Tiflash crashes when executing complex join query

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

CREATE TABLE tb0 (c0 FLOAT UNSIGNED, c1 BIGINT NOT NULL, c2 CHAR(55) NOT NULL);
CREATE TABLE tb1 (c0 VARCHAR(88) NOT NULL, c1 INT NOT NULL, c2 TEXT);
INSERT INTO tb0 (c0, c1, c2) VALUES (241.7921948683188, 4209047541604425391, 'YpTAUEFc4soakCYMV5bOvaFLdhNSgZnjaOFIoKJZAUK20WX1M03AwKR');
INSERT INTO tb0 (c0, c1, c2) VALUES (30.093255637514858, -4125512965765502379, 'i1f3AqSReSCJk5oARGprMlobFTFUjTEKimxt7P3Ldw9UiMrYWPpZnWD');
INSERT INTO tb0 (c0, c1, c2) VALUES (726.4302434447113, -9222169248676787174, 'LltRfxoqZfez1eur8FfMO1H4EeglpctIyulzW9RNEgcOXWLs61nagjv'), (544.1862786677164, -3706772035635077469, 'S6bytz5OPX3dtDG8QJM3jG8a72TEgDSSh4TRHiZURPsoS0ipv1xPPLp');
INSERT INTO tb0 (c0, c1, c2) VALUES (NULL, -2362823421851889077, 'LEtWlUmQyWp6oG6BO7E622gF8nj6L4D2ffHuZ4hRSTwWMt8NYwvKuYr');
INSERT INTO tb0 (c0, c1, c2) VALUES (947.3379404447955, -5103558202990553498, '6ATisyClHRmAMeB5h1Lbc3DwJw2Mjw6Zd0vXQoItzDfEfb2cEDzxhMO'), (266.40486119195384, 635786127340470660, 'o7oo8Q6zZ5qFxxQReATFe6PdD5mc2O6gpsOUorCQFq9pPhfwABPxs5z');
INSERT INTO tb0 (c0, c1, c2) VALUES (NULL, 5827833125144569057, '6fi3OMFHQnwfE0Nqt8hyMqtOuRYnf7C5xK5qzOSlVjvQJcCmAEFNELJ'), (237.21283441325363, 7057002612085790305, 'QBAk9TxsKJfYSa36jpWo3tXF8Y8fvvCrCuZzZSeyyilw9jKGsEjJPM3');
INSERT INTO tb0 (c0, c1, c2) VALUES (NULL, 5474739249887022597, '7EIUI8InJHsDSbs7sR1NAFHayMwHmKFIpXPxglOmoTkGKWPfZjeW8re');
INSERT INTO tb0 (c0, c1, c2) VALUES (NULL, -2789478196618256729, 'wr5cE6I6NX4qeFdBtGmnc2YlXmiSa0kdHgDr0XYspP36OvIVdxI7EfI');
INSERT INTO tb0 (c0, c1, c2) VALUES (801.5365549772641, 2257679608609010124, 'jgEZclx6LKaJB8MoZT68VFYx8OkeYFNIJQiBo6Jb55ArVpGMDDZ4c80'), (79.25363508048258, 6668528013493939675, 'Hup7yWUbdly1EbE9asMjgu7r8hLNABaIdAkfjfoJ5T1Jar1I3RmXgrg');
INSERT INTO tb0 (c0, c1, c2) VALUES (48.41085450706828, 1048834140182321247, '35k8Y92ls38UyKTff7LTYsvwuIFjXDvbSBbTo9w8ERakFt0o9MHm5vJ');
INSERT INTO tb0 (c0, c1, c2) VALUES (107.54743422812862, -4638813054747211760, 'AS0fdGIE0UVZ3JDaU4ABUqPI4FVRUgHU3jWiLCfa0xEZ7uWKtxKDoTi');
INSERT INTO tb0 (c0, c1, c2) VALUES (684.7920862991607, -6008961906279097141, 'YPbNrwsPWn41lOO8w7qzI5qt77vImZjm9nWeEOAIjxbFTVvyM8pkOzL');
INSERT INTO tb0 (c0, c1, c2) VALUES (130.98379018965443, 3672304106650330011, 'nIyRM5us1PaXzdplimG4CdvYcN50aazjNiC1MnoYANyFpgmqV7HZgIr'), (971.4911243248448, 4166680210248168026, 'yjDWwWcGqenylxJgCYgltd0sMCSa2owBgqvCUBvDGXeWLyB6MfnfabQ'), (457.51876841252056, -5401691511684844017, 'KpLSdHS9nkXS0tet20RzEmx7Hh16CHaTdANPw3DzPfGkDkPIw5wKJNS');
INSERT INTO tb0 (c0, c1, c2) VALUES (407.85959011068485, -7519307726946252828, 'YfYOPGjimR7DTXojbk3THoTFvlLT1rGyw0SxmhArsQtQAabxR6C9q48');
INSERT INTO tb0 (c0, c1, c2) VALUES (920.1223866106945, -1923854112751681205, 'DlthxZajQiLFJXwPhPeg7PgpMnhpW1qhVdyPDDoOdCrPSyIqIwVX6h8');
INSERT INTO tb0 (c0, c1, c2) VALUES (45.00753059847398, 2299723058193524193, 'qhVyxWyNU6l0l9xRyjbLTbzxK0Y7jE6AzY1Db8oFNnwv7nrvnjJmsqt');
INSERT INTO tb0 (c0, c1, c2) VALUES (732.4550046389293, 1892655552062715739, 'uq2NlO2iECK2FShAy9swDDwBigHvplOUwb7FzuQvj6ZQZfVviRPqWfj');
INSERT INTO tb0 (c0, c1, c2) VALUES (739.2607488252547, -4678137979132452417, '4x9lf5ggMtOxWFyF32M8wh55VgdmPVG9hW61OUwvhLiSfp6ykEKxRBp'), (416.129860245572, 1940912733009357417, '2G6X2W0VHcaOnvxD5Jhx5fuxHf0NN1gM4eTzAq3k7YsWwtyToyLH64S');
INSERT INTO tb0 (c0, c1, c2) VALUES (119.35668764679326, -2895901692912858790, 'JggrrsulWJrsRalfeNkjn7qOBs6NQeMkltkXrVLhZV44vyBInlGCMPc');
INSERT INTO tb0 (c0, c1, c2) VALUES (400.3485204851338, -7644887566319292296, 'u6c7WzSqbqo8eJYWjL0zd5RaY4iXz9WXqY3DhEKQBubriPXxFMVP5za');
INSERT INTO tb0 (c0, c1, c2) VALUES (234.74572735366837, 1964338872038691453, 'zqKmKnxLj3n28BoW0UtEEHWPwRuC4s8BMvcKlDN2Z4iJc8e4oKVPJbe');
INSERT INTO tb0 (c0, c1, c2) VALUES (892.8409427314471, 5858496466418920983, 'sML0dilpkKsaqutQ4nZlbW663TWz6nmDVyJbm5MUBPV6nH8KPvGdyYK');
INSERT INTO tb0 (c0, c1, c2) VALUES (476.9362151233115, -9022223542176594760, 'zOT4nd0hwV9L218QANQT449PqDDGbelHsr3Z0LZ4YKJjAAQQJb2Ln76');
INSERT INTO tb0 (c0, c1, c2) VALUES (48.889414482582424, 4235997174179369375, '8c00ntVyLa3R9Z8qCWXJGSOzxWWu3yi8VU7lpTWWYWNq8IhaK9DAzOR');
INSERT INTO tb1 (c0, c1, c2) VALUES ('U7SW4bAmcxh1tUzixrHYURqmMo', 1412210713, 'xMoKJGyI7E37g');
INSERT INTO tb1 (c0, c1, c2) VALUES ('EzTZkFrgoK2yEBS', -1262175645, '93us222uiBBRnz5bNDZu'), ('BYlnXvvTQFO2Lzqchm5Kzle7Tw43YNhnzAFY7bpxpP', 664397226, 'GOquVah71O8OBAb42ugKkapammsoPdCh1n0qea'), ('wrAwslBqeOk53leQFGaOJjfwOfrYvAcJmBGaE7', 1241370527, '1'), ('0ITJVaPJWD78G9aMyBtyD', -1200846105, 'zTLn');
INSERT INTO tb1 (c0, c1, c2) VALUES ('QK7weaHa8g', -1946593584, 'efO5b'), ('NYJy9j6RJPylvApzJ5iP3X5mA', -541774759, 'iA0EyfyyINbsiqXfeBcIxjhUIrXgeIfmvlwdF7wXpltgFhduWUzJbxT'), ('Ace3e0vCguDAkE6pOlgGoAtQl8qDyhKILFW6hVszMy', 333036291, '1b0Gtzy'), ('b8JUl77m5UrByuYr9KZWk7KkRVGz', 31176533, 'ztCc0qIkElVHKjQxzlsmu5HOw42Ty478');
INSERT INTO tb1 (c0, c1, c2) VALUES ('Imh9UF9aeDIxGVLSsiUjXJJVNamWprkOXlegTkyJGdhqbXJ2', 1339604515, 'NBsqTEkj5GOEcIs2gm8PhgZiaFUAtW');
INSERT INTO tb1 (c0, c1, c2) VALUES ('sZ9TgkyJuoecZRnKyHECJenEyWuAA1yDab0pLZUJp1YLhYg6', -2094815694, '');
INSERT INTO tb1 (c0, c1, c2) VALUES ('IEcnOH', 1308100670, 'Pe7T6S8G'), ('mNG9sWBRDa', -854108257, 'xPEF844W92dQR'), ('nVhlFYEp0nveULsS0Bf2vPtcZhe7vhhRxexfzxIkMx8vPHd9', -1666430399, NULL), ('48DwgbxG', 1277601994, 'Wbw3KGST'), ('czEKhTOWUds6M8uFMqse3gvQ7qxuHpNuhyb', 1102590752, '7XXcqnlUEdcmYpHLFHf3Jk6FUAS3jt7pB24kpXc2q3rkY');
INSERT INTO tb1 (c0, c1, c2) VALUES ('cUvN8hH', -1791411078, 'veK0zSYrDE37zW');
INSERT INTO tb1 (c0, c1, c2) VALUES ('PADdAfpvls', -149387644, '9NHhgeOyssz4vWMx1RYooqn1MnaivJWdcvsPHN3c');
INSERT INTO tb1 (c0, c1, c2) VALUES ('Z3PdP', -908587463, 'HOEId966xsT0V1ULvHwx'), ('PuSFkSgmHwUgk6vvsQAOeiBz3OoSnZu2MDWr9', 2050244536, 'Ntx9eVw2ebu8BDHkdsotHsAubjpdlP14DnQQZRAmAxl82NI1qlcBPekSbN6'), ('oOTWgE0eyvTx1y6', -1152431259, 'xSqs00mKo2oo4TVm90BIsjlWKglOelERP9CCMf'), ('Znx67OpS9ko8J0o', -1682592176, NULL);
INSERT INTO tb1 (c0, c1, c2) VALUES ('zpl0JwEASlGhlek2FD9ZrcglxOGJtOYXCVcha2NmNgCpH6P71a', 1859542126, 'UInh1s');
INSERT INTO tb1 (c0, c1, c2) VALUES ('qGBRnhCsVWqg', -2132430602, 'NRSbSfVMDFNLtvTT7FxakU'), ('1F7Ho69Aqw', 1558422612, 'WLIfXjjYa'), ('7o74UO2zjNDEjKyrhEKSM4iT0dY8xCKgd22YgT2y', -795762973, 'nleEywJ8V9C'), ('gRLCOFtPQdnJFDEHxNI6AzCPQopNQmqLazdzVlBbmCb3', 586238266, 'EDNrDqYT5');
INSERT INTO tb1 (c0, c1, c2) VALUES ('FYIdN5Ia9KnneLynwK6OsQPSWXlURB', -533917795, 'Oys'), ('ED6lSZz06IVnkstUoMZe', -19009910, 'w9a7NG4M30BR12U2KBKhCK3I'), ('xkhB0Srk4', 381686098, 'ilVRI0QCRoZtbMphuoV6jDHrmQO');
INSERT INTO tb1 (c0, c1, c2) VALUES ('HxyHCUhFO3', -2064195427, 'IYOihg5NOnVTNreiJ1Zi'), ('rGv78ZiLN6KXNvP4iP3d8NSiTjveBVO7pPp8R5QSk84SDY78', 2087222319, 'HFZ7cxLwID'), ('NrXQxJZk46f50Ve4vgFugLdwU', 1068271614, 'bNYMrWSMIPFZKjTxHCsNM1d8RPCIOkXOb2h8JJAkpLt0yTLQI'), ('WRSbu0g7Xdw6EVOkD236Lt', -1157744440, 'NxBtFlwSnZqvF6EbP9HM9Up21fy7cBkQ7NWA4kLYVVVvzx8Dq8D5xo3B5t5NVNuJmL8bQ4j70f');
INSERT INTO tb1 (c0, c1, c2) VALUES ('Xi4UumuRWaMx9zMxQyY4jp3Jppvp6hfBXn70eBORe', 622843604, 'PUkqyenvR1ZcNvrTtPcmiG'), ('fiCh0J', 1338427837, '1Sz2PJdjZnZYhjQxkyez4vE02VxrHISYJVGB6RjV6F0SRpGFWsLvIQhRUem2yRXwCKVauxlBhu1x1ryQh07ME'), ('x9DM9yBTgGb68QM3TZ', 1415082763, 'yM8nNB82kUIax87sHOlQVWqNlbJbKA73cC03zYfnjFvMz'), ('0MPBylVl4TZ6gLSx2v6k2C3P2UYbDeNu2mOOaRVtVD', -2083693781, 'PKj0u47DAwL0SM6tydr58uR0aqITKFmbneQiB0k');
INSERT INTO tb1 (c0, c1, c2) VALUES ('064VRKXjvLG3tw3TVYEKYOPJbDa', 1875884637, 'pniQ4FvNTwdXMRRE5JriQLTkJVqgVpWDo5LNktKxcXtlRexYxy36nYCM7a4vR8'), ('DugzQdUSvwp8fNQcU', 367707509, 'fVkN3qBxA7uX4BqwbRp8XJpCligVjfzomqV13O2wkCfe05ZRdHTbwt6qUUshtPCOcR'), ('szmomYsyTIED7Lu07qQudptmy', -186101252, NULL);

ALTER TABLE tb0 SET TIFLASH REPLICA 1;
ALTER TABLE tb1 SET TIFLASH REPLICA 1;

SELECT /*+ read_from_storage(tiflash[t0,t1,t2]) */ t2.c0 AS col_0, t1.col_1 AS col_1, t1.col_0 AS col_2, t0.col_0 AS col_3, t2.c2 AS col_4 FROM (SELECT /*+ read_from_storage(tiflash[t0]) */ t0.c0 AS col_0, t0.c2 AS col_1, t0.c1 AS col_2 FROM tb1 AS t0) AS t0 LEFT JOIN (SELECT /*+ read_from_storage(tiflash[t0]) */ t0.c0 AS col_0, t0.c2 AS col_1 FROM tb0 AS t0) AS t1 ON (t0.col_2 = t1.col_1) LEFT JOIN tb0 AS t2 ON (t1.col_0 = t2.c1) WHERE (EXISTS (SELECT /*+ read_from_storage(tiflash[t0]) */ 1 FROM tb0 AS t0 WHERE (NOT (t2.c2 IN (SELECT /*+ read_from_storage(tiflash[t0]) */ t0.c1 FROM tb0 AS t0)))));

2. What did you expect to see? (Required)

no error

3. What did you see instead (Required)

tiflash quit: signal: segmentation fault
[2025/09/16 21:25:05.360 +08:00] [ERROR] [BaseDaemon.cpp:402] ["Access: read."] [source=BaseDaemon] [thread_id=451]
[2025/09/16 21:25:05.360 +08:00] [ERROR] [BaseDaemon.cpp:411] ["Address not mapped to object."] [source=BaseDaemon] [thread_id=451]
[2025/09/16 21:25:05.360 +08:00] [ERROR] [BaseDaemon.cpp:558] ["\n  0x5559c209638e\tfaultSignalHandler(int, siginfo_t*, void*) [tiflash+133305230]\n                \tlibs/libdaemon/src/BaseDaemon.cpp:209\n  0x7f9d2cb4f630\t<unknown symbol> [libpthread.so.0+63024]\n  0x5559c48b692d\tPoco::Message::Message(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Message::Priority, char const*, int) [tiflash+175380781]\n                \tcontrib/poco/Foundation/src/Message.cpp:65\n  0x5559c34780d6\tvoid DB::exception_details::logAndTerminate<char const (&) [45], std::__1::basic_string_view<char, std::__1::char_traits<char>>, std::__1::basic_string_view<char, std::__1::char_traits<char>>>(char const*, int, char const*, std::__1::shared_ptr<DB::Logger> const&, char const (&) [45], std::__1::basic_string_view<char, std::__1::char_traits<char>>&&, std::__1::basic_string_view<char, std::__1::char_traits<char>>&&) [tiflash+154153174]\n                \tdbms/src/Common/Exception.h:207\n  0x5559c347c65e\tDB::PipelineTask::doFinalizeImpl() [tiflash+154170974]\n                \tdbms/src/Flash/Pipeline/Schedule/Events/Event.cpp:239\n  0x5559c34963f0\tDB::EventTask::finalizeImpl() [tiflash+154276848]\n                \tdbms/src/Flash/Pipeline/Schedule/Tasks/Impls/EventTask.cpp:45\n  0x5559c3491b61\tDB::Task::finalize() [tiflash+154258273]\n                \tdbms/src/Flash/Pipeline/Schedule/Tasks/Task.cpp:176\n  0x5559bc506c3d\tDB::TaskThreadPool<DB::CPUImpl>::loop(unsigned long) [tiflash+37297213]\n                \tdbms/src/Flash/Pipeline/Schedule/ThreadPool/TaskThreadPool.cpp:134\n  0x5559bc507446\tvoid* std::__1::__thread_proxy[abi:ue170006]<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (DB::TaskThreadPool<DB::CPUImpl>::*)(unsigned long), DB::TaskThreadPool<DB::CPUImpl>*, unsigned long>>(void*) [tiflash+37299270]\n                \t/usr/local/bin/../include/c++/v1/__type_traits/invoke.h:308\n  0x7f9d2cb47ea5\tstart_thread [libpthread.so.0+32421]"] [source=BaseDaemon] [thread_id=451]
[2025/09/16 21:25:05.360 +08:00] [ERROR] [BaseDaemon.cpp:365] [########################################] [source=BaseDaemon] [thread_id=451]
[2025/09/16 21:25:05.360 +08:00] [ERROR] [BaseDaemon.cpp:366] ["(from thread 291) Received signal Segmentation fault(11)."] [source=BaseDaemon] [thread_id=451]
[2025/09/16 21:25:05.360 +08:00] [ERROR] [BaseDaemon.cpp:396] ["Address: 0x8"] [source=BaseDaemon] [thread_id=451]
[2025/09/16 21:25:05.360 +08:00] [ERROR] [BaseDaemon.cpp:402] ["Access: read."] [source=BaseDaemon] [thread_id=451]
[2025/09/16 21:25:05.360 +08:00] [ERROR] [BaseDaemon.cpp:411] ["Address not mapped to object."] [source=BaseDaemon] [thread_id=451]
[2025/09/16 21:25:05.360 +08:00] [ERROR] [BaseDaemon.cpp:558] ["\n  0x5559c209638e\tfaultSignalHandler(int, siginfo_t*, void*) [tiflash+133305230]\n                \tlibs/libdaemon/src/BaseDaemon.cpp:209\n  0x7f9d2cb4f630\t<unknown symbol> [libpthread.so.0+63024]\n  0x5559c48b692d\tPoco::Message::Message(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, Poco::Message::Priority, char const*, int) [tiflash+175380781]\n                \tcontrib/poco/Foundation/src/Message.cpp:65\n  0x5559c34780d6\tvoid DB::exception_details::logAndTerminate<char const (&) [45], std::__1::basic_string_view<char, std::__1::char_traits<char>>, std::__1::basic_string_view<char, std::__1::char_traits<char>>>(char const*, int, char const*, std::__1::shared_ptr<DB::Logger> const&, char const (&) [45], std::__1::basic_string_view<char, std::__1::char_traits<char>>&&, std::__1::basic_string_view<char, std::__1::char_traits<char>>&&) [tiflash+154153174]\n                \tdbms/src/Common/Exception.h:207\n  0x5559c347c65e\tDB::PipelineTask::doFinalizeImpl() [tiflash+154170974]\n                \tdbms/src/Flash/Pipeline/Schedule/Events/Event.cpp:239\n  0x5559c34963f0\tDB::EventTask::finalizeImpl() [tiflash+154276848]\n                \tdbms/src/Flash/Pipeline/Schedule/Tasks/Impls/EventTask.cpp:45\n  0x5559c3491b61\tDB::Task::finalize() [tiflash+154258273]\n                \tdbms/src/Flash/Pipeline/Schedule/Tasks/Task.cpp:176\n  0x5559bc506c3d\tDB::TaskThreadPool<DB::CPUImpl>::loop(unsigned long) [tiflash+37297213]\n                \tdbms/src/Flash/Pipeline/Schedule/ThreadPool/TaskThreadPool.cpp:134\n  0x5559bc507446\tvoid* std::__1::__thread_proxy[abi:ue170006]<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (DB::TaskThreadPool<DB::CPUImpl>::*)(unsigned long), DB::TaskThreadPool<DB::CPUImpl>*, unsigned long>>(void*) [tiflash+37299270]\n                \t/usr/local/bin/../include/c++/v1/__type_traits/invoke.h:308\n  0x7f9d2cb47ea5\tstart_thread [libpthread.so.0+32421]"] [source=BaseDaemon] [thread_id=451]
[2025/09/16 21:25:06.370 +08:00] [DEBUG] [LocalAdmissionController.cpp:566] ["request to GAC done, req: requests { resource_group_name: \"default\" consumption_since_last_request { r_r_u: 197.4766896565751 } is_tiflash: true keyspace_id { value: 4294967295 } } target_request_period_ms: 5000 client_unique_id: 1426249217. resp: responses { resource_group_name: \"default\" keyspace_id { value: 4294967295 } }"] [source=LocalAdmissionController] [thread_id=452]

4. What is your TiFlash version? (Required)

+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| tidb_version()                                                                                                                                                                                                                                                                             |
+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Release Version: v9.0.0-beta.2.pre-501-gbbd963f
Edition: Community
Git Commit Hash: bbd963f9cb0fcf300c814feaf1a3da80827b2c7f
Git Branch: HEAD
UTC Build Time: 2025-09-16 12:13:07
GoVersion: go1.23.12
Race Enabled: false
Check Table Before Drop: false
Store: tikv
Kernel Type: Classic |
+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

Start by running the supplied CREATE, INSERT, ALTER, and complex SELECT statements against TiFlash to reproduce the segmentation fault. Then inspect the reported stack entries, including dbms/src/Flash/Pipeline/Schedule/Events/Event.cpp, EventTask.cpp, and Task.cpp. Done means the query no longer crashes TiFlash and a regression test covers this case.