[MDEV-25399] Assertion `name.length == strlen(name.str)' failed in Item_func_sp::make_send_field Created: 2021-04-13  Updated: 2021-10-27  Resolved: 2021-10-27

Status: Closed
Project: MariaDB Server
Component/s: Character Sets, Stored routines
Affects Version/s: 10.3, 10.4, 10.5, 10.6
Fix Version/s: 10.3.32, 10.4.22, 10.5.13, 10.6.5, 10.7.1

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Alexander Barkov
Resolution: Fixed Votes: 0
Labels: not-10.2, regression

Issue Links:
Relates
relates to MDEV-22380 Assertion `name.length == strlen(name... Closed
relates to MDEV-24349 ASAN use-after-poison in require_quot... Confirmed

 Description   

This may be a variation of MDEV-22380, but the versions affected are different. The stack differs also, as does the actual crashing frame. Also see MDEV-24349.

CREATE FUNCTION f(i INT) RETURNS INT RETURN 1;
PREPARE s FROM "SELECT f('\0')";
EXECUTE s;

Leads to:

10.6.0 f74704c7d963ddcd1109843a5861c6bd76409c8d (Debug)

mysqld: /test/10.6_dbg/sql/item_func.cc:6623: virtual void Item_func_sp::make_send_field(THD*, Send_field*): Assertion `name.length == strlen(name.str)' failed.

10.6.0 f74704c7d963ddcd1109843a5861c6bd76409c8d (Debug)

Core was generated by `/test/MD120421-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
[Current thread is 1 (Thread 0x149564d25700 (LWP 3744623))]
(gdb) bt
#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56
#1  0x00005566f5ea7c9e in my_write_core (sig=sig@entry=6) at /test/10.6_dbg/mysys/stacktrace.c:424
#2  0x00005566f5646b07 in handle_fatal_signal (sig=6) at /test/10.6_dbg/sql/signal_handler.cc:343
#3  <signal handler called>
#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#5  0x0000149579b92859 in __GI_abort () at abort.c:79
#6  0x0000149579b92729 in __assert_fail_base (fmt=0x149579d28588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x5566f61a9a60 "name.length == strlen(name.str)", file=0x5566f61b2370 "/test/10.6_dbg/sql/item_func.cc", line=6623, function=<optimized out>) at assert.c:92
#7  0x0000149579ba3f36 in __GI___assert_fail (assertion=assertion@entry=0x5566f61a9a60 "name.length == strlen(name.str)", file=file@entry=0x5566f61b2370 "/test/10.6_dbg/sql/item_func.cc", line=line@entry=6623, function=function@entry=0x5566f61b2890 "virtual void Item_func_sp::make_send_field(THD*, Send_field*)") at assert.c:101
#8  0x00005566f56dbf2a in Item_func_sp::make_send_field (this=0x149528040d70, thd=<optimized out>, tmp_field=0x149564d22d20) at /test/10.6_dbg/sql/item_func.cc:6623
#9  0x00005566f5626c47 in Send_field::Send_field (this=0x149564d22d20, thd=0x149528000db8, item=0x149528040d70) at /test/10.6_dbg/sql/field.cc:10999
#10 0x00005566f527eb36 in Protocol_text::store_item_metadata (this=this@entry=0x149564d22e40, thd=0x149528000db8, item=item@entry=0x149528040d70, pos=pos@entry=0) at /test/10.6_dbg/sql/protocol.cc:1289
#11 0x00005566f527ef97 in Protocol::send_result_set_metadata (this=0x1495280013a0, list=0x149528040748, flags=3) at /test/10.6_dbg/sql/protocol.cc:1206
#12 0x00005566f5308346 in select_send::send_result_set_metadata (this=0x1495280420b8, list=<optimized out>, flags=<optimized out>) at /test/10.6_dbg/sql/sql_class.cc:2975
#13 0x00005566f5405d41 in JOIN::exec_inner (this=this@entry=0x149528013ce0) at /test/10.6_dbg/sql/sql_select.cc:4336
#14 0x00005566f5406f46 in JOIN::exec (this=this@entry=0x149528013ce0) at /test/10.6_dbg/sql/sql_select.cc:4273
#15 0x00005566f540501f in mysql_select (thd=thd@entry=0x149528000db8, tables=0x0, fields=@0x149528040748: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x149528041880, last = 0x149528041880, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2201171004160, result=0x1495280420b8, unit=0x14952803ea90, select_lex=0x1495280405f8) at /test/10.6_dbg/sql/sql_select.cc:4749
#16 0x00005566f54052e5 in handle_select (thd=thd@entry=0x149528000db8, lex=lex@entry=0x14952803e9c8, result=result@entry=0x1495280420b8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_dbg/sql/sql_select.cc:419
#17 0x00005566f53788b1 in execute_sqlcom_select (thd=thd@entry=0x149528000db8, all_tables=0x0) at /test/10.6_dbg/sql/sql_parse.cc:6231
#18 0x00005566f5385609 in mysql_execute_command (thd=0x149528000db8) at /test/10.6_dbg/sql/sql_parse.cc:3927
#19 0x00005566f539f295 in Prepared_statement::execute (this=this@entry=0x14952801d478, expanded_query=expanded_query@entry=0x149564d23dd0, open_cursor=open_cursor@entry=false) at /test/10.6_dbg/sql/sql_prepare.cc:5040
#20 0x00005566f539f5e3 in Prepared_statement::execute_loop (this=this@entry=0x14952801d478, expanded_query=expanded_query@entry=0x149564d23dd0, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/10.6_dbg/sql/sql_prepare.cc:4502
#21 0x00005566f539fb1a in mysql_sql_stmt_execute (thd=thd@entry=0x149528000db8) at /test/10.6_dbg/sql/sql_prepare.cc:3579
#22 0x00005566f5385673 in mysql_execute_command (thd=thd@entry=0x149528000db8) at /test/10.6_dbg/sql/sql_parse.cc:3943
#23 0x00005566f5371a02 in mysql_parse (thd=thd@entry=0x149528000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x149564d24410) at /test/10.6_dbg/sql/sql_parse.cc:8004
#24 0x00005566f5380726 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x149528000db8, packet=packet@entry=0x14952800b369 "", packet_length=packet_length@entry=9, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_class.h:1331
#25 0x00005566f5383ac7 in do_command (thd=0x149528000db8, blocking=blocking@entry=true) at /test/10.6_dbg/sql/sql_parse.cc:1399
#26 0x00005566f54dd176 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5566f90836e8, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410
#27 0x00005566f54dd77b in handle_one_connection (arg=arg@entry=0x5566f90836e8) at /test/10.6_dbg/sql/sql_connect.cc:1312
#28 0x00005566f598b253 in pfs_spawn_thread (arg=0x5566f8f99aa8) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201
#29 0x000014957a0a0609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#30 0x0000149579c8f293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.3.29 (dbg), 10.4.19 (dbg), 10.5.10 (dbg), 10.6.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.2.38 (dbg), 10.2.38 (opt), 10.3.29 (opt), 10.4.19 (opt), 10.5.10 (opt), 10.6.0 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.33 (dbg), 5.7.33 (opt), 8.0.23 (dbg), 8.0.23 (opt)

Regression:

10.2.38 (Debug)

10.2.38>CREATE FUNCTION f(i INT) RETURNS INT RETURN 1;
Query OK, 0 rows affected (0.01 sec)
 
10.2.38>PREPARE s FROM "SELECT f('\0')";
Query OK, 0 rows affected (0.00 sec)
Statement prepared
 
10.2.38>EXECUTE s;
ERROR 1366 (22007): Incorrect integer value: '' for column ``.``.`i` at row 1

Note the seemingly strange triple-field name ``.``.`i` though.



 Comments   
Comment by Roel Van de Paar [ 2021-04-13 ]

This bug also produces somewhat different stacks across the versions it affects. UniqueID's seen (difference between last to is field vs item):

name.length == strlen(name.str)|SIGABRT|Item_func_sp::make_send_field|Protocol::send_result_set_metadata|select_send::send_result_set_metadata|JOIN::exec_inner
name.length == strlen(name.str)|SIGABRT|Item_func_sp::make_send_field|Send_field::Send_field|Protocol_text::store_field_metadata|Protocol::send_result_set_metadata
name.length == strlen(name.str)|SIGABRT|Item_func_sp::make_send_field|Send_field::Send_field|Protocol_text::store_item_metadata|Protocol::send_result_set_metadata

Comment by Alexander Barkov [ 2021-10-22 ]

sanja, please review a patch:

https://github.com/MariaDB/server/tree/bb-10.3-bar-MDEV-22380

Comment by Oleksandr Byelkin [ 2021-10-26 ]

OK to push

Generated at Thu Feb 08 09:37:23 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.