Bug #36135 void Diagnostics_area::set_eof_status(THD*): Assertion `! is_set()' failed.

Description:
can only repeat on my 6.0.5 bk built with full debugging:

Version: '6.0.5-alpha-debug'  socket: '/tmp/mysql.sock'  port: 3306  yes
mysqld: sql_class.cc:431: void Diagnostics_area::set_eof_status(THD*): Assertion `! is_set()' failed.
mysqld(print_stacktrace
mysqld(handle_segfault
/lib/i686/nosegneg/libc.so.6(abort
/lib/i686/nosegneg/libc.so.6(__assert_fail
mysqld(Diagnostics_area::set_eof_status
mysqld(select_send::send_eof
mysqld(JOIN::exec
mysqld(mysql_select
mysqld(handle_select
mysqld(mysql_execute_command
mysqld(mysql_parse
mysqld(dispatch_command
mysqld(do_command
mysqld(handle_one_connection
080414 21:01:51 - mysqld got signal 6 ;

I expected to get back an error, 
ERROR 1242 (21000): Subquery returns more than 1 row
instead of server crash/assertion

How to repeat:
drop table if exists `t1`;
create table `t1` (`a` int,`b` int,key (`a`),key (`b`)) engine=myisam;
insert into `t1` values (2,4),(2,4),(2,4);
drop table if exists `t2`;
create table `t2` ( `a` int,`b` int,key (`a`),key (`b`)) engine=myisam;
insert into `t2` values (3,3),(3,3),(3,3);

select t2.b from t1,t2 where   
t1.a in (select b from t2) and  
t1.a >= (select a from t2 limit 1) and 
t1.a in (select a from t1 where t1.a = (select t2.b from t1,t2 limit 2) group by a);

Verified on Suse 10.3 X64:

[New Thread 0x49853950 (LWP 6123)]
080416  9:45:56 [Note] Event Scheduler: Loaded 0 events
080416  9:45:56 [Note] /home/miguel/dbs/6.0/libexec/mysqld: ready for connections.
Version: '6.0.5-alpha-debug'  socket: '/tmp/mysql.sock'  port: 3306  Source distribution
[New Thread 0x49894950 (LWP 6137)]
mysqld: sql_class.cc:431: void Diagnostics_area::set_eof_status(THD*): Assertion `! is_set()' failed.

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x49894950 (LWP 6137)]
0x00002b106df5db45 in raise () from /lib64/libc.so.6
(gdb) bt full
#0  0x00002b106df5db45 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00002b106df5f0e0 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00002b106df5707f in __assert_fail () from /lib64/libc.so.6
No symbol table info available.
#3  0x00000000006feb70 in Diagnostics_area::set_eof_status (this=0x1f11a78, thd=0x1f10478) at sql_class.cc:431
        __PRETTY_FUNCTION__ = "void Diagnostics_area::set_eof_status(THD*)"
#4  0x0000000000637184 in my_eof (thd=0x1f10478) at ../../sql/sql_class.h:2225
No locals.
<cut>

See also BUG#34417

Repeatable on 5.1 also. Here is the testcase:

create table ten (a int);
insert into ten values (0),(1),(2),(3),(4),(5),(6),(7),(8),(9);

CREATE TABLE one_k (
  a int(11) DEFAULT NULL,
  b int(11) DEFAULT NULL,
  KEY a (a)
);
-- produce numbers 0..999
insert into one_k select A.a+10*(B.a+10*C.a),A.a+10*(B.a+10*C.a) from ten;

CREATE TABLE two_a1 (
  a int(11) DEFAULT NULL
);
INSERT INTO two_a1 VALUES (0),(1);

CREATE TABLE two_a2 (
  a int(11) DEFAULT NULL
);
INSERT INTO two_a2 VALUES (0),(1);

CREATE TABLE two_c1 (
  a int(11) DEFAULT NULL
);
INSERT INTO two_c1 VALUES (0),(1);

CREATE TABLE two_c2 (
  a int(11) DEFAULT NULL
);
INSERT INTO two_c2 VALUES (0),(1),(0),(1);

# then run this query 
select * from two_a1, two_a2 
where
    two_a1.a < 10 and
    two_a2.a+1 = 2 and
    two_a2.a in (select one_k.b from one_k
                 where one_k.a+1=one_k.a+1 and
                       one_k.a < (select two_c1.a+10                                  
                                  from two_c1, two_c2 limit 2));

# and you'll get:
  mysqld: sql_class.cc:430: void Diagnostics_area::set_eof_status(THD*): Assertion `! is_set()' failed.
  
  Program received signal SIGABRT, Aborted.
  [Switching to Thread 0xb4a89b90 (LWP 19217)]
  0xffffe410 in __kernel_vsyscall ()
(gdb) wher
  #0  0xffffe410 in __kernel_vsyscall ()
  #1  0xb7e27101 in raise () from /lib/libc.so.6
  #2  0xb7e288e8 in abort () from /lib/libc.so.6
  #3  0xb7e207a5 in __assert_fail () from /lib/libc.so.6
  #4  0x082945f1 in Diagnostics_area::set_eof_status (this=0x8ec301c, thd=0x8ec2288) at sql_class.cc:430
  #5  0x081de370 in my_eof (thd=0x8ec2288) at sql_class.h:2156
  #6  0x0829a3ad in select_send::send_eof (this=0x8eed4d0) at sql_class.cc:1569
  #7  0x0832d8ef in do_select (join=0x8eed4e0, fields=0x8ec3678, table=0x0, procedure=0x0) at sql_select.cc:10818
  #8  0x08345e1f in JOIN::exec (this=0x8eed4e0) at sql_select.cc:2179
  #9  0x083413b4 in mysql_select (thd=0x8ec2288, rref_pointer_array=0x8ec36dc, tables=0x8ef8090, wild_num=1, fields=@0x8ec3678, conds=0x8ef8948, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0x8eed4d0, unit=0x8ec3374, select_lex=0x8ec35e4) at sql_select.cc:2357
  #10 0x08346139 in handle_select (thd=0x8ec2288, lex=0x8ec3318, result=0x8eed4d0, setup_tables_done_option=0) at sql_select.cc:269
  #11 0x082c071d in execute_sqlcom_select (thd=0x8ec2288, all_tables=0x8ef8090) at sql_parse.cc:4766
  #12 0x082c1e65 in mysql_execute_command (thd=0x8ec2288) at sql_parse.cc:2052
  #13 0x082cab3a in mysql_parse (thd=0x8ec2288, inBuf=0x8ef7d50 "select * from two_a1, two_a2 where    two_a1.a < 10 and    two_a2.a+1 = 2 and    two_a2.a in (select one_k.b from one_k", ' ' <repeats 17 times>, "where one_k.a+1=one_k.a+1 and", ' ' <repeats 23 times>, "one_k.a < (s"..., length=280, found_semicolon=0xb4a8925c) at sql_parse.cc:5649
  #14 0x082cb6f6 in dispatch_command (command=COM_QUERY, thd=0x8ec2288, packet=0x8eef7c1 "", packet_length=280) at sql_parse.cc:1121
  #15 0x082cc852 in do_command (thd=0x8ec2288) at sql_parse.cc:781
  #16 0x082b9db5 in handle_one_connection (arg=0x8ec2288) at sql_connect.cc:1115
  #17 0xb7fb518b in start_thread () from /lib/libpthread.so.0
  #18 0xb7ebf09e in clone () from /lib/libc.so.6
(gdb)

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/46131

ChangeSet@1.2582, 2008-04-28 21:15:30+04:00, sergefp@mysql.com +3 -0
  BUG#36135: void Diagnostics_area::set_eof_status(THD*): Assertion `! is_set()' failed.
  - Before sending EOF, check if we've already sent an error.

See also bug #36473, same assertion, however the patch (manually applied) does not appear to help.

Philip, confirm, the fix for this bug cannot be expected to fix BUG#36473. 

This bugfix fixes a problem in SELECTs, while BUG#36473 uses INSERT. It seems that BUG#36473 is 
a) either some Falcon-specific problem (some implicit assumption in SE 
    interface that Falcon didn't meet)
b) or a problem similar to this bug but in the other part of the code.

in any case, I don't think there is a need to merge the two fixes together.

this crashes 5.1.26BK with assertion:

Assertion failed: ! is_set(), file .\sql_class.cc, line 443

drop table if exists `t3`;
drop table if exists `t4`;
create table `t3` (`a` int,`b` int) engine=myisam;
create table `t4` (`c` varchar(5),`d` int) engine=myisam;
insert into t3 values (1,5),(1,1);
insert into t4 values ('test',1),('test',1);
select `a` from `t3`,`t4` where `a` = (select `d` from `t4`) or `a`= `c` ;

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/51942

2708 Sergey Petrunia	2008-08-19
        BUG#36135: void Diagnostics_area::set_eof_status(THD*): Assertion `! is_set()' failed.
        - Before sending EOF, check if we've already sent an error.

>> [27 May 11:20] Shane Bester
>> this crashes 5.1.26BK with assertion:
<skip>

This case is fixed too:

mysql> select `a` from `t3`,`t4` where `a` = (select `d` from `t4`) or `a`= `c` ;
ERROR 1242 (21000): Subquery returns more than 1 row

Pushed in 5.1.28

Noted in 5.1.28 changelog.

The server could crash with an assertion failure (or cause the client
to get a Packets out of order error) when the expected query result
is that it should terminate with a Subquery returns more than 1 row
error.

Setting report to NDI pending push into 6.0.x.

Pushed into 6.0.7-alpha  (revid:sergefp@mysql.com-20080819131529-f2qmxoeego57v1yn) (version source revid:vvaintroub@mysql.com-20080804094710-jb2qpqxpf2ir2gf3) (pib:3)

Noted in 6.0.7 changelog.