[MDEV-39562] Assertion `length <= column->length' failed in write_block_record on SELECT...UNION, table corruption - Jira

XML

Word

Printable

Details

Type: Bug
Status: Confirmed (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 11.8, 12.3, 13.0
Fix Version/s: 11.8, 12.3
Component/s: Encryption, JSON, Optimizer, Vector search
Labels:

Bug Category:
Can result in data loss

Description

VECTOR data type for c2, TEXT type for c2, and JSON type for c3 are required. Issue is present on at least InnoDB and MyISAM. Testcase is CLI & MTR compatible.

SET sql_mode='', GLOBAL encrypt_tmp_disk_tables=ON;

CREATE TABLE t1 (c1 INT,c2 VECTOR (1),c3 INT);

CREATE TABLE t2 (c1 INT,c2 TEXT,c3 JSON);

INSERT INTO t1 VALUES (1,1,1);

SELECT * FROM t1 UNION SELECT * FROM t2;

Leads to:

CS 13.0.1 3a2f8e27981b76b99d2b87cc3bcec5ef022b2b23 (Optimized, Clang 21.1.3-20250923) Build 10/04/2026
...
13.0.1-opt>INSERT INTO t1 VALUES (1,1,1);
Query OK, 1 row affected, 2 warnings (0.002 sec)

13.0.1-opt>SELECT * FROM t1 UNION SELECT * FROM t2;
ERROR 127 (HY000): Got error '127 "Table file is corrupted"' for '#sql-temptable-272151-4-0.MAI'

When ', GLOBAL encrypt_tmp_disk_tables=ON' is removed from the testcase, debug builds will show the corruption also, instead of asserting.
When it is left, debug builds show:

CS 13.0.1 3a2f8e27981b76b99d2b87cc3bcec5ef022b2b23 (Debug, Clang 21.1.3-20250923) Build 10/04/2026

mariadbd: /test/13.0_dbg/storage/maria/ma_blockrec.c:2815: my_bool write_block_record(MARIA_HA *, const uchar *, const uchar *, MARIA_ROW *, MARIA_BITMAP_BLOCKS *, my_bool, struct st_row_pos_info *, LSN, ha_checksum): Assertion `length <= column->length' failed.

CS 13.0.1 3a2f8e27981b76b99d2b87cc3bcec5ef022b2b23 (Debug, Clang 21.1.3-20250923) Build 10/04/2026
Core was generated by `/test/MD100426-mariadb-13.0.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGABRT, Aborted.
Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 667670)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
#3 0x00007ee57724526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
#4 0x00007ee5772288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x00007ee57722881b in __assert_fail_base (fmt=0x7ee5773d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x57cc1197ffd1 "length <= column->length", file=file@entry=0x57cc11834fa8 "/test/13.0_dbg/storage/maria/ma_blockrec.c", line=line@entry=2815, function=function@entry=0x57cc1187cecd "my_bool write_block_record(MARIA_HA , const uchar , const uchar , MARIA_ROW , MARIA_BITMAP_BLOCKS , my_bool, struct st_row_pos_info , LSN, ha_checksum)") at ./assert/assert.c:94
#6 0x00007ee57723b507 in __assert_fail (assertion=0x57cc1197ffd1 "length <= column->length", file=0x57cc11834fa8 "/test/13.0_dbg/storage/maria/ma_blockrec.c", line=2815, function=0x57cc1187cecd "my_bool write_block_record(MARIA_HA , const uchar , const uchar , MARIA_ROW , MARIA_BITMAP_BLOCKS , my_bool, struct st_row_pos_info , LSN, ha_checksum)") at ./assert/assert.c:103
#7 0x000057cc129fda7d in write_block_record (info=0x76e4300c61f8, old_record=0x0, record=0x76e43008e580 "\370\001", row=0x76e4300c6278, bitmap_blocks=0x76e4300c6278, head_block_is_read=0 '\000', row_pos=0x7ee574144030, undo_lsn=1, old_record_checksum=0)at /test/13.0_dbg/storage/maria/ma_blockrec.c:2815
#8 0x000057cc129f3b0f in allocate_and_write_block_record (info=0x76e4300c61f8, record=0x76e43008e580 "\370\001", row=0x76e4300c6278, undo_lsn=1) at /test/13.0_dbg/storage/maria/ma_blockrec.c:3580
#9 0x000057cc129f31a5 in _ma_write_init_block_record (info=0x76e4300c61f8, record=0x76e43008e580 "\370\001")at /test/13.0_dbg/storage/maria/ma_blockrec.c:3620
#10 0x000057cc12a09e76 in maria_write (info=0x76e4300c61f8, record=0x76e43008e580 "\370\001")at /test/13.0_dbg/storage/maria/ma_write.c:158
#11 0x000057cc12a1fab7 in ha_maria::write_row (this=0x76e430087928, buf=0x76e43008e580 "\370\001")at /test/13.0_dbg/storage/maria/ha_maria.cc:1249
#12 0x000057cc122d04f0 in handler::ha_write_tmp_row (this=0x76e430087928, buf=0x76e43008e580 "\370\001") at /test/13.0_dbg/sql/sql_class.h:8113
#13 0x000057cc1275e2bf in select_unit::write_record (this=0x76e43001cc00)at /test/13.0_dbg/sql/sql_union.cc:417
#14 0x000057cc1275dfc2 in select_unit::send_data (this=0x76e43001cc00, values=@0x76e43001a470: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x76e43001a7b8, last = 0x76e43001d898, elements = 3}, <No data fields>})at /test/13.0_dbg/sql/sql_union.cc:161
#15 0x000057cc124bd84f in select_result_sink::send_data_with_check (this=0x76e43001cc00, items=@0x76e43001a470: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x76e43001a7b8, last = 0x76e43001d898, elements = 3}, <No data fields>}, u=0x76e430005270, sent=0) at /test/13.0_dbg/sql/sql_class.cc:3308
#16 0x000057cc12681e4f in end_send (join=0x76e43001ccf0, join_tab=0x76e430020818, end_of_records=false)at /test/13.0_dbg/sql/sql_select.cc:26080
#17 0x000057cc126aae54 in evaluate_join_record (join=0x76e43001ccf0, join_tab=0x76e4300203a0, error=0) at /test/13.0_dbg/sql/sql_select.cc:24953
#18 0x000057cc126640b4 in sub_select (join=0x76e43001ccf0, join_tab=0x76e4300203a0, end_of_records=false)at /test/13.0_dbg/sql/sql_select.cc:24720
#19 0x000057cc12687fae in do_select (join=0x76e43001ccf0, procedure=0x0)at /test/13.0_dbg/sql/sql_select.cc:24231
#20 0x000057cc12687496 in JOIN::exec_inner (this=0x76e43001ccf0)at /test/13.0_dbg/sql/sql_select.cc:5125
#21 0x000057cc126867b3 in JOIN::exec (this=0x76e43001ccf0)at /test/13.0_dbg/sql/sql_select.cc:4913
#22 0x000057cc12762a9f in st_select_lex_unit::exec_inner (this=0x76e430005270)at /test/13.0_dbg/sql/sql_union.cc:2455
#23 0x000057cc1275d71a in st_select_lex_unit::exec (this=0x76e430005270)at /test/13.0_dbg/sql/sql_union.cc:2351
#24 0x000057cc1275b377 in mysql_union (thd=0x76e430000d58, lex=0x76e430005190, result=0x76e43001cbd8, unit=0x76e430005270, setup_tables_done_option=0)at /test/13.0_dbg/sql/sql_union.cc:45
#25 0x000057cc12664337 in handle_select (thd=0x76e430000d58, lex=0x76e430005190, result=0x76e43001cbd8, setup_tables_done_option=0)at /test/13.0_dbg/sql/sql_select.cc:626
#26 0x000057cc1260b6fa in execute_sqlcom_select (thd=0x76e430000d58, all_tables=0x76e43001a808) at /test/13.0_dbg/sql/sql_parse.cc:6213
#27 0x000057cc12601b63 in mysql_execute_command (thd=0x76e430000d58, is_called_from_prepared_stmt=false) at /test/13.0_dbg/sql/sql_parse.cc:3989
#28 0x000057cc125fa9c8 in mysql_parse (thd=0x76e430000d58, rawbuf=0x76e43001a110 "SELECT * FROM t1 UNION SELECT * FROM t2", length=39, parser_state=0x7ee5741469f0)at /test/13.0_dbg/sql/sql_parse.cc:7941
#29 0x000057cc125f811e in dispatch_command (command=COM_QUERY, thd=0x76e430000d58, packet=0x76e43000b4b9 "SELECT * FROM t1 UNION SELECT * FROM t2", packet_length=39, blocking=true) at /test/13.0_dbg/sql/sql_parse.cc:1898
#30 0x000057cc125fb44a in do_command (thd=0x76e430000d58, blocking=true)at /test/13.0_dbg/sql/sql_parse.cc:1432
#31 0x000057cc127fe70e in do_handle_one_connection (connect=0x57cc159f2698, put_in_cache=true) at /test/13.0_dbg/sql/sql_connect.cc:1503
#32 0x000057cc127fe4f1 in handle_one_connection (arg=0x57cc159b69c8)at /test/13.0_dbg/sql/sql_connect.cc:1415
#33 0x00007ee57729ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#34 0x00007ee577329c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 100426 f39b634db715cd9dc1835653d1ce544df2aa1613 No bug found
CS 10.6 opt 100426 f39b634db715cd9dc1835653d1ce544df2aa1613 No bug found
CS 10.11 dbg 100426 ba774a0a90fac0163babe9d7a964aa36503e1711 No bug found
CS 10.11 opt 100426 ba774a0a90fac0163babe9d7a964aa36503e1711 No bug found
CS 11.4 dbg 100426 dc89915ad9bf3dcb67e66d2844c77ec0403373de No bug found
CS 11.4 opt 100426 dc89915ad9bf3dcb67e66d2844c77ec0403373de No bug found
CS 11.8 dbg 100426 e47db94aea7f0d6e0177e948486fc8860331f05f length <= column->length\|SIGABRT\|write_block_record\|allocate_and_write_block_record\|_ma_write_init_block_record\|maria_write
CS 11.8 opt 100426 e47db94aea7f0d6e0177e948486fc8860331f05f GOT_ERROR\|Got error '127 "Table file is corrupted"' for '#sql-temptable-9f867-4-0.MAI'
CS 12.3 dbg 100426 f5bb9922107672e88f7b5cbdb3d25151cc5744bb length <= column->length\|SIGABRT\|write_block_record\|allocate_and_write_block_record\|_ma_write_init_block_record\|maria_write
CS 12.3 opt 100426 f5bb9922107672e88f7b5cbdb3d25151cc5744bb GOT_ERROR\|Got error '127 "Table file is corrupted"' for '#sql-temptable-a1052-4-0.MAI'
CS 13.0 dbg 100426 3a2f8e27981b76b99d2b87cc3bcec5ef022b2b23 length <= column->length\|SIGABRT\|write_block_record\|allocate_and_write_block_record\|_ma_write_init_block_record\|maria_write
CS 13.0 opt 100426 3a2f8e27981b76b99d2b87cc3bcec5ef022b2b23 GOT_ERROR\|Got error '127 "Table file is corrupted"' for '#sql-temptable-a1a3c-4-0.MAI'
ES 10.6 dbg 100426 84a80c8b38208d362225496da08d86d8d454e453 No bug found
ES 10.6 opt 100426 84a80c8b38208d362225496da08d86d8d454e453 No bug found
ES 11.4 dbg 100426 8b2bf17b733262409422ce7d039a0c021fc47077 length <= column->length\|SIGABRT\|write_block_record\|allocate_and_write_block_record\|_ma_write_init_block_record\|maria_write
ES 11.4 opt 100426 8b2bf17b733262409422ce7d039a0c021fc47077 GOT_ERROR\|Got error '127 "Table file is corrupted"' for '#sql-temptable-96134-4-0.MAI'
ES 11.8 dbg 100426 854cae81f52e477c7777a51db26ba640d8755b81 length <= column->length\|SIGABRT\|write_block_record\|allocate_and_write_block_record\|_ma_write_init_block_record\|maria_write
ES 11.8 opt 100426 854cae81f52e477c7777a51db26ba640d8755b81 GOT_ERROR\|Got error '127 "Table file is corrupted"' for '#sql-temptable-98088-4-0.MAI'
ES 12.3 dbg 220426 613a6253fe9efc12e166f83a97663ba263db8317 length <= column->length\|SIGABRT\|write_block_record\|allocate_and_write_block_record\|_ma_write_init_block_record\|maria_write
ES 12.3 opt 220426 613a6253fe9efc12e166f83a97663ba263db8317 GOT_ERROR\|Got error '127 "Table file is corrupted"' for '#sql-temptable-99985-4-0.MAI'
MS 5.5 dbg 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
MS 5.5 opt 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
MS 5.6 dbg 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
MS 5.6 opt 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
MS 5.7 dbg 070525 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
MS 5.7 opt 070525 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
MS 8.0 dbg 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
MS 8.0 opt 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
MS 9.1 dbg 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found
MS 9.1 opt 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found

Attachments

Activity

People

Assignee:: Sergei Golubchik

Reporter:: Saahil Alam

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2 days ago 10:06

Updated:: Yesterday 21:17

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.