[MDEV-26742] Assertion `field->type_handler() == this' failed in FixedBinTypeBundle<NATIVE_LEN, MAX_CHAR_LEN>::Type_handler_fbt::stored_field_cmp_to_item - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Affects Version/s: 10.7.0, 10.5, 10.6
Fix Version/s: 10.5.13, 10.6.5, 10.7.1
Component/s: Data types
Labels:
None

Description

-- source include/have_innodb.inc

CREATE TABLE t1 ( pk uuid, c text) engine=myisam;

INSERT INTO t1 VALUES ('00000000-0000-0000-0000-000000000000',1);

CREATE TABLE t2 ( d text, KEY (d)) engine=innodb ;

INSERT INTO t2 VALUES (2);

UPDATE t2 JOIN t1 ON ( t1.pk > t2.d) SET t1.c = 1;

DROP TABLE t1, t2;

preview-10.7-~~MDEV-4958~~-uuid 92e52a0c582e435e2b8fe4c4d

#3  <signal handler called>

#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

#5  0x00007faac0c01859 in __GI_abort () at abort.c:79

#6  0x00007faac0c01729 in __assert_fail_base (fmt=0x7faac0d97588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x557da84a926d "field->type_handler() == this", file=0x557da84a9290 "/preview-10.7-MDEV-4958-uuid/src/sql/sql_type_fixedbin.h", line=308, function=<optimized out>) at assert.c:92

#7  0x00007faac0c12f36 in __GI___assert_fail (assertion=0x557da84a926d "field->type_handler() == this", file=0x557da84a9290 "/preview-10.7-MDEV-4958-uuid/src/sql/sql_type_fixedbin.h", line=308, function=0x557da84a92e0 "int FixedBinTypeBundle<NATIVE_LEN, MAX_CHAR_LEN>::Type_handler_fbt::stored_field_cmp_to_item(THD*, Field*, Item*) const [with long unsigned int NATIVE_LEN = 16; long unsigned int MAX_CHAR_LEN = 36]") at assert.c:101

#8  0x0000557da7e42600 in FixedBinTypeBundle<16ul, 36ul>::Type_handler_fbt::stored_field_cmp_to_item (this=0x557da93a3e40 <FixedBinTypeBundle<16ul, 36ul>::type_handler_fbt()::th>, thd=0x7faa54000db8, field=0x7faa5494ab80, item=0x7faa54014fc8) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_type_fixedbin.h:308

#9  0x0000557da750d64d in stored_field_cmp_to_item (thd=0x7faa54000db8, field=0x7faa5494ab80, item=0x7faa54014fc8) at /preview-10.7-MDEV-4958-uuid/src/sql/item.cc:9896

#10 0x0000557da6fd74be in SEL_ARG_LT::SEL_ARG_LT (this=0x7faa54958180, thd=0x7faa54000db8, key=0x7faa549595f0 "", field=0x7faa5494ab80, value=0x7faa54014fc8) at /preview-10.7-MDEV-4958-uuid/src/sql/opt_range.cc:1973

#11 0x0000557da6fbce39 in Field::stored_field_make_mm_leaf (this=0x7faa5494ab80, param=0x7faab80b8df0, key_part=0x7faa549574d0, op=SCALAR_CMP_LT, value=0x7faa54014fc8) at /preview-10.7-MDEV-4958-uuid/src/sql/opt_range.cc:9016

#12 0x0000557da6fbc89a in Field_str::get_mm_leaf (this=0x7faa5494ab80, prm=0x7faab80b8df0, key_part=0x7faa549574d0, cond=0x7faa54015208, op=SCALAR_CMP_LT, value=0x7faa54014fc8) at /preview-10.7-MDEV-4958-uuid/src/sql/opt_range.cc:8923

#13 0x0000557da6fbbed9 in Item_bool_func::get_mm_leaf (this=0x7faa54015208, param=0x7faab80b8df0, field=0x7faa5494ab80, key_part=0x7faa549574d0, functype=Item_func::LT_FUNC, value=0x7faa54014fc8) at /preview-10.7-MDEV-4958-uuid/src/sql/opt_range.cc:8778

#14 0x0000557da6fbb31b in Item_bool_func::get_mm_parts (this=0x7faa54015208, param=0x7faab80b8df0, field=0x7faa5494ab80, type=Item_func::LT_FUNC, value=0x7faa54014fc8) at /preview-10.7-MDEV-4958-uuid/src/sql/opt_range.cc:8613

#15 0x0000557da6fd2bfe in Item_bool_func2_with_rev::get_func_mm_tree (this=0x7faa54015208, param=0x7faab80b8df0, field=0x7faa5494ab80, value=0x7faa54014fc8) at /preview-10.7-MDEV-4958-uuid/src/sql/item_cmpfunc.h:499

#16 0x0000557da6fba0c8 in Item_bool_func::get_full_func_mm_tree (this=0x7faa54015208, param=0x7faab80b8df0, field_item=0x7faa540150f0, value=0x7faa54014fc8) at /preview-10.7-MDEV-4958-uuid/src/sql/opt_range.cc:8266

#17 0x0000557da6fd2928 in Item_bool_func::get_full_func_mm_tree_for_args (this=0x7faa54015208, param=0x7faab80b8df0, item=0x7faa540150f0, value=0x7faa54014fc8) at /preview-10.7-MDEV-4958-uuid/src/sql/item_cmpfunc.h:208

#18 0x0000557da6fd2ddd in Item_bool_func2_with_rev::get_mm_tree (this=0x7faa54015208, param=0x7faab80b8df0, cond_ptr=0x7faa54017788) at /preview-10.7-MDEV-4958-uuid/src/sql/item_cmpfunc.h:528

#19 0x0000557da6fac09b in SQL_SELECT::test_quick_select (this=0x7faa54017780, thd=0x7faa54000db8, keys_to_use=..., prev_tables=0, limit=18446744073709551615, force_quick_range=false, ordered_output=false, remove_false_parts_of_where=true, only_single_index_range_scan=false) at /preview-10.7-MDEV-4958-uuid/src/sql/opt_range.cc:2881

#20 0x0000557da7190471 in get_quick_record_count (thd=0x7faa54000db8, select=0x7faa54017780, table=0x7faa549521f8, keys=0x7faa5495c7c0, limit=18446744073709551615) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_select.cc:5035

#21 0x0000557da7192dc1 in make_join_statistics (join=0x7faa54015f00, tables_list=..., keyuse_array=0x7faa54016220) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_select.cc:5761

#22 0x0000557da7186e75 in JOIN::optimize_inner (this=0x7faa54015f00) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_select.cc:2453

#23 0x0000557da71847bb in JOIN::optimize (this=0x7faa54015f00) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_select.cc:1809

#24 0x0000557da7190150 in mysql_select (thd=0x7faa54000db8, tables=0x7faa54014118, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2200096997504, result=0x7faa54015de0, unit=0x7faa54005120, select_lex=0x7faa54005918) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_select.cc:4977

#25 0x0000557da7271e55 in mysql_multi_update (thd=0x7faa54000db8, table_list=0x7faa54014118, fields=0x7faa54005bb8, values=0x7faa54005fe0, conds=0x0, options=0, handle_duplicates=DUP_ERROR, ignore=false, unit=0x7faa54005120, select_lex=0x7faa54005918, result=0x7faab80ba000) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_update.cc:1962

#26 0x0000557da712333c in mysql_execute_command (thd=0x7faa54000db8, is_called_from_prepared_stmt=false) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_parse.cc:4489

#27 0x0000557da712f2a3 in mysql_parse (thd=0x7faa54000db8, rawbuf=0x7faa54014010 "UPDATE t2 JOIN t1 ON ( t1.pk > t2.d) SET t1.c = 1", length=49, parser_state=0x7faab80ba480) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_parse.cc:8036

#28 0x0000557da711b677 in dispatch_command (command=COM_QUERY, thd=0x7faa54000db8, packet=0x7faa5400b979 "UPDATE t2 JOIN t1 ON ( t1.pk > t2.d) SET t1.c = 1", packet_length=49, blocking=true) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_parse.cc:1896

#29 0x0000557da711a013 in do_command (thd=0x7faa54000db8, blocking=true) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_parse.cc:1404

#30 0x0000557da72eb429 in do_handle_one_connection (connect=0x557daacca728, put_in_cache=true) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_connect.cc:1418

#31 0x0000557da72eb0b9 in handle_one_connection (arg=0x557daacca728) at /preview-10.7-MDEV-4958-uuid/src/sql/sql_connect.cc:1312

#32 0x0000557da780ca5f in pfs_spawn_thread (arg=0x557daacca808) at /preview-10.7-MDEV-4958-uuid/src/storage/perfschema/pfs.cc:2201

#33 0x00007faac112b609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#34 0x00007faac0cfe293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

MDEV-26742.diff
12 kB
2021-10-04 07:13

Issue Links

is caused by

MDEV-4958 Adding datatype UUID

Closed

is duplicated by

MDEV-23286 ASAN stack-buffer-overflow or Assertion `field->type_handler() == this' failed in Type_handler_inet6::stored_field_cmp_to_item

Closed

Activity

Ascending order - Click to sort in descending order

Alexander Barkov added a comment - 2021-10-01 15:21 - edited

Also repeatable with INET6 (in 10.6 and in the preview branch):

DROP TABLE IF EXISTS t1,t2;

CREATE TABLE t1 ( pk inet6, c text) engine=myisam;

INSERT INTO t1 VALUES ('::',1);

CREATE TABLE t2 ( d text, KEY (d)) engine=innodb ;

INSERT INTO t2 VALUES (2);

UPDATE t2 JOIN t1 ON ( t1.pk > t2.d) SET t1.c = 1;

DROP TABLE t1, t2;

Alexander Barkov added a comment - 2021-10-01 15:21 - edited Also repeatable with INET6 (in 10.6 and in the preview branch): DROP TABLE IF EXISTS t1,t2; CREATE TABLE t1 ( pk inet6, c text) engine=myisam; INSERT INTO t1 VALUES ( '::' ,1); CREATE TABLE t2 ( d text, KEY (d)) engine=innodb ; INSERT INTO t2 VALUES (2); UPDATE t2 JOIN t1 ON ( t1.pk > t2.d) SET t1.c = 1; DROP TABLE t1, t2;

Alexander Barkov added a comment - 2021-10-01 17:10

Also repeatable with SELECT instead of UPDATE:

DROP TABLE IF EXISTS t1,t2;

CREATE TABLE t1 (pk inet6, c text) engine=myisam;

INSERT INTO t1 VALUES ('::',1);

CREATE TABLE t2 ( d text, KEY (d)) engine=innodb ;

INSERT INTO t2 VALUES (2);

SELECT * FROM t2 JOIN t1 ON ( t1.pk > t2.d);

Alexander Barkov added a comment - 2021-10-01 17:10 Also repeatable with SELECT instead of UPDATE: DROP TABLE IF EXISTS t1,t2; CREATE TABLE t1 (pk inet6, c text) engine=myisam; INSERT INTO t1 VALUES ( '::' ,1); CREATE TABLE t2 ( d text, KEY (d)) engine=innodb ; INSERT INTO t2 VALUES (2); SELECT * FROM t2 JOIN t1 ON ( t1.pk > t2.d);

Alexander Barkov added a comment - 2021-10-01 17:34

Also repeatable with one table:

DROP TABLE IF EXISTS t1;

CREATE TABLE t1 (c varchar(64), key(c)) engine=myisam;

INSERT INTO t1 VALUES ('::1'),('::2');

SELECT * FROM t1 WHERE c>CAST('::1' AS INET6);

Alexander Barkov added a comment - 2021-10-01 17:34 Also repeatable with one table: DROP TABLE IF EXISTS t1; CREATE TABLE t1 (c varchar (64), key (c)) engine=myisam; INSERT INTO t1 VALUES ( '::1' ),( '::2' ); SELECT * FROM t1 WHERE c> CAST ( '::1' AS INET6);

Alexander Barkov added a comment - 2021-10-01 18:29 - edited

A related problem:

DROP TABLE IF EXISTS t1,t2;

CREATE TABLE t1 (c varchar(64), key(c)) engine=myisam;

INSERT INTO t1 VALUES ('::1'),('0::1');

SELECT * FROM t1 WHERE c=CAST('::1' AS INET6);

+------+

| c    |

+------+

| ::1  |

+------+

Looks wrong. The expected behavior is to return two records.

SELECT * FROM t1 IGNORE INDEX(c) WHERE c=CAST('::1' AS INET6);

+------+

| c    |

+------+

| ::1  |

| 0::1 |

+------+

Without the index, the result is correct.

Alexander Barkov added a comment - 2021-10-01 18:29 - edited A related problem: DROP TABLE IF EXISTS t1,t2; CREATE TABLE t1 (c varchar (64), key (c)) engine=myisam; INSERT INTO t1 VALUES ( '::1' ),( '0::1' ); SELECT * FROM t1 WHERE c= CAST ( '::1' AS INET6); +------+ | c | +------+ | ::1 | +------+ Looks wrong. The expected behavior is to return two records. SELECT * FROM t1 IGNORE INDEX (c) WHERE c= CAST ( '::1' AS INET6); +------+ | c | +------+ | ::1 | | 0::1 | +------+ Without the index, the result is correct.

Alexander Barkov added a comment - 2021-10-04 07:15

serg, please review a patch (attached to this issue).

I think it should be pushed in two parts:

the fix with the INET6 tests to 10.5
the UUID tests to 10.7

Alexander Barkov added a comment - 2021-10-04 07:15 serg , please review a patch (attached to this issue). I think it should be pushed in two parts: the fix with the INET6 tests to 10.5 the UUID tests to 10.7

Alexander Barkov added a comment - 2021-10-14 05:24

Pushed a fix to 10.5 using the INET6 part of the tests.

Now need to propagate the fix up to 10.7 and to the UUID stage tree, and add UUID specific MTR tests.

Alexander Barkov added a comment - 2021-10-14 05:24 Pushed a fix to 10.5 using the INET6 part of the tests. Now need to propagate the fix up to 10.7 and to the UUID stage tree, and add UUID specific MTR tests.

Alexander Barkov added a comment - 2021-10-25 10:38

Pushed to preview-10.7-~~MDEV-4958~~-uuid

Alexander Barkov added a comment - 2021-10-25 10:38 Pushed to preview-10.7- MDEV-4958 -uuid

People

Assignee:: Alexander Barkov

Reporter:: Alice Sherepa

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2021-10-01 11:10

Updated:: 2022-07-07 11:35

Resolved:: 2021-10-25 10:38

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Attachments

Attachments

Issue Links

Activity

People

Dates

Git Integration