Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-18793

Assertion `0' failed in row_sel_convert_mysql_key_to_innobase, ASAN unknown-crash in row_mysql_store_col_in_innobase_format, warning " InnoDB: Using a partial-field key prefix in search"

    XMLWordPrintable

    Details

      Description

      --source include/have_innodb.inc
       
      CREATE TABLE t1 (a TEXT, b INT, UNIQUE(a)) ENGINE=InnoDB;
      --error ER_CANT_DROP_FIELD_OR_KEY
      ALTER TABLE t1 DROP x;
      UPDATE t1 SET b = 0 WHERE a = 'foo';
       
      # Cleanup
      DROP TABLE t1;
      

      10.4 non-debug 3b47587f

      2019-03-02 16:30:24 9 [Warning] InnoDB: Using a partial-field key prefix in search, index `a` of table `test`.`t1`. Last data field length 9 bytes, key ptr now exceeds key end by 6 bytes. Key value in the MySQL format:
       len 3; hex 000000; asc    ;
      2019-03-02 16:30:24 9 [Warning] InnoDB: Using a partial-field key prefix in search, index `a` of table `test`.`t1`. Last data field length 9 bytes, key ptr now exceeds key end by 6 bytes. Key value in the MySQL format:
       len 3; hex 000000; asc    ;
      

      10.4 debug 3b47587f

      2019-03-02 16:32:14 9 [Warning] InnoDB: Using a partial-field key prefix in search, index `a` of table `test`.`t1`. Last data field length 9 bytes, key ptr now exceeds key end by 6 bytes. Key value in the MySQL format:
       len 3; hex 000000; asc    ;
      mysqld: /data/src/10.4/storage/innobase/row/row0sel.cc:2681: void row_sel_convert_mysql_key_to_innobase(dtuple_t*, byte*, ulint, dict_index_t*, const byte*, ulint): Assertion `0' failed.
      190302 16:32:14 [ERROR] mysqld got signal 6 ;
       
      #7  0x00007f38fd284ee2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
      #8  0x0000557e21b7e5b8 in row_sel_convert_mysql_key_to_innobase (tuple=0x7f38a01a4d58, buf=0x7f38a0150730 "", buf_len=8, index=0x7f38a01a36f8, key_ptr=0x7f38a0152f11 "", key_len=3) at /data/src/10.4/storage/innobase/row/row0sel.cc:2681
      #9  0x0000557e219eb51e in ha_innobase::records_in_range (this=0x7f38a014fd98, keynr=0, min_key=0x0, max_key=0x7f38f2571d80) at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:13537
      #10 0x0000557e21519531 in handler::multi_range_read_info_const (this=0x7f38a014fd98, keyno=0, seq=0x7f38f2571f80, seq_init_param=0x7f38f2571fb0, n_ranges_arg=0, bufsz=0x7f38f2571e84, flags=0x7f38f2571e80, cost=0x7f38f2572640) at /data/src/10.4/sql/multi_range_read.cc:177
      #11 0x0000557e2151cf44 in DsMrr_impl::dsmrr_info_const (this=0x7f38a01501f0, keyno=0, seq=0x7f38f2571f80, seq_init_param=0x7f38f2571fb0, n_ranges=0, bufsz=0x7f38f2572538, flags=0x7f38f2572534, cost=0x7f38f2572640) at /data/src/10.4/sql/multi_range_read.cc:1579
      #12 0x0000557e219f5c54 in ha_innobase::multi_range_read_info_const (this=0x7f38a014fd98, keyno=0, seq=0x7f38f2571f80, seq_init_param=0x7f38f2571fb0, n_ranges=0, bufsz=0x7f38f2572538, flags=0x7f38f2572534, cost=0x7f38f2572640) at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:20289
      #13 0x0000557e2181b43a in check_quick_select (param=0x7f38f25728b0, idx=0, index_only=false, tree=0x7f38a0152f98, update_tbl_stats=true, mrr_flags=0x7f38f2572534, bufsize=0x7f38f2572538, cost=0x7f38f2572640) at /data/src/10.4/sql/opt_range.cc:11070
      #14 0x0000557e21811db2 in get_key_scans_params (param=0x7f38f25728b0, tree=0x7f38a0152f10, index_read_must_be_used=false, update_tbl_stats=true, read_time=3.3000000000000003) at /data/src/10.4/sql/opt_range.cc:7374
      #15 0x0000557e218068df in SQL_SELECT::test_quick_select (this=0x7f38a0016450, thd=0x7f38a0000b00, keys_to_use=..., prev_tables=0, limit=18446744073709551615, force_quick_range=false, ordered_output=false, remove_false_parts_of_where=false, only_single_index_range_scan=false) at /data/src/10.4/sql/opt_range.cc:2902
      #16 0x0000557e2146352c in SQL_SELECT::check_quick (this=0x7f38a0016450, thd=0x7f38a0000b00, force_quick_range=false, limit=18446744073709551615) at /data/src/10.4/sql/opt_range.h:1649
      #17 0x0000557e2145acbb in mysql_update (thd=0x7f38a0000b00, table_list=0x7f38a00155a0, fields=..., values=..., conds=0x7f38a0015fe8, order_num=0, order=0x0, limit=18446744073709551615, handle_duplicates=DUP_ERROR, ignore=false, found_return=0x7f38f2573840, updated_return=0x7f38f2573900) at /data/src/10.4/sql/sql_update.cc:522
      #18 0x0000557e21358159 in mysql_execute_command (thd=0x7f38a0000b00) at /data/src/10.4/sql/sql_parse.cc:4647
      #19 0x0000557e21364636 in mysql_parse (thd=0x7f38a0000b00, rawbuf=0x7f38a00154a8 "UPDATE t1 SET b = 0 WHERE a = 'foo'", length=35, parser_state=0x7f38f2574180, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8157
      #20 0x0000557e2134fd24 in dispatch_command (command=COM_QUERY, thd=0x7f38a0000b00, packet=0x7f38a0139fd1 "UPDATE t1 SET b = 0 WHERE a = 'foo'", packet_length=35, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1829
      #21 0x0000557e2134e4f8 in do_command (thd=0x7f38a0000b00) at /data/src/10.4/sql/sql_parse.cc:1358
      #22 0x0000557e214c8003 in do_handle_one_connection (connect=0x557e24307d10) at /data/src/10.4/sql/sql_connect.cc:1399
      #23 0x0000557e214c7d74 in handle_one_connection (arg=0x557e24307d10) at /data/src/10.4/sql/sql_connect.cc:1302
      #24 0x0000557e219bed17 in pfs_spawn_thread (arg=0x557e2434db80) at /data/src/10.4/storage/perfschema/pfs.cc:1862
      #25 0x00007f38fef5b494 in start_thread (arg=0x7f38f2575700) at pthread_create.c:333
      #26 0x00007f38fd34193f in clone () from /lib/x86_64-linux-gnu/libc.so.6
      

      10.4 ASAN 3b47587f

      ==3855==ERROR: AddressSanitizer: unknown-crash on address 0x6210000a51dc at pc 0x5573843bde97 bp 0x7fa64eab5480 sp 0x7fa64eab5478
      READ of size 1 at 0x6210000a51dc thread T27
          #0 0x5573843bde96 in row_mysql_store_col_in_innobase_format(dfield_t*, unsigned char*, unsigned long, unsigned char const*, unsigned long, unsigned long) /data/src/10.4/storage/innobase/row/row0mysql.cc:437
          #1 0x55738442f15f in row_sel_convert_mysql_key_to_innobase(dtuple_t*, unsigned char*, unsigned long, dict_index_t*, unsigned char const*, unsigned long) /data/src/10.4/storage/innobase/row/row0sel.cc:2649
          #2 0x55738412d5d1 in ha_innobase::records_in_range(unsigned int, st_key_range*, st_key_range*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:13537
          #3 0x55738359ff55 in handler::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:177
          #4 0x5573835ab2ac in DsMrr_impl::dsmrr_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:1579
          #5 0x557384143eb0 in ha_innobase::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:20289
          #6 0x557383cac828 in check_quick_select /data/src/10.4/sql/opt_range.cc:11070
          #7 0x557383c96709 in get_key_scans_params /data/src/10.4/sql/opt_range.cc:7374
          #8 0x557383c7b900 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /data/src/10.4/sql/opt_range.cc:2902
          #9 0x55738340e5cc in SQL_SELECT::check_quick(THD*, bool, unsigned long long) /data/src/10.4/sql/opt_range.h:1649
          #10 0x5573833f923e in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:522
          #11 0x55738317df3a in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4647
          #12 0x557383195996 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
          #13 0x55738316db9f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
          #14 0x55738316a9a0 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
          #15 0x5573834fe0d3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
          #16 0x5573834fdacc in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
          #17 0x5573840c7dae in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
          #18 0x7fa65a462493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
          #19 0x7fa65884893e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
       
      0x6210000a51dc is located 220 bytes inside of 4172-byte region [0x6210000a5100,0x6210000a614c)
      allocated by thread T27 here:
          #0 0x7fa65a6cc73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
          #1 0x557384a777c3 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118
          #2 0x557384a480be in my_malloc /data/src/10.4/mysys/my_malloc.c:101
          #3 0x557384a277b6 in alloc_root /data/src/10.4/mysys/my_alloc.c:250
          #4 0x557383c7a3ce in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /data/src/10.4/sql/opt_range.cc:2731
          #5 0x55738340e5cc in SQL_SELECT::check_quick(THD*, bool, unsigned long long) /data/src/10.4/sql/opt_range.h:1649
          #6 0x5573833f923e in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:522
          #7 0x55738317df3a in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4647
          #8 0x557383195996 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157
          #9 0x55738316db9f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829
          #10 0x55738316a9a0 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358
          #11 0x5573834fe0d3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399
          #12 0x5573834fdacc in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302
          #13 0x5573840c7dae in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
          #14 0x7fa65a462493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
       
      Thread T27 created by T0 here:
          #0 0x7fa65a69bbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
          #1 0x5573840c8376 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
          #2 0x557382eb84a6 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
          #3 0x557382ecd5b2 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6133
          #4 0x557382ecdcb7 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6203
          #5 0x557382ece047 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6301
          #6 0x557382ecec93 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6459
          #7 0x557382eccded in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5791
          #8 0x557382eb632f in main /data/src/10.4/sql/main.cc:25
          #9 0x7fa6587802b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
       
      SUMMARY: AddressSanitizer: unknown-crash /data/src/10.4/storage/innobase/row/row0mysql.cc:437 row_mysql_store_col_in_innobase_format(dfield_t*, unsigned char*, unsigned long, unsigned char const*, unsigned long, unsigned long)
      Shadow bytes around the buggy address:
        0x0c428000c9e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c428000c9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c428000ca00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c428000ca10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c428000ca20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      =>0x0c428000ca30: 00 00 00 00 00 00 00 00 00 04 04[04]00 00 00 00
        0x0c428000ca40: 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00
        0x0c428000ca50: 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7 f7
        0x0c428000ca60: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c428000ca70: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c428000ca80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Contiguous container OOB:fc
        ASan internal:           fe
      ==3855==ABORTING
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              serg Sergei Golubchik
              Reporter:
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: