Alexander Barkov added a comment - 2019-03-13 08:21 - edited The crash happens in Field_varstring::store() which is called from here: case COLUMN_STAT_MIN_VALUE: table_field->read_stats->min_value->set_notnull(); stat_field->val_str(&val); table_field->read_stats->min_value->store(val.ptr(), val.length(), &my_charset_bin); break ; Field_varstring::store() tries to generate a warning, because the value in the column column_statistics.min_value is not well-formed: it has a hard limit of 255 bytes, so in this bug report on the position 255 it contains the first byte (of a two-byte character) without the second byte. The warning is generated here: void Field::set_warning_truncated_wrong_value( const char *type_arg, const char *value) { THD *thd= get_thd(); const char *db_name= table->s->db.str; const char *table_name= table->s->table_name.str; ... } Notice, it tries to get the db and the table from from "table", however "table" is a NULL pointer here. table_field->read_stats->min_value is created here: static void create_min_max_statistical_fields_for_table_share(THD *thd, TABLE_SHARE *table_share) { ... for (Field **field_ptr= table_share->field; *field_ptr; field_ptr++) { Field *fld; Field *table_field= *field_ptr; my_ptrdiff_t diff= record - table_share->default_values; if (!(fld= table_field->clone(&stats_cb->mem_root, diff))) continue ; if (i == 0) table_field->read_stats->min_value= fld; else table_field->read_stats->max_value= fld; } ... } The above code clones a Field instance but does not set the "table" pointer for the cloned Field. Note, the original instance, table_field, does have a non-NULL pointer. So a solution to fix the crash would probably to copy table_field->table to min_value and max_value. However, it will fix only a part of the problem. Well-formedness problem It is generally wrong that any warnings are generated while copying from column_statistics.min_value . 1. either column_statistics.min_value should store well-formed values (e.g. don't break characters in the middle) 2. or the copying code should suppress warnings Note, column_statistics.min_value can be modified manually. So probably both #1 and #2 are needed. Contraction problem Also, the underlying code should be checked for contraction compatibility. The code copying to column_statistics.min_value should make sure not to break contractions in the middle, otherwise max_value can be very far from the actual maximum value. For example, consider this data in combination with Czech collation: CONCAT(REPEAT( 'x' ,254), 'ch' )) 'ch' is a separate letter which is sorted between 'h' and 'i': http://collation-charts.org/mysql60/mysql604.utf8_czech_ci.html 'ch' should not be broken into parts when copying to column_statistics.min_value : 'c' cannot be the last 255-th byte in column_statistics.min_value , because it was followed by 'h' in the original full-length data. The copying code should store only the REPEAT('x',254) part. For column_statistics.max_value , the copying code will be even harder: it should replace 'ch' to the character which immediately follows 'ch' in the collation, which is 'i'.

Alexander Barkov added a comment - 2019-03-13 08:43 - edited igor , please take over this bug. The problem resides in the statistical code. See the analysis above.

Varun Gupta (Inactive) added a comment - 2019-03-19 14:19 - edited Some imput from bar To fix the crash 1. Fix create_min_max_statistical_fields_for_table_share() to make sure to set table_field->table to a non-NULL pointer 2. Fix writing code to write only full multi-byte sequences, so from the desciption we have letter 'ӥ' (0xD3A5 in utf8), if we want to write a multi-bytes sequence then we must be sure that there is space to write the entire multi-byte sequence, else we should reject the multi-byte character Another task would be to make sure that min and max values are set correctly, the suggestion is to fix this in 10.4

Varun Gupta (Inactive) added a comment - 2019-03-23 09:13 Patch http://lists.askmonty.org/pipermail/commits/2019-March/013580.html

Varun Gupta (Inactive) added a comment - 2019-03-23 09:19 - edited Filed MDEV-19028 as a separate issue to address the contraction problem mentioned above