[MDEV-29019] Assertion `(length % 4) == 0' failed in my_lengthsp_utf32 on SELECT Created: 2022-07-04  Updated: 2023-07-19  Resolved: 2023-07-19

Status: Closed
Project: MariaDB Server
Component/s: Character Sets
Affects Version/s: 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10
Fix Version/s: 10.8.8, 10.4.31, 10.5.22, 10.6.15, 10.9.8, 10.10.6, 10.11.5, 11.0.3, 11.1.2, 11.2.1

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Alexander Barkov
Resolution: Fixed Votes: 0
Labels: not-10.3, regression-10.4

Issue Links:
Relates
relates to MDEV-25994 Crash with union of my_decimal type i... Closed
relates to MDEV-28686 Assertion `0' in Type_handler_string_... Confirmed
relates to MDEV-23210 Assertion `(length % 4) == 0' failed ... Closed

 Description   

SET sql_select_limit=2;
CREATE TABLE t (a INT);
SET collation_connection=utf32_unicode_ci;
INSERT INTO t VALUES (0);
SELECT * FROM t ORDER BY (OCT(a));

Leads to:

10.10.0 63961a08a6203f4d58363a9321e4cf9c8b07a9fe (Debug)

mysqld: /test/10.10_dbg/strings/ctype-ucs2.c:2226: my_lengthsp_utf32: Assertion `(length % 4) == 0' failed.

10.10.0 63961a08a6203f4d58363a9321e4cf9c8b07a9fe (Debug)

Core was generated by `/test/MD290622-mariadb-10.10.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x1487180b0700 (LWP 1212610))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x000014872f23d859 in __GI_abort () at abort.c:79
#2  0x000014872f23d729 in __assert_fail_base (fmt=0x14872f3d3588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55b6a736bb3a "(length % 4) == 0", file=0x55b6a736bac8 "/test/10.10_dbg/strings/ctype-ucs2.c", line=2226, function=<optimized out>) at assert.c:92
#3  0x000014872f24efd6 in __GI___assert_fail (assertion=assertion@entry=0x55b6a736bb3a "(length % 4) == 0", file=file@entry=0x55b6a736bac8 "/test/10.10_dbg/strings/ctype-ucs2.c", line=line@entry=2226, function=function@entry=0x55b6a736c230 <__PRETTY_FUNCTION__.17507> "my_lengthsp_utf32") at assert.c:101
#4  0x000055b6a6d58763 in my_lengthsp_utf32 (cs=<optimized out>, ptr=<optimized out>, length=<optimized out>) at /test/10.10_dbg/strings/ctype-ucs2.c:2226
#5  0x000055b6a6d4ebd6 in my_ci_lengthsp (length=<optimized out>, str=0x1486ac0751c8 "0", cs=0x55b6a7765680 <my_charset_utf32_unicode_ci>) at /test/10.10_dbg/include/m_ctype.h:976
#6  my_uca_strnxfrm_utf32 (cs=0x55b6a7765680 <my_charset_utf32_unicode_ci>, dst=0x1486ac074439 '\245' <repeats 200 times>..., dstlen=<optimized out>, nweights=512, src=0x1486ac0751c8 "0", srclen=<optimized out>, flags=192) at /test/10.10_dbg/strings/ctype-uca.inl:744
#7  0x000055b6a65ca3ca in charset_info_st::strnxfrm (flags=192, srclen=<optimized out>, src=<optimized out>, nweights=<optimized out>, dstlen=<optimized out>, dst=0x1486ac074439 '\245' <repeats 200 times>..., this=0x55b6a7765680 <my_charset_utf32_unicode_ci>) at /test/10.10_dbg/include/m_ctype.h:877
#8  Type_handler_string_result::make_sort_key_part (this=<optimized out>, to=<optimized out>, item=0x1486ac0153e8, sort_field=0x1486ac017b78, param=<optimized out>) at /test/10.10_dbg/sql/filesort.cc:1157
#9  0x000055b6a65cc345 in make_sortkey (to=0x1486ac074438 "\001", '\245' <repeats 199 times>..., param=0x1487180adc90) at /test/10.10_dbg/sql/filesort.cc:3041
#10 make_sortkey (param=0x1487180adc90, to=0x1486ac074438 "\001", '\245' <repeats 199 times>..., ref_pos=0x1486ac028e18 "", using_packed_sortkeys=<optimized out>) at /test/10.10_dbg/sql/filesort.cc:1363
#11 0x000055b6a65cf530 in Bounded_queue<unsigned char, unsigned char>::push (element=0x1486ac028e18 "", this=0x1487180adc40) at /test/10.10_dbg/sql/bounded_queue.h:178
#12 find_all_keys (found_rows=0x1486ac0743a0, pq=0x1487180adc40, tempfile=0x1487180add50, buffpek_pointers=0x1487180adec0, fs_info=0x1486ac0741b0, select=0x1486ac0173e0, param=0x1487180adc90, thd=0x1486ac000db8) at /test/10.10_dbg/sql/filesort.cc:964
#13 filesort (thd=thd@entry=0x1486ac000db8, table=table@entry=0x1486ac028898, filesort=filesort@entry=0x1486ac0175b0, tracker=0x1486ac017ae8, join=join@entry=0x1486ac015628, first_table_bit=<optimized out>) at /test/10.10_dbg/sql/filesort.cc:357
#14 0x000055b6a635df2b in create_sort_index (thd=0x1486ac000db8, join=0x1486ac015628, tab=tab@entry=0x1486ac016a90, fsort=0x1486ac0175b0, fsort@entry=0x0) at /test/10.10_dbg/sql/sql_select.cc:24608
#15 0x000055b6a635e1b7 in st_join_table::sort_table (this=this@entry=0x1486ac016a90) at /test/10.10_dbg/sql/sql_select.cc:22289
#16 0x000055b6a635e31d in join_init_read_record (tab=0x1486ac016a90) at /test/10.10_dbg/sql/sql_select.cc:22228
#17 0x000055b6a6347313 in sub_select (join=0x1486ac015628, join_tab=0x1486ac016a90, end_of_records=false) at /test/10.10_dbg/sql/sql_select.cc:21275
#18 0x000055b6a637ac43 in do_select (procedure=<optimized out>, join=0x1486ac015628) at /test/10.10_dbg/sql/sql_select.cc:20823
#19 JOIN::exec_inner (this=this@entry=0x1486ac015628) at /test/10.10_dbg/sql/sql_select.cc:4787
#20 0x000055b6a637b1dc in JOIN::exec (this=this@entry=0x1486ac015628) at /test/10.10_dbg/sql/sql_select.cc:4565
#21 0x000055b6a6378f60 in mysql_select (thd=thd@entry=0x1486ac000db8, tables=0x1486ac014298, fields=@0x1486ac013f60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1486ac014250, last = 0x1486ac014250, elements = 1}, <No data fields>}, conds=0x0, og_num=1, order=0x1486ac0154c0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x1486ac015600, unit=0x1486ac004fd8, select_lex=0x1486ac013cc0) at /test/10.10_dbg/sql/sql_select.cc:5045
#22 0x000055b6a6379756 in handle_select (thd=thd@entry=0x1486ac000db8, lex=lex@entry=0x1486ac004f00, result=result@entry=0x1486ac015600, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.10_dbg/sql/sql_select.cc:579
#23 0x000055b6a62e5096 in execute_sqlcom_select (thd=thd@entry=0x1486ac000db8, all_tables=0x1486ac014298) at /test/10.10_dbg/sql/sql_parse.cc:6260
#24 0x000055b6a62f13a8 in mysql_execute_command (thd=thd@entry=0x1486ac000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.10_dbg/sql/sql_parse.cc:3944
#25 0x000055b6a62df372 in mysql_parse (thd=thd@entry=0x1486ac000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1487180af470) at /test/10.10_dbg/sql/sql_parse.cc:8036
#26 0x000055b6a62ec95a in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1486ac000db8, packet=packet@entry=0x1486ac00b6c9 "", packet_length=packet_length@entry=33, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_class.h:1364
#27 0x000055b6a62ef064 in do_command (thd=0x1486ac000db8, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_parse.cc:1407
#28 0x000055b6a644efde in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55b6a897d578, put_in_cache=put_in_cache@entry=true) at /test/10.10_dbg/sql/sql_connect.cc:1418
#29 0x000055b6a644f4e7 in handle_one_connection (arg=0x55b6a897d578) at /test/10.10_dbg/sql/sql_connect.cc:1312
#30 0x000014872f74e609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#31 0x000014872f33a133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

10.4.26 ebbd5ef6e2902a51a46e47dbb8a8667593cb25e7 (Debug)

mysqld: /test/10.4_dbg/strings/ctype-ucs2.c:2206: my_lengthsp_utf32: Assertion `(length % 4) == 0' failed.

10.4.26 ebbd5ef6e2902a51a46e47dbb8a8667593cb25e7 (Debug)

Core was generated by `/test/MD310522-mariadb-10.4.26-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x147a280f0700 (LWP 1212953))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x0000147a29c12859 in __GI_abort () at abort.c:79
#2  0x0000147a29c12729 in __assert_fail_base (fmt=0x147a29da8588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x558331fe2142 "(length % 4) == 0", file=0x558331fe20d0 "/test/10.4_dbg/strings/ctype-ucs2.c", line=2206, function=<optimized out>) at assert.c:92
#3  0x0000147a29c23fd6 in __GI___assert_fail (assertion=assertion@entry=0x558331fe2142 "(length % 4) == 0", file=file@entry=0x558331fe20d0 "/test/10.4_dbg/strings/ctype-ucs2.c", line=line@entry=2206, function=function@entry=0x558331fe2850 <__PRETTY_FUNCTION__.15897> "my_lengthsp_utf32") at assert.c:101
#4  0x0000558331a163fc in my_lengthsp_utf32 (cs=<optimized out>, ptr=<optimized out>, length=<optimized out>) at /test/10.4_dbg/strings/ctype-ucs2.c:2206
#5  0x0000558331a0c612 in my_uca_strnxfrm_utf32 (cs=0x558332397280 <my_charset_utf32_unicode_ci>, dst=0x1479c006e6a9 '\245' <repeats 200 times>..., dstlen=<optimized out>, nweights=512, src=0x1479c006e200 "0", srclen=<optimized out>, flags=192) at /test/10.4_dbg/strings/ctype-uca.inl:742
#6  0x00005583311c871f in Type_handler_string_result::make_sort_key (this=<optimized out>, to=0x1479c006e6a9 '\245' <repeats 200 times>..., item=0x1479c0014888, sort_field=0x1479c0017100, param=<optimized out>) at /test/10.4_dbg/sql/sql_type.h:2947
#7  0x00005583311c7b53 in make_sortkey (param=0x147a280ecda0, to=0x1479c006e6a8 "\001", '\245' <repeats 199 times>..., ref_pos=0x1479c0021d98 "") at /test/10.4_dbg/sql/filesort.cc:1207
#8  0x00005583311cbb09 in Bounded_queue<unsigned char, unsigned char>::push (element=0x1479c0021d98 "", this=0x147a280ecd50) at /test/10.4_dbg/sql/bounded_queue.h:177
#9  find_all_keys (found_rows=0x1479c006e180, pq=0x147a280ecd50, tempfile=0x147a280ece30, buffpek_pointers=0x147a280ecfa0, fs_info=0x1479c006dfa0, select=0x1479c00167f0, param=0x147a280ecda0, thd=0x1479c0000d90) at /test/10.4_dbg/sql/filesort.cc:833
#10 filesort (thd=thd@entry=0x1479c0000d90, table=table@entry=0x1479c0028580, filesort=filesort@entry=0x1479c00169c0, tracker=0x1479c0017080, join=join@entry=0x1479c0014af8, first_table_bit=<optimized out>) at /test/10.4_dbg/sql/filesort.cc:263
#11 0x0000558330faa97e in create_sort_index (thd=0x1479c0000d90, join=0x1479c0014af8, tab=tab@entry=0x1479c0015eb0, fsort=0x1479c00169c0, fsort@entry=0x0) at /test/10.4_dbg/sql/sql_select.cc:23904
#12 0x0000558330faac09 in st_join_table::sort_table (this=this@entry=0x1479c0015eb0) at /test/10.4_dbg/sql/sql_select.cc:21624
#13 0x0000558330faad42 in join_init_read_record (tab=0x1479c0015eb0) at /test/10.4_dbg/sql/sql_select.cc:21563
#14 0x0000558330f94c1a in sub_select (join=0x1479c0014af8, join_tab=0x1479c0015eb0, end_of_records=false) at /test/10.4_dbg/sql/sql_select.cc:20634
#15 0x0000558330fc701d in do_select (procedure=<optimized out>, join=0x1479c0014af8) at /test/10.4_dbg/sql/sql_select.cc:20173
#16 JOIN::exec_inner (this=this@entry=0x1479c0014af8) at /test/10.4_dbg/sql/sql_select.cc:4545
#17 0x0000558330fc7534 in JOIN::exec (this=this@entry=0x1479c0014af8) at /test/10.4_dbg/sql/sql_select.cc:4327
#18 0x0000558330fc59ed in mysql_select (thd=thd@entry=0x1479c0000d90, tables=0x1479c0013728, wild_num=1, fields=@0x1479c0013290: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1479c00136e0, last = 0x1479c00136e0, elements = 1}, <No data fields>}, conds=0x0, og_num=1, order=0x1479c0014978, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x1479c0014ad0, unit=0x1479c0004b28, select_lex=0x1479c0013148) at /test/10.4_dbg/sql/sql_select.cc:4766
#19 0x0000558330fc5c9d in handle_select (thd=thd@entry=0x1479c0000d90, lex=lex@entry=0x1479c0004a68, result=result@entry=0x1479c0014ad0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.4_dbg/sql/sql_select.cc:436
#20 0x0000558330f4056d in execute_sqlcom_select (thd=thd@entry=0x1479c0000d90, all_tables=0x1479c0013728) at /test/10.4_dbg/sql/sql_parse.cc:6449
#21 0x0000558330f4a9e9 in mysql_execute_command (thd=thd@entry=0x1479c0000d90) at /test/10.4_dbg/sql/sql_parse.cc:3963
#22 0x0000558330f54e43 in mysql_parse (thd=thd@entry=0x1479c0000d90, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x147a280ef530, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:7995
#23 0x0000558330f57969 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1479c0000d90, packet=packet@entry=0x1479c001a1d1 "", packet_length=packet_length@entry=33, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_class.h:1201
#24 0x0000558330f5a42a in do_command (thd=0x1479c0000d90) at /test/10.4_dbg/sql/sql_parse.cc:1378
#25 0x000055833107b321 in do_handle_one_connection (connect=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1420
#26 0x000055833107b3e1 in handle_one_connection (arg=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1316
#27 0x0000147a2a123609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#28 0x0000147a29d0f133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.4.26 (dbg), 10.5.17 (dbg), 10.6.9 (dbg), 10.7.5 (dbg), 10.8.4 (dbg), 10.9.2 (dbg), 10.10.0 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.36 (dbg), 10.3.36 (opt), 10.4.26 (opt), 10.5.17 (opt), 10.6.9 (opt), 10.7.5 (opt), 10.8.4 (opt), 10.9.2 (opt), 10.10.0 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.38 (dbg), 5.7.38 (opt), 8.0.29 (dbg), 8.0.29 (opt)



 Comments   
Comment by Roel Van de Paar [ 2022-07-04 ]

All UniqueID's/stacks seen across versions:

(length % 4) == 0|SIGABRT|my_lengthsp_utf32|my_ci_lengthsp|my_uca_strnxfrm_utf32|charset_info_st::strnxfrm
(length % 4) == 0|SIGABRT|my_lengthsp_utf32|my_uca_strnxfrm_utf32|Type_handler_string_result::make_sort_key|make_sortkey

Comment by Alexander Barkov [ 2023-07-19 ]

This part of the original script:

SET sql_select_limit=2;

does not seem to be relevant.

It still crashes without setting sql_select_limit:

CREATE OR REPLACE TABLE t (a INT);
INSERT INTO t VALUES (0);
SET collation_connection=utf32_unicode_ci;
SELECT * FROM t ORDER BY (OCT(a));

Generated at Thu Feb 08 10:05:16 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.