Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-37435

Assertion `field' failed in virtual bool Item_field::fix_fields(THD *, Item **)

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Fix a scenario where SELECT statements with GROUP BY a virtual column expression and HAVING a condition involving the same expression could cause crash
    • Q4/2025 Server Maintenance

    Description

      CREATE TABLE t (a INT,a1 INT AS (a) VIRTUAL,INDEX (a1));
      SELECT a FROM t WHERE a=(SELECT a FROM t GROUP BY a HAVING a=2);
      

      Leads to:

      CS 12.2.0 e02f4d7e311e214ea62ff2e59599849e229f4165 (Debug, Clang) Build 07/08/2025

      mariadbd: /test/12.2_dbg/sql/item.cc:6415: virtual bool Item_field::fix_fields(THD *, Item **): Assertion `field' failed.
      

      CS 12.2.0 e02f4d7e311e214ea62ff2e59599849e229f4165 (Debug, Clang) Build 07/08/2025

      Core was generated by `/test/MD070825-mariadb-12.2.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
      Program terminated with signal SIGABRT, Aborted.
      Download failed: Invalid argument.  Continuing without source file ./nptl/./nptl/pthread_kill.c.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 1502333)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x000073f4cfa4527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x000073f4cfa288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x000073f4cfa2881b in __assert_fail_base (fmt=0x73f4cfbd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5e5f3c732ca0 "field", file=file@entry=0x5e5f3c7532c5 "/test/12.2_dbg/sql/item.cc", line=line@entry=6415, function=function@entry=0x5e5f3c754f2c "virtual bool Item_field::fix_fields(THD *, Item **)") at ./assert/assert.c:96
      #6  0x000073f4cfa3b517 in __assert_fail (assertion=0x5e5f3c732ca0 "field", file=0x5e5f3c7532c5 "/test/12.2_dbg/sql/item.cc", line=6415, function=0x5e5f3c754f2c "virtual bool Item_field::fix_fields(THD *, Item **)") at ./assert/assert.c:105
      #7  0x00005e5f3baa8983 in Item_field::fix_fields (this=0x73d9bc01ee40, thd=0x73d9bc000d58, reference=0x73d9bc01eff0)at /test/12.2_dbg/sql/item.cc:6415
      #8  0x00005e5f3b4f2a6a in Item::fix_fields_if_needed (this=0x73d9bc01ee40, thd=0x73d9bc000d58, ref=0x73d9bc01eff0) at /test/12.2_dbg/sql/item.h:1143
      #9  0x00005e5f3bb13932 in Item_func::fix_fields (this=0x73d9bc01ef68, thd=0x73d9bc000d58, ref=0x0) at /test/12.2_dbg/sql/item_func.cc:394
      #10 0x00005e5f3b60d66e in st_select_lex::pushdown_from_having_into_where (this=0x73d9bc01ae28, thd=0x73d9bc000d58, having=0x0)at /test/12.2_dbg/sql/sql_lex.cc:12447
      #11 0x00005e5f3b6aa0e4 in JOIN::optimize_inner (this=0x73d9bc01e178)at /test/12.2_dbg/sql/sql_select.cc:2495
      #12 0x00005e5f3b6a6348 in JOIN::optimize (this=0x73d9bc01e178)at /test/12.2_dbg/sql/sql_select.cc:2023
      #13 0x00005e5f3b5f0e4e in st_select_lex::optimize_unflattened_subqueries (this=0x73d9bc019f58, const_only=true) at /test/12.2_dbg/sql/sql_lex.cc:5075
      #14 0x00005e5f3b8987c7 in JOIN::optimize_constant_subqueries (this=0x73d9bc01d7b0) at /test/12.2_dbg/sql/opt_subselect.cc:5941
      #15 0x00005e5f3b6a954a in JOIN::optimize_inner (this=0x73d9bc01d7b0)at /test/12.2_dbg/sql/sql_select.cc:2378
      #16 0x00005e5f3b6a6348 in JOIN::optimize (this=0x73d9bc01d7b0)at /test/12.2_dbg/sql/sql_select.cc:2023
      #17 0x00005e5f3b69df99 in mysql_select (thd=0x73d9bc000d58, tables=0x73d9bc01a5b0, fields=@0x73d9bc01a210: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x73d9bc01a560, last = 0x73d9bc01a560, elements = 1}, <No data fields>}, conds=0x73d9bc01cb88, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x73d9bc01d788, unit=0x73d9bc005158, select_lex=0x73d9bc019f58)at /test/12.2_dbg/sql/sql_select.cc:5388
      #18 0x00005e5f3b69dad5 in handle_select (thd=0x73d9bc000d58, lex=0x73d9bc005078, result=0x73d9bc01d788, setup_tables_done_option=0)at /test/12.2_dbg/sql/sql_select.cc:634
      #19 0x00005e5f3b645611 in execute_sqlcom_select (thd=0x73d9bc000d58, all_tables=0x73d9bc01a5b0) at /test/12.2_dbg/sql/sql_parse.cc:6167
      #20 0x00005e5f3b63a39e in mysql_execute_command (thd=0x73d9bc000d58, is_called_from_prepared_stmt=false) at /test/12.2_dbg/sql/sql_parse.cc:3950
      #21 0x00005e5f3b632664 in mysql_parse (thd=0x73d9bc000d58, rawbuf=0x73d9bc019e80 "SELECT a FROM t WHERE a=(SELECT a FROM t GROUP BY a HAVING a=2)", length=63, parser_state=0x73f4cc127a10)at /test/12.2_dbg/sql/sql_parse.cc:7883
      #22 0x00005e5f3b62fa38 in dispatch_command (command=COM_QUERY, thd=0x73d9bc000d58, packet=0x73d9bc00b1f9 "SELECT a FROM t WHERE a=(SELECT a FROM t GROUP BY a HAVING a=2)", packet_length=63, blocking=true)at /test/12.2_dbg/sql/sql_parse.cc:1878
      #23 0x00005e5f3b633213 in do_command (thd=0x73d9bc000d58, blocking=true)at /test/12.2_dbg/sql/sql_parse.cc:1417
      #24 0x00005e5f3b8204b9 in do_handle_one_connection (connect=0x5e5f65737038, put_in_cache=true) at /test/12.2_dbg/sql/sql_connect.cc:1414
      #25 0x00005e5f3b82025e in handle_one_connection (arg=0x5e5f6566b3a8)at /test/12.2_dbg/sql/sql_connect.cc:1326
      #26 0x000073f4cfa9caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #27 0x000073f4cfb29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Bug Detection Matrix

          Rel    o/d  Build   Commit                                    UniqueID observed             
      CS  10.6   dbg  040825  317f099ca56130a14a45b7250996c207cc95d461  No bug found                  
      CS  10.6   opt  040825  317f099ca56130a14a45b7250996c207cc95d461  No bug found                  
      CS  10.11  dbg  040825  55a39f13e40807c3c8fee4573380f3e4d93e8715  No bug found                  
      CS  10.11  opt  040825  55a39f13e40807c3c8fee4573380f3e4d93e8715  No bug found                  
      CS  11.4   dbg  040825  4e9c252bc4bfef525ff8ec4a37fabd957694285d  No bug found                  
      CS  11.4   opt  040825  4e9c252bc4bfef525ff8ec4a37fabd957694285d  No bug found                  
      CS  11.8   dbg  130825  1a446ccc48528e88a3cd6cd1d1ec9e7492d342ca  No bug found                  
      CS  11.8   opt  130825  1a446ccc48528e88a3cd6cd1d1ec9e7492d342ca  No bug found                  
      CS  12.1   dbg  100725  891108ed665cbcf882454caa16ec2565ed36e337  No bug found                  
      CS  12.1   dbg  130825  033471a367b4c60b7262e64f43f46b02e95b9d74  field|SIGABRT|Item_field::fix_fields|Item::fix_fields_if_needed|Item_func::fix_fields|st_select_lex::pushdown_from_having_into_where
      CS  12.1   opt  130825  033471a367b4c60b7262e64f43f46b02e95b9d74  SIGSEGV|Item_field::fix_fields|Item::fix_fields_if_needed|Item_func::fix_fields|st_select_lex::pushdown_from_having_into_where
      CS  12.2   dbg  130825  e02f4d7e311e214ea62ff2e59599849e229f4165  field|SIGABRT|Item_field::fix_fields|Item::fix_fields_if_needed|Item_func::fix_fields|st_select_lex::pushdown_from_having_into_where
      CS  12.2   opt  130825  e02f4d7e311e214ea62ff2e59599849e229f4165  SIGSEGV|Item_field::fix_fields|Item::fix_fields_if_needed|Item_func::fix_fields|st_select_lex::pushdown_from_having_into_where
      ES  10.5   dbg  040825  70586522eacf09d04d49962072e14325a75d8155  No bug found                  
      ES  10.5   opt  040825  70586522eacf09d04d49962072e14325a75d8155  No bug found                  
      ES  10.6   dbg  040825  9b794f34b48fb7eee490b6da44edc0f33a947447  No bug found                  
      ES  10.6   opt  040825  9b794f34b48fb7eee490b6da44edc0f33a947447  No bug found                  
      ES  11.4   dbg  040825  a1c03ccd54b582e75506687ee19b273ca897f261  No bug found                  
      ES  11.4   opt  040825  a1c03ccd54b582e75506687ee19b273ca897f261  No bug found                  
      

      The assertion happens after this commit

      commit 8cdee25952763a0401e4c2a4d61e92c13499bdc6
      Author: Yuchen Pei <ycp@mariadb.com>
      Date:   Wed Jun 4 11:43:30 2025 +1000
       
          MDEV-36132 Substitute vcol expressions with indexed vcol fields in ORDER BY and GROUP BY
          
          Also expand vcol field index coverings to include indexes covering all
          the fields in the expression. The reasoning goes as follows: let f(c1,
          c2, ..., cn) be a function on applied to columns c1, c2, ..., cn, if
          f(...) is covered by an index, so should vc whose expression is
          f(...).
          
          For example, if t.vf = t.c1 + t.c2, and t has three indexes (vf), (c1,
          c2), (c1).
      [..]
      

      No UB/ASAN issues observed.

      Attachments

        Issue Links

          Activity

            People

              ycp Yuchen Pei
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.