Bug #120686 TO_DAYS function crashes MySQL server

• Submitted: 15 Jun 8:16
• Reporter: chi zhang
• Status: Open
• Category: MySQL Server
• Severity: S3 (Non-critical)
• Version: 9.7.0
• OS: Any
• CPU Architecture: Any

[15 Jun 8:16] chi zhang

Description:
Hi,

The following test case crashes the MySQL server:

```
SET SESSION sql_mode='';

CREATE TABLE t (d DATE, dt DATETIME);
INSERT INTO t VALUES('0000-00-00', '0000-00-00 00:00:00');

SELECT TO_DAYS(JSON_REPLACE('{"a":1}', '$', d)) AS td FROM t;

```

This is the mysql log:
```
2026-06-15T08:06:07.136684Z 0 [System] [MY-010931] [Server] /home/zhangchi/work/MySQLJson/mysql-server/install/bin/mysqld: ready for connections. Version: '9.7.0-debug'  socket: '/tmp/mysql-json-audit-0-c30fb38afd78.sock'  port: 0  Source distribution.
mysqld: /home/zhangchi/work/MySQLJson/mysql-server/mysys/my_temporal.cc:457: uint32_t Date_val::day_number() const: Assertion `month() != 0 && day() != 0' failed.
2026-06-15T08:08:20Z UTC - mysqld got signal 6 ;
Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware.
BuildID[sha1]=a38632b1a6fdaf345466c1e4f716f47a05b1a0f0
Thread pointer: 0x7ecb98000c40
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7ecd5c187a08 thread_stack 0x100000
 #0 0x5c55df472030 print_fatal_signal at /home/zhangchi/work/MySQLJson/mysql-server/sql/signal_handler.cc:321
 #1 0x5c55df4722bf _Z19handle_fatal_signaliP9siginfo_tPv at /home/zhangchi/work/MySQLJson/mysql-server/sql/signal_handler.cc:403
 #2 0x7ecd7424532f <unknown> at sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
 #3 0x7ecd7429eb2c __pthread_kill_implementation at ./nptl/pthread_kill.c:44
 #4 0x7ecd7429eb2c __pthread_kill_internal at ./nptl/pthread_kill.c:78
 #5 0x7ecd7429eb2c __GI___pthread_kill at ./nptl/pthread_kill.c:89
 #6 0x7ecd7424527d __GI_raise at sysdeps/posix/raise.c:26
 #7 0x7ecd742288fe __GI_abort at ./stdlib/abort.c:79
 #8 0x7ecd7422881a __assert_fail_base at ./assert/assert.c:96
 #9 0x7ecd7423b516 __assert_fail at ./assert/assert.c:105
 #10 0x5c55e1755916 _ZNK8Date_val10day_numberEv at /home/zhangchi/work/MySQLJson/mysql-server/mysys/my_temporal.cc:457
 #11 0x5c55df8635d1 _ZN17Item_func_to_days7val_intEv at /home/zhangchi/work/MySQLJson/mysql-server/sql/item_timefunc.cc:1299
 #12 0x5c55df6e89fe _ZN4Item4sendEP8ProtocolP6String at /home/zhangchi/work/MySQLJson/mysql-server/sql/item.cc:7978
 #13 0x5c55df0a1dce _ZN3THD19send_result_set_rowERK14mem_root_dequeIP4ItemE at /home/zhangchi/work/MySQLJson/mysql-server/sql/sql_class.cc:3001
 #14 0x5c55dfa49c78 _ZN17Query_result_send9send_dataEP3THDRK14mem_root_dequeIP4ItemE at /home/zhangchi/work/MySQLJson/mysql-server/sql/query_result.cc:105
 #15 0x5c55df33735a _ZN16Query_expression20ExecuteIteratorQueryEP3THD at /home/zhangchi/work/MySQLJson/mysql-server/sql/sql_union.cc:1153
 #16 0x5c55df337695 _ZN16Query_expression7executeEP3THD at /home/zhangchi/work/MySQLJson/mysql-server/sql/sql_union.cc:1200
 #17 0x5c55df267cf0 _ZN11Sql_cmd_dml13execute_innerEP3THD at /home/zhangchi/work/MySQLJson/mysql-server/sql/sql_select.cc:1153
 #18 0x5c55df266a2b _ZN11Sql_cmd_dml7executeEP3THD at /home/zhangchi/work/MySQLJson/mysql-server/sql/sql_select.cc:798
 #19 0x5c55df1c9d8b _Z21mysql_execute_commandP3THDb at /home/zhangchi/work/MySQLJson/mysql-server/sql/sql_parse.cc:4766
 #20 0x5c55df1cc32c _Z20dispatch_sql_commandP3THDP12Parser_stateb at /home/zhangchi/work/MySQLJson/mysql-server/sql/sql_parse.cc:5441
 #21 0x5c55df1c1a89 _Z16dispatch_commandP3THDPK8COM_DATA19enum_server_command at /home/zhangchi/work/MySQLJson/mysql-server/sql/sql_parse.cc:2152
 #22 0x5c55df1bf886 _Z10do_commandP3THD at /home/zhangchi/work/MySQLJson/mysql-server/sql/sql_parse.cc:1491
 #23 0x5c55df457ed7 handle_connection at /home/zhangchi/work/MySQLJson/mysql-server/sql/conn_handler/connection_handler_per_thread.cc:304
 #24 0x5c55e1a02a62 pfs_spawn_thread at /home/zhangchi/work/MySQLJson/mysql-server/storage/perfschema/pfs.cc:3067
 #25 0x7ecd7429caa3 start_thread at ./nptl/pthread_create.c:447
 #26 0x7ecd74329c6b clone3 at sysdeps/unix/sysv/linux/x86_64/clone3.S:78
 #27 0xffffffffffffffff <unknown>

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (7ecb9810d080): SELECT TO_DAYS(JSON_REPLACE('{"a":1}', '$', d)) AS td FROM t
Connection ID (thread ID): 15
Status: NOT_KILLED

The manual page at https://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.

```

How to repeat:
```
SET SESSION sql_mode='';

CREATE TABLE t (d DATE, dt DATETIME);
INSERT INTO t VALUES('0000-00-00', '0000-00-00 00:00:00');

SELECT TO_DAYS(JSON_REPLACE('{"a":1}', '$', d)) AS td FROM t;

```