[MDEV-22390] Assertion `m_next_rec_ptr >= m_rawmem' failed in Filesort_buffer::spaceleft | SIGSEGV in __memmove_avx_unaligned_erms from my_b_write Created: 2020-04-28  Updated: 2020-07-27  Resolved: 2020-07-06

Status: Closed
Project: MariaDB Server
Component/s: Variables
Affects Version/s: 10.1, 10.2, 10.3, 10.4, 10.5
Fix Version/s: 10.1.46, 10.2.33, 10.3.24, 10.4.14, 10.5.5

Type: Bug Priority: Critical
Reporter: Roel Van de Paar Assignee: Varun Gupta (Inactive)
Resolution: Fixed Votes: 0
Labels: None


 Description   

SET @@SESSION.tmp_table_size=1048576;
SET @@SESSION.max_sort_length=5;
SET @@SESSION.sort_buffer_size=1024;
SET @@SESSION.max_length_for_sort_data=66556;
SELECT * FROM information_schema.session_variables ORDER BY variable_name;

Leads to:

10.5.3 98003440c2f8d20164a191ced1b7d92b283bb68f

mysqld: /test/10.5_dbg/sql/filesort_utils.h:139: size_t Filesort_buffer::spaceleft() const: Assertion `m_next_rec_ptr >= m_rawmem' failed.

10.5.3 98003440c2f8d20164a191ced1b7d92b283bb68f

Core was generated by `/test/MD210420-mariadb-10.5.3-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
[Current thread is 1 (Thread 0x7fea995b2700 (LWP 768694))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
#1  0x0000561f1603e03d in my_write_core (sig=sig@entry=6) at /test/10.5_dbg/mysys/stacktrace.c:518
#2  0x0000561f157e3d7b in handle_fatal_signal (sig=6) at /test/10.5_dbg/sql/signal_handler.cc:329
#3  <signal handler called>
#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#5  0x00007fea97cf6801 in __GI_abort () at abort.c:79
#6  0x00007fea97ce639a in __assert_fail_base (fmt=0x7fea97e6d7d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x561f163447a6 "m_next_rec_ptr >= m_rawmem", file=file@entry=0x561f16344d48 "/test/10.5_dbg/sql/filesort_utils.h", line=line@entry=139, function=function@entry=0x561f163457c0 <Filesort_buffer::spaceleft() const::__PRETTY_FUNCTION__> "size_t Filesort_buffer::spaceleft() const") at assert.c:92
#7  0x00007fea97ce6412 in __GI___assert_fail (assertion=assertion@entry=0x561f163447a6 "m_next_rec_ptr >= m_rawmem", file=file@entry=0x561f16344d48 "/test/10.5_dbg/sql/filesort_utils.h", line=line@entry=139, function=function@entry=0x561f163457c0 <Filesort_buffer::spaceleft() const::__PRETTY_FUNCTION__> "size_t Filesort_buffer::spaceleft() const") at assert.c:101
#8  0x0000561f157e24c8 in Filesort_buffer::spaceleft (this=0x7fea6c1a1200) at /test/10.5_dbg/sql/filesort_utils.h:139
#9  Filesort_buffer::isfull (this=0x7fea6c1a1200) at /test/10.5_dbg/sql/filesort_utils.h:153
#10 SORT_INFO::isfull (this=0x7fea6c1a1200) at /test/10.5_dbg/sql/filesort.h:166
#11 find_all_keys (found_rows=0x7fea6c1a13f0, pq=0x0, tempfile=0x7fea995afc80, buffpek_pointers=0x7fea995afdf0, fs_info=0x7fea6c1a1200, select=0x7fea6c077a58, param=0x7fea995afbe0, thd=0x7fea6c015088) at /test/10.5_dbg/sql/filesort.cc:943
#12 filesort (thd=thd@entry=0x7fea6c015088, table=table@entry=0x7fea6c0800a0, filesort=filesort@entry=0x7fea6c077c28, tracker=0x7fea6c078318, join=join@entry=0x7fea6c075b38, first_table_bit=<optimized out>) at /test/10.5_dbg/sql/filesort.cc:356
#13 0x0000561f1558f009 in create_sort_index (thd=0x7fea6c015088, join=0x7fea6c075b38, tab=tab@entry=0x7fea6c077118, fsort=0x7fea6c077c28, fsort@entry=0x0) at /test/10.5_dbg/sql/sql_select.cc:23861
#14 0x0000561f1558f338 in st_join_table::sort_table (this=this@entry=0x7fea6c077118) at /test/10.5_dbg/sql/sql_select.cc:21590
#15 0x0000561f1558f46c in join_init_read_record (tab=0x7fea6c077118) at /test/10.5_dbg/sql/sql_select.cc:21529
#16 0x0000561f1557fd97 in sub_select (join=0x7fea6c075b38, join_tab=0x7fea6c077118, end_of_records=<optimized out>) at /test/10.5_dbg/sql/sql_select.cc:20603
#17 0x0000561f155b7b28 in do_select (procedure=0x0, join=0x7fea6c075b38) at /test/10.5_dbg/sql/sql_select.cc:20140
#18 JOIN::exec_inner (this=this@entry=0x7fea6c075b38) at /test/10.5_dbg/sql/sql_select.cc:4464
#19 0x0000561f155b8143 in JOIN::exec (this=this@entry=0x7fea6c075b38) at /test/10.5_dbg/sql/sql_select.cc:4245
#20 0x0000561f155b6458 in mysql_select (thd=thd@entry=0x7fea6c015088, tables=<optimized out>, fields=..., conds=0x0, og_num=1, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=2684619520, result=0x7fea6c075b10, unit=0x7fea6c019098, select_lex=0x7fea6c074198) at /test/10.5_dbg/sql/sql_select.cc:4669
#21 0x0000561f155b6787 in handle_select (thd=thd@entry=0x7fea6c015088, lex=lex@entry=0x7fea6c018fd0, result=result@entry=0x7fea6c075b10, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.5_dbg/sql/sql_select.cc:417
#22 0x0000561f15540ef4 in execute_sqlcom_select (thd=thd@entry=0x7fea6c015088, all_tables=0x7fea6c0747c8) at /test/10.5_dbg/sql/sql_parse.cc:6172
#23 0x0000561f15539919 in mysql_execute_command (thd=thd@entry=0x7fea6c015088) at /test/10.5_dbg/sql/sql_parse.cc:3901
#24 0x0000561f15546f2b in mysql_parse (thd=thd@entry=0x7fea6c015088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fea995b1450, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7957
#25 0x0000561f15532c45 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7fea6c015088, packet=packet@entry=0x7fea6c067089 "", packet_length=packet_length@entry=73, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1839
#26 0x0000561f1553149b in do_command (thd=0x7fea6c015088) at /test/10.5_dbg/sql/sql_parse.cc:1358
#27 0x0000561f1568c415 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x7fea777c53a8, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1422
#28 0x0000561f1568c744 in handle_one_connection (arg=arg@entry=0x7fea777c53a8) at /test/10.5_dbg/sql/sql_connect.cc:1319
#29 0x0000561f15aecfb0 in pfs_spawn_thread (arg=0x7fea97045b08) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
#30 0x00007fea989d96db in start_thread (arg=0x7fea995b2700) at pthread_create.c:463
#31 0x00007fea97dd788f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.1.45 (dbg), 10.2.32 (dbg), 10.2.32 (opt), 10.3.23 (dbg), 10.4.13 (dbg), 10.5.2 (dbg), 10.5.3 (dbg)

Bug confirmed not present in:
MariaDB: 10.1.45 (opt), 10.3.23 (opt), 10.4.13 (opt), 10.5.2 (opt), 10.5.3 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)



 Comments   
Comment by Roel Van de Paar [ 2020-06-18 ]

Testcase below crashes 10.1-10.4 optimized and debug builds and 10.5.4 debug. I suspect this issue affects all (i.e. inc 10.5.4) optimized builds.

USE test;
SET SQL_MODE='';
CREATE TABLE t (c1 TIME PRIMARY KEY,c2 TIMESTAMP(3),c3 VARCHAR(1025) CHARACTER SET 'utf8' COLLATE 'utf8_bin') ;
INSERT INTO t VALUES (SYSDATE(2),'',GET_FORMAT(DATETIME,'ISO'));
SET SESSION max_length_for_sort_data=8388608;
SET SESSION sort_buffer_size=16;
SELECT * FROM t WHERE c1 BETWEEN '00:00:00' AND '23:59:59' ORDER BY c1,c2;

Leads to:

10.5.4 4080e3acefd7e58d88c2f3539fb6a0fb359cf057

mysqld: /test/10.5_dbg/sql/filesort_utils.h:139: size_t Filesort_buffer::spaceleft() const: Assertion `m_next_rec_ptr >= m_rawmem' failed.

10.5.4 4080e3acefd7e58d88c2f3539fb6a0fb359cf057

Core was generated by `/test/MD150620-mariadb-10.5.4-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
[Current thread is 1 (Thread 0x14fbe445c700 (LWP 2707316))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
#1  0x00005625db3974c6 in my_write_core (sig=sig@entry=6) at /test/10.5_dbg/mysys/stacktrace.c:518
#2  0x00005625dab39d60 in handle_fatal_signal (sig=6) at /test/10.5_dbg/sql/signal_handler.cc:330
#3  <signal handler called>
#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#5  0x000014fbe50cf801 in __GI_abort () at abort.c:79
#6  0x000014fbe50bf39a in __assert_fail_base (fmt=0x14fbe52467d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5625db6a65a2 "m_next_rec_ptr >= m_rawmem", file=file@entry=0x5625db6a6b40 "/test/10.5_dbg/sql/filesort_utils.h", line=line@entry=139, function=function@entry=0x5625db6a7560 <Filesort_buffer::spaceleft() const::__PRETTY_FUNCTION__> "size_t Filesort_buffer::spaceleft() const") at assert.c:92
#7  0x000014fbe50bf412 in __GI___assert_fail (assertion=assertion@entry=0x5625db6a65a2 "m_next_rec_ptr >= m_rawmem", file=file@entry=0x5625db6a6b40 "/test/10.5_dbg/sql/filesort_utils.h", line=line@entry=139, function=function@entry=0x5625db6a7560 <Filesort_buffer::spaceleft() const::__PRETTY_FUNCTION__> "size_t Filesort_buffer::spaceleft() const") at assert.c:101
#8  0x00005625dab37ee9 in Filesort_buffer::spaceleft (this=0x14fbc396f600) at /test/10.5_dbg/sql/filesort_utils.h:139
#9  Filesort_buffer::isfull (this=0x14fbc396f600) at /test/10.5_dbg/sql/filesort_utils.h:153
#10 SORT_INFO::isfull (this=0x14fbc396f600) at /test/10.5_dbg/sql/filesort.h:166
#11 find_all_keys (found_rows=0x14fbc396f7f0, pq=0x0, tempfile=0x14fbe4459bf0, buffpek_pointers=0x14fbe4459d60, fs_info=0x14fbc396f600, select=0x14fbc3878b38, param=0x14fbe4459b40, thd=0x14fbc3815088) at /test/10.5_dbg/sql/filesort.cc:937
#12 filesort (thd=thd@entry=0x14fbc3815088, table=table@entry=0x14fbc38c3088, filesort=filesort@entry=0x14fbc3878d08, tracker=0x14fbc38793f8, join=join@entry=0x14fbc3875f20, first_table_bit=<optimized out>) at /test/10.5_dbg/sql/filesort.cc:351
#13 0x00005625da8e4f40 in create_sort_index (thd=0x14fbc3815088, join=0x14fbc3875f20, tab=tab@entry=0x14fbc38781f8, fsort=0x14fbc3878d08, fsort@entry=0x0) at /test/10.5_dbg/sql/sql_select.cc:23834
#14 0x00005625da8e526e in st_join_table::sort_table (this=this@entry=0x14fbc38781f8) at /test/10.5_dbg/sql/sql_select.cc:21584
#15 0x00005625da8e53a2 in join_init_read_record (tab=0x14fbc38781f8) at /test/10.5_dbg/sql/sql_select.cc:21523
#16 0x00005625da8d4cbf in sub_select (join=0x14fbc3875f20, join_tab=0x14fbc38781f8, end_of_records=<optimized out>) at /test/10.5_dbg/sql/sql_select.cc:20597
#17 0x00005625da90dc6e in do_select (procedure=0x0, join=0x14fbc3875f20) at /test/10.5_dbg/sql/sql_select.cc:20134
#18 JOIN::exec_inner (this=this@entry=0x14fbc3875f20) at /test/10.5_dbg/sql/sql_select.cc:4444
#19 0x00005625da90e289 in JOIN::exec (this=this@entry=0x14fbc3875f20) at /test/10.5_dbg/sql/sql_select.cc:4225
#20 0x00005625da90c59e in mysql_select (thd=thd@entry=0x14fbc3815088, tables=<optimized out>, fields=@0x14fbc38742e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14fbc3874748, last = 0x14fbc38768c0, elements = 3}, <No data fields>}, conds=0x14fbc3875120, og_num=2, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x14fbc3875ef8, unit=0x14fbc38190a0, select_lex=0x14fbc3874198) at /test/10.5_dbg/sql/sql_select.cc:4649
#21 0x00005625da90c8cd in handle_select (thd=thd@entry=0x14fbc3815088, lex=lex@entry=0x14fbc3818fd8, result=result@entry=0x14fbc3875ef8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.5_dbg/sql/sql_select.cc:417
#22 0x00005625da8961ed in execute_sqlcom_select (thd=thd@entry=0x14fbc3815088, all_tables=0x14fbc3874790) at /test/10.5_dbg/sql/sql_parse.cc:6209
#23 0x00005625da88f312 in mysql_execute_command (thd=thd@entry=0x14fbc3815088) at /test/10.5_dbg/sql/sql_parse.cc:3939
#24 0x00005625da89c15c in mysql_parse (thd=thd@entry=0x14fbc3815088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14fbe445b350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7993
#25 0x00005625da888c60 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14fbc3815088, packet=packet@entry=0x14fbc3867089 "", packet_length=packet_length@entry=73, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1874
#26 0x00005625da88743a in do_command (thd=0x14fbc3815088) at /test/10.5_dbg/sql/sql_parse.cc:1355
#27 0x00005625da9e2c47 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x14fbc657a808, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1411
#28 0x00005625da9e3363 in handle_one_connection (arg=arg@entry=0x14fbc657a808) at /test/10.5_dbg/sql/sql_connect.cc:1313
#29 0x00005625dae44902 in pfs_spawn_thread (arg=0x14fbe3c46c88) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
#30 0x000014fbe5db26db in start_thread (arg=0x14fbe445c700) at pthread_create.c:463
#31 0x000014fbe51b088f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.1.46 (dbg), 10.1.46 (opt), 10.2.33 (dbg), 10.2.33 (opt), 10.3.24 (dbg), 10.3.24 (opt), 10.4.14 (dbg), 10.4.14 (opt), 10.5.4 (dbg)

Bug confirmed not present in:
MariaDB: 10.5.4 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)

Stacks from 10.4.14 (opt):

10.4.14 ea7830eef48333e28f98a9b91f05a95735b465a3 (opt)

Core was generated by `/test/MD260520-mariadb-10.4.14-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
[Current thread is 1 (Thread 0x14b37fd05700 (LWP 2794543))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
#1  0x00005602b4f4ba77 in my_write_core (sig=sig@entry=11) at /test/10.4_opt/mysys/stacktrace.c:481
#2  0x00005602b4923b0a in handle_fatal_signal (sig=11) at /test/10.4_opt/sql/signal_handler.cc:343
#3  <signal handler called>
#4  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:423
#5  0x00005602b491fc86 in memcpy (__len=3098, __src=<optimized out>, __dest=<optimized out>)
    at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
#6  my_b_write (Count=3098, Buffer=<optimized out>, info=0x14b37fd01d80)
    at /test/10.4_opt/include/my_sys.h:539
#7  write_keys (param=param@entry=0x14b37fd01cf0, fs_info=fs_info@entry=0x14b358cc7480, 
    count=<optimized out>, count@entry=1, buffpek_pointers=buffpek_pointers@entry=0x14b37fd01e70, 
    tempfile=tempfile@entry=0x14b37fd01d80) at /test/10.4_opt/sql/filesort.cc:926
#8  0x00005602b4922d31 in find_all_keys (found_rows=0x14b358cc75e0, pq=0x0, tempfile=0x14b37fd01d80, 
    buffpek_pointers=0x14b37fd01e70, fs_info=0x14b358cc7480, select=0x14b358c43800, 
    param=0x14b37fd01cf0, thd=0x14b358c12008) at /test/10.4_opt/sql/filesort.cc:863
#9  filesort (thd=thd@entry=0x14b358c12008, table=table@entry=0x14b358c60c08, 
    filesort=filesort@entry=0x14b358c43950, tracker=0x14b358c44008, join=join@entry=0x14b358c40da0, 
    first_table_bit=<optimized out>) at /test/10.4_opt/sql/filesort.cc:262
#10 0x00005602b475da05 in create_sort_index (thd=0x14b358c12008, join=0x14b358c40da0, 
    tab=tab@entry=0x14b358c42f40, fsort=0x14b358c43950, fsort@entry=0x0)
    at /test/10.4_opt/sql/sql_select.cc:23603
#11 0x00005602b475dcb6 in st_join_table::sort_table (this=this@entry=0x14b358c42f40)
    at /test/10.4_opt/sql/sql_select.cc:21347
#12 0x00005602b475dd4a in join_init_read_record (tab=0x14b358c42f40)
    at /test/10.4_opt/sql/sql_select.cc:21286
#13 0x00005602b474fdd3 in sub_select (join=0x14b358c40da0, join_tab=0x14b358c42f40, 
    end_of_records=false) at /test/10.4_opt/sql/sql_select.cc:20363
#14 0x00005602b477112e in do_select (procedure=<optimized out>, join=0x14b358c40da0)
    at /test/10.4_opt/sql/sql_select.cc:19904
#15 JOIN::exec_inner (this=this@entry=0x14b358c40da0) at /test/10.4_opt/sql/sql_select.cc:4459
#16 0x00005602b4771503 in JOIN::exec (this=this@entry=0x14b358c40da0)
    at /test/10.4_opt/sql/sql_select.cc:4241
#17 0x00005602b476f8e1 in mysql_select (thd=thd@entry=0x14b358c12008, tables=0x14b358c3f6d8, 
    wild_num=1, fields=..., conds=<optimized out>, og_num=2, order=0x14b358c40ab0, group=0x0, having=
    0x0, proc_param=0x0, select_options=2147748608, result=0x14b358c40d78, unit=0x14b358c15d70, 
    select_lex=0x14b358c3f118) at /test/10.4_opt/sql/sql_select.cc:4673
#18 0x00005602b4770291 in handle_select (thd=thd@entry=0x14b358c12008, lex=lex@entry=0x14b358c15cb0, 
    result=result@entry=0x14b358c40d78, setup_tables_done_option=setup_tables_done_option@entry=0)
    at /test/10.4_opt/sql/sql_select.cc:410
#19 0x00005602b470d061 in execute_sqlcom_select (thd=thd@entry=0x14b358c12008, 
    all_tables=0x14b358c3f6d8) at /test/10.4_opt/sql/sql_parse.cc:6359
#20 0x00005602b4715377 in mysql_execute_command (thd=thd@entry=0x14b358c12008)
    at /test/10.4_opt/sql/sql_parse.cc:3898
#21 0x00005602b471c36a in mysql_parse (thd=0x14b358c12008, rawbuf=<optimized out>, length=73, 
    parser_state=0x14b37fd04550, is_com_multi=<optimized out>, is_next_command=<optimized out>)
    at /test/10.4_opt/sql/sql_parse.cc:7900
#22 0x00005602b471eab5 in dispatch_command (command=command@entry=COM_QUERY, 
    thd=thd@entry=0x14b358c12008, packet=packet@entry=0x14b358c32009 "", 
    packet_length=packet_length@entry=73, is_com_multi=is_com_multi@entry=false, 
    is_next_command=is_next_command@entry=false) at /test/10.4_opt/sql/sql_parse.cc:1841
#23 0x00005602b471ff64 in do_command (thd=0x14b358c12008) at /test/10.4_opt/sql/sql_parse.cc:1359
#24 0x00005602b47fc64e in do_handle_one_connection (connect=connect@entry=0x14b37d431748)
    at /test/10.4_opt/sql/sql_connect.cc:1412
#25 0x00005602b47fc70d in handle_one_connection (arg=0x14b37d431748)
    at /test/10.4_opt/sql/sql_connect.cc:1316
#26 0x000014b37eeab6db in start_thread (arg=0x14b37fd05700) at pthread_create.c:463
#27 0x000014b37e2a988f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment by Roel Van de Paar [ 2020-06-18 ]

Unique ID's

m_next_rec_ptr >= m_rawmem|SIGABRT|Filesort_buffer::spaceleft|Filesort_buffer::isfull|SORT_INFO::isfull|find_all_keys ## DBG |MDEV-22390
SIGSEGV|my_b_write|write_keys|find_all_keys|filesort  ## OPT |MDEV-22390

Comment by Varun Gupta (Inactive) [ 2020-06-19 ]

A test case not involving information_schema tables

DATA SET and configuration

SET max_sort_length=8;
SET sort_buffer_size=1024;
SET max_length_for_sort_data=7000;
CREATE TABLE t1(a VARCHAR(64), b VARCHAR(2048))DEFAULT CHARSET=utf8;
INSERT INTO t1 SELECT seq,seq from seq_1_to_100;

Query that fails:

SELECT * FROM t1 ORDER BY a LIMIT 5;

Comment by Varun Gupta (Inactive) [ 2020-06-19 ]

Patch
https://github.com/MariaDB/server/commit/37c1bb545647e82fef243bccbf409bbee2473c08

Comment by Roel Van de Paar [ 2020-06-19 ]

Thank you Varun!

Comment by Sergei Petrunia [ 2020-07-02 ]

Ok to push.

Comment by Elena Stepanova [ 2020-07-27 ]

Other representations of the bug fixed by the same patch (to make them searchable in JIRA)

10.1 3efdac206

mysqld: /data/src/10.1-bug/sql/sql_array.h:64: Element_type& Bounds_checked_array<Element_type>::operator[](size_t) [with Element_type = unsigned char*; size_t = long unsigned int]: Assertion `n < m_size' failed.
200728  1:35:49 [ERROR] mysqld got signal 6 ;
 
#7  0x00007f854ac72f12 in __GI___assert_fail (assertion=0x55af268119ab "n < m_size", file=0x55af26811988 "/data/src/10.1-bug/sql/sql_array.h", line=64, function=0x55af26811ce0 <Bounds_checked_array<unsigned char*>::operator[](unsigned long)::__PRETTY_FUNCTION__> "Element_type& Bounds_checked_array<Element_type>::operator[](size_t) [with Element_type = unsigned char*; size_t = long unsigned int]") at assert.c:101
#8  0x000055af26009011 in Bounds_checked_array<unsigned char*>::operator[] (this=0x7f854c89ce80, n=0) at /data/src/10.1-bug/sql/sql_array.h:64
#9  0x000055af26008d47 in Filesort_buffer::get_record_buffer (this=0x7f854c89ce80, idx=0) at /data/src/10.1-bug/sql/filesort_utils.h:73
#10 0x000055af26008e9a in Filesort_info::get_record_buffer (this=0x7f854c89ce80, idx=0) at /data/src/10.1-bug/sql/table.h:349
#11 0x000055af260057b1 in find_all_keys (thd=0x7f8543fce070, param=0x7f854c89cef0, select=0x7f85420f7590, fs_info=0x7f854c89ce80, buffpek_pointers=0x7f854c89d0f0, tempfile=0x7f854c89cf70, pq=0x0, found_rows=0x7f854c89d2f8) at /data/src/10.1-bug/sql/filesort.cc:841
#12 0x000055af26003e62 in filesort (thd=0x7f8543fce070, table=0x7f854207dc70, sortorder=0x7f85420f8250, s_length=1, select=0x7f85420f7590, max_rows=18446744073709551615, sort_positions=false, examined_rows=0x7f854c89d2f0, found_rows=0x7f854c89d2f8, tracker=0x7f85420f8290) at /data/src/10.1-bug/sql/filesort.cc:296
#13 0x000055af25e3deb0 in create_sort_index (thd=0x7f8543fce070, join=0x7f85421c59b8, order=0x7f85421c19d8, filesort_limit=18446744073709551615, select_limit=18446744073709551615, is_order_by=true) at /data/src/10.1-bug/sql/sql_select.cc:21825
#14 0x000055af25e0f634 in JOIN::exec_inner (this=0x7f85421c59b8) at /data/src/10.1-bug/sql/sql_select.cc:3242
#15 0x000055af25e0cb77 in JOIN::exec (this=0x7f85421c59b8) at /data/src/10.1-bug/sql/sql_select.cc:2564
#16 0x000055af25e1006d in mysql_select (thd=0x7f8543fce070, rref_pointer_array=0x7f8543fd2568, tables=0x7f85421c12c0, wild_num=0, fields=..., conds=0x0, og_num=1, order=0x7f85421c19d8, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f85421c5998, unit=0x7f8543fd1bb8, select_lex=0x7f8543fd22c0) at /data/src/10.1-bug/sql/sql_select.cc:3501
#17 0x000055af25e057dc in handle_select (thd=0x7f8543fce070, lex=0x7f8543fd1af8, result=0x7f85421c5998, setup_tables_done_option=0) at /data/src/10.1-bug/sql/sql_select.cc:377
#18 0x000055af25dd5299 in execute_sqlcom_select (thd=0x7f8543fce070, all_tables=0x7f85421c12c0) at /data/src/10.1-bug/sql/sql_parse.cc:5682
#19 0x000055af25dcbf65 in mysql_execute_command (thd=0x7f8543fce070) at /data/src/10.1-bug/sql/sql_parse.cc:3029
#20 0x000055af25dd8da6 in mysql_parse (thd=0x7f8543fce070, rawbuf=0x7f85421c1088 "SELECT pk FROM view_DD_InnoDB ORDER BY col_time_nokey", length=53, parser_state=0x7f854c89e5f0) at /data/src/10.1-bug/sql/sql_parse.cc:7200
#21 0x000055af25dc7f7d in dispatch_command (command=COM_QUERY, thd=0x7f8543fce070, packet=0x7f8545fee071 "SELECT pk FROM view_DD_InnoDB ORDER BY col_time_nokey", packet_length=53) at /data/src/10.1-bug/sql/sql_parse.cc:1491
#22 0x000055af25dc6e62 in do_command (thd=0x7f8543fce070) at /data/src/10.1-bug/sql/sql_parse.cc:1123
#23 0x000055af25f04d01 in do_handle_one_connection (thd_arg=0x7f8543fce070) at /data/src/10.1-bug/sql/sql_connect.cc:1331
#24 0x000055af25f04a32 in handle_one_connection (arg=0x7f8543fce070) at /data/src/10.1-bug/sql/sql_connect.cc:1242
#25 0x000055af26322e90 in pfs_spawn_thread (arg=0x7f854a439c70) at /data/src/10.1-bug/storage/perfschema/pfs.cc:1868
#26 0x00007f854c5214a4 in start_thread (arg=0x7f854c89f700) at pthread_create.c:456
#27 0x00007f854ad2fd0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

10.1 3efdac206

#3  <signal handler called>
#4  0x0000564ebdba6a19 in ptr_compare_1 (compare_length=0x7fa8ec111388, a=0x7fa8e1a8e0c8, b=<optimized out>) at /data/src/10.1-bug/mysys/ptr_cmp.c:139
#5  0x0000564ebdb9af85 in my_qsort2 (base_ptr=base_ptr@entry=0x7fa8e1a8e008, count=count@entry=100, size=size@entry=8, cmp=0x564ebdba6a10 <ptr_compare_1>, cmp_argument=cmp_argument@entry=0x7fa8ec111388) at /data/src/10.1-bug/mysys/mf_qsort.c:144
#6  0x0000564ebd8b5eca in Filesort_buffer::sort_buffer (this=this@entry=0x7fa8ec111030, param=param@entry=0x7fa8ec1115e0, count=count@entry=100) at /data/src/10.1-bug/sql/filesort_utils.cc:142
#7  0x0000564ebd78be9e in Filesort_info::sort_buffer (count=100, param=0x7fa8ec1115e0, this=0x7fa8ec111030) at /data/src/10.1-bug/sql/table.h:343
#8  write_keys (param=param@entry=0x7fa8ec1115e0, fs_info=fs_info@entry=0x7fa8ec111570, count=count@entry=100, buffpek_pointers=buffpek_pointers@entry=0x7fa8ec111770, tempfile=tempfile@entry=0x7fa8ec111670) at /data/src/10.1-bug/sql/filesort.cc:920
#9  0x0000564ebd78f2bf in find_all_keys (found_rows=0x7fa8ec111908, pq=0x0, tempfile=0x7fa8ec111670, buffpek_pointers=0x7fa8ec111770, fs_info=0x7fa8ec111570, select=<optimized out>, param=0x7fa8ec1115e0, thd=0xffffffffeb00594d) at /data/src/10.1-bug/sql/filesort.cc:876
#10 filesort (thd=thd@entry=0x7fa8e576d008, table=table@entry=0x7fa8e18d9808, sortorder=<optimized out>, s_length=<optimized out>, select=select@entry=0x7fa8e19574a8, max_rows=max_rows@entry=18446744073709551615, sort_positions=false, examined_rows=0x7fa8ec111900, found_rows=0x7fa8ec111908, tracker=0x7fa8e1958120) at /data/src/10.1-bug/sql/filesort.cc:296
#11 0x0000564ebd667e14 in create_sort_index (thd=0x7fa8e576d008, join=join@entry=0x7fa8e1907950, order=<optimized out>, filesort_limit=18446744073709551615, select_limit=<optimized out>, is_order_by=<optimized out>) at /data/src/10.1-bug/sql/sql_select.cc:21825
#12 0x0000564ebd66fc1f in JOIN::exec_inner (this=this@entry=0x7fa8e1907950) at /data/src/10.1-bug/sql/sql_select.cc:3242
#13 0x0000564ebd671954 in JOIN::exec (this=this@entry=0x7fa8e1907950) at /data/src/10.1-bug/sql/sql_select.cc:2564
#14 0x0000564ebd66e377 in mysql_select (thd=thd@entry=0x7fa8e576d008, rref_pointer_array=rref_pointer_array@entry=0x7fa8e5771340, tables=0x7fa8e1903258, wild_num=<optimized out>, fields=..., conds=<optimized out>, og_num=1, order=0x7fa8e1903970, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fa8e1907930, unit=0x7fa8e5770990, select_lex=0x7fa8e5771098) at /data/src/10.1-bug/sql/sql_select.cc:3501
#15 0x0000564ebd66edae in handle_select (thd=thd@entry=0x7fa8e576d008, lex=lex@entry=0x7fa8e57708d0, result=result@entry=0x7fa8e1907930, setup_tables_done_option=setup_tables_done_option@entry=0) at /data/src/10.1-bug/sql/sql_select.cc:377
#16 0x0000564ebd568a47 in execute_sqlcom_select (thd=thd@entry=0x7fa8e576d008, all_tables=0x7fa8e1903258) at /data/src/10.1-bug/sql/sql_parse.cc:5682
#17 0x0000564ebd620ac9 in mysql_execute_command (thd=thd@entry=0x7fa8e576d008) at /data/src/10.1-bug/sql/sql_parse.cc:3029
#18 0x0000564ebd622b3a in mysql_parse (thd=thd@entry=0x7fa8e576d008, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fa8ec113600) at /data/src/10.1-bug/sql/sql_parse.cc:7200
#19 0x0000564ebd62592a in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7fa8e576d008, packet=packet@entry=0x7fa8e3710009 "SELECT pk FROM view_DD_InnoDB ORDER BY col_time_nokey", packet_length=packet_length@entry=53) at /data/src/10.1-bug/sql/sql_parse.cc:1491
#20 0x0000564ebd62679e in do_command (thd=0x7fa8e576d008) at /data/src/10.1-bug/sql/sql_parse.cc:1123
#21 0x0000564ebd6e6d94 in do_handle_one_connection (thd_arg=thd_arg@entry=0x7fa8e576d008) at /data/src/10.1-bug/sql/sql_connect.cc:1331
#22 0x0000564ebd6e6ee7 in handle_one_connection (arg=arg@entry=0x7fa8e576d008) at /data/src/10.1-bug/sql/sql_connect.cc:1242
#23 0x0000564ebd99f3c4 in pfs_spawn_thread (arg=0x7fa8e9c3ea08) at /data/src/10.1-bug/storage/perfschema/pfs.cc:1868
#24 0x00007fa8ebd964a4 in start_thread (arg=0x7fa8ec114700) at pthread_create.c:456
#25 0x00007fa8ea5a4d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

Generated at Thu Feb 08 09:14:23 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.