[MDEV-28095] crash in multi-update and implicit grouping Created: 2022-03-16  Updated: 2022-04-25  Resolved: 2022-04-25

Status: Closed
Project: MariaDB Server
Component/s: Data Manipulation - Update
Affects Version/s: 10.9.0, 10.3, 10.4, 10.5, 10.6, 10.7, 10.8
Fix Version/s: 10.3.35, 10.4.25, 10.5.16, 10.6.8, 10.7.4

Type: Bug Priority: Major
Reporter: Jingzhou Fu Assignee: Sergei Golubchik
Resolution: Fixed Votes: 0
Labels: None
Environment:

Linux jie-2 5.4.143-1-pve #1 SMP PVE 5.4.143-1 (Tue, 28 Sep 2021 09:10:37 +0200) x86_64 x86_64 x86_64 GNU/Linux

Issue Links:
Relates
relates to MDEV-22185 Failing assertion: node->pcur->rel_po... Closed

 Description   

PoC:

CREATE TABLE v0 ( v3 DOUBLE , v2 TEXT UNIQUE NOT NULL , v1 INT NOT NULL ) ;
 
INSERT INTO v0 VALUES ( ( 'x' = 62 OR v1 = 33 ) , -1 , 5 ) ;
 
CREATE TABLE v5 ( v4 CHAR ( 98 ) UNIQUE NULL , ONE INT ) AS SELECT 'x' FROM v0 ;
 
UPDATE v5 SET v1 = ( NOT ( v4 IS NULL ) ) ;
 
UPDATE v5 SET v2 = abs ( 0 + 4 ) , v2 = 11 ;
 
SELECT DISTINCT -1 , v3 + -1 , -1 FROM v0 UNION SELECT DISTINCT * FROM v5 ;
 
UPDATE v5 NATURAL JOIN v0 SET v4 = v2 , v1 = 0 ORDER BY 97811695.000000 * AVG ( v3 ) ASC ;

report (compiled with ASAN):

Thread pointer: 0x62b00015e218                                                                                                                                                               
Attempting backtrace. You can use the following information to find out                                                                                                                      
where mysqld died. If you see no messages after this, something went                                                                                                                         
terribly wrong...                                                                                                                                                                            
stack_bottom = 0x7fc262592880 thread_stack 0x5fc00                                                                                                                                           
??:0(__interceptor_backtrace)[0x7cbadb]                                                                                                                                                      
mysys/stacktrace.c:212(my_print_stacktrace)[0x2a86d37]                                                                                                                                       
sql/signal_handler.cc:0(handle_fatal_signal)[0x15af5d9]                                                                                                                                      
sigaction.c:0(__restore_rt)[0x7fc286d323c0]                                                                                                                                                  
??:0(gsignal)[0x7fc28696003b]                                                                                                                                                                
??:0(abort)[0x7fc28693f859]                                                                                                                                                                  
ut/ut0dbg.cc:40(ut_dbg_assertion_failed(char const*, char const*, unsigned int))[0x25a393e]                                                                                                  
row/row0mysql.cc:1633(row_update_for_mysql(row_prebuilt_t*))[0x244a426]                                                                                                                      
handler/ha_innodb.cc:8562(ha_innobase::update_row(unsigned char const*, unsigned char const*))[0x21700b4]                                                                                    
sql/handler.cc:7575(handler::ha_update_row(unsigned char const*, unsigned char const*))[0x15ee54f]                                                                                           
sql/sql_update.cc:2593(multi_update::send_data(List<Item>&))[0x100d8b5]                                                                                                                      
sql/sql_select.cc:22489(end_send_group(JOIN*, st_join_table*, bool))[0xe2f2e7]                                                                                                               
sql/sql_select.cc:20642(do_select(JOIN*, Procedure*))[0xdc6a47]                                                                                                                              
sql/sql_select.cc:4528(JOIN::exec())[0xdc344d]                                                                                                                                               
sql/sql_select.cc:5009(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_
 
select_lex*))[0xd4e4e9]                                                                                                                                                                      
sql/sql_update.cc:1968(mysql_multi_update(THD*, TABLE_LIST*, List<Item>*, List<Item>*, Item*, unsigned long long, enum_duplicates, bool, st_select_lex_unit*, st_select_lex*, multi_update**)
 
)[0x1006043]                                                                                                                                                                                 
sql/sql_parse.cc:4486(mysql_execute_command(THD*, bool))[0xc682ea]                                                                                                                           
sql/sql_class.h:2734(THD::enter_stage(PSI_stage_info_v1 const*, char const*, char const*, unsigned int))[0xc4a67f]                                                                           
sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0xc41baa]                                                                                      
sql/sql_parse.cc:1404(do_command(THD*, bool))[0xc4b74c]                                                                                                                                      
sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x111f9f3]
 
??:0(handle_one_connection)[0x111f249]
 
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x1f3f9de]
 
nptl/pthread_create.c:478(start_thread)[0x7fc286d26609]
 
??:0(clone)[0x7fc286a3c163]
 
 
 
Trying to get some variables.
 
Some pointers may be invalid and cause the dump to abort.
 
Query (0x62900008c238): UPDATE v5 NATURAL JOIN v0 SET v4 = v2 , v1 = 0 ORDER BY 97811695.000000 * AVG ( v3 ) ASC



 Comments   
Comment by Alice Sherepa [ 2022-03-17 ]

Thanks! Reproducible on 10.3-10.9, with InnoDB, also on non-debug build

--source include/have_innodb.inc
 
 
 
CREATE TABLE t1 (a int) engine=innodb;
 
INSERT INTO t1 VALUES (1),(2);
 
 
 
CREATE TABLE t2 (b int);
 
INSERT INTO t2 VALUES (1),(2);
 
 
 
UPDATE t1 NATURAL JOIN t2 SET a = 1 ORDER BY AVG (a) ;

10.3 6a2d88c132221ea07dd322

 
Version: '10.3.35-MariaDB-debug-log' 
2022-03-17 13:15:53 0x7fbfc4c52300  InnoDB: Assertion failure in file /10.3/src/storage/innobase/row/row0mysql.cc line 1793
 
InnoDB: Failing assertion: node->pcur->rel_pos == BTR_PCUR_ON
 
InnoDB: We intentionally generate a memory trap.
 
InnoDB: Submit a detailed bug report to https://jira.mariadb.org/
 
InnoDB: If you get repeated assertion failures or crashes, even
 
InnoDB: immediately after the mysqld startup, there may be
 
InnoDB: corruption in the InnoDB tablespace. Please refer to
 
InnoDB: https://mariadb.com/kb/en/library/innodb-recovery-modes/
 
InnoDB: about forcing recovery.
 
220317 13:15:53 [ERROR] mysqld got signal 6 ;
 
 
 
Server version: 10.3.35-MariaDB-debug-log
 
 
 
row/row0mysql.cc:1802(row_update_for_mysql(row_prebuilt_t*))[0x55eb98a33abc]
 
handler/ha_innodb.cc:8920(ha_innobase::update_row(unsigned char const*, unsigned char const*))[0x55eb986ed9d7]
 
sql/handler.cc:6511(handler::ha_update_row(unsigned char const*, unsigned char const*))[0x55eb9818411a]
 
sql/sql_update.cc:2447(multi_update::send_data(List<Item>&))[0x55eb97c977f2]
 
sql/sql_select.cc:21215(end_send_group(JOIN*, st_join_table*, bool))[0x55eb97b1c4c4]
 
sql/sql_select.cc:19832(sub_select(JOIN*, st_join_table*, bool))[0x55eb97b1110e]
 
sql/sql_select.cc:19832(sub_select(JOIN*, st_join_table*, bool))[0x55eb97b1110e]
 
sql/sql_select.cc:19421(do_select(JOIN*, Procedure*))[0x55eb97b0f956]
 
sql/sql_select.cc:4150(JOIN::exec_inner())[0x55eb97aa2501]
 
sql/sql_select.cc:3945(JOIN::exec())[0x55eb97a9fe7e]
 
sql/sql_select.cc:4355(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55eb97aa397c]
 
sql/sql_update.cc:1824(mysql_multi_update(THD*, TABLE_LIST*, List<Item>*, List<Item>*, Item*, unsigned long long, enum_duplicates, bool, st_select_lex_unit*, st_select_lex*, multi_update**))[0x55eb97c91038]
 
sql/sql_parse.cc:4419(mysql_execute_command(THD*))[0x55eb979dc22a]
 
sql/sql_parse.cc:7870(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55eb979f4b22]
 
sql/sql_parse.cc:1855(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55eb979cb9ff]
 
sql/sql_parse.cc:1398(do_command(THD*))[0x55eb979c8542]
 
sql/sql_connect.cc:1403(do_handle_one_connection(CONNECT*))[0x55eb97d9a163]
 
sql/sql_connect.cc:1309(handle_one_connection)[0x55eb97d99a1d]
 
perfschema/pfs.cc:1871(pfs_spawn_thread)[0x55eb993c8625]
 
nptl/pthread_create.c:478(start_thread)[0x7fbfdb40d609]
 
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7fbfdb330163]
 
 
 
Query (0x62b000000290): UPDATE t1 NATURAL JOIN t2 SET a = 1 ORDER BY AVG (a)

Generated at Thu Feb 08 09:58:01 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.