Roel Van de Paar added a comment - 2022-09-28 06:20 Assert/stack is same on all versions observed to crash 0|SIGABRT|Item_cache_row::illegal_method_call|Item_cache_row::val_str|spider_db_open_item_string|spider_db_open_item_cache

Roel Van de Paar added a comment - 2022-10-04 09:51 Another, similar, testcase INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; CREATE USER Spider@localhost IDENTIFIED BY 'PWD0' ; CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock' , DATABASE 'test' , user 'Spider' , PASSWORD 'PWD0' ); CREATE TABLE t (c INT ); CREATE TABLE t2 (a CHAR (0),b INT ) ENGINE=Spider COMMENT= 'WRAPPER "mysql",srv "srv",TABLE "t"' ; SELECT 0 FROM t2 WHERE ROW(a, (a,a)) IN ((0, (0,0)),(0, (0,0)));

Yuchen Pei added a comment - 2022-12-16 06:43 mtr testcase: --echo # --echo # MDEV-29653 Assertion `0' failed in Item_cache_row::illegal_method_call on SELECT from Spider table --echo #   --disable_query_log --disable_result_log --source ../../t/test_init.inc --enable_result_log --enable_query_log   --connection child2_1 CREATE DATABASE auto_test_remote; USE auto_test_remote; eval CREATE TABLE t ( c INT ) $CHILD2_1_ENGINE $CHILD2_1_CHARSET;   --connection master_1 CREATE DATABASE auto_test_local; USE auto_test_local; eval CREATE TABLE ts ( c INT ) $MASTER_1_ENGINE COMMENT=' table "t" , srv "s_2_1" ';   SELECT 1 FROM ts WHERE ROW(c,c) NOT IN ((0,0),(1,1));   --connection master_1 DROP DATABASE IF EXISTS auto_test_local;   --connection child2_1 DROP DATABASE IF EXISTS auto_test_remote;   --disable_query_log --disable_result_log --source ../t/test_deinit.inc --enable_query_log --enable_result_log

Yuchen Pei added a comment - 2022-12-16 06:50 The bug exists in very old commits like 6dce6aecebe6ef78a14cb5c5c5daa8a355551e40 (2019-11) and 69c86abb646361c607a248f079f8fd4e600dcada (2021-01).

Yuchen Pei added a comment - 2022-12-19 08:00 The bug seems to be caused by the item having the wrong result_type() . It is a Item_cache_row , corresponding to the constant row (0, 0), and the result type should be ROW_RESULT , but is actually STRING_RESULT . This causes spider_db_open_item_cache to go into the wrong branch: int spider_db_open_item_cache( ... ) { ...   switch (item_cache->result_type()) { case STRING_RESULT: DBUG_RETURN(spider_db_open_item_string(item_cache, field, spider, str, alias, alias_length, dbton_id, use_fields, fields)); case ROW_RESULT: { int error_num; Item_cache_row *item_cache_row = (Item_cache_row *) item_cache; uint item_count = item_cache_row->cols() - 1, roop_count; if (str) { ... The cause for the wrong result type seems to be: when constructing the Item_cache_row corresponding to (0,0) , it uses the constructor Item_cache(thd) , which calls the constructor of Type_handler_hybrid_field_type with hardcoded type_handler_string : Type_handler_hybrid_field_type(&type_handler_string) #0 Type_handler_hybrid_field_type::Type_handler_hybrid_field_type ( this=0x7fdf70022560, handler=0x560a837001c0 <type_handler_string>) at /home/ycp/source/mariadb-server/10.4/src/sql/sql_type.h:6672 #1 0x0000560a824dd024 in Item_cache::Item_cache (this=0x7fdf700224e0, thd=0x7fdf7000b6c0) at /home/ycp/source/mariadb-server/10.4/src/sql/item.h:6828 #2 0x0000560a824ddd65 in Item_cache_row::Item_cache_row (this=0x7fdf700224e0, thd=0x7fdf7000b6c0) at /home/ycp/source/mariadb-server/10.4/src/sql/item.h:7309 #3 0x0000560a824c318d in Type_handler_row::Item_get_cache ( this=0x560a837000e8 <type_handler_row>, thd=0x7fdf7000b6c0, item=0x7fdf7001ee80) at /home/ycp/source/mariadb-server/10.4/src/sql/sql_type.cc:3989 #4 0x0000560a821f9deb in Item::get_cache (this=0x7fdf7001ee80, thd=0x7fdf7000b6c0) at /home/ycp/source/mariadb-server/10.4/src/sql/item.h:1130 #5 0x0000560a825fa1e5 in Item::cache_const_expr_transformer ( this=0x7fdf7001ee80, thd=0x7fdf7000b6c0, arg=0x7fdf495cd2cf "") at /home/ycp/source/mariadb-server/10.4/src/sql/item.cc:7274 #6 0x0000560a821b913b in Item::compile (this=0x7fdf7001ee80, thd=0x7fdf7000b6c0, analyzer= (bool (Item::*)(Item * const, uchar **)) 0x560a825fa01c <Item::cache_const_expr_analyzer(unsigned char**)>, arg_p=0x7fdf495cd250, transformer= (Item *(Item::*)(Item * const, THD *, uchar *)) 0x560a825fa1ac <Item::cache_const_expr_transformer(THD*, unsigned char*)>, arg_t=0x7fdf495cd2cf "") at /home/ycp/source/mariadb-server/10.4/src/sql/item.h:1892 #7 0x0000560a826515ce in Item_func::compile (this=0x7fdf7001f1b0, thd=0x7fdf7000b6c0, analyzer= (bool (Item::*)(Item * const, uchar **)) 0x560a825fa01c <Item::cache_const_expr_analyzer(unsigned char**)>, arg_p=0x7fdf495cd2d0, transformer= (Item *(Item::*)(Item * const, THD *, uchar *)) 0x560a825fa1ac <Item::cache_const_expr_transformer(THD*, unsigned char*)>, arg_t=0x7fdf495cd2cf "") at /home/ycp/source/mariadb-server/10.4/src/sql/item_func.cc:548 #8 0x0000560a8234d3cf in JOIN::cache_const_exprs (this=0x7fdf7001fd98) at /home/ycp/source/mariadb-server/10.4/src/sql/sql_select.cc:28295 #9 0x0000560a82308478 in JOIN::optimize_stage2 (this=0x7fdf7001fd98) at /home/ycp/source/mariadb-server/10.4/src/sql/sql_select.cc:2613 When it calls result_type() for the Item_cache_row , it uses the type_handler of Type_handler_hybrid_field_type : (rr) bt #0 Type_handler_hybrid_field_type::type_handler (this=0x7fdf70022560) at /home/ycp/source/mariadb-server/10.4/src/sql/sql_type.h:6681 #1 0x0000560a824dd22a in Item_cache::type_handler (this=0x7fdf700224e0) at /home/ycp/source/mariadb-server/10.4/src/sql/item.h:6865 #2 0x0000560a821c4a53 in Item::result_type (this=0x7fdf700224e0) at /home/ycp/source/mariadb-server/10.4/src/sql/item.h:1082 #3 0x00007fdf49177fa0 in spider_db_open_item_cache (item_cache=0x7fdf700224e0, field=0x0, spider=0x7fdf7011ad68, str=0x7fdf70127e70, alias=0x0, alias_length=0, dbton_id=0, use_fields=true, fields=0x7fdf70032c80) at /home/ycp/source/mariadb-server/10.4/src/storage/spider/spd_db_conn.cc:9913 #4 0x00007fdf4917613c in spider_db_print_item_type (item=0x7fdf700224e0, field=0x0, spider=0x7fdf7011ad68, str=0x7fdf70127e70, alias=0x0, alias_length=0, dbton_id=0, use_fields=true, fields=0x7fdf70032c80) at /home/ycp/source/mariadb-server/10.4/src/storage/spider/spd_db_conn.cc:9162 #5 0x00007fdf4921565d in spider_db_mbase_util::open_item_func ( this=0x7fdf492845a0 <spider_db_mysql_utility>, item_func=0x7fdf7001f1b0, spider=0x7fdf7011ad68, str=0x7fdf70127e70, alias=0x0, alias_length=0, use_fields=true, fields=0x7fdf70032c80) at /home/ycp/source/mariadb-server/10.4/src/storage/spider/spd_db_mysql.cc:6656 #6 0x00007fdf491766cd in spider_db_open_item_func (item_func=0x7fdf7001f1b0, spider=0x7fdf7011ad68, str=0x7fdf70127e70, alias=0x0, alias_length=0, dbton_id=0, use_fields=true, fields=0x7fdf70032c80) at /home/ycp/source/mariadb-server/10.4/src/storage/spider/spd_db_conn.cc:9304 #7 0x00007fdf49175f06 in spider_db_print_item_type (item=0x7fdf7001f1b0, field=0x0, spider=0x7fdf7011ad68, str=0x7fdf70127e70, alias=0x0, alias_length=0, dbton_id=0, use_fields=true, fields=0x7fdf70032c80) at /home/ycp/source/mariadb-server/10.4/src/storage/spider/spd_db_conn.cc:9114 #8 0x00007fdf49236cd8 in spider_mbase_handler::append_item_type_part ( this=0x7fdf70127e10, item=0x7fdf7001f1b0, alias=0x0, alias_length=0, use_fields=true, fields=0x7fdf70032c80, sql_type=1) at /home/ycp/source/mariadb-server/10.4/src/storage/spider/spd_db_mysql.cc:15845 #9 0x00007fdf4923c89f in spider_group_by_handler::init_scan ( this=0x7fdf7016f8a0) at /home/ycp/source/mariadb-server/10.4/src/storage/spider/spd_group_by_handler.cc:1333 ... (rr) p m_type_handler $214 = (const Type_handler *) 0x560a837001c0 <type_handler_string>

Yuchen Pei added a comment - 2022-12-19 23:40 This patch fixes the this bug. Running tests to check for regressions... From a70ac9210a9e9ab59c52f92adb9b11f02816145d Mon Sep 17 00:00:00 2001 From: Yuchen Pei <yuchen.pei@mariadb.com> Date: Tue, 20 Dec 2022 10:38:35 +1100 Subject: [PATCH] MDEV-29653   --- sql/item.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)   diff --git a/sql/item.h b/sql/item.h index 083bc2261ce..9389250d6ec 100644 --- a/sql/item.h +++ b/sql/item.h @@ -7305,7 +7305,7 @@ class Item_cache_row: public Item_cache bool save_array; public: Item_cache_row(THD *thd): - Item_cache(thd), values(0), item_count(2), + Item_cache(thd, &type_handler_row), values(0), item_count(2), save_array(0) {} /* -- 2.30.2

Yuchen Pei added a comment - 2022-12-20 01:34 I have run the following tests before and after the above patch, based on 10.4 f97f6955bda, and can confirm there are no new failures. ./mysql-test/mtr --parallel=12 --force --max-test-fail=0 --skip-core-file

Yuchen Pei added a comment - 2022-12-20 01:41 https://github.com/MariaDB/server/commit/756db1dc7fa

Yuchen Pei added a comment - 2022-12-20 03:54 serg Can you review this, since it touches some common sql code outside of spider. Feel free to re-assign it to anyone for the review.

Sergei Golubchik added a comment - 2022-12-20 22:16 ok to push, thanks

Yuchen Pei added a comment - 2022-12-22 02:45 Thanks for the review, pushed