[MDEV-24618] Assertion failure when TVC uses a row in the context expecting a scalar value Created: 2021-01-18  Updated: 2021-01-27  Resolved: 2021-01-27

Status: Closed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.3, 10.4, 10.5
Fix Version/s: 10.3.28, 10.4.18, 10.5.9

Type: Bug Priority: Major
Reporter: Alice Sherepa Assignee: Igor Babaev
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-22786 Crashes with nested table value const... Closed
relates to MDEV-24675 Server crash when table value constru... Closed

 Description   

select * from (values ((1,2)))dt;

10.3 f130adbf35b5b8ef7ed09

Version: '10.3.28-MariaDB-debug-log'  
mysqld: /10.3/sql/sql_type.h:1592: virtual bool Type_handler_row::Item_hybrid_func_fix_attributes(THD*, const char*, Type_handler_hybrid_field_type*, Type_all_attributes*, Item**, uint) const: Assertion `0' failed.
210118 17:22:18 [ERROR] mysqld got signal 6 ;
 
Server version: 10.3.28-MariaDB-debug-log
 
linux/raise.c:51(__GI_raise)[0x7ff1384ad7bb]
stdlib/abort.c:81(__GI_abort)[0x7ff138498535]
intl/loadmsgcat.c:1177(_nl_load_domain)[0x7ff13849840f]
/lib/x86_64-linux-gnu/libc.so.6(+0x30102)[0x7ff1384a6102]
sql/sql_type.h:1593(Type_handler_row::Item_hybrid_func_fix_attributes(THD*, char const*, Type_handler_hybrid_field_type*, Type_all_attributes*, Item**, unsigned int) const)[0x565088ca52c1]
sql/sql_class.h:6774(Type_holder::aggregate_attributes(THD*))[0x565088a1aca4]
sql/sql_tvc.cc:191(get_type_attributes_for_tvc(THD*, List_iterator_fast<List<Item> >&, Type_holder*, unsigned int, unsigned int))[0x565088cdb159]
sql/sql_tvc.cc:242(table_value_constr::prepare(THD*, st_select_lex*, select_result*, st_select_lex_unit*))[0x565088cdb72d]
sql/sql_union.cc:1029(st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long))[0x565088a0d2af]
sql/sql_derived.cc:771(mysql_derived_prepare(THD*, LEX*, TABLE_LIST*))[0x56508869862b]
sql/sql_derived.cc:199(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x565088694e35]
sql/table.cc:8362(TABLE_LIST::handle_derived(LEX*, unsigned int))[0x565088a938b7]
sql/sql_lex.h:4004(LEX::handle_list_of_derived(TABLE_LIST*, unsigned int))[0x5650886dc9a2]
sql/sql_lex.cc:4164(st_select_lex::handle_derived(LEX*, unsigned int))[0x5650886fe8b9]
sql/sql_select.cc:1049(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x56508880baf9]
sql/sql_select.cc:4297(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x56508882e58c]
sql/sql_select.cc:370(handle_select(THD*, LEX*, select_result*, unsigned long))[0x565088805384]
sql/sql_parse.cc:6316(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5650887717a0]
sql/sql_parse.cc:3847(mysql_execute_command(THD*))[0x56508875f2e0]
sql/sql_parse.cc:7840(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x56508877b897]
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x565088751f6c]
sql/sql_parse.cc:1398(do_command(THD*))[0x56508874e6a7]
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x565088b3f61c]
sql/sql_connect.cc:1309(handle_one_connection)[0x565088b3eed4]
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x56508a2a5295]
nptl/pthread_create.c:487(start_thread)[0x7ff138bebfa3]
x86_64/clone.S:97(clone)[0x7ff13856f4cf]
 
Query (0x62b000000410): select * from (values ((1,2)))dt

on a non-debug build - wrong results.

MariaDB [test]> select * from (values ((1,2)))dt;
Query OK, 0 rows affected (0.000 sec)
 
MariaDB [test]> create table t1  select * from (values ((1,2)))dt;
Query OK, 0 rows affected (0.000 sec)
 
MariaDB [test]> show tables;  #table was not created
Empty set (0.000 sec)



 Comments   
Comment by Alice Sherepa [ 2021-01-18 ]

on second thought, shorter test

values ((1,2));

/10.5/sql/sql_type.h:4475: virtual bool Type_handler_row::Item_hybrid_func_fix_attributes(THD*, const char*, Type_handler_hybrid_field_type*, Type_all_attributes*, Item**, uint) const: Assertion `0' failed.
210118 17:37:04 [ERROR] mysqld got signal 6 ;
 
intl/loadmsgcat.c:1177(_nl_load_domain)[0x7f671aa5140f]
??:0(__assert_fail)[0x7f671aa5f102]
sql/sql_type.h:4476(Type_handler_row::Item_hybrid_func_fix_attributes(THD*, char const*, Type_handler_hybrid_field_type*, Type_all_attributes*, Item**, unsigned int) const)[0x5591c78c5ebb]
sql/sql_class.h:7368(Type_holder::aggregate_attributes(THD*))[0x5591c75f18a6]
sql/sql_tvc.cc:222(get_type_attributes_for_tvc(THD*, List_iterator_fast<List<Item> >&, Type_holder*, unsigned int, unsigned int))[0x5591c791290f]
sql/sql_tvc.cc:273(table_value_constr::prepare(THD*, st_select_lex*, select_result*, st_select_lex_unit*))[0x5591c7912edc]
sql/sql_union.cc:1558(st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long long))[0x5591c75e3116]
sql/sql_union.cc:39(mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long))[0x5591c75d4e8f]
sql/sql_select.cc:407(handle_select(THD*, LEX*, select_result*, unsigned long))[0x5591c73a757e]
sql/sql_parse.cc:6281(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5591c7314a42]
sql/sql_parse.cc:3977(mysql_execute_command(THD*))[0x5591c730392f]
sql/sql_parse.cc:8062(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x5591c731f88c]
sql/sql_parse.cc:1892(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5591c72f61d4]
sql/sql_parse.cc:1370(do_command(THD*))[0x5591c72f2ae2]
sql/sql_connect.cc:1410(do_handle_one_connection(CONNECT*, bool))[0x5591c7720f66]
sql/sql_connect.cc:1314(handle_one_connection)[0x5591c77208c3]
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x5591c83e36d8]
nptl/pthread_create.c:487(start_thread)[0x7f671b521fa3]
x86_64/clone.S:97(clone)[0x7f671ab284cf]

Comment by Igor Babaev [ 2021-01-27 ]

A fix for this bug was pushed into 10.3

Generated at Thu Feb 08 09:31:21 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.