0x55f72535c08e]
 
sql/sql_connect.cc:1419(do_handle_one_connection(CONNECT*))[0x55f72577067e]
 
sql/sql_connect.cc:1324(handle_one_connection)[0x55f72576ff22]
 
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55f72640dbb0]
 
nptl/pthread_create.c:478(start_thread)[0x7fb3340cd609]
 
 
 
Query (0x62b0000a1290): SELECT VAR_SAMP( c50 ) AS c11 FROM ( SELECT c50 IN ( 'Et28CWS$_' IN ( SQRT ( 104 ) BETWEEN -90 AND 26 , 63 , -82 ) , ASIN ( -46 ) = 92 , 30 ) AS c58 FROM t0 ) AS t1 JOIN t0 ON NULLIF ( LENGTH ( c58 ) , 8 ) = t0 . c55 GROUP BY c55 , c50 HAVING c55 = NULLIF ( COUNT( * ) , 68 )
 



CREATE TABLE t0 ( a int, b int);
 
INSERT INTO t0 VALUES (48,-126),(-123,118);
 
 
 
SELECT 5 FROM ( SELECT b FROM t0 ) AS t1 
JOIN t0 ON LENGTH ( t1.b )  = t0.a 
GROUP BY a 
HAVING a = NULLIF ( COUNT(*) , 68 );

Generated at Thu Feb 08 10:33:48 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.