Bug #74447 Assertion `n < m_size' failed. | abort in Bounds_checked_array
Submitted: 20 Oct 2014 9:04 Modified: 6 Nov 2014 21:52
Reporter: Roel Van de Paar Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: DML Severity:S6 (Debug Builds)
Version:5.6.20, 5.6.22, 5.7.6 OS:Any
Assigned to: CPU Architecture:Any
Tags: debug

[20 Oct 2014 9:04] Roel Van de Paar
Description:
Version: '5.6.20-debug'  socket: '/sda/mysql-5.6.20-linux-x86_64-debug/socket.sock'  port: 17011  MySQL Community Server (GPL)
mysqld: /bzr/mysql-5.6/sql/sql_array.h:63: Element_type& Bounds_checked_array<Element_type>::operator[](size_t) [with Element_type = Item*; size_t = long unsigned int]: Assertion `n < m_size' failed.
19:00:15 UTC - mysqld got signal 6 ;

+bt
#0  0x00007f5815d01771 in pthread_kill () from /lib64/libpthread.so.0
#1  0x0000000000a9035e in my_write_core (sig=6) at /bzr/mysql-5.6/mysys/stacktrace.c:422
#2  0x0000000000723688 in handle_fatal_signal (sig=6) at /bzr/mysql-5.6/sql/signal_handler.cc:230
#3  <signal handler called>
#4  0x00007f5814b0d5c9 in raise () from /lib64/libc.so.6
#5  0x00007f5814b0ecd8 in abort () from /lib64/libc.so.6
#6  0x00007f5814b06536 in __assert_fail_base () from /lib64/libc.so.6
#7  0x00007f5814b065e2 in __assert_fail () from /lib64/libc.so.6
#8  0x000000000066dc4d in Bounds_checked_array<Item*>::operator[] (this=0x7f577fafb690, n=5) at /bzr/mysql-5.6/sql/sql_array.h:63
#9  0x00000000009b5245 in create_distinct_group (thd=0x198c0c0, ref_pointer_array=..., order_list=0x0, fields=..., all_fields=..., all_order_by_fields_used=0x7f577fafba1f) at /bzr/mysql-5.6/sql/sql_optimizer.cc:8924
#10 0x00000000009a03ff in JOIN::optimize (this=0x7f5760005830) at /bzr/mysql-5.6/sql/sql_optimizer.cc:631
#11 0x00000000007fe0ee in mysql_execute_select (thd=0x198c0c0, select_lex=0x198e938, free_join=true) at /bzr/mysql-5.6/sql/sql_select.cc:1086
#12 0x00000000007fe43f in mysql_select (thd=0x198c0c0, tables=0x7f57600051f0, wild_num=1, fields=..., conds=0x0, order=0x198eb00, group=0x198ea38, having=0x0, select_options=2147748609, result=0x7f5760005808, unit=0x198e2f0, select_lex=0x198e938) at /bzr/mysql-5.6/sql/sql_select.cc:1221
#13 0x00000000007fc4c7 in handle_select (thd=0x198c0c0, result=0x7f5760005808, setup_tables_done_option=0) at /bzr/mysql-5.6/sql/sql_select.cc:110
#14 0x00000000007d681b in execute_sqlcom_select (thd=0x198c0c0, all_tables=0x7f57600051f0) at /bzr/mysql-5.6/sql/sql_parse.cc:5103
#15 0x00000000007cf5cb in mysql_execute_command (thd=0x198c0c0) at /bzr/mysql-5.6/sql/sql_parse.cc:2649
#16 0x00000000007d8fa4 in mysql_parse (thd=0x198c0c0, rawbuf=0x7f5760004ff0 "select distinct * from t1", length=25, parser_state=0x7f577fafceb0) at /bzr/mysql-5.6/sql/sql_parse.cc:6245
#17 0x00000000007cc557 in dispatch_command (command=COM_QUERY, thd=0x198c0c0, packet=0x762b6e1 "select distinct * from t1", packet_length=25) at /bzr/mysql-5.6/sql/sql_parse.cc:1332
#18 0x00000000007cb646 in do_command (thd=0x198c0c0) at /bzr/mysql-5.6/sql/sql_parse.cc:1034
#19 0x0000000000793a61 in do_handle_one_connection (thd_arg=0x198c0c0) at /bzr/mysql-5.6/sql/sql_connect.cc:982
#20 0x000000000079354a in handle_one_connection (arg=0x198c0c0) at /bzr/mysql-5.6/sql/sql_connect.cc:898
#21 0x0000000000ade888 in pfs_spawn_thread (arg=0x74e5250) at /bzr/mysql-5.6/storage/perfschema/pfs.cc:1860
#22 0x00007f5815cfcdf3 in start_thread () from /lib64/libpthread.so.0
#23 0x00007f5814bce01d in clone () from /lib64/libc.so.6

How to repeat:
DROP DATABASE test;CREATE DATABASE test;USE test;
CREATE TABLE t1(b1 BIT,b2 BIT,b3 BIT)ENGINE=InnoDB;
select distinct * from t1;
[20 Oct 2014 9:06] Roel Van de Paar
Debug only
[20 Oct 2014 9:32] MySQL Verification Team
Hello Roel,

Thank you for the bug report and test case.
Confirmed with 5.6.22 that only debug build asserts.

Thanks,
Umesh
[20 Oct 2014 9:33] MySQL Verification Team
// 5.6.22
mysql> show variables like '%version%';
+-------------------------+---------------------------------------------------------------+
| Variable_name           | Value                                                         |
+-------------------------+---------------------------------------------------------------+
| innodb_version          | 5.6.22                                                        |
| protocol_version        | 10                                                            |
| slave_type_conversions  |                                                               |
| version                 | 5.6.22-enterprise-commercial-advanced-debug                   |
| version_comment         | MySQL Enterprise Server - Advanced Edition Debug (Commercial) |
| version_compile_machine | x86_64                                                        |
| version_compile_os      | Linux                                                         |
+-------------------------+---------------------------------------------------------------+
7 rows in set (0.01 sec)

mysql> DROP DATABASE test;CREATE DATABASE test;USE test;
Query OK, 1 row affected (0.07 sec)

Query OK, 1 row affected (0.00 sec)

Database changed
mysql> CREATE TABLE t1(b1 BIT,b2 BIT,b3 BIT)ENGINE=InnoDB;
Query OK, 0 rows affected (0.07 sec)

mysql> select distinct * from t1;
ERROR 2013 (HY000): Lost connection to MySQL server during query

//

mysqld-debug: /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_array.h:63: Element_type& Bounds_checked_array<Element_type>::operator[](size_t) [with Element_type =
 Item*]: Assertion `n < m_size' failed.

(gdb) bt
#0  0x0000003bf260c8ac in pthread_kill () from /lib64/libpthread.so.0
#1  0x0000000000afe982 in my_write_core (sig=6) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/mysys/stacktrace.c:422
#2  0x000000000077e6cc in handle_fatal_signal (sig=6) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/signal_handler.cc:230
#3  <signal handler called>
#4  0x0000003bf2232635 in raise () from /lib64/libc.so.6
#5  0x0000003bf2233e15 in abort () from /lib64/libc.so.6
#6  0x0000003bf222b75e in __assert_fail_base () from /lib64/libc.so.6
#7  0x0000003bf222b820 in __assert_fail () from /lib64/libc.so.6
#8  0x00000000006c5d7b in Bounds_checked_array<Item*>::operator[] (this=0x7ff250cd5900, n=5) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_array.h:63
#9  0x0000000000a1eb63 in create_distinct_group (thd=0x81d2370, ref_pointer_array=..., order_list=0x0, fields=..., all_fields=..., all_order_by_fields_used=0x7ff250cd5c9f)
    at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_optimizer.cc:8952
#10 0x0000000000a09170 in JOIN::optimize (this=0x7ff220005810) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_optimizer.cc:631
#11 0x000000000085cc9b in mysql_execute_select (thd=0x81d2370, select_lex=0x81d4be8, free_join=true)
    at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_select.cc:1086
#12 0x000000000085d003 in mysql_select (thd=0x81d2370, tables=0x7ff2200051d0, wild_num=1, fields=..., conds=0x0, order=0x81d4db0, group=0x81d4ce8, having=0x0, select_options=2147748609,
    result=0x7ff2200057e8, unit=0x81d45a0, select_lex=0x81d4be8) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_select.cc:1221
#13 0x000000000085b00f in handle_select (thd=0x81d2370, result=0x7ff2200057e8, setup_tables_done_option=0)
    at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_select.cc:110
#14 0x0000000000834dfb in execute_sqlcom_select (thd=0x81d2370, all_tables=0x7ff2200051d0) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_parse.cc:5103
#15 0x000000000082d553 in mysql_execute_command (thd=0x81d2370) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_parse.cc:2649
#16 0x00000000008375d1 in mysql_parse (thd=0x81d2370, rawbuf=0x7ff220004fd0 "select distinct * from t1", length=25, parser_state=0x7ff250cd7680)
    at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_parse.cc:6245
#17 0x000000000082a3a2 in dispatch_command (command=COM_QUERY, thd=0x81d2370, packet=0x8301051 "select distinct * from t1", packet_length=25)
    at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_parse.cc:1332
#18 0x0000000000829407 in do_command (thd=0x81d2370) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_parse.cc:1034
#19 0x00000000007f0887 in do_handle_one_connection (thd_arg=0x81d2370) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_connect.cc:982
#20 0x00000000007f0358 in handle_one_connection (arg=0x81d2370) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/sql/sql_connect.cc:898
#21 0x0000000000e5c19d in pfs_spawn_thread (arg=0x81f6100) at /export/home/pb2/build/sb_0-13146752-1409933888.09/mysqlcom-pro-5.6.22/storage/perfschema/pfs.cc:1860
#22 0x0000003bf26079d1 in start_thread () from /lib64/libpthread.so.0
#23 0x0000003bf22e886d in clone () from /lib64/libc.so.6
[20 Oct 2014 9:39] MySQL Verification Team
//
mysql> show variables like '%version%';
+-------------------------+---------------------------------------------------------------+
| Variable_name           | Value                                                         |
+-------------------------+---------------------------------------------------------------+
| innodb_version          | 5.7.6                                                         |
| protocol_version        | 10                                                            |
| slave_type_conversions  |                                                               |
| version                 | 5.7.6-m16-enterprise-commercial-advanced-debug                |
| version_comment         | MySQL Enterprise Server - Advanced Edition Debug (Commercial) |
| version_compile_machine | x86_64                                                        |
| version_compile_os      | Linux                                                         |
+-------------------------+---------------------------------------------------------------+
7 rows in set (0.01 sec)

mysql> DROP DATABASE test;CREATE DATABASE test;USE test;
Query OK, 1 row affected (0.06 sec)

Query OK, 1 row affected (0.00 sec)

Database changed
mysql> CREATE TABLE t1(b1 BIT,b2 BIT,b3 BIT)ENGINE=InnoDB;
Query OK, 0 rows affected (0.04 sec)

mysql> select distinct * from t1;
ERROR 2013 (HY000): Lost connection to MySQL server during query

mysqld-debug: /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_array.h:66: Element_type& Bounds_checked_array<Element_type>::operator[](size_t) [with Element_type = Item*]:
Assertion `n < m_size' failed.

//

(gdb) bt
#0  0x0000003bf260c8ac in pthread_kill () from /lib64/libpthread.so.0
#1  0x0000000000e794c5 in my_write_core (sig=6) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/mysys/stacktrace.c:247
#2  0x000000000086cb4e in handle_fatal_signal (sig=6) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/signal_handler.cc:219
#3  <signal handler called>
#4  0x0000003bf2232635 in raise () from /lib64/libc.so.6
#5  0x0000003bf2233e15 in abort () from /lib64/libc.so.6
#6  0x0000003bf222b75e in __assert_fail_base () from /lib64/libc.so.6
#7  0x0000003bf222b820 in __assert_fail () from /lib64/libc.so.6
#8  0x0000000000907b3b in Bounds_checked_array<Item*>::operator[] (this=0x7fbfd410a740, n=5) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_array.h:66
#9  0x0000000000b95727 in create_distinct_group (thd=0x7fbf100011a0, ref_pointer_array=..., order_list=0x0, fields=..., all_fields=..., all_order_by_fields_used=0x7fbfd410a80f)
    at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_optimizer.cc:10051
#10 0x0000000000b7f158 in JOIN::optimize_distinct_group_order (this=0x7fbf10006670) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_optimizer.cc:994
#11 0x0000000000b7d33d in JOIN::optimize (this=0x7fbf10006670) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_optimizer.cc:448
#12 0x0000000000be189c in mysql_prepare_and_optimize_select (thd=0x7fbf100011a0, fields=..., select_options=2147748609, result=0x7fbf10006648, select_lex=0x7fbf10005460,
    free_join=0x7fbfd410ad5e) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_select.cc:1011
#13 0x0000000000be195e in mysql_select (thd=0x7fbf100011a0, fields=..., select_options=2147748609, result=0x7fbf10006648, select_lex=0x7fbf10005460)
    at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_select.cc:1048
#14 0x0000000000bdfe55 in handle_select (thd=0x7fbf100011a0, result=0x7fbf10006648, setup_tables_done_option=0)
    at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_select.cc:97
#15 0x0000000000ba9163 in execute_sqlcom_select (thd=0x7fbf100011a0, all_tables=0x7fbf10006010) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_parse.cc:5028
#16 0x0000000000ba1007 in mysql_execute_command (thd=0x7fbf100011a0) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_parse.cc:2488
#17 0x0000000000baa012 in mysql_parse (thd=0x7fbf100011a0, parser_state=0x7fbfd410c660) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_parse.cc:5427
#18 0x0000000000b9dec7 in dispatch_command (command=COM_QUERY, thd=0x7fbf100011a0, packet=0x7fbf10009881 "select distinct * from t1", packet_length=25)
    at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_parse.cc:1250
#19 0x0000000000b9cb7b in do_command (thd=0x7fbf100011a0) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/sql_parse.cc:834
#20 0x0000000000caa2d8 in handle_connection (arg=0xc5e3e00) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/sql/conn_handler/connection_handler_per_thread.cc:298
#21 0x0000000001241f24 in pfs_spawn_thread (arg=0xc67ab60) at /pb2/build/sb_0-13146106-1409929295.44/mysqlcom-pro-5.7.6-m16/storage/perfschema/pfs.cc:2137
#22 0x0000003bf26079d1 in start_thread () from /lib64/libpthread.so.0
#23 0x0000003bf22e886d in clone () from /lib64/libc.so.6
[6 Nov 2014 21:52] Paul DuBois
Noted in 5.6.23, 5.7.6 changelogs.

For debug builds, the server could exit due to an optimizer failure
to allocate enough memory for group references.
[12 Feb 2015 12:11] Laurynas Biveinis
$ git show -s 99a59ef
commit 99a59ef7a4078775eb2f1b04aa6623c429946d7c
Author: Tor Didriksen <tor.didriksen@oracle.com>
Date:   Tue Nov 4 16:42:43 2014 +0100

    Bug#19855522 ASSERTION `N < M_SIZE' FAILED. | ABORT IN BOUNDS_CHECKED_ARRAY
    
    create_distinct_group() may need some extra space, so do a similar counting
    in setup_ref_array() to have enough space in st_select_lex::ref_pointer_array
    
    Also: shrinking an existing ref_pointer_array, as introduced by
    WL#5953 - Optimize away useless subquery clauses
    has to be reversed. The '*' wildcards are fixed in the prepare phase,
    but not in the execute phase.