Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40897

Assertion `pos != (~(my_off_t) 0)` fails in `my_seek()` during UPDATE with EXCEPT subquery

    XMLWordPrintable

Details

    • Hide
      ## Affected version

      - MariaDB `11.8.8-MariaDB-debug`
      - Source revision: `46a8eb42a520193686d9a16d4cea4b3e002917e4`

      ## Summary

      The server aborts while executing an `UPDATE` statement whose assigned expression is an `IN` predicate over an `EXCEPT` subquery:

      ```sql
      UPDATE v0 SET v1 = v1 IN (SELECT v1 FROM v0 AS v6 EXCEPT SELECT v1 FROM v0);
      ```

      The failing assertion is in `my_seek()`:

      ```text
      mariadbd: /home/mysql/mariadb/mysys/my_seek.c:53:
      my_off_t my_seek(File, my_off_t, int, myf):
      Assertion `pos != (~(my_off_t) 0)' failed.
      ```

      The stack includes temporary row deletion:

      ```text
      my_seek()
      unlink_deleted_block()
      delete_dynamic_record()
      handler::ha_delete_tmp_row(unsigned char*)
      select_unit::send_data(...)
      ...
      Item_in_subselect::val_bool()
      Item::save_bool_in_field(...)
      multi_update::send_data(...)
      Sql_cmd_update::execute_inner(...)
      ```

      This points to an invalid temporary-row file position during set-operation execution.

      ## Steps to reproduce

      Run the following SQL against a debug build:

      ```sql
      SET GLOBAL TRANSACTION READ WRITE;
      SET SESSION TRANSACTION READ WRITE;
      DROP DATABASE IF EXISTS test_sqlright1;
      CREATE DATABASE IF NOT EXISTS test_sqlright1;
      USE test_sqlright1;
      CREATE TABLE v1099(c1100 INT);

      CREATE TABLE v0 (v1 TEXT(83));

      INSERT INTO v0 (v1) VALUES (51);

      UPDATE v0
      SET v1 = (
        SELECT 94
        FROM (
          SELECT v1 AS v5
          FROM v0 AS v4
          GROUP BY v1
          HAVING v1
          EXCEPT
          SELECT v1 FROM v0
        ) AS v3,
        v0 AS v2
        JOIN v0
      );

      INSERT INTO v0 (v1)
      VALUES
        (61),
        (
          v1 + (
            SELECT v1
            WHERE (32880467.000000 * v1 * -1 IN (30, -1, 48, 0, -1))
            GROUP BY v1
            ORDER BY v1 / v1, v1 + v1
          )
        );

      UPDATE v0
      SET v1 = v1 IN (
        SELECT v1 FROM v0 AS v6
        EXCEPT
        SELECT v1 FROM v0
      );
      ```

      ## Actual result

      The server aborts:

      ```text
      Assertion `pos != (~(my_off_t) 0)' failed.
      got signal 6
      my_seek()
      handler::ha_delete_tmp_row(unsigned char*)
      select_unit::send_data(...)
      Item_in_subselect::val_bool()
      Sql_cmd_update::execute_inner(...)
      Query: UPDATE v0 SET v1 = v1 IN ( SELECT v1 FROM v0 AS v6 EXCEPT SELECT v1 FROM v0 )
      ```

      After replay:

      ```text
      server_ready 1
      client_rc 0
      server_alive_after 0
      ```
      Show
      ## Affected version - MariaDB `11.8.8-MariaDB-debug` - Source revision: `46a8eb42a520193686d9a16d4cea4b3e002917e4` ## Summary The server aborts while executing an `UPDATE` statement whose assigned expression is an `IN` predicate over an `EXCEPT` subquery: ```sql UPDATE v0 SET v1 = v1 IN (SELECT v1 FROM v0 AS v6 EXCEPT SELECT v1 FROM v0); ``` The failing assertion is in `my_seek()`: ```text mariadbd: /home/mysql/mariadb/mysys/my_seek.c:53: my_off_t my_seek(File, my_off_t, int, myf): Assertion `pos != (~(my_off_t) 0)' failed. ``` The stack includes temporary row deletion: ```text my_seek() unlink_deleted_block() delete_dynamic_record() handler::ha_delete_tmp_row(unsigned char*) select_unit::send_data(...) ... Item_in_subselect::val_bool() Item::save_bool_in_field(...) multi_update::send_data(...) Sql_cmd_update::execute_inner(...) ``` This points to an invalid temporary-row file position during set-operation execution. ## Steps to reproduce Run the following SQL against a debug build: ```sql SET GLOBAL TRANSACTION READ WRITE; SET SESSION TRANSACTION READ WRITE; DROP DATABASE IF EXISTS test_sqlright1; CREATE DATABASE IF NOT EXISTS test_sqlright1; USE test_sqlright1; CREATE TABLE v1099(c1100 INT); CREATE TABLE v0 (v1 TEXT(83)); INSERT INTO v0 (v1) VALUES (51); UPDATE v0 SET v1 = (   SELECT 94   FROM (     SELECT v1 AS v5     FROM v0 AS v4     GROUP BY v1     HAVING v1     EXCEPT     SELECT v1 FROM v0   ) AS v3,   v0 AS v2   JOIN v0 ); INSERT INTO v0 (v1) VALUES   (61),   (     v1 + (       SELECT v1       WHERE (32880467.000000 * v1 * -1 IN (30, -1, 48, 0, -1))       GROUP BY v1       ORDER BY v1 / v1, v1 + v1     )   ); UPDATE v0 SET v1 = v1 IN (   SELECT v1 FROM v0 AS v6   EXCEPT   SELECT v1 FROM v0 ); ``` ## Actual result The server aborts: ```text Assertion `pos != (~(my_off_t) 0)' failed. got signal 6 my_seek() handler::ha_delete_tmp_row(unsigned char*) select_unit::send_data(...) Item_in_subselect::val_bool() Sql_cmd_update::execute_inner(...) Query: UPDATE v0 SET v1 = v1 IN ( SELECT v1 FROM v0 AS v6 EXCEPT SELECT v1 FROM v0 ) ``` After replay: ```text server_ready 1 client_rc 0 server_alive_after 0 ```

    Attachments

      Issue Links

        Activity

          People

            psergei Sergei Petrunia
            v3rdant Xingwang Xiang
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.