[MDEV-22267] Assertion `length == Field_timef::pack_length()' failed in Field_timef::sort_string Created: 2020-04-17  Updated: 2020-06-13  Resolved: 2020-06-12

Status: Closed
Project: MariaDB Server
Component/s: Data Manipulation - Update
Affects Version/s: 10.1, 10.2, 10.3, 10.4, 10.5
Fix Version/s: 10.5.4, 10.1.46, 10.2.33, 10.3.24, 10.4.14

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Varun Gupta (Inactive)
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-22715 SIGSEGV in radixsort_for_str_ptr and ... Closed
relates to MDEV-22875 Various SIGSEGV crashes on optimized ... Closed

 Description   

USE test;
SET @@SESSION.max_sort_length=5;
CREATE TABLE t(c TIME(6));
INSERT INTO t VALUES ('00:00:00');
UPDATE t SET c='00:00:00' ORDER BY c;

Leads to:

10.5.3 364e7a9ae6b5fbf69494cec30733b5ad28738cbb

mysqld: /test/10.5_dbg/sql/field.h:3655: virtual void Field_timef::sort_string(uchar*, uint): Assertion `length == Field_timef::pack_length()' failed.

10.5.3 364e7a9ae6b5fbf69494cec30733b5ad28738cbb

Core was generated by `/test/MD110420-mariadb-10.5.3-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
[Current thread is 1 (Thread 0x7fceaa1c4700 (LWP 12197))]
(gdb) bt
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
#1 0x00005648527f821e in my_write_core (sig=sig@entry=6) at /test/10.5_dbg/mysys/stacktrace.c:518
#2 0x0000564851f9e08f in handle_fatal_signal (sig=6) at /test/10.5_dbg/sql/signal_handler.cc:329
#3 <signal handler called>
#4 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#5 0x00007fcea8908801 in __GI_abort () at abort.c:79
#6 0x00007fcea88f839a in __assert_fail_base (fmt=0x7fcea8a7f7d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x564852afda50 "length == Field_timef::pack_length()", file=file@entry=0x564852947529 "/test/10.5_dbg/sql/field.h", line=line@entry=3655, function=function@entry=0x564852af7a40 <Field_timef::sort_string(unsigned char*, unsigned int)::__PRETTY_FUNCTION__> "virtual void Field_timef::sort_string(uchar*, uint)") at assert.c:92
#7 0x00007fcea88f8412 in __GI___assert_fail (assertion=assertion@entry=0x564852afda50 "length == Field_timef::pack_length()", file=file@entry=0x564852947529 "/test/10.5_dbg/sql/field.h", line=line@entry=3655, function=function@entry=0x564852af7a40 <Field_timef::sort_string(unsigned char*, unsigned int)::__PRETTY_FUNCTION__> "virtual void Field_timef::sort_string(uchar*, uint)") at assert.c:101
#8 0x0000564851f90996 in Field_timef::sort_string (this=0x7fce7e44a0c8, to=0x7fce7e573089 '\245' <repeats 200 times>..., length=5) at /test/10.5_dbg/sql/field.h:3655
#9 0x0000564851f7805c in Field::make_sort_key_part (this=this@entry=0x7fce7e44a0c8, buff=<optimized out>, buff@entry=0x7fce7e573088 "\001", '\245' <repeats 199 times>..., length=<optimized out>) at /test/10.5_dbg/sql/field.cc:1035
#10 0x0000564851f98aa9 in make_sortkey (to=0x7fce7e573088 "\001", '\245' <repeats 199 times>..., param=0x7fceaa1c1ee0) at /test/10.5_dbg/sql/filesort.cc:3004
#11 make_sortkey (param=param@entry=0x7fceaa1c1ee0, to=0x7fce7e573088 "\001", '\245' <repeats 199 times>..., ref_pos=ref_pos@entry=0x7fce7e44a1c8 "", using_packed_sortkeys=using_packed_sortkeys@entry=false) at /test/10.5_dbg/sql/filesort.cc:1338
#12 0x0000564851f9c72f in find_all_keys (found_rows=0x7fce7e54a5f0, pq=0x0, tempfile=0x7fceaa1c1f80, buffpek_pointers=0x7fceaa1c20f0, fs_info=0x7fce7e54a400, select=0x0, param=0x7fceaa1c1ee0, thd=0x7fce7e415088) at /test/10.5_dbg/sql/filesort.cc:955
#13 filesort (thd=thd@entry=0x7fce7e415088, table=table@entry=0x7fce7e4f0088, filesort=filesort@entry=0x7fceaa1c2830, tracker=0x7fce7e475190, join=join@entry=0x0, first_table_bit=first_table_bit@entry=0) at /test/10.5_dbg/sql/filesort.cc:356
#14 0x0000564851dea861 in mysql_update (thd=thd@entry=0x7fce7e415088, table_list=<optimized out>, fields=..., values=..., conds=<optimized out>, order_num=<optimized out>, order=0x7fce7e474bf8, limit=18446744073709551615, ignore=false, found_return=0x7fceaa1c2d30, updated_return=0x7fceaa1c2e00) at /test/10.5_dbg/sql/sql_update.cc:774
#15 0x0000564851cf585e in mysql_execute_command (thd=thd@entry=0x7fce7e415088) at /test/10.5_dbg/sql/sql_parse.cc:4363
#16 0x0000564851d019d1 in mysql_parse (thd=thd@entry=0x7fce7e415088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fceaa1c3450, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7953
#17 0x0000564851ced719 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7fce7e415088, packet=packet@entry=0x7fce7e467089 "UPDATE t SET c='00:00:00' ORDER BY c", packet_length=packet_length@entry=36, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1839
#18 0x0000564851cebf6f in do_command (thd=0x7fce7e415088) at /test/10.5_dbg/sql/sql_parse.cc:1358
#19 0x0000564851e46a53 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x7fce808433a8, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1422
#20 0x0000564851e46d82 in handle_one_connection (arg=arg@entry=0x7fce808433a8) at /test/10.5_dbg/sql/sql_connect.cc:1319
#21 0x00005648522a7080 in pfs_spawn_thread (arg=0x7fcea7c45888) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
#22 0x00007fcea95eb6db in start_thread (arg=0x7fceaa1c4700) at pthread_create.c:463
#23 0x00007fcea89e988f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.1.45 (dbg), 10.2.32 (dbg), 10.3.23 (dbg), 10.4.13 (dbg), 10.5.2 (dbg), 10.5.3 (dbg)

Bug confirmed not present in:
MariaDB: 10.1.45 (opt), 10.2.32 (opt), 10.3.23 (opt), 10.4.13 (opt), 10.5.2 (opt), 10.5.3 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)



 Comments   
Comment by Alexander Barkov [ 2020-05-20 ]

The crash is also repeatable with a SELECT..ORDER BY query instead of UPDATE..ORDER BY:

SET @@SESSION.max_sort_length=5;
CREATE OR REPLACE TABLE t1(c TIME(6));
INSERT INTO t1 VALUES ('00:00:00');
SELECT * FROM t1 ORDER BY c;

Comment by Roel Van de Paar [ 2020-05-20 ]

Note to self; latest testcase gives same stacks.

Interestingly, not reproducible on 10.5.4 (dbg)

Comment by Varun Gupta (Inactive) [ 2020-05-28 ]

This will be fixed as a part of MDEV-22715.

Comment by Roel Van de Paar [ 2020-06-13 ]

varun Thank you! So as MDEV-22715 is closed now, can this bug be closed also? I have not retested yet.

Generated at Thu Feb 08 09:13:28 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.