[MDEV-29108] Assertion `m_using_unique_constraint || m_group_buff <= param->group_buff + param->group_length' failed in Create_tmp_table::finalize Created: 2022-07-15  Updated: 2022-07-31  Resolved: 2022-07-19

Status: Closed
Project: MariaDB Server
Component/s: Server
Affects Version/s: N/A
Fix Version/s: 10.10.1

Type: Bug Priority: Critical
Reporter: Elena Stepanova Assignee: Daniel Black
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-25704 Add RANDOM_BYTES function Closed

 Description   

I'm not sure at all that the failure has anything to do with RANDOM_BYTES, but it's the first time I've ever seen it, and I can't find anything to replace RANDOM_BYTES with to make the test applicable to other branches. Please reduce the priority if the analysis shows it's unrelated.

CREATE TABLE t (a INT);
 
INSERT INTO t VALUES (1),(2);
 
SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2;
 
 
 
# Cleanup
 
DROP TABLE t;

preview-10.10-misc a5f44a81b

 
mariadbd: /data/src/preview-10.10-misc/sql/sql_select.cc:19597: bool Create_tmp_table::finalize(THD*, TABLE*, TMP_TABLE_PARAM*, bool, bool): Assertion `m_using_unique_constraint || m_group_buff <= param->group_buff + param->group_length' failed.
 
220715 14:51:08 [ERROR] mysqld got signal 6 ;
 
 
 
#7  0x00007ffa10c83662 in __GI___assert_fail (assertion=0x55b8c777e460 "m_using_unique_constraint || m_group_buff <= param->group_buff + param->group_length", file=0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", line=19597, function=0x55b8c777e280 "bool Create_tmp_table::finalize(THD*, TABLE*, TMP_TABLE_PARAM*, bool, bool)") at assert.c:101
 
No locals.
 
#8  0x000055b8c58dd7d8 in Create_tmp_table::finalize (this=0x7ffa07975e80, thd=0x62b00007e288, table=0x620000014128, param=0x6290000ea0f8, do_not_open=true, keep_row_order=false) at /data/src/preview-10.10-misc/sql/sql_select.cc:19597
 
        cur_group = 0x0
 
        _db_stack_frame_ = {func = 0x55b8c7776860 "JOIN::create_postjoin_aggr_table", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483659, line = -1, prev = 0x7ffa07976030}
 
        __PRETTY_FUNCTION__ = "bool Create_tmp_table::finalize(THD*, TABLE*, TMP_TABLE_PARAM*, bool, bool)"
 
        null_pack_length = {0, 1}
 
        null_pack_base = {1, 0}
 
        null_counter = {0, 1}
 
        whole_null_pack_length = 1
 
        use_packed_rows = false
 
        save_abort_on_warning = false
 
        pos = 0x61a000084805 '\276' <repeats 27 times>, "\377"
 
        null_flags = 0x61a000084800 "\377"
 
        keyinfo = 0x620000014ae8
 
        recinfo = 0x620000014c58
 
        share = 0x6200000144e0
 
        copy = 0x629000271488
 
        mem_root_save = 0x62b000084208
 
#9  0x000055b8c58e0c86 in create_tmp_table (thd=0x62b00007e288, param=0x6290000ea0f8, fields=@0x6290000e85a8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6290000e6b28, last = 0x6290000e6e48, elements = 2}, <No data fields>}, group=0x6290000e7710, distinct=false, save_sum_fields=false, select_options=2147748608, rows_limit=18446744073709551615, table_alias=0x55b8c8ae3ac0 <empty_clex_str>, do_not_open=true, keep_row_order=false) at /data/src/preview-10.10-misc/sql/sql_select.cc:19830
 
        table = 0x620000014128
 
        maker = {<Data_type_statistics> = {m_uneven_bit_length = 0, m_fixed_string_total_length = 0, m_fixed_string_count = 0, m_variable_string_total_length = 0, m_variable_string_count = 0, m_blob_count = 0}, _vptr.Create_tmp_table = 0x55b8c8b27c48 <vtable for Create_tmp_table+16>, m_from_field = 0x620000014ac0, m_default_field = 0x620000014aa0, m_key_part_info = 0x620000014bc8, m_group_buff = 0x620000014e04 "\276\276\276\276\377\377\377\377", m_bitmaps = 0x620000014e08 "\377\377\377\377", m_alloced_field_count = 2, m_using_unique_constraint = false, m_temp_pool_slot = 4294967295, m_group = 0x6290000e78a0, m_distinct = false, m_save_sum_fields = false, m_with_cycle = false, m_select_options = 2147748608, m_rows_limit = 18446744073709551615, m_group_null_items = 0, m_field_count = {0, 1}, m_null_count = {0, 1}, m_blobs_count = {0, 0}, m_uneven_bit = {0, 0}, current_counter = Create_tmp_table::other}
 
#10 0x000055b8c586e00e in JOIN::create_postjoin_aggr_table (this=0x6290000e8240, tab=0x6290000e9b38, table_fields=0x6290000e85a8, table_group=0x6290000e7710, save_sum_fields=false, distinct=false, keep_row_order=false) at /data/src/preview-10.10-misc/sql/sql_select.cc:4066
 
        _db_stack_frame_ = {func = 0x55b8c77764c0 "JOIN::make_aggr_tables_info", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483658, line = -1, prev = 0x7ffa07976170}
 
        table_rows_limit = 18446744073709551615
 
        table = 0x6290000e8240
 
        __PRETTY_FUNCTION__ = "bool JOIN::create_postjoin_aggr_table(JOIN_TAB*, List<Item>*, ORDER*, bool, bool, bool)"
 
#11 0x000055b8c586987b in JOIN::make_aggr_tables_info (this=0x6290000e8240) at /data/src/preview-10.10-misc/sql/sql_select.cc:3645
 
        tmp_group = 0x6290000e7710
 
        save_sum_fields = false
 
        curr_all_fields = 0x6290000e85a8
 
        curr_fields_list = 0x6290000e6670
 
        curr_tab = 0x6290000e9b38
 
        exec_tmp_table = 0x0
 
        distinct = false
 
        has_group_by = true
 
        keep_row_order = false
 
        is_having_added_as_table_cond = false
 
        _db_stack_frame_ = {func = 0x55b8c7775de0 "JOIN::optimize_stage2", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483657, line = -1, prev = 0x7ffa07976340}
 
        implicit_grouping_with_window_funcs = false
 
        implicit_grouping_without_tables = false
 
        __PRETTY_FUNCTION__ = "bool JOIN::make_aggr_tables_info()"
 
#12 0x000055b8c5865274 in JOIN::optimize_stage2 (this=0x6290000e8240) at /data/src/preview-10.10-misc/sql/sql_select.cc:3273
 
        select_opts_for_readinfo = 0
 
        no_jbuf_after = 1
 
        tab = 0x0
 
        _db_stack_frame_ = {func = 0x55b8c7775920 "JOIN::optimize_inner", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483656, line = -1, prev = 0x7ffa07976500}
 
        __PRETTY_FUNCTION__ = "int JOIN::optimize_stage2()"
 
        res = -1
 
#13 0x000055b8c585d8b6 in JOIN::optimize_inner (this=0x6290000e8240) at /data/src/preview-10.10-misc/sql/sql_select.cc:2532
 
        _db_stack_frame_ = {func = 0x55b8c77776c0 "mysql_select", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483655, line = -1, prev = 0x7ffa079767e0}
 
        trace_wrapper = {<Json_writer_struct> = {_vptr.Json_writer_struct = 0x55b8c8b191c8 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
 
        trace_prepare = {<Json_writer_struct> = {_vptr.Json_writer_struct = 0x55b8c8b191c8 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
 
        trace_steps = {<Json_writer_struct> = {_vptr.Json_writer_struct = 0x55b8c8b191a8 <vtable for Json_writer_array+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
 
        sel = 0x6290000e63c8
 
        eq_list = {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55b8c9a84580 <end_of_list>, last = 0x7ffa079764c0, elements = 0}, <No data fields>}
 
        ignore_on_expr = false
 
        __PRETTY_FUNCTION__ = "int JOIN::optimize_inner()"
 
#14 0x000055b8c5856586 in JOIN::optimize (this=0x6290000e8240) at /data/src/preview-10.10-misc/sql/sql_select.cc:1848
 
        res = 0
 
        init_state = JOIN::NOT_OPTIMIZED
 
#15 0x000055b8c587790a in mysql_select (thd=0x62b00007e288, tables=0x6290000e6ec0, fields=@0x6290000e6670: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6290000e6b28, last = 0x6290000e6e48, elements = 2}, <No data fields>}, conds=0x0, og_num=2, order=0x0, group=0x6290000e7710, having=0x0, proc_param=0x0, select_options=2147748608, result=0x6290000e8210, unit=0x62b0000826b0, select_lex=0x6290000e63c8) at /data/src/preview-10.10-misc/sql/sql_select.cc:5033
 
        err = 0
 
        free_join = true
 
        _db_stack_frame_ = {func = 0x55b8c7774440 "handle_select", file = 0x55b8c7774060 "/data/src/preview-10.10-misc/sql/sql_select.cc", level = 2147483654, line = -1, prev = 0x7ffa07976900}
 
        join = 0x6290000e8240
 
#16 0x000055b8c5848407 in handle_select (thd=0x62b00007e288, lex=0x62b0000825d0, result=0x6290000e8210, setup_tables_done_option=0) at /data/src/preview-10.10-misc/sql/sql_select.cc:579
 
        unit = 0x62b0000826b0
 
        res = false
 
        select_lex = 0x6290000e63c8
 
        _db_stack_frame_ = {func = 0x55b8c771f1e0 "mysql_execute_command", file = 0x55b8c771ccc0 "/data/src/preview-10.10-misc/sql/sql_parse.cc", level = 2147483653, line = -1, prev = 0x7ffa07977260}
 
#17 0x000055b8c5774753 in execute_sqlcom_select (thd=0x62b00007e288, all_tables=0x6290000e6ec0) at /data/src/preview-10.10-misc/sql/sql_parse.cc:6017
 
        save_protocol = 0x0
 
        lex = 0x62b0000825d0
 
        result = 0x6290000e8210
 
        res = false
 
        __PRETTY_FUNCTION__ = "bool execute_sqlcom_select(THD*, TABLE_LIST*)"
 
#18 0x000055b8c576565b in mysql_execute_command (thd=0x62b00007e288, is_called_from_prepared_stmt=false) at /data/src/preview-10.10-misc/sql/sql_parse.cc:3939
 
        privileges_requested = SELECT_ACL
 
        res = 0
 
        lex = 0x62b0000825d0
 
        select_lex = 0x6290000e63c8
 
        first_table = 0x6290000e6ec0
 
        all_tables = 0x6290000e6ec0
 
        unit = 0x62b0000826b0
 
        rpl_filter = 0x7ffa07976fe0
 
        _db_stack_frame_ = {func = 0x55b8c7721ea0 "mysql_parse", file = 0x55b8c771ccc0 "/data/src/preview-10.10-misc/sql/sql_parse.cc", level = 2147483652, line = -1, prev = 0x7ffa079777c0}
 
        __PRETTY_FUNCTION__ = "int mysql_execute_command(THD*, bool)"
 
        ots = {ctx = 0x62b000082268, traceable = false}
 
        orig_binlog_format = BINLOG_FORMAT_MIXED
 
        orig_current_stmt_binlog_format = BINLOG_FORMAT_STMT
 
#19 0x000055b8c577f575 in mysql_parse (thd=0x62b00007e288, rawbuf=0x6290000e62a8 "SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2", length=88, parser_state=0x7ffa07977bb0) at /data/src/preview-10.10-misc/sql/sql_parse.cc:7797
 
        found_semicolon = 0x0
 
        error = 24880
 
        lex = 0x62b0000825d0
 
        err = false
 
        _db_stack_frame_ = {func = 0x55b8c771dca0 "dispatch_command", file = 0x55b8c771ccc0 "/data/src/preview-10.10-misc/sql/sql_parse.cc", level = 2147483651, line = -1, prev = 0x7ffa07977a30}
 
        __PRETTY_FUNCTION__ = "void mysql_parse(THD*, char*, uint, Parser_state*)"
 
#20 0x000055b8c5758193 in dispatch_command (command=COM_QUERY, thd=0x62b00007e288, packet=0x62900025d289 "SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2", packet_length=88, blocking=true) at /data/src/preview-10.10-misc/sql/sql_parse.cc:1892
 
        packet_end = 0x6290000e6300 ""
 
        parser_state = {m_lip = {lookahead_token = -1, lookahead_yylval = 0x0, m_thd = 0x62b00007e288, m_ptr = 0x6290000e6301 "\004", m_tok_start = 0x6290000e6301 "\004", m_tok_end = 0x6290000e6301 "\004", m_end_of_query = 0x6290000e6300 "", m_tok_start_prev = 0x6290000e6300 "", m_buf = 0x6290000e62a8 "SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2", m_buf_length = 88, m_echo = true, m_echo_saved = false, m_cpp_buf = 0x6290000e6360 "SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2", m_cpp_ptr = 0x6290000e63b8 "", m_cpp_tok_start = 0x6290000e63b8 "", m_cpp_tok_start_prev = 0x6290000e63b8 "", m_cpp_tok_end = 0x6290000e63b8 "", m_body_utf8 = 0x0, m_body_utf8_ptr = 0x616000653780 "\017", m_cpp_utf8_processed_ptr = 0x0, next_state = MY_LEX_END, found_semicolon = 0x0, ignore_space = false, stmt_prepare_mode = false, multi_statements = true, yylineno = 1, m_digest = 0x0, in_comment = NO_COMMENT, in_comment_saved = (DISCARD_COMMENT | unknown: 0x7ff8), m_cpp_text_start = 0x6290000e63b6 "f2", m_cpp_text_end = 0x6290000e63b8 "", m_underscore_cs = 0x0}, m_yacc = {yacc_yyss = 0x0, yacc_yyvs = 0x0, m_set_signal_info = {m_item = {0x0 <repeats 13 times>}}, m_lock_type = TL_READ_DEFAULT, m_mdl_type = MDL_SHARED_READ}, m_digest_psi = 0x62b000081ff8}
 
        net = 0x62b00007e5c0
 
        error = false
 
        do_end_of_statement = true
 
        _db_stack_frame_ = {func = 0x55b8c771d420 "do_command", file = 0x55b8c771ccc0 "/data/src/preview-10.10-misc/sql/sql_parse.cc", level = 2147483650, line = -1, prev = 0x7ffa07978ca0}
 
        drop_more_results = false
 
        __PRETTY_FUNCTION__ = "dispatch_command_return dispatch_command(enum_server_command, THD*, char*, uint, bool)"
 
        __FUNCTION__ = "dispatch_command"
 
        res = <optimized out>
 
#21 0x000055b8c5754f90 in do_command (thd=0x62b00007e288, blocking=true) at /data/src/preview-10.10-misc/sql/sql_parse.cc:1405
 
        return_value = DISPATCH_COMMAND_SUCCESS
 
        packet = 0x62900025d288 "\003SELECT RANDOM_BYTES(CAST('-00:00:10' AS TIME)) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2"
 
        packet_length = 89
 
        net = 0x62b00007e5c0
 
        command = COM_QUERY
 
        _db_stack_frame_ = {func = 0x55b8c8616680 "?func", file = 0x55b8c86166c0 "?file", level = 2147483649, line = -1, prev = 0x0}
 
        __PRETTY_FUNCTION__ = "dispatch_command_return do_command(THD*, bool)"
 
        __FUNCTION__ = "do_command"
 
#22 0x000055b8c5bec38c in do_handle_one_connection (connect=0x61100000a708, put_in_cache=true) at /data/src/preview-10.10-misc/sql/sql_connect.cc:1418
 
        create_user = true
 
        thr_create_utime = 4307980419727
 
        thd = 0x62b00007e288
 
        __PRETTY_FUNCTION__ = "void do_handle_one_connection(CONNECT*, bool)"
 
#23 0x000055b8c5bebc51 in handle_one_connection (arg=0x61100000a5c8) at /data/src/preview-10.10-misc/sql/sql_connect.cc:1312
 
        connect = 0x61100000a5c8
 
#24 0x000055b8c67bfa94 in pfs_spawn_thread (arg=0x618000005d08) at /data/src/preview-10.10-misc/storage/perfschema/pfs.cc:2201
 
        typed_arg = 0x618000005d08
 
        user_arg = 0x61100000a5c8
 
        user_start_routine = 0x55b8c5bebbd1 <handle_one_connection(void*)>
 
        pfs = 0x7ffa0d162d80
 
        klass = 0x625000005400
 
#25 0x00007ffa1114dea7 in start_thread (arg=<optimized out>) at pthread_create.c:477
 
        ret = <optimized out>
 
        pd = <optimized out>
 
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140711845926656, -5234889544690009439, 140720531011822, 140720531011823, 140711845924608, 1060864, 5237088914247285409, 5237067996144499361}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
 
        not_first_call = 0
 
#26 0x00007ffa10d4cdef in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95



 Comments   
Comment by Daniel Black [ 2022-07-19 ]

non-debug doesn't crash as its a DBUG_ASSERTION only.

simpler debug build

 
MariaDB [test]> SELECT RANDOM_BYTES(-10) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2;
 
ERROR 2013 (HY000): Lost connection to server during query
 
MariaDB [test]>

debug preview-10.10-misc b708af32d4e81d702d364e027a4706eee95b9dde

 
(gdb) b  sql/sql_select.cc:19589
 
Breakpoint 1 at 0xa2fd27: file /home/dan/repos/mariadb-server-10.10/sql/sql_select.cc, line 19589.
 
(gdb) c
 
Continuing.
 
[New Thread 0x7f46703a9640 (LWP 60927)]
 
[Switching to Thread 0x7f46703a9640 (LWP 60927)]
 
 
 
Thread 19 "mysqld" hit Breakpoint 1, Create_tmp_table::finalize (this=0x7f46703a4ee8, thd=0x7f4620000dc8, table=0x7f4620068430, param=0x7f462001a248, do_not_open=true, keep_row_order=false) at /home/dan/repos/mariadb-server-10.10/sql/sql_select.cc:19589
 
19589	        m_group_buff+= cur_group->field->pack_length();
 
(gdb) p m_group_buff
 
$1 = (uchar *) 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377"
 
(gdb) p param->group_buff
 
$2 = (uchar *) 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377"
 
(gdb) p param->group_length
 
$3 = 1
 
(gdb) p *cur_group
 
$4 = {next = 0x0, item = 0x7f4620018838, item_ptr = 0x7f4620017780, fast_field_copier_func = 0xa5a5a5a5a5a5a5a5, fast_field_copier_setup = 0x0, counter = -1515870811, direction = st_order::ORDER_ASC, in_field_list = true, counter_used = false, field = 0x7f46200692b0, buff = 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377", used = 0, depend_map = 1}
 
(gdb) p *cur_group->field
 
$5 = (Field_long) {<Field_int> = {<Field_num> = {<Field> = {<Value_source> = {<No data fields>}, _vptr$Field = 0x2029950 <vtable for Field_long+16>, ptr = 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377", null_ptr = 0x0, table = 0x7f4620068430, orig_table = 0x7f4620068430, table_name = 0x7f4620068540, field_name = {str = 0x7f4620016eb8 "f2", length = 2}, comment = {str = 0x1a55de9 "", length = 0}, option_list = 0x0, option_struct = 0x0, key_start = {buffer = {0}}, part_of_key = {buffer = {0}}, part_of_key_not_clustered = {buffer = {0}}, part_of_sortkey = {buffer = {0}}, unireg_check = Field::NONE, invisible = VISIBLE, field_length = 11, flags = 1, field_index = 0, null_bit = 0 '\000', is_created_from_null_item = false, cond_selectivity = 1, next_equal_field = 0x0, read_stats = 0x0, collected_stats = 0x0, vcol_info = 0x0, check_constraint = 0x0, default_value = 0x0}, dec = 0, zerofill = false, unsigned_flag = false}, <No data fields>}, <No data fields>}
 
 
 
(gdb) p cur_group->field->pack_length()
 
$6 = 4
 
(gdb) n
 
19591	      keyinfo->key_length+=  m_key_part_info->length;
 
(gdb) n
 
19530	    for (; cur_group ; cur_group= cur_group->next, m_key_part_info++)
 
(gdb) n
 
19597	    DBUG_ASSERT(m_using_unique_constraint ||
 
(gdb) list
 
19592	    }
 
19593	    /*
 
19594	      Ensure we didn't overrun the group buffer. The < is only true when
 
19595	      some maybe_null fields was changed to be not null fields.
 
19596	    */
 
19597	    DBUG_ASSERT(m_using_unique_constraint ||
 
19598	                m_group_buff <= param->group_buff + param->group_length);
 
19599	  }
 
19600	
19601	  if (m_distinct && (share->fields != param->hidden_field_count ||
 
(gdb) p m_group_buff
 
$7 = (uchar *) 0x7f46200690d4 "\245\245\245\245\377\377\377\377"
 
(gdb) p param->group_buff
 
$8 = (uchar *) 0x7f46200690d0 "\245\245\245\245\245\245\245\245\377\377\377\377"
 
(gdb) p param->group_length
 
$9 = 1
 
(gdb) p  param->group_buff + param->group_length
 
$10 = (uchar *) 0x7f46200690d1 "\245\245\245\245\245\245\245\377\377\377\377"
 
(gdb) n
 
[Thread 0x7f4669ffb640 (LWP 60843) exited]
 
 
 
Thread 19 "mysqld" received signal SIGABRT, Aborted.
 
0x00007f469468ec4c in __pthread_kill_implementation () from /lib64/libc.so.6

Breakpoint executing SELECT RANDOM_BYTES(-10) f1, IFNULL(a,1) f2 FROM t GROUP BY f1, f2;.

So: {{19589 m_group_buff+= cur_group->field->pack_length();}} gets incremented by 4 breaking the assertion constraint. So the assertion is incorrect, or param->group_length should also be 4.

calc_group_buffer never sets the value of this param so I'm unsure where group_length is set to 1 from.

Comment by Daniel Black [ 2022-07-19 ] 

Item_func_random_bytes::fix_length_and_dec (this=0x7fe120016b40, thd=0x7fe120000dc8) at /home/dan/repos/mariadb-server-10.10/sql/item_strfunc.cc:1488
 
1488	    max_length= MY_MIN((int32) args[0]->val_int(), MAX_RANDOM_BYTES);
 
(gdb) list
 
1483	bool Item_func_random_bytes::fix_length_and_dec(THD *thd)
 
1484	{
 
1485	  used_tables_cache|= RAND_TABLE_BIT;
 
1486	  if (args[0]->can_eval_in_optimize())
 
1487	  {
 
1488	    max_length= MY_MIN((int32) args[0]->val_int(), MAX_RANDOM_BYTES);
 
1489	    return false;
 
1490	  }
 
1491	  max_length= MAX_RANDOM_BYTES;
 
1492	  return false;
 
(gdb) p  args[0]->val_int()
 
$4 = -10
 
(gdb) n
 
1489	    return false;
 
(gdb) p max_length
 
$5 = 4294967286

A 0 underflow on max_length appears to be enough cause this. Capped this at 0 for negative values alleviates the assertion 0.

Comment by Daniel Black [ 2022-07-19 ]

elenst, Roel, note that any other item function that sets max_length to near uint32 max will also probably hit this on group by queries.

Generated at Thu Feb 08 10:05:57 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.