[MDEV-11171] Assertion `m_cpp_buf <= ptr && ptr <= m_cpp_buf + m_buf_length' failed in Lex_input_stream::body_utf8_append(const char*, const char*) Created: 2016-10-29  Updated: 2016-11-28  Resolved: 2016-11-28

Status: Closed
Project: MariaDB Server
Component/s: Parser
Affects Version/s: 5.5, 10.0, 10.1, 10.2
Fix Version/s: 5.5.54, 10.0.29, 10.1.20, 10.2.3

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Alexander Barkov
Resolution: Fixed Votes: 0
Labels: upstream


 Description   

drop table if exists t1;
create table t1 (id int);
create trigger tr AFTER DELETE ON t1 FOR EACH ROW SET @a = 1\;;

5.5 2a2e79b702

mysqld: /data/src/5.5/sql/sql_lex.cc:363: void Lex_input_stream::body_utf8_append(const char*, const char*): Assertion `m_cpp_buf <= ptr && ptr <= m_cpp_buf + m_buf_length' failed.
161029 13:35:30 [ERROR] mysqld got signal 6 ;

#7  0x00007fdef1c2c312 in __GI___assert_fail (assertion=0xd1f6f8 "m_cpp_buf <= ptr && ptr <= m_cpp_buf + m_buf_length", file=0xd1f634 "/data/src/5.5/sql/sql_lex.cc", line=363, function=0xd20000 <Lex_input_stream::body_utf8_append(char const*, char const*)::__PRETTY_FUNCTION__> "void Lex_input_stream::body_utf8_append(const char*, const char*)") at assert.c:101
#8  0x00000000005f2b68 in Lex_input_stream::body_utf8_append (this=0x7fdef3c83650, ptr=0x7fdeec548156 "\245\245\300\035N\001", end_ptr=0x7fdeec548156 "\245\245\300\035N\001") at /data/src/5.5/sql/sql_lex.cc:363
#9  0x00000000005f2c7f in Lex_input_stream::body_utf8_append (this=0x7fdef3c83650, ptr=0x7fdeec548156 "\245\245\300\035N\001") at /data/src/5.5/sql/sql_lex.cc:391
#10 0x00000000008dd130 in sp_head::set_stmt_end (this=0x7fdeec580078, thd=0x7fdeed674060) at /data/src/5.5/sql/sp_head.cc:698
#11 0x000000000077197f in MYSQLparse (thd=0x7fdeed674060) at /data/src/5.5/sql/sql_yacc.yy:14922
#12 0x0000000000610651 in parse_sql (thd=0x7fdeed674060, parser_state=0x7fdef3c83650, creation_ctx=0x0) at /data/src/5.5/sql/sql_parse.cc:7818
#13 0x000000000060c65c in mysql_parse (thd=0x7fdeed674060, rawbuf=0x7fdeec548078 "create trigger tr AFTER DELETE ON t1 FOR EACH ROW SET @a = 1\\", length=61, parser_state=0x7fdef3c83650) at /data/src/5.5/sql/sql_parse.cc:5889
#14 0x00000000006004b7 in dispatch_command (command=COM_QUERY, thd=0x7fdeed674060, packet=0x7fdeee34e061 "create trigger tr AFTER DELETE ON t1 FOR EACH ROW SET @a = 1\\", packet_length=61) at /data/src/5.5/sql/sql_parse.cc:1079
#15 0x00000000005ff671 in do_command (thd=0x7fdeed674060) at /data/src/5.5/sql/sql_parse.cc:793
#16 0x0000000000701879 in do_handle_one_connection (thd_arg=0x7fdeed674060) at /data/src/5.5/sql/sql_connect.cc:1270
#17 0x0000000000701606 in handle_one_connection (arg=0x7fdeed674060) at /data/src/5.5/sql/sql_connect.cc:1186
#18 0x0000000000943ad5 in pfs_spawn_thread (arg=0x7fdeee37a300) at /data/src/5.5/storage/perfschema/pfs.cc:1015
#19 0x00007fdef38c00a4 in start_thread (arg=0x7fdef3c84700) at pthread_create.c:309
#20 0x00007fdef1ce687d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111



 Comments   
Comment by Alexander Barkov [ 2016-11-28 ]

The same crash happens during this query:

PREPARE stmt FROM 'create trigger tr AFTER DELETE ON t1 FOR EACH ROW SET @a = 1\\';

Generated at Thu Feb 08 07:47:51 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.