[MDEV-7339] Server crashes in Item_func_trig_cond::val_int Created: 2014-12-18  Updated: 2017-07-12  Resolved: 2017-07-12

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 5.3.12, 5.5, 10.0, 10.1, 10.2
Fix Version/s: 10.1.26, 5.5.57, 10.0.32, 10.2.8

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Sergei Golubchik
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Duplicate
duplicates MDEV-11358 Crash during SELECT (SELECT 1,2) NOT ... Closed

 Description   

select (select 1, 2) in (select 3, 4);

Stack trace from 5.5 revno 4390

#2  0x00000000007e7759 in handle_fatal_signal (sig=11) at 5.5/sql/signal_handler.cc:262
#3  <signal handler called>
#4  0x00000000006a131f in Item_func_trig_cond::val_int (this=0x7efed9083bd0) at 5.5/sql/item_cmpfunc.h:486
#5  0x00000000007f578d in Item::val_bool (this=0x7efed9083bd0) at 5.5/sql/item.cc:215
#6  0x0000000000825ad5 in Item_cond_and::val_int (this=0x7efed90b3b18) at 5.5/sql/item_cmpfunc.cc:4695
#7  0x0000000000669153 in JOIN::exec (this=0x7efed90825a8) at 5.5/sql/sql_select.cc:2277
#8  0x0000000000883e23 in subselect_single_select_engine::exec (this=0x7efed904bb80) at 5.5/sql/item_subselect.cc:3231
#9  0x000000000087cab6 in Item_subselect::exec (this=0x7efed904b9e0) at 5.5/sql/item_subselect.cc:655
#10 0x000000000087cfe2 in Item_in_subselect::exec (this=0x7efed904b9e0) at 5.5/sql/item_subselect.cc:828
#11 0x000000000087f407 in Item_in_subselect::val_bool (this=0x7efed904b9e0) at 5.5/sql/item_subselect.cc:1654
#12 0x000000000059eab1 in Item::val_bool_result (this=0x7efed904b9e0) at 5.5/sql/item.h:981
#13 0x000000000081baf9 in Item_in_optimizer::val_int (this=0x7efed9083008) at 5.5/sql/item_cmpfunc.cc:1747
#14 0x00000000008066b9 in Item::send (this=0x7efed9083008, protocol=0x7efee9053628, buffer=0x7eff0446e240) at 5.5/sql/item.cc:6514
#15 0x000000000059ad96 in Protocol::send_result_set_row (this=0x7efee9053628, row_items=0x7efee9056b70) at 5.5/sql/protocol.cc:903
#16 0x00000000005fd8ac in select_send::send_data (this=0x7efed904bc80, items=...) at 5.5/sql/sql_class.cc:2370
#17 0x0000000000669242 in JOIN::exec (this=0x7efed9082078) at 5.5/sql/sql_select.cc:2281
#18 0x000000000066beb5 in mysql_select (thd=0x7efee9053060, rref_pointer_array=0x7efee9056cc8, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7efed904bc80, unit=0x7efee9056380, select_lex=0x7efee9056a58) at 5.5/sql/sql_select.cc:3094
#19 0x0000000000662985 in handle_select (thd=0x7efee9053060, lex=0x7efee90562d0, result=0x7efed904bc80, setup_tables_done_option=0) at 5.5/sql/sql_select.cc:319
#20 0x000000000063bfd8 in execute_sqlcom_select (thd=0x7efee9053060, all_tables=0x0) at 5.5/sql/sql_parse.cc:4689
#21 0x00000000006351ba in mysql_execute_command (thd=0x7efee9053060) at 5.5/sql/sql_parse.cc:2234
#22 0x000000000063e6d4 in mysql_parse (thd=0x7efee9053060, rawbuf=0x7efed904a078 "select (select 1, 2) in (select 3, 4)", length=37, parser_state=0x7eff0446f680) at 5.5/sql/sql_parse.cc:5800
#23 0x0000000000632701 in dispatch_command (command=COM_QUERY, thd=0x7efee9053060, packet=0x7efee910e061 "", packet_length=37) at 5.5/sql/sql_parse.cc:1079
#24 0x000000000063188d in do_command (thd=0x7efee9053060) at 5.5/sql/sql_parse.cc:793
#25 0x00000000007339de in do_handle_one_connection (thd_arg=0x7efee9053060) at 5.5/sql/sql_connect.cc:1266
#26 0x000000000073349d in handle_one_connection (arg=0x7efee9053060) at 5.5/sql/sql_connect.cc:1181
#27 0x00007eff040a5b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
#28 0x00007eff0235c20d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112



 Comments   
Comment by Vladislav Vaintroub [ 2015-12-03 ]

The crash is caused by NULL pointer derefence,
which is caused by in Item_func_trig_cond::val_int()
which is caused by prior constructor Item_func_trig_cond(thd, col_item, get_cond_guard(i)) where the last parameter evaluates to NULL, because pushed_cond_guards is NULL.

This is so much I could find about it. Handing back to someone who knows the code better

Comment by Oleksandr Byelkin [ 2017-07-12 ]

OK to push!

Generated at Thu Feb 08 07:18:50 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.