Assertion `0' failed in row_sel_convert_mysql_key_to_innobase, ASAN unknown-crash in row_mysql_store_col_in_innobase_format, warning " InnoDB: Using a partial-field key prefix in search"

--source include/have_innodb.inc

CREATE TABLE t1 (a TEXT, b INT, UNIQUE(a)) ENGINE=InnoDB;

--error ER_CANT_DROP_FIELD_OR_KEY

ALTER TABLE t1 DROP x;

UPDATE t1 SET b = 0 WHERE a = 'foo';

# Cleanup

DROP TABLE t1;

2019-03-02 16:30:24 9 [Warning] InnoDB: Using a partial-field key prefix in search, index `a` of table `test`.`t1`. Last data field length 9 bytes, key ptr now exceeds key end by 6 bytes. Key value in the MySQL format:

 len 3; hex 000000; asc    ;

2019-03-02 16:30:24 9 [Warning] InnoDB: Using a partial-field key prefix in search, index `a` of table `test`.`t1`. Last data field length 9 bytes, key ptr now exceeds key end by 6 bytes. Key value in the MySQL format:

 len 3; hex 000000; asc    ;

2019-03-02 16:32:14 9 [Warning] InnoDB: Using a partial-field key prefix in search, index `a` of table `test`.`t1`. Last data field length 9 bytes, key ptr now exceeds key end by 6 bytes. Key value in the MySQL format:

 len 3; hex 000000; asc    ;

mysqld: /data/src/10.4/storage/innobase/row/row0sel.cc:2681: void row_sel_convert_mysql_key_to_innobase(dtuple_t*, byte*, ulint, dict_index_t*, const byte*, ulint): Assertion `0' failed.

190302 16:32:14 [ERROR] mysqld got signal 6 ;

#7  0x00007f38fd284ee2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6

#8  0x0000557e21b7e5b8 in row_sel_convert_mysql_key_to_innobase (tuple=0x7f38a01a4d58, buf=0x7f38a0150730 "", buf_len=8, index=0x7f38a01a36f8, key_ptr=0x7f38a0152f11 "", key_len=3) at /data/src/10.4/storage/innobase/row/row0sel.cc:2681

#9  0x0000557e219eb51e in ha_innobase::records_in_range (this=0x7f38a014fd98, keynr=0, min_key=0x0, max_key=0x7f38f2571d80) at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:13537

#10 0x0000557e21519531 in handler::multi_range_read_info_const (this=0x7f38a014fd98, keyno=0, seq=0x7f38f2571f80, seq_init_param=0x7f38f2571fb0, n_ranges_arg=0, bufsz=0x7f38f2571e84, flags=0x7f38f2571e80, cost=0x7f38f2572640) at /data/src/10.4/sql/multi_range_read.cc:177

#11 0x0000557e2151cf44 in DsMrr_impl::dsmrr_info_const (this=0x7f38a01501f0, keyno=0, seq=0x7f38f2571f80, seq_init_param=0x7f38f2571fb0, n_ranges=0, bufsz=0x7f38f2572538, flags=0x7f38f2572534, cost=0x7f38f2572640) at /data/src/10.4/sql/multi_range_read.cc:1579

#12 0x0000557e219f5c54 in ha_innobase::multi_range_read_info_const (this=0x7f38a014fd98, keyno=0, seq=0x7f38f2571f80, seq_init_param=0x7f38f2571fb0, n_ranges=0, bufsz=0x7f38f2572538, flags=0x7f38f2572534, cost=0x7f38f2572640) at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:20289

#13 0x0000557e2181b43a in check_quick_select (param=0x7f38f25728b0, idx=0, index_only=false, tree=0x7f38a0152f98, update_tbl_stats=true, mrr_flags=0x7f38f2572534, bufsize=0x7f38f2572538, cost=0x7f38f2572640) at /data/src/10.4/sql/opt_range.cc:11070

#14 0x0000557e21811db2 in get_key_scans_params (param=0x7f38f25728b0, tree=0x7f38a0152f10, index_read_must_be_used=false, update_tbl_stats=true, read_time=3.3000000000000003) at /data/src/10.4/sql/opt_range.cc:7374

#15 0x0000557e218068df in SQL_SELECT::test_quick_select (this=0x7f38a0016450, thd=0x7f38a0000b00, keys_to_use=..., prev_tables=0, limit=18446744073709551615, force_quick_range=false, ordered_output=false, remove_false_parts_of_where=false, only_single_index_range_scan=false) at /data/src/10.4/sql/opt_range.cc:2902

#16 0x0000557e2146352c in SQL_SELECT::check_quick (this=0x7f38a0016450, thd=0x7f38a0000b00, force_quick_range=false, limit=18446744073709551615) at /data/src/10.4/sql/opt_range.h:1649

#17 0x0000557e2145acbb in mysql_update (thd=0x7f38a0000b00, table_list=0x7f38a00155a0, fields=..., values=..., conds=0x7f38a0015fe8, order_num=0, order=0x0, limit=18446744073709551615, handle_duplicates=DUP_ERROR, ignore=false, found_return=0x7f38f2573840, updated_return=0x7f38f2573900) at /data/src/10.4/sql/sql_update.cc:522

#18 0x0000557e21358159 in mysql_execute_command (thd=0x7f38a0000b00) at /data/src/10.4/sql/sql_parse.cc:4647

#19 0x0000557e21364636 in mysql_parse (thd=0x7f38a0000b00, rawbuf=0x7f38a00154a8 "UPDATE t1 SET b = 0 WHERE a = 'foo'", length=35, parser_state=0x7f38f2574180, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8157

#20 0x0000557e2134fd24 in dispatch_command (command=COM_QUERY, thd=0x7f38a0000b00, packet=0x7f38a0139fd1 "UPDATE t1 SET b = 0 WHERE a = 'foo'", packet_length=35, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1829

#21 0x0000557e2134e4f8 in do_command (thd=0x7f38a0000b00) at /data/src/10.4/sql/sql_parse.cc:1358

#22 0x0000557e214c8003 in do_handle_one_connection (connect=0x557e24307d10) at /data/src/10.4/sql/sql_connect.cc:1399

#23 0x0000557e214c7d74 in handle_one_connection (arg=0x557e24307d10) at /data/src/10.4/sql/sql_connect.cc:1302

#24 0x0000557e219bed17 in pfs_spawn_thread (arg=0x557e2434db80) at /data/src/10.4/storage/perfschema/pfs.cc:1862

#25 0x00007f38fef5b494 in start_thread (arg=0x7f38f2575700) at pthread_create.c:333

#26 0x00007f38fd34193f in clone () from /lib/x86_64-linux-gnu/libc.so.6

==3855==ERROR: AddressSanitizer: unknown-crash on address 0x6210000a51dc at pc 0x5573843bde97 bp 0x7fa64eab5480 sp 0x7fa64eab5478

READ of size 1 at 0x6210000a51dc thread T27

    #0 0x5573843bde96 in row_mysql_store_col_in_innobase_format(dfield_t*, unsigned char*, unsigned long, unsigned char const*, unsigned long, unsigned long) /data/src/10.4/storage/innobase/row/row0mysql.cc:437

    #1 0x55738442f15f in row_sel_convert_mysql_key_to_innobase(dtuple_t*, unsigned char*, unsigned long, dict_index_t*, unsigned char const*, unsigned long) /data/src/10.4/storage/innobase/row/row0sel.cc:2649

    #2 0x55738412d5d1 in ha_innobase::records_in_range(unsigned int, st_key_range*, st_key_range*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:13537

    #3 0x55738359ff55 in handler::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:177

    #4 0x5573835ab2ac in DsMrr_impl::dsmrr_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/sql/multi_range_read.cc:1579

    #5 0x557384143eb0 in ha_innobase::multi_range_read_info_const(unsigned int, st_range_seq_if*, void*, unsigned int, unsigned int*, unsigned int*, Cost_estimate*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:20289

    #6 0x557383cac828 in check_quick_select /data/src/10.4/sql/opt_range.cc:11070

    #7 0x557383c96709 in get_key_scans_params /data/src/10.4/sql/opt_range.cc:7374

    #8 0x557383c7b900 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /data/src/10.4/sql/opt_range.cc:2902

    #9 0x55738340e5cc in SQL_SELECT::check_quick(THD*, bool, unsigned long long) /data/src/10.4/sql/opt_range.h:1649

    #10 0x5573833f923e in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:522

    #11 0x55738317df3a in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4647

    #12 0x557383195996 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157

    #13 0x55738316db9f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829

    #14 0x55738316a9a0 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358

    #15 0x5573834fe0d3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399

    #16 0x5573834fdacc in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302

    #17 0x5573840c7dae in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862

    #18 0x7fa65a462493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

    #19 0x7fa65884893e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x6210000a51dc is located 220 bytes inside of 4172-byte region [0x6210000a5100,0x6210000a614c)

allocated by thread T27 here:

    #0 0x7fa65a6cc73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)

    #1 0x557384a777c3 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118

    #2 0x557384a480be in my_malloc /data/src/10.4/mysys/my_malloc.c:101

    #3 0x557384a277b6 in alloc_root /data/src/10.4/mysys/my_alloc.c:250

    #4 0x557383c7a3ce in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /data/src/10.4/sql/opt_range.cc:2731

    #5 0x55738340e5cc in SQL_SELECT::check_quick(THD*, bool, unsigned long long) /data/src/10.4/sql/opt_range.h:1649

    #6 0x5573833f923e in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, enum_duplicates, bool, unsigned long long*, unsigned long long*) /data/src/10.4/sql/sql_update.cc:522

    #7 0x55738317df3a in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:4647

    #8 0x557383195996 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8157

    #9 0x55738316db9f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829

    #10 0x55738316a9a0 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358

    #11 0x5573834fe0d3 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399

    #12 0x5573834fdacc in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302

    #13 0x5573840c7dae in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862

    #14 0x7fa65a462493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

Thread T27 created by T0 here:

    #0 0x7fa65a69bbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)

    #1 0x5573840c8376 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912

    #2 0x557382eb84a6 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268

    #3 0x557382ecd5b2 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6133

    #4 0x557382ecdcb7 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6203

    #5 0x557382ece047 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6301

    #6 0x557382ecec93 in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6459

    #7 0x557382eccded in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5791

    #8 0x557382eb632f in main /data/src/10.4/sql/main.cc:25

    #9 0x7fa6587802b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: unknown-crash /data/src/10.4/storage/innobase/row/row0mysql.cc:437 row_mysql_store_col_in_innobase_format(dfield_t*, unsigned char*, unsigned long, unsigned char const*, unsigned long, unsigned long)

Shadow bytes around the buggy address:

  0x0c428000c9e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c428000c9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c428000ca00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c428000ca10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c428000ca20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0c428000ca30: 00 00 00 00 00 00 00 00 00 04 04[04]00 00 00 00

  0x0c428000ca40: 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00

  0x0c428000ca50: 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7 f7

  0x0c428000ca60: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c428000ca70: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c428000ca80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Contiguous container OOB:fc

  ASan internal:           fe

==3855==ABORTING