[MDEV-30721] Assertion `fixed()' or fixed == 1 failed in Item_cond_and::val_int on SELECT Created: 2023-02-24  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 11.0
Fix Version/s: 10.4, 10.5, 10.6, 10.11

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: regression-10.4

Issue Links:
Relates
relates to MDEV-23838 Possibly wrong result or Assertion `0... Closed

 Description   

I reviewed open bugs for this generic assert, but could not locate any bug that looked directly related.

CREATE TABLE t (c INT KEY) ENGINE=InnoDB;
INSERT INTO t (c) VALUES (0);
SELECT * FROM t WHERE (0,0) IN (SELECT MAX(c),MIN(c) FROM t);

Leads to:

11.0.1 f2dc4d4c10ac36a73b5c1eb765352d3aee808d66 (Debug)

mariadbd: /test/11.0_dbg/sql/item_cmpfunc.cc:5514: virtual longlong Item_cond_and::val_int(): Assertion `fixed()' failed.

11.0.1 f2dc4d4c10ac36a73b5c1eb765352d3aee808d66 (Debug)

Core was generated by `/test/MD180223-mariadb-11.0.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=22705815160384)
    at ./nptl/pthread_kill.c:44
[Current thread is 1 (Thread 0x14a69c0c0640 (LWP 1920928))]
(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=22705815160384) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=22705815160384) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=22705815160384, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x000014a6b534a476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x000014a6b53307f3 in __GI_abort () at ./stdlib/abort.c:79
#5  0x000014a6b533071b in __assert_fail_base (fmt=0x14a6b54e5150 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x563ff4faea79 "fixed()", file=0x563ff5137e48 "/test/11.0_dbg/sql/item_cmpfunc.cc", line=5514, function=<optimized out>) at ./assert/assert.c:92
#6  0x000014a6b5341e96 in __GI___assert_fail (assertion=0x563ff4faea79 "fixed()", file=0x563ff5137e48 "/test/11.0_dbg/sql/item_cmpfunc.cc", line=5514, function=0x563ff5138368 "virtual longlong Item_cond_and::val_int()") at ./assert/assert.c:101
#7  0x0000563ff47a59c6 in Item_cond_and::val_int (this=0x14a5fc06a320) at /test/11.0_dbg/sql/item_cmpfunc.cc:5514
#8  0x0000563ff43a5a2f in Item_func::is_simplified_cond_processor (this=0x14a5fc06a320, arg=arg@entry=0x0) at /test/11.0_dbg/sql/item_func.h:391
#9  0x0000563ff47a78b2 in Item_func_or_sum::walk (arg=0x0, walk_subquery=<optimized out>, processor=&virtual table offset 1144, this=0x14a5fc06a320) at /test/11.0_dbg/sql/item.h:5482
#10 Item_cond::walk (this=0x14a5fc06a320, processor=&virtual table offset 1144, walk_subquery=<optimized out>, arg=0x0) at /test/11.0_dbg/sql/item_cmpfunc.cc:5200
#11 0x0000563ff464cc04 in and_new_conditions_to_optimized_cond (thd=0x14a5fc000d58, cond=0x14a5fc06a320, cond_eq=cond_eq@entry=0x14a5fc016c00, new_conds=@0x14a69c0be790: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14a5fc069fc0, last = 0x14a5fc06a200, elements = 2}, <No data fields>}, cond_value=cond_value@entry=0x14a5fc016ad8) at /test/11.0_dbg/sql/opt_subselect.cc:6273
#12 0x0000563ff4520e74 in JOIN::optimize_inner (this=this@entry=0x14a5fc016738) at /test/11.0_dbg/sql/sql_select.cc:2353
#13 0x0000563ff45219bc in JOIN::optimize (this=this@entry=0x14a5fc016738) at /test/11.0_dbg/sql/sql_select.cc:1897
#14 0x0000563ff4521ac5 in mysql_select (thd=thd@entry=0x14a5fc000d58, tables=0x14a5fc013830, fields=@0x14a5fc0134d0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14a5fc0137e8, last = 0x14a5fc0137e8, elements = 1}, <No data fields>}, conds=0x14a5fc015ae0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x14a5fc016710, unit=0x14a5fc004fa0, select_lex=0x14a5fc013218) at /test/11.0_dbg/sql/sql_select.cc:5132
#15 0x0000563ff452228b in handle_select (thd=thd@entry=0x14a5fc000d58, lex=lex@entry=0x14a5fc004ec8, result=result@entry=0x14a5fc016710, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.0_dbg/sql/sql_select.cc:608
#16 0x0000563ff4487e8d in execute_sqlcom_select (thd=thd@entry=0x14a5fc000d58, all_tables=0x14a5fc013830) at /test/11.0_dbg/sql/sql_parse.cc:6267
#17 0x0000563ff44934af in mysql_execute_command (thd=thd@entry=0x14a5fc000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.0_dbg/sql/sql_parse.cc:3949
#18 0x0000563ff449a7cf in mysql_parse (thd=thd@entry=0x14a5fc000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14a69c0bf2c0) at /test/11.0_dbg/sql/sql_parse.cc:8002
#19 0x0000563ff449c963 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14a5fc000d58, packet=packet@entry=0x14a5fc00ae19 "SELECT * FROM t WHERE (0,0) IN (SELECT MAX(c),MIN(c) FROM t)", packet_length=packet_length@entry=60, blocking=blocking@entry=true) at /test/11.0_dbg/sql/sql_class.h:242
#20 0x0000563ff449e7bc in do_command (thd=0x14a5fc000d58, blocking=blocking@entry=true) at /test/11.0_dbg/sql/sql_parse.cc:1407
#21 0x0000563ff45ef6e2 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x563ff78ccaf8, put_in_cache=put_in_cache@entry=true) at /test/11.0_dbg/sql/sql_connect.cc:1416
#22 0x0000563ff45ef941 in handle_one_connection (arg=0x563ff78ccaf8) at /test/11.0_dbg/sql/sql_connect.cc:1318
#23 0x000014a6b539cb43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#24 0x000014a6b542ea00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Bug confirmed present in:
MariaDB: 10.4.29 (dbg), 10.5.20 (dbg), 10.6.13 (dbg), 10.7.8 (dbg), 10.8.8 (dbg), 10.9.6 (dbg), 10.10.4 (dbg), 10.11.2 (dbg), 11.0.1 (dbg)

Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.38 (dbg), 10.3.38 (opt), 10.4.29 (opt), 10.5.20 (opt), 10.6.13 (opt), 10.7.8 (opt), 10.8.8 (opt), 10.9.6 (opt), 10.10.4 (opt), 10.11.2 (opt), 11.0.1 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.40 (dbg), 5.7.40 (opt), 8.0.31 (dbg), 8.0.31 (opt)



 Comments   
Comment by Roel Van de Paar [ 2023-02-24 ]

10.3 Outcome:

10.3.38 2743a510a156456fe57429032bf41c0da0f11198 (Debug)

10.3.38-dbg>SELECT * FROM t WHERE (0,0) IN (SELECT MAX(c),MIN(c) FROM t);
+---+
| c |
+---+
| 0 |
+---+
1 row in set (0.001 sec)

Comment by Roel Van de Paar [ 2023-02-24 ]

All UniqueID's observed:

fixed == 1|SIGABRT|Item_cond_and::val_int|Item_func::is_simplified_cond_processor|Item_func_or_sum::walk|Item_cond::walk
fixed()|SIGABRT|Item_cond_and::val_int|Item_func::is_simplified_cond_processor|Item_func_or_sum::walk|Item_cond::walk

Generated at Thu Feb 08 10:18:24 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.