[MDEV-32769] MSAN/Valgrind errors in Item_func_group_concat::setup Created: 2023-11-10  Updated: 2023-11-26

Status: Open
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: None


 Description   

CREATE TABLE t (f TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP);
INSERT INTO t VALUES (),();
SELECT GROUP_CONCAT(DEFAULT(f)) FROM t;
 
# Cleanup
DROP TABLE t;

10.5 dd62a285b88958dae9b9f3e49fdd0c55f6eced72

==2848625==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x5589313f2d0b in Item_func_group_concat::setup(THD*) /data/bld/10.5-msan/sql/item_sum.cc:4313:47
    #1 0x5589304c2f55 in Item_sum::aggregator_setup(THD*) /data/bld/10.5-msan/sql/item_sum.h:555:57
    #2 0x5589304c2f55 in setup_sum_funcs(THD*, Item_sum**) /data/bld/10.5-msan/sql/sql_select.cc:26402:15
    #3 0x5589304c2f55 in JOIN::make_aggr_tables_info() /data/bld/10.5-msan/sql/sql_select.cc:3773:9
    #4 0x558930474ad0 in JOIN::optimize_stage2() /data/bld/10.5-msan/sql/sql_select.cc:3125:7
    #5 0x558930484422 in JOIN::optimize_inner() /data/bld/10.5-msan/sql/sql_select.cc:2409:9
    #6 0x55893046840c in JOIN::optimize() /data/bld/10.5-msan/sql/sql_select.cc:1741:10
    #7 0x55893044a5d0 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/10.5-msan/sql/sql_select.cc:4865:19
    #8 0x5589304491c6 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/bld/10.5-msan/sql/sql_select.cc:450:10
    #9 0x5589303801ae in execute_sqlcom_select(THD*, TABLE_LIST*) /data/bld/10.5-msan/sql/sql_parse.cc:6343:12
    #10 0x55893035a35a in mysql_execute_command(THD*) /data/bld/10.5-msan/sql/sql_parse.cc:4020:12
    #11 0x558930341647 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.5-msan/sql/sql_parse.cc:8121:18
    #12 0x558930334bd2 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.5-msan/sql/sql_parse.cc:1891:7
    #13 0x5589303435e8 in do_command(THD*) /data/bld/10.5-msan/sql/sql_parse.cc:1375:17
    #14 0x55893094634f in do_handle_one_connection(CONNECT*, bool) /data/bld/10.5-msan/sql/sql_connect.cc:1416:11
    #15 0x558930945a45 in handle_one_connection /data/bld/10.5-msan/sql/sql_connect.cc:1318:5
    #16 0x558931d60a5a in pfs_spawn_thread /data/bld/10.5-msan/storage/perfschema/pfs.cc:2201:3
    #17 0x7f0fd789f043 in start_thread nptl/./nptl/pthread_create.c:442:8
    #18 0x7f0fd791f61b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
 
  Memory was marked as uninitialized
    #0 0x55892fe2673e in __msan_allocated_memory (/mnt8t/bld/10.5-msan/sql/mariadbd+0x77e73e)
    #1 0x5589331ab976 in my_malloc /data/bld/10.5-msan/mysys/my_malloc.c:114:7
 
SUMMARY: MemorySanitizer: use-of-uninitialized-value /data/bld/10.5-msan/sql/item_sum.cc:4313:47 in Item_func_group_concat::setup(THD*)

10.4 64f44b22d9a3dab3d4c0b77addbcbdafde57b466 Valgrind

==2848768== Thread 6:
==2848768== Conditional jump or move depends on uninitialised value(s)
==2848768==    at 0xE1964A: Item_func_group_concat::setup(THD*) (item_sum.cc:4147)
==2848768==    by 0xE1AE46: Aggregator_simple::setup(THD*) (item_sum.h:721)
==2848768==    by 0xA37867: Item_sum::aggregator_setup(THD*) (item_sum.h:553)
==2848768==    by 0xA28F91: setup_sum_funcs(THD*, Item_sum**) (sql_select.cc:26097)
==2848768==    by 0x9E9F19: JOIN::make_aggr_tables_info() (sql_select.cc:3773)
==2848768==    by 0x9E73B5: JOIN::optimize_stage2() (sql_select.cc:3128)
==2848768==    by 0x9E4ABA: JOIN::optimize_inner() (sql_select.cc:2414)
==2848768==    by 0x9E2197: JOIN::optimize() (sql_select.cc:1731)
==2848768==    by 0x9EDD69: mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:4832)
==2848768==    by 0x9DC9FE: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:442)
==2848768==    by 0x99D1E6: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:6521)
==2848768==    by 0x993533: mysql_execute_command(THD*) (sql_parse.cc:3978)
==2848768==    by 0x9A13A8: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:8060)
==2848768==    by 0x98CB1F: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1857)
==2848768==    by 0x98B386: do_command(THD*) (sql_parse.cc:1378)
==2848768==    by 0xB3595E: do_handle_one_connection(CONNECT*) (sql_connect.cc:1419)
==2848768== 

Reproducible on all existing versions, with at least MyISAM, InnoDB, Aria.


Generated at Thu Feb 08 10:33:52 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.