Description:
MySQL 26.7.0 terminates the server process while executing the valid `SELECT`
statement below. The reduced reproducer needs only one row in `t1`; `t3` is
intentionally empty.
The query combines:
- an aggregated derived table;
- `RANK()` in the outer select list;
- a second aggregation over the derived table; and
- a correlated scalar subquery in the outer `HAVING` clause.
Because `t3` is empty, the scalar subquery returns `NULL` and the outer
`HAVING` predicate cannot be true. The server should therefore return an empty
result. Instead, it dereferences address `0x60` and exits with `SIGSEGV`.
This is a server crash and is independent of client timeout handling. The
reduced case was reproduced repeatedly, including with session
`sort_buffer_size=262144` and `read_rnd_buffer_size=262144`.
# Expected result
The statement should complete normally and return an empty result because
`t3` is empty and the scalar subquery in `HAVING` returns `NULL`. A valid SQL
statement must never terminate the server.
# Actual result
A network client observes a lost connection (`ERROR 2013: Lost connection to
MySQL server during query`). When run with the command-line client inside the
container, the client exits with status `137` as the container terminates.
The server log contains:
```text
mysqld got signal 11 ;
Signal SIGSEGV (Address not mapped to object) at address 0x60
Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware.
BuildID[sha1]=d877dfc4a4fecde2e9c52ea3107776d94dfc15e8
Attempting backtrace.
#0 0x194ca80 <unknown>
#1 <libc address> <unknown>
#2 0xe7226d <unknown>
#3 0xe7180b <unknown>
#4 0xe6e534 <unknown>
#5 0xf60442 <unknown>
```
Container state immediately after each reduced reproduction:
```text
Status: exited
ExitCode: 2
OOMKilled: false
```
How to repeat:
The following script is self-contained. No pre-existing database or external
files are required.
```sql
DROP DATABASE IF EXISTS mysql_crash_repro;
CREATE DATABASE mysql_crash_repro
CHARACTER SET utf8mb4
COLLATE utf8mb4_0900_as_cs;
USE mysql_crash_repro;
CREATE TABLE t1 (
c1 INT NOT NULL AUTO_INCREMENT,
c2 VARCHAR(255) NOT NULL,
c3 VARCHAR(255),
c4 INT,
c5 DATE NOT NULL,
c6 VARCHAR(10) NOT NULL,
PRIMARY KEY (c1),
UNIQUE KEY idx_t1_pk (c1),
KEY idx_t1_c6_c4 (c6, c4),
KEY idx_t1_c5 (c5)
);
CREATE TABLE t3 (
c5 DATETIME,
c8 MEDIUMINT,
KEY idx_t3_c8 (c8),
KEY idx_t3_c5 (c5)
);
INSERT INTO t1 VALUES (
29,
'sample_rYnQKed8qO0N5kpKDfUZXFPm81Khsne8QDXm2UMwsHIbEkb2MTTEd2WR4Zy',
'sample_wVoZPU1vobBxenISDcXYwe0KDNTFqHfCddUvUaBws24W76KJMnfxDvf1LkN3NdCYs2ufTYYIDy4iQCX25WwMKH145dyMS728CzLtE2oZvdENSq3zzgdL7mANWZpHwcEHjjSBsWF',
58,
'2026-08-04',
'sample_N'
);
SELECT
VARIANCE(sq3.q1_col_1) AS q2_col_1,
sq3.q1_col_2 AS q2_col_2,
RANK() OVER (ORDER BY sq3.q1_col_2 DESC) AS q2_col_3,
STDDEV_POP(sq3.q1_col_1) AS q2_col_4,
sq3.q1_col_1 - 22 AS q2_col_5
FROM (
SELECT DISTINCT
LOG(t4.c4, t4.c4) AS q1_col_1,
TIMEDIFF(t4.c5, t4.c5) AS q1_col_2,
t4.c2 AS q1_col_3
FROM t1 AS t4
WHERE (
(
(t4.c3 IS NULL OR
t4.c5 NOT BETWEEN '2023-01-01 00:00:00'
AND '2023-12-31 23:59:59')
AND t4.c1 + t4.c4 <= 0
)
OR t4.c4 - t4.c1 = t4.c1
)
GROUP BY t4.c4, t4.c5, t4.c2
HAVING VARIANCE(t4.c1) <> 70
OR BIT_AND(t4.c1) <= 92
OR BIT_OR(t4.c4) <= 2
) AS sq3
WHERE ROUND(sq3.q1_col_1, sq3.q1_col_1)
<= sq3.q1_col_1 + sq3.q1_col_1
GROUP BY sq3.q1_col_2, sq3.q1_col_1
HAVING '2023-01-01' >= (
SELECT t5.c5
FROM t3 AS t5
WHERE sq3.q1_col_1 >= t5.c8
ORDER BY t5.c5 ASC
LIMIT 1
)
AND BIT_AND(sq3.q1_col_1) <> 32;
```
Description: MySQL 26.7.0 terminates the server process while executing the valid `SELECT` statement below. The reduced reproducer needs only one row in `t1`; `t3` is intentionally empty. The query combines: - an aggregated derived table; - `RANK()` in the outer select list; - a second aggregation over the derived table; and - a correlated scalar subquery in the outer `HAVING` clause. Because `t3` is empty, the scalar subquery returns `NULL` and the outer `HAVING` predicate cannot be true. The server should therefore return an empty result. Instead, it dereferences address `0x60` and exits with `SIGSEGV`. This is a server crash and is independent of client timeout handling. The reduced case was reproduced repeatedly, including with session `sort_buffer_size=262144` and `read_rnd_buffer_size=262144`. # Expected result The statement should complete normally and return an empty result because `t3` is empty and the scalar subquery in `HAVING` returns `NULL`. A valid SQL statement must never terminate the server. # Actual result A network client observes a lost connection (`ERROR 2013: Lost connection to MySQL server during query`). When run with the command-line client inside the container, the client exits with status `137` as the container terminates. The server log contains: ```text mysqld got signal 11 ; Signal SIGSEGV (Address not mapped to object) at address 0x60 Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware. BuildID[sha1]=d877dfc4a4fecde2e9c52ea3107776d94dfc15e8 Attempting backtrace. #0 0x194ca80 <unknown> #1 <libc address> <unknown> #2 0xe7226d <unknown> #3 0xe7180b <unknown> #4 0xe6e534 <unknown> #5 0xf60442 <unknown> ``` Container state immediately after each reduced reproduction: ```text Status: exited ExitCode: 2 OOMKilled: false ``` How to repeat: The following script is self-contained. No pre-existing database or external files are required. ```sql DROP DATABASE IF EXISTS mysql_crash_repro; CREATE DATABASE mysql_crash_repro CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_cs; USE mysql_crash_repro; CREATE TABLE t1 ( c1 INT NOT NULL AUTO_INCREMENT, c2 VARCHAR(255) NOT NULL, c3 VARCHAR(255), c4 INT, c5 DATE NOT NULL, c6 VARCHAR(10) NOT NULL, PRIMARY KEY (c1), UNIQUE KEY idx_t1_pk (c1), KEY idx_t1_c6_c4 (c6, c4), KEY idx_t1_c5 (c5) ); CREATE TABLE t3 ( c5 DATETIME, c8 MEDIUMINT, KEY idx_t3_c8 (c8), KEY idx_t3_c5 (c5) ); INSERT INTO t1 VALUES ( 29, 'sample_rYnQKed8qO0N5kpKDfUZXFPm81Khsne8QDXm2UMwsHIbEkb2MTTEd2WR4Zy', 'sample_wVoZPU1vobBxenISDcXYwe0KDNTFqHfCddUvUaBws24W76KJMnfxDvf1LkN3NdCYs2ufTYYIDy4iQCX25WwMKH145dyMS728CzLtE2oZvdENSq3zzgdL7mANWZpHwcEHjjSBsWF', 58, '2026-08-04', 'sample_N' ); SELECT VARIANCE(sq3.q1_col_1) AS q2_col_1, sq3.q1_col_2 AS q2_col_2, RANK() OVER (ORDER BY sq3.q1_col_2 DESC) AS q2_col_3, STDDEV_POP(sq3.q1_col_1) AS q2_col_4, sq3.q1_col_1 - 22 AS q2_col_5 FROM ( SELECT DISTINCT LOG(t4.c4, t4.c4) AS q1_col_1, TIMEDIFF(t4.c5, t4.c5) AS q1_col_2, t4.c2 AS q1_col_3 FROM t1 AS t4 WHERE ( ( (t4.c3 IS NULL OR t4.c5 NOT BETWEEN '2023-01-01 00:00:00' AND '2023-12-31 23:59:59') AND t4.c1 + t4.c4 <= 0 ) OR t4.c4 - t4.c1 = t4.c1 ) GROUP BY t4.c4, t4.c5, t4.c2 HAVING VARIANCE(t4.c1) <> 70 OR BIT_AND(t4.c1) <= 92 OR BIT_OR(t4.c4) <= 2 ) AS sq3 WHERE ROUND(sq3.q1_col_1, sq3.q1_col_1) <= sq3.q1_col_1 + sq3.q1_col_1 GROUP BY sq3.q1_col_2, sq3.q1_col_1 HAVING '2023-01-01' >= ( SELECT t5.c5 FROM t3 AS t5 WHERE sq3.q1_col_1 >= t5.c8 ORDER BY t5.c5 ASC LIMIT 1 ) AND BIT_AND(sq3.q1_col_1) <> 32; ```