[MDEV-28319] Assertion `cur_step->type & JSON_PATH_KEY' failed in json_find_path Created: 2022-04-14  Updated: 2022-04-26  Resolved: 2022-04-26

Status: Closed
Project: MariaDB Server
Component/s: JSON
Affects Version/s: 10.9
Fix Version/s: 10.9.1

Type: Bug Priority: Blocker
Reporter: Elena Stepanova Assignee: Rucha Deodhar
Resolution: Fixed Votes: 0
Labels: regression

Issue Links:
Problem/Incident
is caused by MDEV-22224 Support JSON Path negative index Closed

 Description   

SELECT * FROM JSON_TABLE('{"foo":{"bar":1},"qux":2}', '$' COLUMNS(c1 VARCHAR(8) PATH '$[0]', c2 CHAR(8) PATH '$.*.x')) AS js;

10.9 abe97121

mariadbd: /data/src/10.9/strings/json_lib.c:1406: json_find_path: Assertion `cur_step->type & JSON_PATH_KEY' failed.
220415  0:21:35 [ERROR] mysqld got signal 6 ;
 
#7  0x00007f1df4bc6662 in __GI___assert_fail (assertion=0x5583e5566768 "cur_step->type & JSON_PATH_KEY", file=0x5583e5566740 "/data/src/10.9/strings/json_lib.c", line=1406, function=0x5583e5566840 <__PRETTY_FUNCTION__.3> "json_find_path") at assert.c:101
#8  0x00005583e4f20f87 in json_find_path (je=0x7f1deb57fff0, p=0x7f1dd4016e78, p_cur_step=0x7f1deb57fee0, array_counters=0x7f1deb57ff70) at /data/src/10.9/strings/json_lib.c:1406
#9  0x00005583e453bcc1 in ha_json_table::fill_column_values (this=0x7f1dd42155e0, thd=0x7f1dd4000db8, buf=0x7f1dd4225bb0 "\375\377", pos=0x0) at /data/src/10.9/sql/json_table.cc:530
#10 0x00005583e453b873 in ha_json_table::rnd_next (this=0x7f1dd42155e0, buf=0x7f1dd4225bb0 "\375\377") at /data/src/10.9/sql/json_table.cc:420
#11 0x00005583e4617bcc in handler::ha_rnd_next (this=0x7f1dd42155e0, buf=0x7f1dd4225bb0 "\375\377") at /data/src/10.9/sql/handler.cc:3414
#12 0x00005583e4124229 in rr_sequential (info=0x7f1dd4114230) at /data/src/10.9/sql/records.cc:519
#13 0x00005583e410f62d in READ_RECORD::read_record (this=0x7f1dd4114230) at /data/src/10.9/sql/records.h:81
#14 0x00005583e42f81e1 in join_init_read_record (tab=0x7f1dd4114168) at /data/src/10.9/sql/sql_select.cc:22089
#15 0x00005583e42f5bac in sub_select (join=0x7f1dd40184b0, join_tab=0x7f1dd4114168, end_of_records=false) at /data/src/10.9/sql/sql_select.cc:21092
#16 0x00005583e42f50be in do_select (join=0x7f1dd40184b0, procedure=0x0) at /data/src/10.9/sql/sql_select.cc:20640
#17 0x00005583e42c8748 in JOIN::exec_inner (this=0x7f1dd40184b0) at /data/src/10.9/sql/sql_select.cc:4749
#18 0x00005583e42c77bd in JOIN::exec (this=0x7f1dd40184b0) at /data/src/10.9/sql/sql_select.cc:4527
#19 0x00005583e42c90ee in mysql_select (thd=0x7f1dd4000db8, tables=0x7f1dd4017370, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f1dd4018488, unit=0x7f1dd40051c8, select_lex=0x7f1dd40156d8) at /data/src/10.9/sql/sql_select.cc:5007
#20 0x00005583e42b83e7 in handle_select (thd=0x7f1dd4000db8, lex=0x7f1dd40050f0, result=0x7f1dd4018488, setup_tables_done_option=0) at /data/src/10.9/sql/sql_select.cc:543
#21 0x00005583e42613f5 in execute_sqlcom_select (thd=0x7f1dd4000db8, all_tables=0x7f1dd4017370) at /data/src/10.9/sql/sql_parse.cc:6268
#22 0x00005583e4258702 in mysql_execute_command (thd=0x7f1dd4000db8, is_called_from_prepared_stmt=false) at /data/src/10.9/sql/sql_parse.cc:3959
#23 0x00005583e4266177 in mysql_parse (thd=0x7f1dd4000db8, rawbuf=0x7f1dd4015580 "SELECT * FROM JSON_TABLE('{\"foo\":{\"bar\":1},\"qux\":2}', '$' COLUMNS(c1 VARCHAR(8) PATH '$[0]', c2 CHAR(8) PATH '$.*.x')) AS js", length=124, parser_state=0x7f1deb581500) at /data/src/10.9/sql/sql_parse.cc:8043
#24 0x00005583e42527d8 in dispatch_command (command=COM_QUERY, thd=0x7f1dd4000db8, packet=0x7f1dd400b999 "", packet_length=124, blocking=true) at /data/src/10.9/sql/sql_parse.cc:1910
#25 0x00005583e4251105 in do_command (thd=0x7f1dd4000db8, blocking=true) at /data/src/10.9/sql/sql_parse.cc:1407
#26 0x00005583e4423e92 in do_handle_one_connection (connect=0x5583e88fac48, put_in_cache=true) at /data/src/10.9/sql/sql_connect.cc:1418
#27 0x00005583e4423b31 in handle_one_connection (arg=0x5583e88fd2c8) at /data/src/10.9/sql/sql_connect.cc:1312
#28 0x00005583e491d838 in pfs_spawn_thread (arg=0x5583e88fa7b8) at /data/src/10.9/storage/perfschema/pfs.cc:2201
#29 0x00007f1df5090ea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
#30 0x00007f1df4c8fdef in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

The failure appeared in 10.9 after this commit:

commit dfcbb30a92c2f1d33ceefb56a1d3fa13f8d0ce67
Author: Rucha Deodhar
Date:   Mon Nov 22 22:59:30 2021 +0530
 
    MDEV-22224: Support JSON Path negative index



 Comments   
Comment by Elena Stepanova [ 2022-04-18 ]

There are also tests which started failing in buildbot after the push of MDEV-22224:
http://buildbot.askmonty.org/buildbot/builders/kvm-ubsan/builds/942/steps/mtr_nm/logs/stdio

json.json_no_table                       w4 [ fail ]  Found warnings/errors in server log file!
        Test ended at 2022-04-13 20:38:27
line
/home/buildbot/buildbot/build/mariadb-10.9.0/sql/item_jsonfunc.cc:1472:37: runtime error: load of value 2779096485, which is not a valid value for type 'json_path_step_types'
/home/buildbot/buildbot/build/mariadb-10.9.0/sql/item_jsonfunc.cc:857:37: runtime error: load of value 2779096485, which is not a valid value for type 'json_path_step_types'
/home/buildbot/buildbot/build/mariadb-10.9.0/sql/item_jsonfunc.cc:3645:37: runtime error: load of value 2779096485, which is not a valid value for type 'json_path_step_types'

main.func_json                           w4 [ fail ]  Found warnings/errors in server log file!
        Test ended at 2022-04-13 20:47:08
line
/home/buildbot/buildbot/build/mariadb-10.9.0/sql/item_jsonfunc.cc:1472:37: runtime error: load of value 2779096485, which is not a valid value for type 'json_path_step_types'

If a patch for this issue doesn't fix them, please address them separately.
Please also check the foundation buildbot, there are some MSAN failures.

Comment by Rucha Deodhar [ 2022-04-18 ]

Patch: https://github.com/MariaDB/server/commit/d40587bc3f97833570081b9b8fe29eb57db051b7

Comment by Rucha Deodhar [ 2022-04-19 ]

Assigning back to myself because test failure in buildbot

Comment by Rucha Deodhar [ 2022-04-19 ]

Created blocker MDEV-28350 because this patch doesn't fix failing test on buildbot and is not directly related to failure. Tests failing on buildbot need a different patch because underlying cause is different (overflow and uninitialised variables). So decreasing priority to critical again.

Comment by Alexey Botchkov [ 2022-04-26 ]

ok to push.

Generated at Thu Feb 08 09:59:47 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.