Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-29108

Assertion `m_using_unique_constraint || m_group_buff <= param->group_buff + param->group_length' failed in Create_tmp_table::finalize

Details

    • Bug
    • Status: Closed (View Workflow)
    • Critical
    • Resolution: Fixed
    • N/A
    • 10.10.1
    • Server
    • None

    Description

      I'm not sure at all that the failure has anything to do with RANDOM_BYTES, but it's the first time I've ever seen it, and I can't find anything to replace RANDOM_BYTES with to make the test applicable to other branches. Please reduce the priority if the analysis shows it's unrelated.

      CREATE TABLE t (a INT);
      INSERT INTO t VALUES (1),(2);
      SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2;
       
      # Cleanup
      DROP TABLE t;
      

      preview-10.10-misc a5f44a81b

      mariadbd: /data/src/preview-10.10-misc/sql/sql_select.cc:19597: bool Create_tmp_table::finalize(THD*, TABLE*, TMP_TABLE_PARAM*, bool, bool): Assertion `m_using_unique_constraint || m_group_buff <= param->group_buff + param->group_length' failed.
      220715 14:51:08 [ERROR] mysqld got signal 6 ;
       
      #7  0x00007ffa10c83662 in __GI___assert_fail (assertion=0x55b8c777e460 "m_using_unique_constraint || m_group_buff <= param->group_buff + param->group_length", file=0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", line=19597, function=0x55b8c777e280 "bool Create_tmp_table::finalize(THD*, TABLE*, TMP_TABLE_PARAM*, bool, bool)") at assert.c:101
      No locals.
      #8  0x000055b8c58dd7d8 in Create_tmp_table::finalize (this=0x7ffa07975e80, thd=0x62b00007e288, table=0x620000014128, param=0x6290000ea0f8, do_not_open=true, keep_row_order=false) at /data/src/preview-10.10-misc/sql/sql_select.cc:19597
              cur_group = 0x0
              _db_stack_frame_ = {func = 0x55b8c7776860 "JOIN::create_postjoin_aggr_table", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483659, line = -1, prev = 0x7ffa07976030}
              __PRETTY_FUNCTION__ = "bool Create_tmp_table::finalize(THD*, TABLE*, TMP_TABLE_PARAM*, bool, bool)"
              null_pack_length = {0, 1}
              null_pack_base = {1, 0}
              null_counter = {0, 1}
              whole_null_pack_length = 1
              use_packed_rows = false
              save_abort_on_warning = false
              pos = 0x61a000084805 '\276' <repeats 27 times>, "\377"
              null_flags = 0x61a000084800 "\377"
              keyinfo = 0x620000014ae8
              recinfo = 0x620000014c58
              share = 0x6200000144e0
              copy = 0x629000271488
              mem_root_save = 0x62b000084208
      #9  0x000055b8c58e0c86 in create_tmp_table (thd=0x62b00007e288, param=0x6290000ea0f8, fields=@0x6290000e85a8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6290000e6b28, last = 0x6290000e6e48, elements = 2}, <No data fields>}, group=0x6290000e7710, distinct=false, save_sum_fields=false, select_options=2147748608, rows_limit=18446744073709551615, table_alias=0x55b8c8ae3ac0 <empty_clex_str>, do_not_open=true, keep_row_order=false) at /data/src/preview-10.10-misc/sql/sql_select.cc:19830
              table = 0x620000014128
              maker = {<Data_type_statistics> = {m_uneven_bit_length = 0, m_fixed_string_total_length = 0, m_fixed_string_count = 0, m_variable_string_total_length = 0, m_variable_string_count = 0, m_blob_count = 0}, _vptr.Create_tmp_table = 0x55b8c8b27c48 <vtable for Create_tmp_table+16>, m_from_field = 0x620000014ac0, m_default_field = 0x620000014aa0, m_key_part_info = 0x620000014bc8, m_group_buff = 0x620000014e04 "\276\276\276\276\377\377\377\377", m_bitmaps = 0x620000014e08 "\377\377\377\377", m_alloced_field_count = 2, m_using_unique_constraint = false, m_temp_pool_slot = 4294967295, m_group = 0x6290000e78a0, m_distinct = false, m_save_sum_fields = false, m_with_cycle = false, m_select_options = 2147748608, m_rows_limit = 18446744073709551615, m_group_null_items = 0, m_field_count = {0, 1}, m_null_count = {0, 1}, m_blobs_count = {0, 0}, m_uneven_bit = {0, 0}, current_counter = Create_tmp_table::other}
      #10 0x000055b8c586e00e in JOIN::create_postjoin_aggr_table (this=0x6290000e8240, tab=0x6290000e9b38, table_fields=0x6290000e85a8, table_group=0x6290000e7710, save_sum_fields=false, distinct=false, keep_row_order=false) at /data/src/preview-10.10-misc/sql/sql_select.cc:4066
              _db_stack_frame_ = {func = 0x55b8c77764c0 "JOIN::make_aggr_tables_info", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483658, line = -1, prev = 0x7ffa07976170}
              table_rows_limit = 18446744073709551615
              table = 0x6290000e8240
              __PRETTY_FUNCTION__ = "bool JOIN::create_postjoin_aggr_table(JOIN_TAB*, List<Item>*, ORDER*, bool, bool, bool)"
      #11 0x000055b8c586987b in JOIN::make_aggr_tables_info (this=0x6290000e8240) at /data/src/preview-10.10-misc/sql/sql_select.cc:3645
              tmp_group = 0x6290000e7710
              save_sum_fields = false
              curr_all_fields = 0x6290000e85a8
              curr_fields_list = 0x6290000e6670
              curr_tab = 0x6290000e9b38
              exec_tmp_table = 0x0
              distinct = false
              has_group_by = true
              keep_row_order = false
              is_having_added_as_table_cond = false
              _db_stack_frame_ = {func = 0x55b8c7775de0 "JOIN::optimize_stage2", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483657, line = -1, prev = 0x7ffa07976340}
              implicit_grouping_with_window_funcs = false
              implicit_grouping_without_tables = false
              __PRETTY_FUNCTION__ = "bool JOIN::make_aggr_tables_info()"
      #12 0x000055b8c5865274 in JOIN::optimize_stage2 (this=0x6290000e8240) at /data/src/preview-10.10-misc/sql/sql_select.cc:3273
              select_opts_for_readinfo = 0
              no_jbuf_after = 1
              tab = 0x0
              _db_stack_frame_ = {func = 0x55b8c7775920 "JOIN::optimize_inner", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483656, line = -1, prev = 0x7ffa07976500}
              __PRETTY_FUNCTION__ = "int JOIN::optimize_stage2()"
              res = -1
      #13 0x000055b8c585d8b6 in JOIN::optimize_inner (this=0x6290000e8240) at /data/src/preview-10.10-misc/sql/sql_select.cc:2532
              _db_stack_frame_ = {func = 0x55b8c77776c0 "mysql_select", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483655, line = -1, prev = 0x7ffa079767e0}
              trace_wrapper = {<Json_writer_struct> = {_vptr.Json_writer_struct = 0x55b8c8b191c8 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
              trace_prepare = {<Json_writer_struct> = {_vptr.Json_writer_struct = 0x55b8c8b191c8 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
              trace_steps = {<Json_writer_struct> = {_vptr.Json_writer_struct = 0x55b8c8b191a8 <vtable for Json_writer_array+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
              sel = 0x6290000e63c8
              eq_list = {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55b8c9a84580 <end_of_list>, last = 0x7ffa079764c0, elements = 0}, <No data fields>}
              ignore_on_expr = false
              __PRETTY_FUNCTION__ = "int JOIN::optimize_inner()"
      #14 0x000055b8c5856586 in JOIN::optimize (this=0x6290000e8240) at /data/src/preview-10.10-misc/sql/sql_select.cc:1848
              res = 0
              init_state = JOIN::NOT_OPTIMIZED
      #15 0x000055b8c587790a in mysql_select (thd=0x62b00007e288, tables=0x6290000e6ec0, fields=@0x6290000e6670: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6290000e6b28, last = 0x6290000e6e48, elements = 2}, <No data fields>}, conds=0x0, og_num=2, order=0x0, group=0x6290000e7710, having=0x0, proc_param=0x0, select_options=2147748608, result=0x6290000e8210, unit=0x62b0000826b0, select_lex=0x6290000e63c8) at /data/src/preview-10.10-misc/sql/sql_select.cc:5033
              err = 0
              free_join = true
              _db_stack_frame_ = {func = 0x55b8c7774440 "handle_select", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483654, line = -1, prev = 0x7ffa07976900}
              join = 0x6290000e8240
      #16 0x000055b8c5848407 in handle_select (thd=0x62b00007e288, lex=0x62b0000825d0, result=0x6290000e8210, setup_tables_done_option=0) at /data/src/preview-10.10-misc/sql/sql_select.cc:579
              unit = 0x62b0000826b0
              res = false
              select_lex = 0x6290000e63c8
              _db_stack_frame_ = {func = 0x55b8c771f1e0 "mysql_execute_command", file = 0x55b8c771ccc0 "/data/src/preview-10.10-misc/sql/sql_parse.cc", level = 2147483653, line = -1, prev = 0x7ffa07977260}
      #17 0x000055b8c5774753 in execute_sqlcom_select (thd=0x62b00007e288, all_tables=0x6290000e6ec0) at /data/src/preview-10.10-misc/sql/sql_parse.cc:6017
              save_protocol = 0x0
              lex = 0x62b0000825d0
              result = 0x6290000e8210
              res = false
              __PRETTY_FUNCTION__ = "bool execute_sqlcom_select(THD*, TABLE_LIST*)"
      #18 0x000055b8c576565b in mysql_execute_command (thd=0x62b00007e288, is_called_from_prepared_stmt=false) at /data/src/preview-10.10-misc/sql/sql_parse.cc:3939
              privileges_requested = SELECT_ACL
              res = 0
              lex = 0x62b0000825d0
              select_lex = 0x6290000e63c8
              first_table = 0x6290000e6ec0
              all_tables = 0x6290000e6ec0
              unit = 0x62b0000826b0
              rpl_filter = 0x7ffa07976fe0
              _db_stack_frame_ = {func = 0x55b8c7721ea0 "mysql_parse", file = 0x55b8c771ccc0 "/data/src/preview-10.10-misc/sql/sql_parse.cc", level = 2147483652, line = -1, prev = 0x7ffa079777c0}
              __PRETTY_FUNCTION__ = "int mysql_execute_command(THD*, bool)"
              ots = {ctx = 0x62b000082268, traceable = false}
              orig_binlog_format = BINLOG_FORMAT_MIXED
              orig_current_stmt_binlog_format = BINLOG_FORMAT_STMT
      #19 0x000055b8c577f575 in mysql_parse (thd=0x62b00007e288, rawbuf=0x6290000e62a8 "SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2", length=88, parser_state=0x7ffa07977bb0) at /data/src/preview-10.10-misc/sql/sql_parse.cc:7797
              found_semicolon = 0x0
              error = 24880
              lex = 0x62b0000825d0
              err = false
              _db_stack_frame_ = {func = 0x55b8c771dca0 "dispatch_command", file = 0x55b8c771ccc0 "/data/src/preview-10.10-misc/sql/sql_parse.cc", level = 2147483651, line = -1, prev = 0x7ffa07977a30}
              __PRETTY_FUNCTION__ = "void mysql_parse(THD*, char*, uint, Parser_state*)"
      #20 0x000055b8c5758193 in dispatch_command (command=COM_QUERY, thd=0x62b00007e288, packet=0x62900025d289 "SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2", packet_length=88, blocking=true) at /data/src/preview-10.10-misc/sql/sql_parse.cc:1892
              packet_end = 0x6290000e6300 ""
              parser_state = {m_lip = {lookahead_token = -1, lookahead_yylval = 0x0, m_thd = 0x62b00007e288, m_ptr = 0x6290000e6301 "\004", m_tok_start = 0x6290000e6301 "\004", m_tok_end = 0x6290000e6301 "\004", m_end_of_query = 0x6290000e6300 "", m_tok_start_prev = 0x6290000e6300 "", m_buf = 0x6290000e62a8 "SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2", m_buf_length = 88, m_echo = true, m_echo_saved = false, m_cpp_buf = 0x6290000e6360 "SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2", m_cpp_ptr = 0x6290000e63b8 "", m_cpp_tok_start = 0x6290000e63b8 "", m_cpp_tok_start_prev = 0x6290000e63b8 "", m_cpp_tok_end = 0x6290000e63b8 "", m_body_utf8 = 0x0, m_body_utf8_ptr = 0x616000653780 "\017", m_cpp_utf8_processed_ptr = 0x0, next_state = MY_LEX_END, found_semicolon = 0x0, ignore_space = false, stmt_prepare_mode = false, multi_statements = true, yylineno = 1, m_digest = 0x0, in_comment = NO_COMMENT, in_comment_saved = (DISCARD_COMMENT | unknown: 0x7ff8), m_cpp_text_start = 0x6290000e63b6 "f2", m_cpp_text_end = 0x6290000e63b8 "", m_underscore_cs = 0x0}, m_yacc = {yacc_yyss = 0x0, yacc_yyvs = 0x0, m_set_signal_info = {m_item = {0x0 <repeats 13 times>}}, m_lock_type = TL_READ_DEFAULT, m_mdl_type = MDL_SHARED_READ}, m_digest_psi = 0x62b000081ff8}
              net = 0x62b00007e5c0
              error = false
              do_end_of_statement = true
              _db_stack_frame_ = {func = 0x55b8c771d420 "do_command", file = 0x55b8c771ccc0 "/data/src/preview-10.10-misc/sql/sql_parse.cc", level = 2147483650, line = -1, prev = 0x7ffa07978ca0}
              drop_more_results = false
              __PRETTY_FUNCTION__ = "dispatch_command_return dispatch_command(enum_server_command, THD*, char*, uint, bool)"
              __FUNCTION__ = "dispatch_command"
              res = <optimized out>
      #21 0x000055b8c5754f90 in do_command (thd=0x62b00007e288, blocking=true) at /data/src/preview-10.10-misc/sql/sql_parse.cc:1405
              return_value = DISPATCH_COMMAND_SUCCESS
              packet = 0x62900025d288 "\003SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2"
              packet_length = 89
              net = 0x62b00007e5c0
              command = COM_QUERY
              _db_stack_frame_ = {func = 0x55b8c8616680 "?func", file = 0x55b8c86166c0 "?file", level = 2147483649, line = -1, prev = 0x0}
              __PRETTY_FUNCTION__ = "dispatch_command_return do_command(THD*, bool)"
              __FUNCTION__ = "do_command"
      #22 0x000055b8c5bec38c in do_handle_one_connection (connect=0x61100000a708, put_in_cache=true) at /data/src/preview-10.10-misc/sql/sql_connect.cc:1418
              create_user = true
              thr_create_utime = 4307980419727
              thd = 0x62b00007e288
              __PRETTY_FUNCTION__ = "void do_handle_one_connection(CONNECT*, bool)"
      #23 0x000055b8c5bebc51 in handle_one_connection (arg=0x61100000a5c8) at /data/src/preview-10.10-misc/sql/sql_connect.cc:1312
              connect = 0x61100000a5c8
      #24 0x000055b8c67bfa94 in pfs_spawn_thread (arg=0x618000005d08) at /data/src/preview-10.10-misc/storage/perfschema/pfs.cc:2201
              typed_arg = 0x618000005d08
              user_arg = 0x61100000a5c8
              user_start_routine = 0x55b8c5bebbd1 <handle_one_connection(void*)>
              pfs = 0x7ffa0d162d80
              klass = 0x625000005400
      #25 0x00007ffa1114dea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
              ret = <optimized out>
              pd = <optimized out>
              unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140711845926656, -5234889544690009439, 140720531011822, 140720531011823, 140711845924608, 1060864, 5237088914247285409, 5237067996144499361}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
              not_first_call = 0
      #26 0x00007ffa10d4cdef in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Attachments

        Issue Links

          Activity

            danblack Daniel Black added a comment -

            non-debug doesn't crash as its a DBUG_ASSERTION only.

            simpler debug build

            MariaDB [test]> SELECT RANDOM_BYTES(-10) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2;
            ERROR 2013 (HY000): Lost connection to server during query
            MariaDB [test]> 
            

            debug preview-10.10-misc b708af32d4e81d702d364e027a4706eee95b9dde

            (gdb) b  sql/sql_select.cc:19589
            Breakpoint 1 at 0xa2fd27: file /home/dan/repos/mariadb-server-10.10/sql/sql_select.cc, line 19589.
            (gdb) c
            Continuing.
            [New Thread 0x7f46703a9640 (LWP 60927)]
            [Switching to Thread 0x7f46703a9640 (LWP 60927)]
             
            Thread 19 "mysqld" hit Breakpoint 1, Create_tmp_table::finalize (this=0x7f46703a4ee8, thd=0x7f4620000dc8, table=0x7f4620068430, param=0x7f462001a248, do_not_open=true, keep_row_order=false) at /home/dan/repos/mariadb-server-10.10/sql/sql_select.cc:19589
            19589	        m_group_buff+= cur_group->field->pack_length();
            (gdb) p m_group_buff
            $1 = (uchar *) 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377"
            (gdb) p param->group_buff
            $2 = (uchar *) 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377"
            (gdb) p param->group_length
            $3 = 1
            (gdb) p *cur_group
            $4 = {next = 0x0, item = 0x7f4620018838, item_ptr = 0x7f4620017780, fast_field_copier_func = 0xa5a5a5a5a5a5a5a5, fast_field_copier_setup = 0x0, counter = -1515870811, direction = st_order::ORDER_ASC, in_field_list = true, counter_used = false, field = 0x7f46200692b0, buff = 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377", used = 0, depend_map = 1}
            (gdb) p *cur_group->field
            $5 = (Field_long) {<Field_int> = {<Field_num> = {<Field> = {<Value_source> = {<No data fields>}, _vptr$Field = 0x2029950 <vtable for Field_long+16>, ptr = 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377", null_ptr = 0x0, table = 0x7f4620068430, orig_table = 0x7f4620068430, table_name = 0x7f4620068540, field_name = {str = 0x7f4620016eb8 "f2", length = 2}, comment = {str = 0x1a55de9 "", length = 0}, option_list = 0x0, option_struct = 0x0, key_start = {buffer = {0}}, part_of_key = {buffer = {0}}, part_of_key_not_clustered = {buffer = {0}}, part_of_sortkey = {buffer = {0}}, unireg_check = Field::NONE, invisible = VISIBLE, field_length = 11, flags = 1, field_index = 0, null_bit = 0 '\000', is_created_from_null_item = false, cond_selectivity = 1, next_equal_field = 0x0, read_stats = 0x0, collected_stats = 0x0, vcol_info = 0x0, check_constraint = 0x0, default_value = 0x0}, dec = 0, zerofill = false, unsigned_flag = false}, <No data fields>}, <No data fields>}
             
            (gdb) p cur_group->field->pack_length()
            $6 = 4
            (gdb) n
            19591	      keyinfo->key_length+=  m_key_part_info->length;
            (gdb) n
            19530	    for (; cur_group ; cur_group= cur_group->next, m_key_part_info++)
            (gdb) n
            19597	    DBUG_ASSERT(m_using_unique_constraint ||
            (gdb) list
            19592	    }
            19593	    /*
            19594	      Ensure we didn't overrun the group buffer. The < is only true when
            19595	      some maybe_null fields was changed to be not null fields.
            19596	    */
            19597	    DBUG_ASSERT(m_using_unique_constraint ||
            19598	                m_group_buff <= param->group_buff + param->group_length);
            19599	  }
            19600	
            19601	  if (m_distinct && (share->fields != param->hidden_field_count ||
            (gdb) p m_group_buff
            $7 = (uchar *) 0x7f46200690d4 "\245\245\245\245\377\377\377\377"
            (gdb) p param->group_buff
            $8 = (uchar *) 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377"
            (gdb) p param->group_length
            $9 = 1
            (gdb) p  param->group_buff + param->group_length
            $10 = (uchar *) 0x7f46200690d1 "\245\245\245\245\245\245\245\377\377\377\377"
            (gdb) n
            [Thread 0x7f4669ffb640 (LWP 60843) exited]
             
            Thread 19 "mysqld" received signal SIGABRT, Aborted.
            0x00007f469468ec4c in __pthread_kill_implementation () from /lib64/libc.so.6
            

            Breakpoint executing SELECT RANDOM_BYTES(-10) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2;.

            So: {{19589 m_group_buff+= cur_group->field->pack_length();}} gets incremented by 4 breaking the assertion constraint. So the assertion is incorrect, or param->group_length should also be 4.

            calc_group_buffer never sets the value of this param so I'm unsure where group_length is set to 1 from.

            danblack Daniel Black added a comment - non-debug doesn't crash as its a DBUG_ASSERTION only. simpler debug build MariaDB [test]> SELECT RANDOM_BYTES(-10) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2; ERROR 2013 (HY000): Lost connection to server during query MariaDB [test]> debug preview-10.10-misc b708af32d4e81d702d364e027a4706eee95b9dde (gdb) b sql/sql_select.cc:19589 Breakpoint 1 at 0xa2fd27: file /home/dan/repos/mariadb-server-10.10/sql/sql_select.cc, line 19589. (gdb) c Continuing. [New Thread 0x7f46703a9640 (LWP 60927)] [Switching to Thread 0x7f46703a9640 (LWP 60927)]   Thread 19 "mysqld" hit Breakpoint 1, Create_tmp_table::finalize (this=0x7f46703a4ee8, thd=0x7f4620000dc8, table=0x7f4620068430, param=0x7f462001a248, do_not_open=true, keep_row_order=false) at /home/dan/repos/mariadb-server-10.10/sql/sql_select.cc:19589 19589 m_group_buff+= cur_group->field->pack_length(); (gdb) p m_group_buff $1 = (uchar *) 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377" (gdb) p param->group_buff $2 = (uchar *) 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377" (gdb) p param->group_length $3 = 1 (gdb) p *cur_group $4 = {next = 0x0, item = 0x7f4620018838, item_ptr = 0x7f4620017780, fast_field_copier_func = 0xa5a5a5a5a5a5a5a5, fast_field_copier_setup = 0x0, counter = -1515870811, direction = st_order::ORDER_ASC, in_field_list = true, counter_used = false, field = 0x7f46200692b0, buff = 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377", used = 0, depend_map = 1} (gdb) p *cur_group->field $5 = (Field_long) {<Field_int> = {<Field_num> = {<Field> = {<Value_source> = {<No data fields>}, _vptr$Field = 0x2029950 <vtable for Field_long+16>, ptr = 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377", null_ptr = 0x0, table = 0x7f4620068430, orig_table = 0x7f4620068430, table_name = 0x7f4620068540, field_name = {str = 0x7f4620016eb8 "f2", length = 2}, comment = {str = 0x1a55de9 "", length = 0}, option_list = 0x0, option_struct = 0x0, key_start = {buffer = {0}}, part_of_key = {buffer = {0}}, part_of_key_not_clustered = {buffer = {0}}, part_of_sortkey = {buffer = {0}}, unireg_check = Field::NONE, invisible = VISIBLE, field_length = 11, flags = 1, field_index = 0, null_bit = 0 '\000', is_created_from_null_item = false, cond_selectivity = 1, next_equal_field = 0x0, read_stats = 0x0, collected_stats = 0x0, vcol_info = 0x0, check_constraint = 0x0, default_value = 0x0}, dec = 0, zerofill = false, unsigned_flag = false}, <No data fields>}, <No data fields>}   (gdb) p cur_group->field->pack_length() $6 = 4 (gdb) n 19591 keyinfo->key_length+= m_key_part_info->length; (gdb) n 19530 for (; cur_group ; cur_group= cur_group->next, m_key_part_info++) (gdb) n 19597 DBUG_ASSERT(m_using_unique_constraint || (gdb) list 19592 } 19593 /* 19594 Ensure we didn't overrun the group buffer. The < is only true when 19595 some maybe_null fields was changed to be not null fields. 19596 */ 19597 DBUG_ASSERT(m_using_unique_constraint || 19598 m_group_buff <= param->group_buff + param->group_length); 19599 } 19600 19601 if (m_distinct && (share->fields != param->hidden_field_count || (gdb) p m_group_buff $7 = (uchar *) 0x7f46200690d4 "\245\245\245\245\377\377\377\377" (gdb) p param->group_buff $8 = (uchar *) 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377" (gdb) p param->group_length $9 = 1 (gdb) p param->group_buff + param->group_length $10 = (uchar *) 0x7f46200690d1 "\245\245\245\245\245\245\245\377\377\377\377" (gdb) n [Thread 0x7f4669ffb640 (LWP 60843) exited]   Thread 19 "mysqld" received signal SIGABRT, Aborted. 0x00007f469468ec4c in __pthread_kill_implementation () from /lib64/libc.so.6 Breakpoint executing SELECT RANDOM_BYTES(-10) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2; . So: {{19589 m_group_buff+= cur_group->field->pack_length();}} gets incremented by 4 breaking the assertion constraint. So the assertion is incorrect, or param->group_length should also be 4. calc_group_buffer never sets the value of this param so I'm unsure where group_length is set to 1 from.
            danblack Daniel Black added a comment -

            Item_func_random_bytes::fix_length_and_dec (this=0x7fe120016b40, thd=0x7fe120000dc8) at /home/dan/repos/mariadb-server-10.10/sql/item_strfunc.cc:1488
            1488	    max_length= MY_MIN((int32) args[0]->val_int(), MAX_RANDOM_BYTES);
            (gdb) list
            1483	bool Item_func_random_bytes::fix_length_and_dec(THD *thd)
            1484	{
            1485	  used_tables_cache|= RAND_TABLE_BIT;
            1486	  if (args[0]->can_eval_in_optimize())
            1487	  {
            1488	    max_length= MY_MIN((int32) args[0]->val_int(), MAX_RANDOM_BYTES);
            1489	    return false;
            1490	  }
            1491	  max_length= MAX_RANDOM_BYTES;
            1492	  return false;
            (gdb) p  args[0]->val_int()
            $4 = -10
            (gdb) n
            1489	    return false;
            (gdb) p max_length
            $5 = 4294967286
            

            A 0 underflow on max_length appears to be enough cause this. Capped this at 0 for negative values alleviates the assertion 0.

            danblack Daniel Black added a comment - Item_func_random_bytes::fix_length_and_dec (this=0x7fe120016b40, thd=0x7fe120000dc8) at /home/dan/repos/mariadb-server-10.10/sql/item_strfunc.cc:1488 1488 max_length= MY_MIN((int32) args[0]->val_int(), MAX_RANDOM_BYTES); (gdb) list 1483 bool Item_func_random_bytes::fix_length_and_dec(THD *thd) 1484 { 1485 used_tables_cache|= RAND_TABLE_BIT; 1486 if (args[0]->can_eval_in_optimize()) 1487 { 1488 max_length= MY_MIN((int32) args[0]->val_int(), MAX_RANDOM_BYTES); 1489 return false; 1490 } 1491 max_length= MAX_RANDOM_BYTES; 1492 return false; (gdb) p args[0]->val_int() $4 = -10 (gdb) n 1489 return false; (gdb) p max_length $5 = 4294967286 A 0 underflow on max_length appears to be enough cause this. Capped this at 0 for negative values alleviates the assertion 0.
            danblack Daniel Black added a comment -

            elenst, Roel, note that any other item function that sets max_length to near uint32 max will also probably hit this on group by queries.

            danblack Daniel Black added a comment - elenst , Roel , note that any other item function that sets max_length to near uint32 max will also probably hit this on group by queries.

            People

              danblack Daniel Black
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.