Date: 2017-04-13 11:58:26 +0200
From: @PedroTadim
To: SQL devs <>
Version: 11.25.15 (Dec2016-SP3)
CC: @njnes

Last updated: 2017-05-01 13:33:40 +0200

Comment 25217

Date: 2017-04-13 11:58:26 +0200
From: @PedroTadim

User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Build Identifier:

One more sqlitelogictest crash :) The mserver gets a SIGSEGV with a SQL query.

Reproducible: Always

Steps to Reproduce:

CREATE TABLE tab0(pk INTEGER PRIMARY KEY, col0 INTEGER, col1 FLOAT, col2 TEXT, col3 INTEGER, col4 FLOAT, col5 TEXT);

INSERT INTO tab0 VALUES(0,698,169.42,'apdbu',431,316.15,'sqvis');
INSERT INTO tab0 VALUES(1,538,676.36,'fuqeu',514,685.97,'bgwrq');
INSERT INTO tab0 VALUES(2,90,205.26,'yrrzx',123,836.88,'kpuhc');
INSERT INTO tab0 VALUES(3,620,864.8,'myrdv',877,820.98,'oxkuv');
INSERT INTO tab0 VALUES(4,754,677.3,'iofrg',67,665.49,'bzqba');
INSERT INTO tab0 VALUES(5,107,710.19,'lhfro',286,504.28,'kwwsg);
INSERT INTO tab0 VALUES(6,904,193.16,'eozui',48,698.55,'ejyzs');
INSERT INTO tab0 VALUES(7,606,650.64,'ovmce',417,962.43,'dvkbh');
INSERT INTO tab0 VALUES(8,535,18.11,'ijika',630,489.63,'hpnyu');
INSERT INTO tab0 VALUES(9,501,776.40,'cvygg',725,75.5,'etlyv');

SELECT * FROM tab0 AS cor0 WHERE NOT NULL IN ( col3 );

Actual Results:

The server gets a SIGSEGV (details bellow).

Expected Results:

An empty result set.

The SIGSEGV:

Thread 6 "mserver5" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffc49f1700 (LWP 781)]
0x00007fffe8d5f3bf in exp_subtype (e=0x0) at rel_exp.c:654
654 switch(e->type) {

Backtrace:

0 0x00007fffe8d5f3bf in exp_subtype (e=0x0) at rel_exp.c:654
1 0x00007fffe8d3a8b4 in rel_logical_value_exp (sql=0x7fffb000d4b0, rel=0x7fffc49f04b0, sc=0x7fffb00e3130, f=1) at rel_select.c:2058
2 0x00007fffe8d468d8 in rel_value_exp2 (sql=0x7fffb000d4b0, rel=0x7fffc49f04b0, se=0x7fffb00e3130, f=1, ek=..., is_last=0x7fffc49f047c) at rel_select.c:4461
3 0x00007fffe8d4698a in rel_value_exp (sql=0x7fffb000d4b0, rel=0x7fffc49f04b0, se=0x7fffb00e3130, f=1, ek=...) at rel_select.c:4476
4 0x00007fffe8d3e77f in rel_logical_exp (sql=0x7fffb000d4b0, rel=0x7fffb00e3290, sc=0x7fffb00e3150, f=1) at rel_select.c:2779
5 0x00007fffe8d4766e in rel_select_exp (sql=0x7fffb000d4b0, rel=0x7fffb00e3290, sn=0x7fffb00e3210, ek=...) at rel_select.c:4684
6 0x00007fffe8d488f7 in rel_query (sql=0x7fffb000d4b0, rel=0x0, sq=0x7fffb00e3210, toplevel=1, ek=..., apply=8) at rel_select.c:4966
7 0x00007fffe8d4a343 in rel_subquery (sql=0x7fffb000d4b0, rel=0x0, sq=0x7fffb00e3210, ek=..., apply=8) at rel_select.c:5349
8 0x00007fffe8d4a454 in rel_selects (sql=0x7fffb000d4b0, s=0x7fffb00e3210) at rel_select.c:5370
9 0x00007fffe8d3179e in rel_semantic (sql=0x7fffb000d4b0, s=0x7fffb00e3210) at rel_semantic.c:210
10 0x00007fffe8c74c18 in sql_symbol2relation (c=0x7fffb000d4b0, sym=0x7fffb00e3210) at sql.c:117
11 0x00007fffe8c9a24b in SQLparser (c=0x7fffea363328) at sql_scenario.c:1078
12 0x00007ffff79a7f24 in runPhase (c=0x7fffea363328, phase=1) at mal_scenario.c:517
13 0x00007ffff79a8068 in runScenarioBody (c=0x7fffea363328) at mal_scenario.c:550
14 0x00007ffff79a820b in runScenario (c=0x7fffea363328) at mal_scenario.c:579
15 0x00007ffff79a9d51 in MSserveClient (dummy=0x7fffea363328) at mal_session.c:448
16 0x00007ffff79a97fb in MSscheduleClient (command=0x7fffb00008d0 "0", challenge=0x7fffc49f0df0 "EACsk9qc", fin=0x7fffb0002980, fout=0x7fffbc002b60) at mal_session.c:339
17 0x00007ffff7a4986b in doChallenge (data=0x7fffbc0008d0) at mal_mapi.c:197
18 0x00007ffff7633c2a in thread_starter (arg=0x7fffbc004c50) at gdk_system.c:485
19 0x00007ffff4e946ca in start_thread () from /lib64/libpthread.so.0
20 0x00007ffff4bcef7f in clone () from /lib64/libc.so.6

Comment 25250

Date: 2017-04-19 14:08:48 +0200
From: @njnes

fixed. added some more defensive code.

Comment 25251

Date: 2017-04-19 15:12:46 +0200
From: MonetDB Mercurial Repository <>

Changeset c150cc9de5d5 made by Niels Nes niels@cwi.nl in the MonetDB repo, refers to this bug.

For complete details, see http//devmonetdborg/hg/MonetDB?cmd=changeset;node=c150cc9de5d5

Changeset description:

fixed bug #6260, ie crash in the in type checking.
approved output (properties aren't stable?)