[MDEV-24585] Assertion `je->s.cs == nice_js->charset()' failed in json_nice Created: 2021-01-13  Updated: 2021-11-03  Resolved: 2021-10-19

Status: Closed
Project: MariaDB Server
Component/s: JSON
Affects Version/s: 10.2, 10.3, 10.4, 10.5
Fix Version/s: 10.2.41, 10.3.32, 10.4.22, 10.5.13, 10.6.5

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Alexey Botchkov
Resolution: Fixed Votes: 0
Labels: affects-tests

Issue Links:
Relates
relates to MDEV-26963 Assertion `je->s.cs == nice_js->chars... Confirmed

 Description   

SELECT JSON_REPLACE( JSON_DETAILED('["x"]'), '$.a', 'xx' );

10.2 ab271ee7

mysqld: /data/src/10.2/sql/item_jsonfunc.cc:140: int json_nice(json_engine_t*, String*, Item_func_json_format::formats, int): Assertion `je->s.cs == nice_js->charset()' failed.
210114  1:06:49 [ERROR] mysqld got signal 6 ;
 
#7  0x00007f0f57ff7f36 in __GI___assert_fail (assertion=0x55a8b54c7500 "je->s.cs == nice_js->charset()", file=0x55a8b54c74d8 "/data/src/10.2/sql/item_jsonfunc.cc", line=140, function=0x55a8b54c7488 "int json_nice(json_engine_t*, String*, Item_func_json_format::formats, int)") at assert.c:101
#8  0x000055a8b4d9c773 in json_nice (je=0x7f0f5214fdb0, nice_js=0x7f0f5214ffa0, mode=Item_func_json_format::LOOSE, tab_size=4) at /data/src/10.2/sql/item_jsonfunc.cc:140
#9  0x000055a8b4da72a7 in Item_func_json_insert::val_str (this=0x7f0f40012cf8, str=0x7f0f5214ffa0) at /data/src/10.2/sql/item_jsonfunc.cc:2966
#10 0x000055a8b4becce5 in Item::send (this=0x7f0f40012cf8, protocol=0x7f0f40001348, buffer=0x7f0f5214ffa0) at /data/src/10.2/sql/item.cc:6898
#11 0x000055a8b4862fc5 in Protocol::send_result_set_row (this=0x7f0f40001348, row_items=0x7f0f400051f0) at /data/src/10.2/sql/protocol.cc:992
#12 0x000055a8b48fa270 in select_send::send_data (this=0x7f0f40012f80, items=...) at /data/src/10.2/sql/sql_class.cc:2734
#13 0x000055a8b498be0d in JOIN::exec_inner (this=0x7f0f40012fa0) at /data/src/10.2/sql/sql_select.cc:3517
#14 0x000055a8b498b87a in JOIN::exec (this=0x7f0f40012fa0) at /data/src/10.2/sql/sql_select.cc:3436
#15 0x000055a8b498ca3c in mysql_select (thd=0x7f0f40000d90, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f0f40012f80, unit=0x7f0f40004988, select_lex=0x7f0f400050c8) at /data/src/10.2/sql/sql_select.cc:3836
#16 0x000055a8b4980bb6 in handle_select (thd=0x7f0f40000d90, lex=0x7f0f400048c8, result=0x7f0f40012f80, setup_tables_done_option=0) at /data/src/10.2/sql/sql_select.cc:361
#17 0x000055a8b494b508 in execute_sqlcom_select (thd=0x7f0f40000d90, all_tables=0x0) at /data/src/10.2/sql/sql_parse.cc:6248
#18 0x000055a8b4941eb7 in mysql_execute_command (thd=0x7f0f40000d90) at /data/src/10.2/sql/sql_parse.cc:3559
#19 0x000055a8b494f2b1 in mysql_parse (thd=0x7f0f40000d90, rawbuf=0x7f0f40012840 "SELECT JSON_REPLACE( JSON_DETAILED('[\"x\"]'), '$.a', 'xx' )", length=58, parser_state=0x7f0f521515f0, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7763
#20 0x000055a8b493d58a in dispatch_command (command=COM_QUERY, thd=0x7f0f40000d90, packet=0x7f0f40008b51 "", packet_length=58, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1827
#21 0x000055a8b493c085 in do_command (thd=0x7f0f40000d90) at /data/src/10.2/sql/sql_parse.cc:1381
#22 0x000055a8b4a96704 in do_handle_one_connection (connect=0x55a8b7bed9c0) at /data/src/10.2/sql/sql_connect.cc:1336
#23 0x000055a8b4a96469 in handle_one_connection (arg=0x55a8b7bed9c0) at /data/src/10.2/sql/sql_connect.cc:1241
#24 0x000055a8b52be44a in pfs_spawn_thread (arg=0x55a8b7bd0d80) at /data/src/10.2/storage/perfschema/pfs.cc:1869
#25 0x00007f0f58507609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#26 0x00007f0f580e3293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

SELECT JSON_REPLACE(JSON_ARRAYAGG('x'), '$[1]', '["a"]') AS f;

10.5 8de233af

mariadbd: /data/src/10.5/sql/item_jsonfunc.cc:140: int json_nice(json_engine_t*, String*, Item_func_json_format::formats, int): Assertion `je->s.cs == nice_js->charset()' failed.
210114  0:42:22 [ERROR] mysqld got signal 6 ;
 
#7  0x00007fdc7ca24f36 in __GI___assert_fail (assertion=0x55e87f1792b0 "je->s.cs == nice_js->charset()", file=0x55e87f1792d0 "/data/src/10.5/sql/item_jsonfunc.cc", line=140, function=0x55e87f1792f8 "int json_nice(json_engine_t*, String*, Item_func_json_format::formats, int)") at assert.c:101
#8  0x000055e87e704500 in json_nice (je=0x7fdc7837ce90, nice_js=0x7fdc7837d0e0, mode=Item_func_json_format::LOOSE, tab_size=4) at /data/src/10.5/sql/item_jsonfunc.cc:140
#9  0x000055e87e70fc2f in Item_func_json_insert::val_str (this=0x7fdc5c014d68, str=0x7fdc7837d0e0) at /data/src/10.5/sql/item_jsonfunc.cc:3002
#10 0x000055e87e3c2397 in Type_handler::Item_send_str (this=0x55e87fb2e3e0 <type_handler_medium_blob>, item=0x7fdc5c014d68, protocol=0x7fdc5c001388, buf=0x7fdc7837d0b0) at /data/src/10.5/sql/sql_type.cc:7359
#11 0x000055e87e2f408c in Type_handler_string_result::Item_send (this=0x55e87fb2e3e0 <type_handler_medium_blob>, item=0x7fdc5c014d68, protocol=0x7fdc5c001388, buf=0x7fdc7837d0b0) at /data/src/10.5/sql/sql_type.h:5360
#12 0x000055e87e03be4c in Item::send (this=0x7fdc5c014d68, protocol=0x7fdc5c001388, buffer=0x7fdc7837d0b0) at /data/src/10.5/sql/item.h:1066
#13 0x000055e87e03519b in Protocol::send_result_set_row (this=0x7fdc5c001388, row_items=0x7fdc5c015b70) at /data/src/10.5/sql/protocol.cc:1085
#14 0x000055e87e0f2a2d in select_send::send_data (this=0x7fdc5c015790, items=...) at /data/src/10.5/sql/sql_class.cc:3048
#15 0x000055e87e20e733 in select_result_sink::send_data_with_check (this=0x7fdc5c015790, items=..., u=0x7fdc5c004f58, sent=0) at /data/src/10.5/sql/sql_class.h:5334
#16 0x000055e87e1f4ff9 in end_send_group (join=0x7fdc5c0157b8, join_tab=0x0, end_of_records=true) at /data/src/10.5/sql/sql_select.cc:21965
#17 0x000055e87e1f086b in do_select (join=0x7fdc5c0157b8, procedure=0x0) at /data/src/10.5/sql/sql_select.cc:20115
#18 0x000055e87e1c4602 in JOIN::exec_inner (this=0x7fdc5c0157b8) at /data/src/10.5/sql/sql_select.cc:4462
#19 0x000055e87e1c3723 in JOIN::exec (this=0x7fdc5c0157b8) at /data/src/10.5/sql/sql_select.cc:4242
#20 0x000055e87e1c4de5 in mysql_select (thd=0x7fdc5c000db8, tables=0x0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fdc5c015790, unit=0x7fdc5c004f58, select_lex=0x7fdc5c014168) at /data/src/10.5/sql/sql_select.cc:4658
#21 0x000055e87e1b4a33 in handle_select (thd=0x7fdc5c000db8, lex=0x7fdc5c004e90, result=0x7fdc5c015790, setup_tables_done_option=0) at /data/src/10.5/sql/sql_select.cc:417
#22 0x000055e87e177409 in execute_sqlcom_select (thd=0x7fdc5c000db8, all_tables=0x0) at /data/src/10.5/sql/sql_parse.cc:6281
#23 0x000055e87e16e495 in mysql_execute_command (thd=0x7fdc5c000db8) at /data/src/10.5/sql/sql_parse.cc:3977
#24 0x000055e87e17c2b0 in mysql_parse (thd=0x7fdc5c000db8, rawbuf=0x7fdc5c014090 "SELECT JSON_REPLACE(JSON_ARRAYAGG('x'), '$[1]', '[\"a\"]') AS f", length=61, parser_state=0x7fdc7837e510, is_com_multi=false, is_next_command=false) at /data/src/10.5/sql/sql_parse.cc:8062
#25 0x000055e87e168237 in dispatch_command (command=COM_QUERY, thd=0x7fdc5c000db8, packet=0x7fdc5c0090a9 "", packet_length=61, is_com_multi=false, is_next_command=false) at /data/src/10.5/sql/sql_parse.cc:1889
#26 0x000055e87e166a2b in do_command (thd=0x7fdc5c000db8) at /data/src/10.5/sql/sql_parse.cc:1370
#27 0x000055e87e31478d in do_handle_one_connection (connect=0x55e882a0abd8, put_in_cache=true) at /data/src/10.5/sql/sql_connect.cc:1410
#28 0x000055e87e3144f0 in handle_one_connection (arg=0x55e88297ddd8) at /data/src/10.5/sql/sql_connect.cc:1312
#29 0x000055e87e87345d in pfs_spawn_thread (arg=0x55e882a0c238) at /data/src/10.5/storage/perfschema/pfs.cc:2201
#30 0x00007fdc7cf3c609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#31 0x00007fdc7cb10293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

The first one is reproducible on 10.2+.
The second one is only applicable to 10.5+ due to the use of JSON_ARRAYAGG.
No obvious problem on non-debug builds.

In addition to JSON_REPLACE, at least JSON_SET and JSON_INSERT are also affected.


Generated at Thu Feb 08 09:31:06 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.