Sqlitelogictest crash on aggregation query with IN clause

[monetdb-team]

Date: 2017-09-21 10:21:06 +0200
From: @PedroTadim
To: SQL devs <>
Version: -- development
CC: @njnes

Last updated: 2017-10-26 14:01:27 +0200

Comment 25665

Date: 2017-09-21 10:21:06 +0200
From: @PedroTadim

User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.91 Safari/537.36
Build Identifier:

Mserver receives a SIGSEV in an aggregation query with IN clause. Tested in the latest development version of the Jul2017 branch.

Reproducible: Always

Steps to Reproduce:

1. CREATE TABLE tab2(col0 INTEGER, col1 INTEGER, col2 INTEGER);
2. SELECT 9 - - col1 FROM tab2 GROUP BY col1 HAVING - CAST ( NULL AS INTEGER ) IN ( + - SUM ( - + 47 ), + MIN ( col2 ) );

Actual Results:

Mserver receives a SIGSEGV in a rel_logical_exp call.

Expected Results:

An empty result set.

GDB output:

Thread 6 "mserver5" received signal SIGSEGV, Segmentation fault.
0x00007fffe8ae5d36 in rel_logical_exp (sql=0x7fffb800ab40, rel=0x7fffb80e98b0, sc=0x7fffb80e7e80, f=3) at rel_select.c:2628
2628 le = exp_column(sql->sa, exp_relname(le), exp_name(le), exp_subtype(le), le->card, has_nil(le), is_intern(le));

Backtrace:

0 0x00007fffe8ae5d36 in rel_logical_exp (sql=0x7fffb800ab40, rel=0x7fffb80e98b0, sc=0x7fffb80e7e80, f=3) at rel_select.c:2628
1 0x00007fffe8af0f39 in rel_select_exp (sql=0x7fffb800ab40, rel=0x7fffb80e8540, sn=0x7fffb80e7f40, ek=...) at rel_select.c:4884
2 0x00007fffe8af1c67 in rel_query (sql=0x7fffb800ab40, rel=0x0, sq=0x7fffb80e7f40, toplevel=1, ek=..., apply=8) at rel_select.c:5082
3 0x00007fffe8af3547 in rel_subquery (sql=0x7fffb800ab40, rel=0x0, sq=0x7fffb80e7f40, ek=..., apply=8) at rel_select.c:5447
4 0x00007fffe8af366e in rel_selects (sql=0x7fffb800ab40, s=0x7fffb80e7f40) at rel_select.c:5468
5 0x00007fffe8ad94e1 in rel_semantic (sql=0x7fffb800ab40, s=0x7fffb80e7f40) at rel_semantic.c:225
6 0x00007fffe8a1ab09 in sql_symbol2relation (c=0x7fffb800ab40, sym=0x7fffb80e7f40) at sql.c:117
7 0x00007fffe8a39940 in SQLparser (c=0x7fffea11f338) at sql_scenario.c:1129
8 0x00007ffff7a15768 in runPhase (c=0x7fffea11f338, phase=1) at mal_scenario.c:506
9 0x00007ffff7a158ac in runScenarioBody (c=0x7fffea11f338) at mal_scenario.c:539
10 0x00007ffff7a15a4f in runScenario (c=0x7fffea11f338) at mal_scenario.c:568
11 0x00007ffff7a17541 in MSserveClient (dummy=0x7fffea11f338) at mal_session.c:467
12 0x00007ffff7a17031 in MSscheduleClient (command=0x7fffb80008d0 "0", challenge=0x7fffcdc79deb "bwX3mxJHt8d", fin=0x7fffb80028f0, fout=0x7fffc4002b70, protocol=PROTOCOL_9, blocksize=8190,
compute_column_widths=0) at mal_session.c:358
13 0x00007ffff7aba460 in doChallenge (data=0x7fffc40008d0) at mal_mapi.c:273
14 0x00007ffff769180c in thread_starter (arg=0x7fffc4004c60) at gdk_system.c:485
15 0x00007ffff4ca536d in start_thread () from /lib64/libpthread.so.0
16 0x00007ffff49ddbbf in clone () from /lib64/libc.so.6

Comment 25666

Date: 2017-09-21 10:38:21 +0200
From: MonetDB Mercurial Repository <>

Changeset d2a9f17a79ea made by Pedro Ferreira pedro.ferreira@monetdbsolutions.com in the MonetDB repo, refers to this bug.

For complete details, see https//devmonetdborg/hg/MonetDB?cmd=changeset;node=d2a9f17a79ea

Changeset description:

Added test for bug #6410

Comment 25669

Date: 2017-09-27 16:36:00 +0200
From: MonetDB Mercurial Repository <>

Changeset 7a69de77b1b3 made by Niels Nes niels@cwi.nl in the MonetDB repo, refers to this bug.

For complete details, see https//devmonetdborg/hg/MonetDB?cmd=changeset;node=7a69de77b1b3

Changeset description:

fixes for bugs 6409 and 6410. Only set subquery flags when realy needed.

Comment 25670

Date: 2017-09-27 16:54:25 +0200
From: @njnes

fixed by improved subquery handing