[MDEV-34895] Assertion `(mem_root->flags & 4) == 0' failed in alloc_root from parse_escaped_string on double PS EXECUTE - Jira

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 10.5, 10.6, 10.11, 11.2(EOL), 11.4, 11.6(EOL), 11.7(EOL)
Fix Version/s: 10.5, 10.6, 10.11, 11.4
Component/s: Prepared Statements, Views
Labels:
- affects-tests

Description

Distinct from ~~MDEV-34757~~ and not fixed by the patch thereof, with this testcase:

CREATE VIEW c AS SELECT 1;

PREPARE s FROM 'ALTER VIEW c AS SELECT 2';

EXECUTE s;

EXECUTE s;

We see:

CS 10.6.20 c630e23a186c7ecfe0afac21163cb4fa2cdc5f7a (Debug)
mariadbd: /test/10.6_dbg/mysys/my_alloc.c:212: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed.

CS 10.6.20 c630e23a186c7ecfe0afac21163cb4fa2cdc5f7a (Debug)
Core was generated by `/test/MD090924-mariadb-10.6.20-linux-x86_64-dbg/bin/mariadbd --no-defaults --ma'.
Program terminated with signal SIGABRT, Aborted.
Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 3934036)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
#3 0x000014d63f44526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
#4 0x000014d63f4288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x000014d63f42881b in __assert_fail_base (fmt=0x14d63f5d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5632839cc63e "(mem_root->flags & 4) == 0", file=file@entry=0x563283961088 "/test/10.6_dbg/mysys/my_alloc.c", line=line@entry=212, function=function@entry=0x563283b3b040 <__PRETTY_FUNCTION__.0> "alloc_root") at ./assert/assert.c:94
#6 0x000014d63f43b507 in __assert_fail (assertion=assertion@entry=0x5632839cc63e "(mem_root->flags & 4) == 0", file=file@entry=0x563283961088 "/test/10.6_dbg/mysys/my_alloc.c", line=line@entry=212, function=function@entry=0x563283b3b040 <__PRETTY_FUNCTION__.0> "alloc_root") at ./assert/assert.c:103
#7 0x00005632835d58b0 in alloc_root (mem_root=0x14d5e401c238, length=16)at /test/10.6_dbg/mysys/my_alloc.c:212
#8 0x0000563282a18417 in parse_escaped_string (ptr=ptr@entry=0x14d5e4024ea8 "select 2 AS `2`\nmd5=df27c95c6eba6092cfb7e3c801af0d09\nupdatable=0\nalgorithm=0\ndefiner_user=root\ndefiner_host=localhost\nsuid=1\nwith_check_option=0\ntimestamp=0001725831891150816\ncreate-version=2\nsource=S"..., end=end@entry=0x14d5e4024feb "", mem_root=mem_root@entry=0x14d5e401c238, str=0x14d63cdb1760)at /test/10.6_dbg/sql/parse_file.cc:656
#9 0x0000563282a18745 in File_parser::parse (this=0x14d5e4024e70, base=base@entry=0x14d63cdb1510 "", mem_root=0x14d5e401c238, parameters=parameters@entry=0x5632840f2b40 <view_parameters>, required=required@entry=15, hook=0x5632840ddbd0 <file_parser_dummy_hook>)at /test/10.6_dbg/sql/parse_file.cc:855
#10 0x0000563282c0a0b0 in mysql_make_view (thd=thd@entry=0x14d5e4000d58, share=share@entry=0x14d5e4026820, table=table@entry=0x14d63cdb1510, open_view_no_parse=open_view_no_parse@entry=true)at /test/10.6_dbg/sql/sql_view.cc:1385
#11 0x0000563282a84783 in tdc_open_view (thd=thd@entry=0x14d5e4000d58, table_list=table_list@entry=0x14d63cdb1510, flags=flags@entry=16384)at /test/10.6_dbg/sql/sql_base.cc:3000
#12 0x0000563282c08223 in fill_defined_view_parts (view=0x14d5e401efa0, thd=0x14d5e4000d58) at /test/10.6_dbg/sql/sql_view.cc:225
#13 mysql_create_view (thd=thd@entry=0x14d5e4000d58, views=views@entry=0x14d5e401efa0, mode=VIEW_ALTER)at /test/10.6_dbg/sql/sql_view.cc:490
#14 0x0000563282b07ce7 in mysql_execute_command (thd=0x14d5e4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true)at /test/10.6_dbg/sql/sql_parse.cc:5943
#15 0x0000563282b20b40 in Prepared_statement::execute (this=this@entry=0x14d5e401bea8, expanded_query=expanded_query@entry=0x14d63cdb2cc0, open_cursor=open_cursor@entry=false)at /test/10.6_dbg/sql/sql_prepare.cc:5264
#16 0x0000563282b20ee8 in Prepared_statement::execute_loop (this=this@entry=0x14d5e401bea8, expanded_query=expanded_query@entry=0x14d63cdb2cc0, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/10.6_dbg/sql/sql_prepare.cc:4670
#17 0x0000563282b213a3 in mysql_sql_stmt_execute (thd=thd@entry=0x14d5e4000d58)at /test/10.6_dbg/sql/sql_prepare.cc:3696
#18 0x0000563282b02897 in mysql_execute_command (thd=thd@entry=0x14d5e4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/10.6_dbg/sql/sql_parse.cc:4004
#19 0x0000563282b09d84 in mysql_parse (thd=thd@entry=0x14d5e4000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14d63cdb32b0)at /test/10.6_dbg/sql/sql_parse.cc:8181
#20 0x0000563282b0c21b in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14d5e4000d58, packet=packet@entry=0x14d5e400b0c9 "EXECUTE s", packet_length=packet_length@entry=9, blocking=blocking@entry=true)at /test/10.6_dbg/sql/sql_class.h:242
#21 0x0000563282b0e442 in do_command (thd=0x14d5e4000d58, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_parse.cc:1410
#22 0x0000563282c5b224 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x563286765c18, put_in_cache=put_in_cache@entry=true)at /test/10.6_dbg/sql/sql_connect.cc:1417
#23 0x0000563282c5b524 in handle_one_connection (arg=arg@entry=0x563286765c18)at /test/10.6_dbg/sql/sql_connect.cc:1319
#24 0x00005632830a92c4 in pfs_spawn_thread (arg=0x563286750818)at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
#25 0x000014d63f49ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#26 0x000014d63f529c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Testcase is both CLI and MTR compatible.

The commit that triggered this to be found:

8ed3c375929b449ef8556cfa0c49a35707d59b84 is the first bad commit

commit 8ed3c375929b449ef8556cfa0c49a35707d59b84

Author: Oleksandr Byelkin <sanja@mariadb.com>

Date:   Thu Jul 4 09:27:30 2024 +0200

    Make PROTECT_STATEMENT_MEMROOT default for version less then 11.2

 CMakeLists.txt | 11 +++++++++--

 1 file changed, 9 insertions(+), 2 deletions(-)

Attachments

Issue Links

relates to

MDEV-33858 Assertion `(mem_root->flags & 4) == 0' fails on 2nd execution of PS with -DWITH_PROTECT_STATEMENT_MEMROOT=ON

Closed

MDEV-14959 Control over memory allocated for SP/PS

Closed

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar added a comment - 2024-09-14 04:48 - edited

SET @a='';

SET NAMES utf8;

CREATE TABLE t (c INT KEY,c2 BLOB,c3 BLOB);

PREPARE s5 FROM 'DELETE FROM t WHERE c=?';

CREATE TEMPORARY TABLE t (KEYc INT,c CHAR,c2 CHAR,INDEX sec_index (c));

EXECUTE s5 USING @arg;

EXECUTE s5 USING @a;

Adds this stack:

CS 11.2.6 e91a79945822def1452787f825e6047c6a64dbd9 (Debug)
mariadbd: /test/11.2_dbg/mysys/my_alloc.c:275: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed.

CS 11.2.6 e91a79945822def1452787f825e6047c6a64dbd9 (Debug)
Core was generated by `/test/MD090924-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGABRT, Aborted.
Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 1870416)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
#3 0x0000150e32c4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
#4 0x0000150e32c288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x0000150e32c2881b in __assert_fail_base (fmt=0x150e32dd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5617b89f6f5d "(mem_root->flags & 4) == 0", file=file@entry=0x5617b8983290 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x5617b8b65110 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:94
#6 0x0000150e32c3b507 in __assert_fail (assertion=assertion@entry=0x5617b89f6f5d "(mem_root->flags & 4) == 0", file=file@entry=0x5617b8983290 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x5617b8b65110 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:103
#7 0x00005617b85cb1d5 in alloc_root (mem_root=0x150dd401b698, length=272)at /test/11.2_dbg/mysys/my_alloc.c:275
#8 0x00005617b7e30d83 in Item::operator new (mem_root=<optimized out>, size=272) at /test/11.2_dbg/sql/item.h:862
#9 Type_std_attributes::agg_item_set_converter (this=this@entry=0x150dd407e1c8, coll=@0x150e308fff20: {collation = 0x5617b9250980 <my_charset_latin1>, derivation = DERIVATION_IMPLICIT, repertoire = MY_REPERTOIRE_UNICODE30}, fname=@0x150e308fff60: {str = 0x5617b89c56e6 "=", length = 1}, args=args@entry=0x150dd407e248, nargs=nargs@entry=1, flags=flags@entry=7, item_sep=1, single_err=0x150e308fff40) at /test/11.2_dbg/sql/item.cc:2739
#10 0x00005617b7e65f7c in Item_func_or_sum::agg_arg_charsets_for_comparison (this=0x150dd407e1c0, cs=cs@entry=0x150dd407e290, a=0x150dd407e240, b=0x150dd407e248, allow_narrowing=<optimized out>)at /test/11.2_dbg/sql/item.h:5647
#11 0x00005617b7e4e073 in Arg_comparator::set_cmp_func_string (this=0x150dd407e278, thd=0x150dd4000d58)at /test/11.2_dbg/sql/item_cmpfunc.cc:591
#12 0x00005617b7d1c702 in Type_handler_string_result::set_comparator_func (this=<optimized out>, thd=<optimized out>, cmp=<optimized out>)at /test/11.2_dbg/sql/sql_type.cc:4481
#13 0x00005617b7e4d540 in Arg_comparator::set_cmp_func (this=this@entry=0x150dd407e278, thd=thd@entry=0x150dd4000d58, owner_arg=owner_arg@entry=0x150dd407e1c0, compare_handler=compare_handler@entry=0x5617b93247f0 <type_handler_long_blob>, a1=a1@entry=0x150dd407e240, a2=a2@entry=0x150dd407e248)at /test/11.2_dbg/sql/item_cmpfunc.cc:524
#14 0x00005617b7d1cc03 in Arg_comparator::set_cmp_func (set_null_arg=true, a2=0x150dd407e248, a1=0x150dd407e240, compare_handler=0x5617b93247f0 <type_handler_long_blob>, owner_arg=0x150dd407e1c0, thd=0x150dd4000d58, this=0x150dd407e278)at /test/11.2_dbg/sql/item_cmpfunc.h:104
#15 Item_bool_rowready_func2::fix_length_and_dec_generic (compare_handler=0x5617b93247f0 <type_handler_long_blob>, thd=0x150dd4000d58, this=0x150dd407e1c0)at /test/11.2_dbg/sql/item_cmpfunc.h:584
#16 Type_handler::Item_bool_rowready_func2_fix_length_and_dec (this=0x5617b93247f0 <type_handler_long_blob>, thd=0x150dd4000d58, func=0x150dd407e1c0) at /test/11.2_dbg/sql/sql_type.cc:5810
#17 0x00005617b7e4d438 in Item_bool_rowready_func2::fix_length_and_dec (this=0x150dd407e1c0, thd=0x150dd4000d58)at /test/11.2_dbg/sql/item_cmpfunc.cc:491
#18 0x00005617b7e83b47 in Item_func::fix_fields (this=0x150dd407e1c0, thd=0x150dd4000d58, ref=<optimized out>)at /test/11.2_dbg/sql/item_func.cc:380
#19 0x00005617b7a725c0 in Item::fix_fields_if_needed (ref=0x150dd4013d20, thd=0x150dd4000d58, this=0x150dd407e1c0) at /test/11.2_dbg/sql/item.h:802
#20 Item::fix_fields_if_needed_for_scalar (ref=0x150dd4013d20, thd=0x150dd4000d58, this=0x150dd407e1c0) at /test/11.2_dbg/sql/item.h:1176
#21 Item::fix_fields_if_needed_for_bool (ref=0x150dd4013d20, thd=0x150dd4000d58, this=0x150dd407e1c0) at /test/11.2_dbg/sql/item.h:1180
#22 setup_conds (thd=thd@entry=0x150dd4000d58, tables=tables@entry=0x150dd407d7d0, leaves=@0x150dd407bdb8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x150dd4013878, last = 0x150dd4013878, elements = 1}, <No data fields>}, conds=conds@entry=0x150dd4013d20) at /test/11.2_dbg/sql/sql_base.cc:8940
#23 0x00005617b7b69579 in setup_without_group (hidden_group_fields=0x150dd4013be7, win_funcs=@0x150dd407c040: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5617b92f71e0 <end_of_list>, last = 0x150dd407c040, elements = 0}, <No data fields>}, win_specs=@0x150dd407c020: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5617b92f71e0 <end_of_list>, last = 0x150dd407c020, elements = 0}, <No data fields>}, group=0x0, order=0x0, conds=0x150dd4013d20, all_fields=@0x150dd4013c38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5617b92f71e0 <end_of_list>, last = 0x150dd4013c38, elements = 0}, <No data fields>}, fields=@0x150dd407e430: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5617b92f71e0 <end_of_list>, last = 0x150dd407e430, elements = 0}, <No data fields>}, leaves=@0x150dd407bdb8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x150dd4013878, last = 0x150dd4013878, elements = 1}, <No data fields>}, tables=0x150dd407d7d0, ref_pointer_array=<optimized out>, thd=0x150dd4000d58) at /test/11.2_dbg/sql/sql_select.cc:950
#24 JOIN::prepare (this=this@entry=0x150dd4013888, tables_init=tables_init@entry=0x150dd407d7d0, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x150dd407bba0, unit_arg=0x150dd407b368) at /test/11.2_dbg/sql/sql_select.cc:1572
#25 0x00005617b7a9c70b in Sql_cmd_delete::prepare_inner (this=0x150dd407e3f0, thd=0x150dd4000d58) at /test/11.2_dbg/sql/sql_delete.cc:1698
#26 0x00005617b7b30227 in Sql_cmd_dml::prepare (this=0x150dd407e3f0, thd=0x150dd4000d58) at /test/11.2_dbg/sql/sql_select.cc:33715
#27 0x00005617b7b32035 in Sql_cmd_dml::execute (this=0x150dd407e3f0, thd=0x150dd4000d58) at /test/11.2_dbg/sql/sql_select.cc:33768
#28 0x00005617b7aee3ea in mysql_execute_command (thd=0x150dd4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true)at /test/11.2_dbg/sql/sql_parse.cc:4433
#29 0x00005617b7b1bde3 in Prepared_statement::execute (this=this@entry=0x150dd401b308, expanded_query=expanded_query@entry=0x150e30900c70, open_cursor=open_cursor@entry=false)at /test/11.2_dbg/sql/sql_prepare.cc:5077
#30 0x00005617b7b1c199 in Prepared_statement::execute_loop (this=this@entry=0x150dd401b308, expanded_query=expanded_query@entry=0x150e30900c70, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/11.2_dbg/sql/sql_prepare.cc:4461
#31 0x00005617b7b1c64b in mysql_sql_stmt_execute (thd=thd@entry=0x150dd4000d58)at /test/11.2_dbg/sql/sql_prepare.cc:3480
#32 0x00005617b7aed0e1 in mysql_execute_command (thd=thd@entry=0x150dd4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:4000
#33 0x00005617b7af3d26 in mysql_parse (thd=thd@entry=0x150dd4000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x150e309012a0)at /test/11.2_dbg/sql/sql_parse.cc:7929
#34 0x00005617b7af61bd in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x150dd4000d58, packet=packet@entry=0x150dd400b309 "EXECUTE s5 USING @a", packet_length=packet_length@entry=19, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:248
#35 0x00005617b7af83e3 in do_command (thd=0x150dd4000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407
#36 0x00005617b7c6435c in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5617bae96e18, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439
#37 0x00005617b7c6465c in handle_one_connection (arg=arg@entry=0x5617bae96e18)at /test/11.2_dbg/sql/sql_connect.cc:1341
#38 0x00005617b80ab62c in pfs_spawn_thread (arg=0x5617bae65f68)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201
#39 0x0000150e32c9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#40 0x0000150e32d29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

This stack looks to be present in 11.1+ debub builds only. Testcase is MTR and CLI compatible.

Roel Van de Paar added a comment - 2024-09-14 04:48 - edited SET @a= '' ; SET NAMES utf8; CREATE TABLE t (c INT KEY ,c2 BLOB,c3 BLOB); PREPARE s5 FROM 'DELETE FROM t WHERE c=?' ; CREATE TEMPORARY TABLE t (KEYc INT ,c CHAR ,c2 CHAR , INDEX sec_index (c)); EXECUTE s5 USING @arg; EXECUTE s5 USING @a; Adds this stack: CS 11.2.6 e91a79945822def1452787f825e6047c6a64dbd9 (Debug) mariadbd: /test/11.2_dbg/mysys/my_alloc.c:275: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed. CS 11.2.6 e91a79945822def1452787f825e6047c6a64dbd9 (Debug) Core was generated by `/test/MD090924-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'. Program terminated with signal SIGABRT, Aborted. Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c. #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44 [Current thread is 1 (LWP 1870416)] (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89 #3 0x0000150e32c4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26 #4 0x0000150e32c288ff in __GI_abort () at ./stdlib/abort.c:79 #5 0x0000150e32c2881b in __assert_fail_base (fmt=0x150e32dd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5617b89f6f5d "(mem_root->flags & 4) == 0", file=file@entry=0x5617b8983290 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x5617b8b65110 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:94 #6 0x0000150e32c3b507 in __assert_fail (assertion=assertion@entry=0x5617b89f6f5d "(mem_root->flags & 4) == 0", file=file@entry=0x5617b8983290 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x5617b8b65110 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:103 #7 0x00005617b85cb1d5 in alloc_root (mem_root=0x150dd401b698, length=272)at /test/11.2_dbg/mysys/my_alloc.c:275 #8 0x00005617b7e30d83 in Item::operator new (mem_root=<optimized out>, size=272) at /test/11.2_dbg/sql/item.h:862 #9 Type_std_attributes::agg_item_set_converter (this=this@entry=0x150dd407e1c8, coll=@0x150e308fff20: {collation = 0x5617b9250980 <my_charset_latin1>, derivation = DERIVATION_IMPLICIT, repertoire = MY_REPERTOIRE_UNICODE30}, fname=@0x150e308fff60: {str = 0x5617b89c56e6 "=", length = 1}, args=args@entry=0x150dd407e248, nargs=nargs@entry=1, flags=flags@entry=7, item_sep=1, single_err=0x150e308fff40) at /test/11.2_dbg/sql/item.cc:2739 #10 0x00005617b7e65f7c in Item_func_or_sum::agg_arg_charsets_for_comparison (this=0x150dd407e1c0, cs=cs@entry=0x150dd407e290, a=0x150dd407e240, b=0x150dd407e248, allow_narrowing=<optimized out>)at /test/11.2_dbg/sql/item.h:5647 #11 0x00005617b7e4e073 in Arg_comparator::set_cmp_func_string (this=0x150dd407e278, thd=0x150dd4000d58)at /test/11.2_dbg/sql/item_cmpfunc.cc:591 #12 0x00005617b7d1c702 in Type_handler_string_result::set_comparator_func (this=<optimized out>, thd=<optimized out>, cmp=<optimized out>)at /test/11.2_dbg/sql/sql_type.cc:4481 #13 0x00005617b7e4d540 in Arg_comparator::set_cmp_func (this=this@entry=0x150dd407e278, thd=thd@entry=0x150dd4000d58, owner_arg=owner_arg@entry=0x150dd407e1c0, compare_handler=compare_handler@entry=0x5617b93247f0 <type_handler_long_blob>, a1=a1@entry=0x150dd407e240, a2=a2@entry=0x150dd407e248)at /test/11.2_dbg/sql/item_cmpfunc.cc:524 #14 0x00005617b7d1cc03 in Arg_comparator::set_cmp_func (set_null_arg=true, a2=0x150dd407e248, a1=0x150dd407e240, compare_handler=0x5617b93247f0 <type_handler_long_blob>, owner_arg=0x150dd407e1c0, thd=0x150dd4000d58, this=0x150dd407e278)at /test/11.2_dbg/sql/item_cmpfunc.h:104 #15 Item_bool_rowready_func2::fix_length_and_dec_generic (compare_handler=0x5617b93247f0 <type_handler_long_blob>, thd=0x150dd4000d58, this=0x150dd407e1c0)at /test/11.2_dbg/sql/item_cmpfunc.h:584 #16 Type_handler::Item_bool_rowready_func2_fix_length_and_dec (this=0x5617b93247f0 <type_handler_long_blob>, thd=0x150dd4000d58, func=0x150dd407e1c0) at /test/11.2_dbg/sql/sql_type.cc:5810 #17 0x00005617b7e4d438 in Item_bool_rowready_func2::fix_length_and_dec (this=0x150dd407e1c0, thd=0x150dd4000d58)at /test/11.2_dbg/sql/item_cmpfunc.cc:491 #18 0x00005617b7e83b47 in Item_func::fix_fields (this=0x150dd407e1c0, thd=0x150dd4000d58, ref=<optimized out>)at /test/11.2_dbg/sql/item_func.cc:380 #19 0x00005617b7a725c0 in Item::fix_fields_if_needed (ref=0x150dd4013d20, thd=0x150dd4000d58, this=0x150dd407e1c0) at /test/11.2_dbg/sql/item.h:802 #20 Item::fix_fields_if_needed_for_scalar (ref=0x150dd4013d20, thd=0x150dd4000d58, this=0x150dd407e1c0) at /test/11.2_dbg/sql/item.h:1176 #21 Item::fix_fields_if_needed_for_bool (ref=0x150dd4013d20, thd=0x150dd4000d58, this=0x150dd407e1c0) at /test/11.2_dbg/sql/item.h:1180 #22 setup_conds (thd=thd@entry=0x150dd4000d58, tables=tables@entry=0x150dd407d7d0, leaves=@0x150dd407bdb8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x150dd4013878, last = 0x150dd4013878, elements = 1}, <No data fields>}, conds=conds@entry=0x150dd4013d20) at /test/11.2_dbg/sql/sql_base.cc:8940 #23 0x00005617b7b69579 in setup_without_group (hidden_group_fields=0x150dd4013be7, win_funcs=@0x150dd407c040: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5617b92f71e0 <end_of_list>, last = 0x150dd407c040, elements = 0}, <No data fields>}, win_specs=@0x150dd407c020: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5617b92f71e0 <end_of_list>, last = 0x150dd407c020, elements = 0}, <No data fields>}, group=0x0, order=0x0, conds=0x150dd4013d20, all_fields=@0x150dd4013c38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5617b92f71e0 <end_of_list>, last = 0x150dd4013c38, elements = 0}, <No data fields>}, fields=@0x150dd407e430: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5617b92f71e0 <end_of_list>, last = 0x150dd407e430, elements = 0}, <No data fields>}, leaves=@0x150dd407bdb8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x150dd4013878, last = 0x150dd4013878, elements = 1}, <No data fields>}, tables=0x150dd407d7d0, ref_pointer_array=<optimized out>, thd=0x150dd4000d58) at /test/11.2_dbg/sql/sql_select.cc:950 #24 JOIN::prepare (this=this@entry=0x150dd4013888, tables_init=tables_init@entry=0x150dd407d7d0, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x150dd407bba0, unit_arg=0x150dd407b368) at /test/11.2_dbg/sql/sql_select.cc:1572 #25 0x00005617b7a9c70b in Sql_cmd_delete::prepare_inner (this=0x150dd407e3f0, thd=0x150dd4000d58) at /test/11.2_dbg/sql/sql_delete.cc:1698 #26 0x00005617b7b30227 in Sql_cmd_dml::prepare (this=0x150dd407e3f0, thd=0x150dd4000d58) at /test/11.2_dbg/sql/sql_select.cc:33715 #27 0x00005617b7b32035 in Sql_cmd_dml::execute (this=0x150dd407e3f0, thd=0x150dd4000d58) at /test/11.2_dbg/sql/sql_select.cc:33768 #28 0x00005617b7aee3ea in mysql_execute_command (thd=0x150dd4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true)at /test/11.2_dbg/sql/sql_parse.cc:4433 #29 0x00005617b7b1bde3 in Prepared_statement::execute (this=this@entry=0x150dd401b308, expanded_query=expanded_query@entry=0x150e30900c70, open_cursor=open_cursor@entry=false)at /test/11.2_dbg/sql/sql_prepare.cc:5077 #30 0x00005617b7b1c199 in Prepared_statement::execute_loop (this=this@entry=0x150dd401b308, expanded_query=expanded_query@entry=0x150e30900c70, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/11.2_dbg/sql/sql_prepare.cc:4461 #31 0x00005617b7b1c64b in mysql_sql_stmt_execute (thd=thd@entry=0x150dd4000d58)at /test/11.2_dbg/sql/sql_prepare.cc:3480 #32 0x00005617b7aed0e1 in mysql_execute_command (thd=thd@entry=0x150dd4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:4000 #33 0x00005617b7af3d26 in mysql_parse (thd=thd@entry=0x150dd4000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x150e309012a0)at /test/11.2_dbg/sql/sql_parse.cc:7929 #34 0x00005617b7af61bd in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x150dd4000d58, packet=packet@entry=0x150dd400b309 "EXECUTE s5 USING @a", packet_length=packet_length@entry=19, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:248 #35 0x00005617b7af83e3 in do_command (thd=0x150dd4000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407 #36 0x00005617b7c6435c in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5617bae96e18, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439 #37 0x00005617b7c6465c in handle_one_connection (arg=arg@entry=0x5617bae96e18)at /test/11.2_dbg/sql/sql_connect.cc:1341 #38 0x00005617b80ab62c in pfs_spawn_thread (arg=0x5617bae65f68)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201 #39 0x0000150e32c9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447 #40 0x0000150e32d29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 This stack looks to be present in 11.1+ debub builds only. Testcase is MTR and CLI compatible.

Lena Startseva added a comment - 2024-09-20 12:52

Also there is the same problem with case in 10.6:

CREATE TABLE t1 (a int);

INSERT INTO t1 VALUES ('1'),('2');

create view v1 as  SELECT a.* FROM t1 a WHERE (SELECT EXISTS ( SELECT 1 FROM t1 b WHERE b.a = a.a ));

prepare stmt from "select * from v1";

execute stmt;

execute stmt;

drop view v1;

DROP TABLE t1;

/10.6/mysys/my_alloc.c:212: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed.

shulga, plz, after fix this bug in 10.6 check tests for main suite with ps-protocol and view-protocol together. Also, enable all case that were disabled for any protocols and marked with number of this task (You can find them with search by "MDEV-34895")

Lena Startseva added a comment - 2024-09-20 12:52 Also there is the same problem with case in 10.6: CREATE TABLE t1 (a int ); INSERT INTO t1 VALUES ( '1' ),( '2' ); create view v1 as SELECT a.* FROM t1 a WHERE ( SELECT EXISTS ( SELECT 1 FROM t1 b WHERE b.a = a.a )); prepare stmt from "select * from v1" ; execute stmt; execute stmt; drop view v1; DROP TABLE t1; /10.6/mysys/my_alloc.c:212: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed. shulga , plz, after fix this bug in 10.6 check tests for main suite with ps-protocol and view-protocol together. Also, enable all case that were disabled for any protocols and marked with number of this task (You can find them with search by " MDEV-34895 ")

Roel Van de Paar added a comment - 2024-09-25 07:14

The following testcase:

SET @a='ABC<DIV style="x:x1ression (javript:alert">DEF';

CREATE TABLE t (c INT,c2 INT) PARTITION BY KEY(c) PARTITIONS 1;

PREPARE s FROM 'DELETE FROM t WHERE c=?';

EXECUTE s USING @SET;

EXECUTE s USING @a;

Leads to these additional stack:

CS 11.2.6 e91a79945822def1452787f825e6047c6a64dbd9 (Debug)
mariadbd: /test/11.2_dbg/mysys/my_alloc.c:275: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed.

CS 11.2.6 e91a79945822def1452787f825e6047c6a64dbd9 (Debug)
Core was generated by `/test/MD090924-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGABRT, Aborted.
Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 2521856)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
#3 0x000014f488c4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
#4 0x000014f488c288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x000014f488c2881b in __assert_fail_base (fmt=0x14f488dd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55b803d24f5d "(mem_root->flags & 4) == 0", file=file@entry=0x55b803cb1290 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x55b803e93110 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:94
#6 0x000014f488c3b507 in __assert_fail (assertion=assertion@entry=0x55b803d24f5d "(mem_root->flags & 4) == 0", file=file@entry=0x55b803cb1290 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x55b803e93110 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:103
#7 0x000055b8038f91d5 in alloc_root (mem_root=0x14f42801d678, length=16)at /test/11.2_dbg/mysys/my_alloc.c:275
#8 0x000055b802ded1c4 in Sql_alloc::operator new (mem_root=<optimized out>, size=16) at /test/11.2_dbg/sql/sql_alloc.h:37
#9 base_list::push_back (mem_root=<optimized out>, info=0x14f42802c5f0, this=0x14f42802abf0) at /test/11.2_dbg/sql/sql_list.h:195
#10 List<TABLE_LIST>::push_back (mem_root=<optimized out>, a=0x14f42802c5f0, this=0x14f42802abf0) at /test/11.2_dbg/sql/sql_list.h:505
#11 st_select_lex::save_leaf_tables (this=0x14f42802a9c0, thd=thd@entry=0x14f428000d58) at /test/11.2_dbg/sql/sql_lex.cc:5775
#12 0x000055b802dc8b53 in Sql_cmd_delete::delete_from_single_table (this=this@entry=0x14f42802d210, thd=thd@entry=0x14f428000d58)at /test/11.2_dbg/sql/sql_delete.cc:920
#13 0x000055b802dc9230 in Sql_cmd_delete::execute_inner (this=0x14f42802d210, thd=0x14f428000d58) at /test/11.2_dbg/sql/sql_delete.cc:1821
#14 0x000055b802e600df in Sql_cmd_dml::execute (this=0x14f42802d210, thd=0x14f428000d58) at /test/11.2_dbg/sql/sql_select.cc:33800
#15 0x000055b802e1c3ea in mysql_execute_command (thd=0x14f428000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true)at /test/11.2_dbg/sql/sql_parse.cc:4433
#16 0x000055b802e49de3 in Prepared_statement::execute (this=this@entry=0x14f42801d2e8, expanded_query=expanded_query@entry=0x14f483f67c70, open_cursor=open_cursor@entry=false)at /test/11.2_dbg/sql/sql_prepare.cc:5077
#17 0x000055b802e4a199 in Prepared_statement::execute_loop (this=this@entry=0x14f42801d2e8, expanded_query=expanded_query@entry=0x14f483f67c70, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/11.2_dbg/sql/sql_prepare.cc:4461
#18 0x000055b802e4a64b in mysql_sql_stmt_execute (thd=thd@entry=0x14f428000d58)at /test/11.2_dbg/sql/sql_prepare.cc:3480
#19 0x000055b802e1b0e1 in mysql_execute_command (thd=thd@entry=0x14f428000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:4000
#20 0x000055b802e21d26 in mysql_parse (thd=thd@entry=0x14f428000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14f483f682a0)at /test/11.2_dbg/sql/sql_parse.cc:7929
#21 0x000055b802e241bd in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14f428000d58, packet=packet@entry=0x14f42800b309 "EXECUTE s USING @a", packet_length=packet_length@entry=18, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:248
#22 0x000055b802e263e3 in do_command (thd=0x14f428000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407
#23 0x000055b802f9235c in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55b805c8fe18, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439
#24 0x000055b802f9265c in handle_one_connection (arg=arg@entry=0x55b805c8fe18)at /test/11.2_dbg/sql/sql_connect.cc:1341
#25 0x000055b8033d962c in pfs_spawn_thread (arg=0x55b805c5ef68)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201
#26 0x000014f488c9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#27 0x000014f488d29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Confirmed in: MariaDB: 11.2.6 (dbg), 11.4.4 (dbg), 11.6.2 (dbg), 11.7.0 (dbg)

Roel Van de Paar added a comment - 2024-09-25 07:14 The following testcase: SET @a= 'ABC<DIV style="x:x1ression (javript:alert">DEF' ; CREATE TABLE t (c INT ,c2 INT ) PARTITION BY KEY (c) PARTITIONS 1; PREPARE s FROM 'DELETE FROM t WHERE c=?' ; EXECUTE s USING @ SET ; EXECUTE s USING @a; Leads to these additional stack: CS 11.2.6 e91a79945822def1452787f825e6047c6a64dbd9 (Debug) mariadbd: /test/11.2_dbg/mysys/my_alloc.c:275: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed. CS 11.2.6 e91a79945822def1452787f825e6047c6a64dbd9 (Debug) Core was generated by `/test/MD090924-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'. Program terminated with signal SIGABRT, Aborted. Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c. #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44 [Current thread is 1 (LWP 2521856)] (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89 #3 0x000014f488c4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26 #4 0x000014f488c288ff in __GI_abort () at ./stdlib/abort.c:79 #5 0x000014f488c2881b in __assert_fail_base (fmt=0x14f488dd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55b803d24f5d "(mem_root->flags & 4) == 0", file=file@entry=0x55b803cb1290 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x55b803e93110 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:94 #6 0x000014f488c3b507 in __assert_fail (assertion=assertion@entry=0x55b803d24f5d "(mem_root->flags & 4) == 0", file=file@entry=0x55b803cb1290 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x55b803e93110 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:103 #7 0x000055b8038f91d5 in alloc_root (mem_root=0x14f42801d678, length=16)at /test/11.2_dbg/mysys/my_alloc.c:275 #8 0x000055b802ded1c4 in Sql_alloc::operator new (mem_root=<optimized out>, size=16) at /test/11.2_dbg/sql/sql_alloc.h:37 #9 base_list::push_back (mem_root=<optimized out>, info=0x14f42802c5f0, this=0x14f42802abf0) at /test/11.2_dbg/sql/sql_list.h:195 #10 List<TABLE_LIST>::push_back (mem_root=<optimized out>, a=0x14f42802c5f0, this=0x14f42802abf0) at /test/11.2_dbg/sql/sql_list.h:505 #11 st_select_lex::save_leaf_tables (this=0x14f42802a9c0, thd=thd@entry=0x14f428000d58) at /test/11.2_dbg/sql/sql_lex.cc:5775 #12 0x000055b802dc8b53 in Sql_cmd_delete::delete_from_single_table (this=this@entry=0x14f42802d210, thd=thd@entry=0x14f428000d58)at /test/11.2_dbg/sql/sql_delete.cc:920 #13 0x000055b802dc9230 in Sql_cmd_delete::execute_inner (this=0x14f42802d210, thd=0x14f428000d58) at /test/11.2_dbg/sql/sql_delete.cc:1821 #14 0x000055b802e600df in Sql_cmd_dml::execute (this=0x14f42802d210, thd=0x14f428000d58) at /test/11.2_dbg/sql/sql_select.cc:33800 #15 0x000055b802e1c3ea in mysql_execute_command (thd=0x14f428000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true)at /test/11.2_dbg/sql/sql_parse.cc:4433 #16 0x000055b802e49de3 in Prepared_statement::execute (this=this@entry=0x14f42801d2e8, expanded_query=expanded_query@entry=0x14f483f67c70, open_cursor=open_cursor@entry=false)at /test/11.2_dbg/sql/sql_prepare.cc:5077 #17 0x000055b802e4a199 in Prepared_statement::execute_loop (this=this@entry=0x14f42801d2e8, expanded_query=expanded_query@entry=0x14f483f67c70, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/11.2_dbg/sql/sql_prepare.cc:4461 #18 0x000055b802e4a64b in mysql_sql_stmt_execute (thd=thd@entry=0x14f428000d58)at /test/11.2_dbg/sql/sql_prepare.cc:3480 #19 0x000055b802e1b0e1 in mysql_execute_command (thd=thd@entry=0x14f428000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:4000 #20 0x000055b802e21d26 in mysql_parse (thd=thd@entry=0x14f428000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14f483f682a0)at /test/11.2_dbg/sql/sql_parse.cc:7929 #21 0x000055b802e241bd in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14f428000d58, packet=packet@entry=0x14f42800b309 "EXECUTE s USING @a", packet_length=packet_length@entry=18, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:248 #22 0x000055b802e263e3 in do_command (thd=0x14f428000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407 #23 0x000055b802f9235c in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55b805c8fe18, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439 #24 0x000055b802f9265c in handle_one_connection (arg=arg@entry=0x55b805c8fe18)at /test/11.2_dbg/sql/sql_connect.cc:1341 #25 0x000055b8033d962c in pfs_spawn_thread (arg=0x55b805c5ef68)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201 #26 0x000014f488c9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447 #27 0x000014f488d29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 Confirmed in: MariaDB: 11.2.6 (dbg), 11.4.4 (dbg), 11.6.2 (dbg), 11.7.0 (dbg)

Roel Van de Paar added a comment - 2024-10-20 23:05

Additional stack with this optimizer switch change:

CREATE TABLE t (c INT);

PREPARE s FROM 'SELECT * FROM t WHERE EXISTS (SELECT 1)';

SET SESSION optimizer_switch='exists_to_in=off';

CREATE TEMPORARY TABLE t (d INT);

EXECUTE s;

SET SESSION optimizer_switch='exists_to_in=on';

EXECUTE s;

Leads to:

CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug)
mariadbd: /test/11.2_dbg/mysys/my_alloc.c:275: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed.

CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug)
Core was generated by `/test/MD141024-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGABRT, Aborted.
Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 1362825)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
#3 0x00001519e0a4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
#4 0x00001519e0a288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x00001519e0a2881b in __assert_fail_base (fmt=0x1519e0bd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x560387d3ac49 "(mem_root->flags & 4) == 0", file=file@entry=0x560387cc6cf8 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x560387ea8750 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:94
#6 0x00001519e0a3b507 in __assert_fail (assertion=assertion@entry=0x560387d3ac49 "(mem_root->flags & 4) == 0", file=file@entry=0x560387cc6cf8 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x560387ea8750 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:103
#7 0x000056038790de51 in alloc_root (mem_root=0x151978022538, length=208)at /test/11.2_dbg/mysys/my_alloc.c:275
#8 0x0000560387249a47 in Item::operator new (mem_root=<optimized out>, size=208) at /test/11.2_dbg/sql/item.h:862
#9 Item_exists_subselect::select_prepare_to_be_in (this=0x15197803ac60)at /test/11.2_dbg/sql/item_subselect.cc:2984
#10 0x0000560387249ca3 in Item_exists_subselect::select_transformer (this=<optimized out>, join=<optimized out>)at /test/11.2_dbg/sql/item_subselect.cc:2797
#11 0x0000560386ffcf53 in check_and_do_in_subquery_rewrites (join=join@entry=0x151978013f78) at /test/11.2_dbg/sql/opt_subselect.cc:802
#12 0x0000560386eaa375 in JOIN::prepare (this=0x151978013f78, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=skip_order_by@entry=false, group_init=<optimized out>, having_init=<optimized out>, proc_param_init=<optimized out>, select_lex_arg=<optimized out>, unit_arg=<optimized out>)at /test/11.2_dbg/sql/sql_select.cc:1685
#13 0x000056038724b2e7 in subselect_single_select_engine::prepare (this=0x15197803ae08, thd=0x151978000d58)at /test/11.2_dbg/sql/sql_lex.h:1405
#14 0x000056038724a7a1 in Item_subselect::fix_fields (this=0x15197803ac60, thd_param=<optimized out>, ref=0x151978013c38)at /test/11.2_dbg/sql/item_subselect.cc:298
#15 0x000056038724ab39 in Item_exists_subselect::fix_fields (this=<optimized out>, thd=0x151978000d58, ref=0x151978013c38)at /test/11.2_dbg/sql/item_subselect.cc:3558
#16 0x0000560386db184d in Item::fix_fields_if_needed (ref=0x151978013c38, thd=0x151978000d58, this=0x15197803ac60) at /test/11.2_dbg/sql/item.h:802
#17 Item::fix_fields_if_needed_for_scalar (ref=0x151978013c38, thd=0x151978000d58, this=0x15197803ac60) at /test/11.2_dbg/sql/item.h:1176
#18 Item::fix_fields_if_needed_for_bool (ref=0x151978013c38, thd=0x151978000d58, this=0x15197803ac60) at /test/11.2_dbg/sql/item.h:1180
#19 setup_conds (thd=thd@entry=0x151978000d58, tables=tables@entry=0x151978039798, leaves=@0x151978039378: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151978013f68, last = 0x151978013f68, elements = 1}, <No data fields>}, conds=conds@entry=0x151978013c38) at /test/11.2_dbg/sql/sql_base.cc:8940
#20 0x0000560386ea9a05 in setup_without_group (hidden_group_fields=0x151978013aff, win_funcs=@0x151978039600: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56038863b280 <end_of_list>, last = 0x151978039600, elements = 0}, <No data fields>}, win_specs=@0x1519780395e0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56038863b280 <end_of_list>, last = 0x1519780395e0, elements = 0}, <No data fields>}, group=0x0, order=0x0, conds=0x151978013c38, all_fields=@0x151978013b50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151978039748, last = 0x151978039748, elements = 1}, <No data fields>}, fields=@0x151978039418: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151978039748, last = 0x151978039748, elements = 1}, <No data fields>}, leaves=@0x151978039378: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151978013f68, last = 0x151978013f68, elements = 1}, <No data fields>}, tables=0x151978039798, ref_pointer_array=<optimized out>, thd=0x151978000d58) at /test/11.2_dbg/sql/sql_select.cc:964
#21 JOIN::prepare (this=this@entry=0x1519780137a0, tables_init=tables_init@entry=0x151978039798, conds_init=conds_init@entry=0x15197803ac60, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x151978039160, unit_arg=0x151978037448)at /test/11.2_dbg/sql/sql_select.cc:1586
#22 0x0000560386ec262e in mysql_select (thd=thd@entry=0x151978000d58, tables=0x151978039798, fields=@0x151978039418: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151978039748, last = 0x151978039748, elements = 1}, <No data fields>}, conds=0x15197803ac60, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2201187781376, result=0x15197803b6a0, unit=0x151978037448, select_lex=0x151978039160)at /test/11.2_dbg/sql/sql_select.cc:5333
#23 0x0000560386ec2858 in handle_select (thd=thd@entry=0x151978000d58, lex=lex@entry=0x151978037368, result=result@entry=0x15197803b6a0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/11.2_dbg/sql/sql_select.cc:642
#24 0x0000560386e20751 in execute_sqlcom_select (thd=thd@entry=0x151978000d58, all_tables=0x151978039798) at /test/11.2_dbg/sql/sql_parse.cc:6177
#25 0x0000560386e2c5bc in mysql_execute_command (thd=0x151978000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true)at /test/11.2_dbg/sql/sql_parse.cc:3984
#26 0x0000560386e5b3cd in Prepared_statement::execute (this=this@entry=0x1519780221a8, expanded_query=expanded_query@entry=0x1519e0147c70, open_cursor=open_cursor@entry=false)at /test/11.2_dbg/sql/sql_prepare.cc:5077
#27 0x0000560386e5b783 in Prepared_statement::execute_loop (this=this@entry=0x1519780221a8, expanded_query=expanded_query@entry=0x1519e0147c70, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/11.2_dbg/sql/sql_prepare.cc:4461
#28 0x0000560386e5bc44 in mysql_sql_stmt_execute (thd=thd@entry=0x151978000d58)at /test/11.2_dbg/sql/sql_prepare.cc:3480
#29 0x0000560386e2c623 in mysql_execute_command (thd=thd@entry=0x151978000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:4000
#30 0x0000560386e332ce in mysql_parse (thd=thd@entry=0x151978000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1519e01482a0)at /test/11.2_dbg/sql/sql_parse.cc:7938
#31 0x0000560386e35786 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x151978000d58, packet=packet@entry=0x15197800b319 "EXECUTE s", packet_length=packet_length@entry=9, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:248
#32 0x0000560386e379c2 in do_command (thd=0x151978000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407
#33 0x0000560386fa4fe7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x56038a4732b8, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439
#34 0x0000560386fa52ef in handle_one_connection (arg=arg@entry=0x56038a4732b8)at /test/11.2_dbg/sql/sql_connect.cc:1341
#35 0x00005603873ecf14 in pfs_spawn_thread (arg=0x56038a442408)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201
#36 0x00001519e0a9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#37 0x00001519e0b29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug confirmed present in:
MariaDB: 10.5.27 (dbg), 10.6.20 (dbg), 10.11.10 (dbg), 11.2.6 (dbg), 11.4.4 (dbg), 11.6.2 (dbg), 11.7.0 (dbg)

Roel Van de Paar added a comment - 2024-10-20 23:05 Additional stack with this optimizer switch change: CREATE TABLE t (c INT ); PREPARE s FROM 'SELECT * FROM t WHERE EXISTS (SELECT 1)' ; SET SESSION optimizer_switch= 'exists_to_in=off' ; CREATE TEMPORARY TABLE t (d INT ); EXECUTE s; SET SESSION optimizer_switch= 'exists_to_in=on' ; EXECUTE s; Leads to: CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug) mariadbd: /test/11.2_dbg/mysys/my_alloc.c:275: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed. CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug) Core was generated by `/test/MD141024-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'. Program terminated with signal SIGABRT, Aborted. Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c. #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44 [Current thread is 1 (LWP 1362825)] (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89 #3 0x00001519e0a4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26 #4 0x00001519e0a288ff in __GI_abort () at ./stdlib/abort.c:79 #5 0x00001519e0a2881b in __assert_fail_base (fmt=0x1519e0bd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x560387d3ac49 "(mem_root->flags & 4) == 0", file=file@entry=0x560387cc6cf8 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x560387ea8750 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:94 #6 0x00001519e0a3b507 in __assert_fail (assertion=assertion@entry=0x560387d3ac49 "(mem_root->flags & 4) == 0", file=file@entry=0x560387cc6cf8 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x560387ea8750 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:103 #7 0x000056038790de51 in alloc_root (mem_root=0x151978022538, length=208)at /test/11.2_dbg/mysys/my_alloc.c:275 #8 0x0000560387249a47 in Item::operator new (mem_root=<optimized out>, size=208) at /test/11.2_dbg/sql/item.h:862 #9 Item_exists_subselect::select_prepare_to_be_in (this=0x15197803ac60)at /test/11.2_dbg/sql/item_subselect.cc:2984 #10 0x0000560387249ca3 in Item_exists_subselect::select_transformer (this=<optimized out>, join=<optimized out>)at /test/11.2_dbg/sql/item_subselect.cc:2797 #11 0x0000560386ffcf53 in check_and_do_in_subquery_rewrites (join=join@entry=0x151978013f78) at /test/11.2_dbg/sql/opt_subselect.cc:802 #12 0x0000560386eaa375 in JOIN::prepare (this=0x151978013f78, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=skip_order_by@entry=false, group_init=<optimized out>, having_init=<optimized out>, proc_param_init=<optimized out>, select_lex_arg=<optimized out>, unit_arg=<optimized out>)at /test/11.2_dbg/sql/sql_select.cc:1685 #13 0x000056038724b2e7 in subselect_single_select_engine::prepare (this=0x15197803ae08, thd=0x151978000d58)at /test/11.2_dbg/sql/sql_lex.h:1405 #14 0x000056038724a7a1 in Item_subselect::fix_fields (this=0x15197803ac60, thd_param=<optimized out>, ref=0x151978013c38)at /test/11.2_dbg/sql/item_subselect.cc:298 #15 0x000056038724ab39 in Item_exists_subselect::fix_fields (this=<optimized out>, thd=0x151978000d58, ref=0x151978013c38)at /test/11.2_dbg/sql/item_subselect.cc:3558 #16 0x0000560386db184d in Item::fix_fields_if_needed (ref=0x151978013c38, thd=0x151978000d58, this=0x15197803ac60) at /test/11.2_dbg/sql/item.h:802 #17 Item::fix_fields_if_needed_for_scalar (ref=0x151978013c38, thd=0x151978000d58, this=0x15197803ac60) at /test/11.2_dbg/sql/item.h:1176 #18 Item::fix_fields_if_needed_for_bool (ref=0x151978013c38, thd=0x151978000d58, this=0x15197803ac60) at /test/11.2_dbg/sql/item.h:1180 #19 setup_conds (thd=thd@entry=0x151978000d58, tables=tables@entry=0x151978039798, leaves=@0x151978039378: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151978013f68, last = 0x151978013f68, elements = 1}, <No data fields>}, conds=conds@entry=0x151978013c38) at /test/11.2_dbg/sql/sql_base.cc:8940 #20 0x0000560386ea9a05 in setup_without_group (hidden_group_fields=0x151978013aff, win_funcs=@0x151978039600: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56038863b280 <end_of_list>, last = 0x151978039600, elements = 0}, <No data fields>}, win_specs=@0x1519780395e0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56038863b280 <end_of_list>, last = 0x1519780395e0, elements = 0}, <No data fields>}, group=0x0, order=0x0, conds=0x151978013c38, all_fields=@0x151978013b50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151978039748, last = 0x151978039748, elements = 1}, <No data fields>}, fields=@0x151978039418: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151978039748, last = 0x151978039748, elements = 1}, <No data fields>}, leaves=@0x151978039378: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151978013f68, last = 0x151978013f68, elements = 1}, <No data fields>}, tables=0x151978039798, ref_pointer_array=<optimized out>, thd=0x151978000d58) at /test/11.2_dbg/sql/sql_select.cc:964 #21 JOIN::prepare (this=this@entry=0x1519780137a0, tables_init=tables_init@entry=0x151978039798, conds_init=conds_init@entry=0x15197803ac60, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x151978039160, unit_arg=0x151978037448)at /test/11.2_dbg/sql/sql_select.cc:1586 #22 0x0000560386ec262e in mysql_select (thd=thd@entry=0x151978000d58, tables=0x151978039798, fields=@0x151978039418: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151978039748, last = 0x151978039748, elements = 1}, <No data fields>}, conds=0x15197803ac60, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2201187781376, result=0x15197803b6a0, unit=0x151978037448, select_lex=0x151978039160)at /test/11.2_dbg/sql/sql_select.cc:5333 #23 0x0000560386ec2858 in handle_select (thd=thd@entry=0x151978000d58, lex=lex@entry=0x151978037368, result=result@entry=0x15197803b6a0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/11.2_dbg/sql/sql_select.cc:642 #24 0x0000560386e20751 in execute_sqlcom_select (thd=thd@entry=0x151978000d58, all_tables=0x151978039798) at /test/11.2_dbg/sql/sql_parse.cc:6177 #25 0x0000560386e2c5bc in mysql_execute_command (thd=0x151978000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true)at /test/11.2_dbg/sql/sql_parse.cc:3984 #26 0x0000560386e5b3cd in Prepared_statement::execute (this=this@entry=0x1519780221a8, expanded_query=expanded_query@entry=0x1519e0147c70, open_cursor=open_cursor@entry=false)at /test/11.2_dbg/sql/sql_prepare.cc:5077 #27 0x0000560386e5b783 in Prepared_statement::execute_loop (this=this@entry=0x1519780221a8, expanded_query=expanded_query@entry=0x1519e0147c70, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/11.2_dbg/sql/sql_prepare.cc:4461 #28 0x0000560386e5bc44 in mysql_sql_stmt_execute (thd=thd@entry=0x151978000d58)at /test/11.2_dbg/sql/sql_prepare.cc:3480 #29 0x0000560386e2c623 in mysql_execute_command (thd=thd@entry=0x151978000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:4000 #30 0x0000560386e332ce in mysql_parse (thd=thd@entry=0x151978000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1519e01482a0)at /test/11.2_dbg/sql/sql_parse.cc:7938 #31 0x0000560386e35786 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x151978000d58, packet=packet@entry=0x15197800b319 "EXECUTE s", packet_length=packet_length@entry=9, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:248 #32 0x0000560386e379c2 in do_command (thd=0x151978000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407 #33 0x0000560386fa4fe7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x56038a4732b8, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439 #34 0x0000560386fa52ef in handle_one_connection (arg=arg@entry=0x56038a4732b8)at /test/11.2_dbg/sql/sql_connect.cc:1341 #35 0x00005603873ecf14 in pfs_spawn_thread (arg=0x56038a442408)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201 #36 0x00001519e0a9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447 #37 0x00001519e0b29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 Bug confirmed present in: MariaDB: 10.5.27 (dbg), 10.6.20 (dbg), 10.11.10 (dbg), 11.2.6 (dbg), 11.4.4 (dbg), 11.6.2 (dbg), 11.7.0 (dbg)

Roel Van de Paar added a comment - 2024-10-21 01:11

Additional stack with

SET @s:=REPLACE ("DO ST_ASTEXT (LEFT(@c,@f));","'",'"');

PREPARE s FROM @s;

EXECUTE s;

SET @a=0,@b=0,@c=0;

EXECUTE s;

Leads to:

CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug)
mariadbd: /test/11.2_dbg/mysys/my_alloc.c:275: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed.

CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug)
Core was generated by `/test/MD141024-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGABRT, Aborted.
Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 3945123)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
#3 0x00001527fea4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
#4 0x00001527fea288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x00001527fea2881b in __assert_fail_base (fmt=0x1527febd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55f273f5ac49 "(mem_root->flags & 4) == 0", file=file@entry=0x55f273ee6cf8 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x55f2740c8750 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:94
#6 0x00001527fea3b507 in __assert_fail (assertion=assertion@entry=0x55f273f5ac49 "(mem_root->flags & 4) == 0", file=file@entry=0x55f273ee6cf8 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x55f2740c8750 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:103
#7 0x000055f273b2de51 in alloc_root (mem_root=0x1527a8019ae8, length=272)at /test/11.2_dbg/mysys/my_alloc.c:275
#8 0x000055f273391fad in Item::operator new (mem_root=<optimized out>, size=272) at /test/11.2_dbg/sql/item.h:862
#9 Type_std_attributes::agg_item_set_converter (this=this@entry=0x1527a801dba8, coll=@0x1527a801dbb0: {collation = 0x55f274830d60 <my_charset_utf8mb3_general_ci>, derivation = DERIVATION_COERCIBLE, repertoire = MY_REPERTOIRE_ASCII}, fname=@0x1527f5bb2040: {str = 0x55f273f36267 "left", length = 4}, args=args@entry=0x1527a801dc20, nargs=nargs@entry=1, flags=flags@entry=11, item_sep=1, single_err=0x0) at /test/11.2_dbg/sql/item.cc:2739
#10 0x000055f273437b7c in Type_std_attributes::agg_arg_charsets (item_sep=1, flags=11, nitems=1, items=0x1527a801dc20, func_name=@0x1527f5bb2040: {str = 0x55f273f36267 "left", length = 4}, c=@0x1527a801dbb0: {collation = 0x55f274830d60 <my_charset_utf8mb3_general_ci>, derivation = DERIVATION_COERCIBLE, repertoire = MY_REPERTOIRE_ASCII}, this=0x1527a801dba8) at /test/11.2_dbg/sql/sql_type.h:3329
#11 Type_std_attributes::agg_arg_charsets_for_string_result (item_sep=1, nitems=1, items=0x1527a801dc20, func_name=@0x1527f5bb2040: {str = 0x55f273f36267 "left", length = 4}, c=@0x1527a801dbb0: {collation = 0x55f274830d60 <my_charset_utf8mb3_general_ci>, derivation = DERIVATION_COERCIBLE, repertoire = MY_REPERTOIRE_ASCII}, this=0x1527a801dba8) at /test/11.2_dbg/sql/sql_type.h:3344
#12 Item_func_or_sum::agg_arg_charsets_for_string_result (item_sep=1, nitems=1, items=0x1527a801dc20, c=@0x1527a801dbb0: {collation = 0x55f274830d60 <my_charset_utf8mb3_general_ci>, derivation = DERIVATION_COERCIBLE, repertoire = MY_REPERTOIRE_ASCII}, this=0x1527a801dba0) at /test/11.2_dbg/sql/item.h:5572
#13 Item_func_left::fix_length_and_dec (this=0x1527a801dba0, thd=<optimized out>) at /test/11.2_dbg/sql/item_strfunc.cc:1949
#14 0x000055f2733e4d71 in Item_func::fix_fields (this=this@entry=0x1527a801dba0, thd=thd@entry=0x1527a8000d58, ref=<optimized out>) at /test/11.2_dbg/sql/item_func.cc:380
#15 0x000055f273428e26 in Item_str_func::fix_fields (this=0x1527a801dba0, thd=0x1527a8000d58, ref=<optimized out>)at /test/11.2_dbg/sql/item_strfunc.cc:128
#16 0x000055f2733e4d3d in Item::fix_fields_if_needed (ref=0x1527a801dd40, thd=0x1527a8000d58, this=<optimized out>) at /test/11.2_dbg/sql/item.h:802
#17 Item_func::fix_fields (this=this@entry=0x1527a801dcc0, thd=thd@entry=0x1527a8000d58, ref=<optimized out>)at /test/11.2_dbg/sql/item_func.cc:362
#18 0x000055f273428e26 in Item_str_func::fix_fields (this=0x1527a801dcc0, thd=0x1527a8000d58, ref=<optimized out>)at /test/11.2_dbg/sql/item_strfunc.cc:128
#19 0x000055f272fcf5f3 in Item::fix_fields_if_needed (ref=0x1527a801ddb0, thd=0x1527a8000d58, this=0x1527a801dcc0) at /test/11.2_dbg/sql/item.h:1167
#20 Item::fix_fields_if_needed_for_scalar (ref=0x1527a801ddb0, thd=0x1527a8000d58, this=0x1527a801dcc0) at /test/11.2_dbg/sql/item.h:1176
#21 setup_fields (thd=thd@entry=0x1527a8000d58, ref_pointer_array=<optimized out>, fields=@0x1527a801dd90: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1527a801dda8, last = 0x1527a801dda8, elements = 1}, <No data fields>}, column_usage=column_usage@entry=COLUMNS_READ, sum_func_list=sum_func_list@entry=0x0, pre_fix=0x0, allow_sum_func=false)at /test/11.2_dbg/sql/sql_base.cc:8114
#22 0x000055f27350e19d in mysql_do (thd=thd@entry=0x1527a8000d58, values=@0x1527a801dd90: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1527a801dda8, last = 0x1527a801dda8, elements = 1}, <No data fields>})at /test/11.2_dbg/sql/sql_do.cc:32
#23 0x000055f27304c6cc in mysql_execute_command (thd=0x1527a8000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true)at /test/11.2_dbg/sql/sql_parse.cc:4013
#24 0x000055f27307b3cd in Prepared_statement::execute (this=this@entry=0x1527a8019758, expanded_query=expanded_query@entry=0x1527f5bb2c70, open_cursor=open_cursor@entry=false)at /test/11.2_dbg/sql/sql_prepare.cc:5077
#25 0x000055f27307b783 in Prepared_statement::execute_loop (this=this@entry=0x1527a8019758, expanded_query=expanded_query@entry=0x1527f5bb2c70, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/11.2_dbg/sql/sql_prepare.cc:4461
#26 0x000055f27307bc44 in mysql_sql_stmt_execute (thd=thd@entry=0x1527a8000d58)at /test/11.2_dbg/sql/sql_prepare.cc:3480
#27 0x000055f27304c623 in mysql_execute_command (thd=thd@entry=0x1527a8000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:4000
#28 0x000055f2730532ce in mysql_parse (thd=thd@entry=0x1527a8000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1527f5bb32a0)at /test/11.2_dbg/sql/sql_parse.cc:7938
#29 0x000055f273055786 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1527a8000d58, packet=packet@entry=0x1527a800b319 "EXECUTE s", packet_length=packet_length@entry=9, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:248
#30 0x000055f2730579c2 in do_command (thd=0x1527a8000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407
#31 0x000055f2731c4fe7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55f27657e0d8, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439
#32 0x000055f2731c52ef in handle_one_connection (arg=arg@entry=0x55f27657e0d8)at /test/11.2_dbg/sql/sql_connect.cc:1341
#33 0x000055f27360cf14 in pfs_spawn_thread (arg=0x55f27654d298)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201
#34 0x00001527fea9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#35 0x00001527feb29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug confirmed present in:
MariaDB: 10.5.27 (dbg), 10.6.20 (dbg), 10.11.10 (dbg), 11.2.6 (dbg), 11.4.4 (dbg), 11.6.2 (dbg), 11.7.0 (dbg)

Roel Van de Paar added a comment - 2024-10-21 01:11 Additional stack with SET @s:= REPLACE ( "DO ST_ASTEXT (LEFT(@c,@f));" , "'" ,'"'); PREPARE s FROM @s; EXECUTE s; SET @a=0,@b=0,@c=0; EXECUTE s; Leads to: CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug) mariadbd: /test/11.2_dbg/mysys/my_alloc.c:275: alloc_root: Assertion `(mem_root->flags & 4) == 0' failed. CS 11.2.6 12a91b57e27b979819924cf89614e6e51f24b37b (Debug) Core was generated by `/test/MD141024-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'. Program terminated with signal SIGABRT, Aborted. Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c. #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44 [Current thread is 1 (LWP 3945123)] (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89 #3 0x00001527fea4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26 #4 0x00001527fea288ff in __GI_abort () at ./stdlib/abort.c:79 #5 0x00001527fea2881b in __assert_fail_base (fmt=0x1527febd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55f273f5ac49 "(mem_root->flags & 4) == 0", file=file@entry=0x55f273ee6cf8 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x55f2740c8750 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:94 #6 0x00001527fea3b507 in __assert_fail (assertion=assertion@entry=0x55f273f5ac49 "(mem_root->flags & 4) == 0", file=file@entry=0x55f273ee6cf8 "/test/11.2_dbg/mysys/my_alloc.c", line=line@entry=275, function=function@entry=0x55f2740c8750 <__PRETTY_FUNCTION__.1> "alloc_root") at ./assert/assert.c:103 #7 0x000055f273b2de51 in alloc_root (mem_root=0x1527a8019ae8, length=272)at /test/11.2_dbg/mysys/my_alloc.c:275 #8 0x000055f273391fad in Item::operator new (mem_root=<optimized out>, size=272) at /test/11.2_dbg/sql/item.h:862 #9 Type_std_attributes::agg_item_set_converter (this=this@entry=0x1527a801dba8, coll=@0x1527a801dbb0: {collation = 0x55f274830d60 <my_charset_utf8mb3_general_ci>, derivation = DERIVATION_COERCIBLE, repertoire = MY_REPERTOIRE_ASCII}, fname=@0x1527f5bb2040: {str = 0x55f273f36267 "left", length = 4}, args=args@entry=0x1527a801dc20, nargs=nargs@entry=1, flags=flags@entry=11, item_sep=1, single_err=0x0) at /test/11.2_dbg/sql/item.cc:2739 #10 0x000055f273437b7c in Type_std_attributes::agg_arg_charsets (item_sep=1, flags=11, nitems=1, items=0x1527a801dc20, func_name=@0x1527f5bb2040: {str = 0x55f273f36267 "left", length = 4}, c=@0x1527a801dbb0: {collation = 0x55f274830d60 <my_charset_utf8mb3_general_ci>, derivation = DERIVATION_COERCIBLE, repertoire = MY_REPERTOIRE_ASCII}, this=0x1527a801dba8) at /test/11.2_dbg/sql/sql_type.h:3329 #11 Type_std_attributes::agg_arg_charsets_for_string_result (item_sep=1, nitems=1, items=0x1527a801dc20, func_name=@0x1527f5bb2040: {str = 0x55f273f36267 "left", length = 4}, c=@0x1527a801dbb0: {collation = 0x55f274830d60 <my_charset_utf8mb3_general_ci>, derivation = DERIVATION_COERCIBLE, repertoire = MY_REPERTOIRE_ASCII}, this=0x1527a801dba8) at /test/11.2_dbg/sql/sql_type.h:3344 #12 Item_func_or_sum::agg_arg_charsets_for_string_result (item_sep=1, nitems=1, items=0x1527a801dc20, c=@0x1527a801dbb0: {collation = 0x55f274830d60 <my_charset_utf8mb3_general_ci>, derivation = DERIVATION_COERCIBLE, repertoire = MY_REPERTOIRE_ASCII}, this=0x1527a801dba0) at /test/11.2_dbg/sql/item.h:5572 #13 Item_func_left::fix_length_and_dec (this=0x1527a801dba0, thd=<optimized out>) at /test/11.2_dbg/sql/item_strfunc.cc:1949 #14 0x000055f2733e4d71 in Item_func::fix_fields (this=this@entry=0x1527a801dba0, thd=thd@entry=0x1527a8000d58, ref=<optimized out>) at /test/11.2_dbg/sql/item_func.cc:380 #15 0x000055f273428e26 in Item_str_func::fix_fields (this=0x1527a801dba0, thd=0x1527a8000d58, ref=<optimized out>)at /test/11.2_dbg/sql/item_strfunc.cc:128 #16 0x000055f2733e4d3d in Item::fix_fields_if_needed (ref=0x1527a801dd40, thd=0x1527a8000d58, this=<optimized out>) at /test/11.2_dbg/sql/item.h:802 #17 Item_func::fix_fields (this=this@entry=0x1527a801dcc0, thd=thd@entry=0x1527a8000d58, ref=<optimized out>)at /test/11.2_dbg/sql/item_func.cc:362 #18 0x000055f273428e26 in Item_str_func::fix_fields (this=0x1527a801dcc0, thd=0x1527a8000d58, ref=<optimized out>)at /test/11.2_dbg/sql/item_strfunc.cc:128 #19 0x000055f272fcf5f3 in Item::fix_fields_if_needed (ref=0x1527a801ddb0, thd=0x1527a8000d58, this=0x1527a801dcc0) at /test/11.2_dbg/sql/item.h:1167 #20 Item::fix_fields_if_needed_for_scalar (ref=0x1527a801ddb0, thd=0x1527a8000d58, this=0x1527a801dcc0) at /test/11.2_dbg/sql/item.h:1176 #21 setup_fields (thd=thd@entry=0x1527a8000d58, ref_pointer_array=<optimized out>, fields=@0x1527a801dd90: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1527a801dda8, last = 0x1527a801dda8, elements = 1}, <No data fields>}, column_usage=column_usage@entry=COLUMNS_READ, sum_func_list=sum_func_list@entry=0x0, pre_fix=0x0, allow_sum_func=false)at /test/11.2_dbg/sql/sql_base.cc:8114 #22 0x000055f27350e19d in mysql_do (thd=thd@entry=0x1527a8000d58, values=@0x1527a801dd90: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1527a801dda8, last = 0x1527a801dda8, elements = 1}, <No data fields>})at /test/11.2_dbg/sql/sql_do.cc:32 #23 0x000055f27304c6cc in mysql_execute_command (thd=0x1527a8000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true)at /test/11.2_dbg/sql/sql_parse.cc:4013 #24 0x000055f27307b3cd in Prepared_statement::execute (this=this@entry=0x1527a8019758, expanded_query=expanded_query@entry=0x1527f5bb2c70, open_cursor=open_cursor@entry=false)at /test/11.2_dbg/sql/sql_prepare.cc:5077 #25 0x000055f27307b783 in Prepared_statement::execute_loop (this=this@entry=0x1527a8019758, expanded_query=expanded_query@entry=0x1527f5bb2c70, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/11.2_dbg/sql/sql_prepare.cc:4461 #26 0x000055f27307bc44 in mysql_sql_stmt_execute (thd=thd@entry=0x1527a8000d58)at /test/11.2_dbg/sql/sql_prepare.cc:3480 #27 0x000055f27304c623 in mysql_execute_command (thd=thd@entry=0x1527a8000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:4000 #28 0x000055f2730532ce in mysql_parse (thd=thd@entry=0x1527a8000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1527f5bb32a0)at /test/11.2_dbg/sql/sql_parse.cc:7938 #29 0x000055f273055786 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1527a8000d58, packet=packet@entry=0x1527a800b319 "EXECUTE s", packet_length=packet_length@entry=9, blocking=blocking@entry=true)at /test/11.2_dbg/sql/sql_class.h:248 #30 0x000055f2730579c2 in do_command (thd=0x1527a8000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407 #31 0x000055f2731c4fe7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55f27657e0d8, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439 #32 0x000055f2731c52ef in handle_one_connection (arg=arg@entry=0x55f27657e0d8)at /test/11.2_dbg/sql/sql_connect.cc:1341 #33 0x000055f27360cf14 in pfs_spawn_thread (arg=0x55f27654d298)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201 #34 0x00001527fea9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447 #35 0x00001527feb29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 Bug confirmed present in: MariaDB: 10.5.27 (dbg), 10.6.20 (dbg), 10.11.10 (dbg), 11.2.6 (dbg), 11.4.4 (dbg), 11.6.2 (dbg), 11.7.0 (dbg)

Roel Van de Paar added a comment - 2024-10-21 01:13 - edited

It has become clear that - while causing the same assert and while all triggered by double PS exec's - various bugs are present in this ticket.
shulga Please let us know if you like to have them split into additional tickets.

Roel Van de Paar added a comment - 2024-10-21 01:13 - edited It has become clear that - while causing the same assert and while all triggered by double PS exec's - various bugs are present in this ticket. shulga Please let us know if you like to have them split into additional tickets.

People

Assignee:: Dmitry Shulga

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 2024-09-08 21:57

Updated:: 2025-04-09 10:22

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server