Bug #37870 Assertion in convert_constant_item: result = 0
| Submitted: | 4 Jul 2008 13:00 | Modified: | 11 Nov 2008 21:35 |
|---|---|---|---|
| Reporter: | Philip Stoev | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server: Optimizer | Severity: | S1 (Critical) |
| Version: | 5.0 -r2646, 5.1 - r2673 , 6.0 - r2764 | OS: | Any |
| Assigned to: | Evgeny Potemkin | CPU Architecture: | Any |
[4 Jul 2008 13:09]
Philip Stoev
The query in question is: SELECT OUTR . `date_key` AS X FROM C AS OUTR WHERE NOT EXISTS ( SELECT COUNT( INNR . `datetime_nokey` ) FROM CC AS INNR WHERE INNR . `date_nokey` = 241 OR OUTR . `date_key` < 109 GROUP BY INNR . `datetime_key` HAVING X < 49 ) AND NOT ( OUTR . `int_key` >= 174 AND NOT OUTR . `date_key` >= OUTR . `int_key` ) GROUP BY OUTR . `int_key` LIMIT 5 However executing the same query again on its own does not cause a crash.
[5 Jul 2008 11:30]
Philip Stoev
Grammar file for bug 37870
Attachment: bug37870.yy (text/plain), 3.36 KiB.
[5 Jul 2008 11:34]
Philip Stoev
To reproduce this bug, please clone the mysql-test-extra-6.0 tree and: $ cd mysql-test-extra-6.0/mysql-test/gentest $ ./runall.pl --basedir=/location/of/mysql-6.0 --engine=myisam \ --threads=5 --queries=1000000 --grammar=/path/to/bug37870.yy This will start a server, create the test tables and proceed to run random queries generated from the grammar in the .yy file. The crash will happen anywhere from 5 seconds to two hours of running the test (5 threads and 2 CPU cores). More threads and more CPU cores may or may not help reduce the time-to-crash. To run against an existing server, please use: $ ./gentest.pl --gendata --engine=myisam --threads=5 \ --queries=1000000 --grammar=/path/to/bug37870.yy \ --dsn=dbi:mysql:host=127.0.0.1:port=9306:user=root:database=test Please let me know if a better/simplifed/in other format test case is required.
[9 Jul 2008 16:05]
Philip Stoev
Setting to Open so that the bug verification team can check previous releases.
[17 Jul 2008 8:08]
Philip Stoev
Affects 5.1 bzr as well.
[12 Aug 2008 18:19]
Sveta Smirnova
Thank you for the report. Verified as described.
[17 Oct 2008 7:55]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/56436 2765 Evgeny Potemkin 2008-10-17 Bug#37870: Usage of uninitialized value caused failed assertion. The convert_constant_item function converts a constant to integer using field for condition like 'field = a_constant'. When the convert_constant_item is called for a subquery the outer select is already being executed, so convert_constant_item saves field's value to prevent its corruption. For EXPLAIN field's value isn't initialized thus when convert_constant_item tries to restore saved value it fails assertion. Now the convert_constant_item doesn't save/restore field's value for EXPLAIN.
[27 Oct 2008 9:24]
Evgeny Potemkin
The reported stack trace seems to belongs to the bug#37937. The reported assertion occurs only on EXPLAIN queries.
[27 Oct 2008 9:26]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/57091 2765 Evgeny Potemkin 2008-10-27 Bug#37870: Usage of uninitialized value caused failed assertion. The convert_constant_item function converts a constant to integer using field for condition like 'field = a_constant'. When the convert_constant_item is called for a subquery the outer select is already being executed, so convert_constant_item saves field's value to prevent its corruption. For EXPLAIN field's value isn't initialized thus when convert_constant_item tries to restore saved value it fails assertion. Now the convert_constant_item doesn't save/restore field's value for EXPLAIN.
[28 Oct 2008 17:33]
Philip Stoev
Evgeny, I am getting this assertion even on workloads that contain no EXPLAIN and no "=" operator at all.
[5 Nov 2008 13:11]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/57889 2694 Evgeny Potemkin 2008-11-05 Bug#37870: Usage of uninitialized value caused failed assertion. The convert_constant_item function converts a constant to integer using field for condition like 'field = a_constant'. In some cases the convert_constant_item is called for a subquery when outer select is already being executed, so convert_constant_item saves field's value to prevent its corruption. For EXPLAIN and at the prepare phase field's value isn't initialized yet, thus when convert_constant_item tries to restore saved value it fails assertion.
[5 Nov 2008 15:00]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/57904 2694 Evgeny Potemkin 2008-11-05 Bug#37870: Usage of uninitialized value caused failed assertion. The convert_constant_item function converts a constant to integer using field for condition like 'field = a_constant'. In some cases the convert_constant_item is called for a subquery when outer select is already being executed, so convert_constant_item saves field's value to prevent its corruption. For EXPLAIN and at the prepare phase field's value isn't initialized yet, thus when convert_constant_item tries to restore saved value it fails assertion. Now the convert_constant_item doesn't save/restore field's value if it's haven't been read yet. Outer constants values are always saved.
[5 Nov 2008 15:40]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/57912 2694 Evgeny Potemkin 2008-11-05 Bug#37870: Usage of uninitialized value caused failed assertion. The convert_constant_item function converts a constant to integer using field for condition like 'field = a_constant'. In some cases the convert_constant_item is called for a subquery when outer select is already being executed, so convert_constant_item saves field's value to prevent its corruption. For EXPLAIN and at the prepare phase field's value isn't initialized yet, thus when convert_constant_item tries to restore saved value it fails assertion. Now the convert_constant_item doesn't save/restore field's value if it's haven't been read yet. Outer constant values are always saved.
[10 Nov 2008 10:53]
Bugs System
Pushed into 6.0.8-alpha (revid:epotemkin@mysql.com-20081105204624-0typ2ug2w5qcmylq) (version source revid:mattias.jonsson@sun.com-20081106095916-hp895g17ase9ie7b) (pib:5)
[10 Nov 2008 11:37]
Bugs System
Pushed into 5.1.30 (revid:epotemkin@mysql.com-20081105204624-0typ2ug2w5qcmylq) (version source revid:epotemkin@mysql.com-20081105204624-0typ2ug2w5qcmylq) (pib:5)
[11 Nov 2008 16:05]
Paul DuBois
The versions are actually 5.1.31, 6.0.9.
[11 Nov 2008 21:35]
Paul DuBois
Noted in 5.1.31, 6.0.9 changelog. Use of an uninitialized constant in EXPLAIN evaluation caused an assertion failure.
[19 Jan 2009 11:25]
Bugs System
Pushed into 5.1.31-ndb-6.2.17 (revid:tomas.ulin@sun.com-20090119095303-uwwvxiibtr38djii) (version source revid:tomas.ulin@sun.com-20090108105244-8opp3i85jw0uj5ib) (merge vers: 5.1.31-ndb-6.2.17) (pib:6)
[19 Jan 2009 13:02]
Bugs System
Pushed into 5.1.31-ndb-6.3.21 (revid:tomas.ulin@sun.com-20090119104956-guxz190n2kh31fxl) (version source revid:tomas.ulin@sun.com-20090119104956-guxz190n2kh31fxl) (merge vers: 5.1.31-ndb-6.3.21) (pib:6)
[19 Jan 2009 16:08]
Bugs System
Pushed into 5.1.31-ndb-6.4.1 (revid:tomas.ulin@sun.com-20090119144033-4aylstx5czzz88i5) (version source revid:tomas.ulin@sun.com-20090119144033-4aylstx5czzz88i5) (merge vers: 5.1.31-ndb-6.4.1) (pib:6)
Portions of this website are copyright © 2001, 2002 The PHP Group
Page generated in 0.091 sec. using MySQL 8.4.7-u6-cloud
Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the
respective copyright holders.
It is not reviewed in advance
by Oracle and does not necessarily represent the opinion of
Oracle or any other party.
Description: When executing a (EXPLAIN) SELECT workload, mysqld crashed as follows: #0 0x00110416 in __kernel_vsyscall () #1 0x00581c78 in pthread_kill () from /lib/libpthread.so.0 #2 0x085b0d94 in my_write_core (sig=6) at stacktrace.c:307 #3 0x08213e88 in handle_segfault (sig=6) at mysqld.cc:2638 #4 <signal handler called> #5 0x00110416 in __kernel_vsyscall () #6 0x003e6660 in raise () from /lib/libc.so.6 #7 0x003e8028 in abort () from /lib/libc.so.6 #8 0x003df57e in __assert_fail () from /lib/libc.so.6 #9 0x081a259b in convert_constant_item (thd=0x9a3ad80, field_item=0x9a45f70, item=0x9a460c4) at item_cmpfunc.cc:434 #10 0x081ab542 in Item_bool_func2::fix_length_and_dec (this=0x9a46068) at item_cmpfunc.cc:499 #11 0x0819259d in Item_func::fix_fields (this=0x9a46068, thd=0x9a3ad80, ref=0x9a461fc) at item_func.cc:199 #12 0x081a3858 in Item_cond::fix_fields (this=0x9a46158, thd=0x9a3ad80, ref=0x9aba21c) at item_cmpfunc.cc:3959 #13 0x082569d3 in setup_conds (thd=0x9a3ad80, tables=0x9a458c0, leaves=0x9a458c0, conds=0x9aba21c) at sql_base.cc:6997 #14 0x0827a142 in JOIN::prepare (this=0x9ab8eb0, rref_pointer_array=0x9a4534c, tables_init=0x9a458c0, wild_num=0, conds_init=0x9a46158, og_num=1, order_init=0x0, group_init=0x9a462e8, having_init=0x9a46408, proc_param_init=0x0, select_lex_arg=0x9a45248, unit_arg=0x9a453e0) at sql_select.cc:443 #15 0x081d2f47 in subselect_single_select_engine::prepare (this=0x9a46590) at item_subselect.cc:2071 #16 0x081d4384 in Item_subselect::fix_fields (this=0x9a464f8, thd_param=0x9a3ad80, ref=0x9a46610) at item_subselect.cc:174 #17 0x08192463 in Item_func::fix_fields (this=0x9a465b8, thd=0x9a3ad80, ref=0x9aaa3cc) at item_func.cc:172 #18 0x081a3858 in Item_cond::fix_fields (this=0x9aaa320, thd=0x9a3ad80, ref=0x9aab8b4) at item_cmpfunc.cc:3959 #19 0x082569d3 in setup_conds (thd=0x9a3ad80, tables=0x9a44e08, leaves=0x9a44e08, conds=0x9aab8b4) at sql_base.cc:6997 #20 0x0827a142 in JOIN::prepare (this=0x9aaa548, rref_pointer_array=0x9a3c264, tables_init=0x9a44e08, wild_num=0, conds_init=0x9aaa320, og_num=1, order_init=0x0, group_init=0x9aaa4a0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x9a3c160, unit_arg=0x9a3bed0) at sql_select.cc:443 #21 0x0828e169 in mysql_select (thd=0x9a3ad80, rref_pointer_array=0x9a3c264, tables=0x9a44e08, wild_num=0, fields=@0x9a3c1f4, conds=0x9aaa320, og_num=1, order=0x0, group=0x9aaa4a0, having=0x0, proc_param=0x0, select_options=2147764736, result=0x9aaa538, unit=0x9a3bed0, select_lex=0x9a3c160) at sql_select.cc:2971 #22 0x082910cc in handle_select (thd=0x9a3ad80, lex=0x9a3be74, result=0x9aaa538, setup_tables_done_option=0) at sql_select.cc:302 #23 0x082201d2 in execute_sqlcom_select (thd=0x9a3ad80, all_tables=0x9a44e08) at sql_parse.cc:4847 #24 0x08220f51 in mysql_execute_command (thd=0x9a3ad80) at sql_parse.cc:2015 #25 0x0822a01e in mysql_parse (thd=0x9a3ad80, inBuf=0x9a447c8 "SELECT OUTR . `date_key` AS X FROM C AS OUTR WHERE NOT EXISTS ( SELECT COUNT( INNR . `datetime_nokey` ) FROM CC AS INNR WHERE INNR . `date_nokey` = 241 OR OUTR . `date_key` < 109 GROUP BY INNR . `date"..., length=342, found_semicolon=0xa8a57314) at sql_parse.cc:5811 #26 0x0822a911 in dispatch_command (command=COM_QUERY, thd=0x9a3ad80, packet=0x9a3c799 "SELECT OUTR . `date_key` AS X FROM C AS OUTR WHERE NOT EXISTS ( SELECT COUNT( INNR . `datetime_nokey` ) FROM CC AS INNR WHERE INNR . `date_nokey` = 241 OR OUTR . `date_key` < 109 GROUP BY INNR . `date"..., packet_length=342) at sql_parse.cc:1051 #27 0x0822ba39 in do_command (thd=0x9a3ad80) at sql_parse.cc:724 #28 0x0821bee0 in handle_one_connection (arg=0x9a3ad80) at sql_connect.cc:1153 #29 0x0057d32f in start_thread () from /lib/libpthread.so.0 #30 0x0049a27e in clone () from /lib/libc.so.6 The assertion is here: 429 /* Restore the original field value. */ 430 if (field_item->depended_from) 431 { 432 result= field->store(orig_field_val, TRUE); 433 /* orig_field_val must be a valid value that can be restored back. */ 434 DBUG_ASSERT(!result); <<<<<<<< HERE 435 } 436 thd->variables.sql_mode= orig_sql_mode; 437 thd->count_cuted_fields= orig_count_cuted_fields; 438 if (table) (gdb) print result $3 = 0 (gdb) print orig_field_val $4 = 12 (gdb) print field $5 = (class Field *) 0x9a568f0 (gdb) print * field $6 = {_vptr.Field = 0x8620fc8, ptr = 0x9a56756 "", null_ptr = 0x9a56748 "ВЪ\004", table = 0x9a56000, orig_table = 0x9a56000, table_name = 0x9a56080, field_name = 0x9a19a02 "date_key", comment = {str = 0x86c8761 "", length = 0}, key_start = {map = 4}, part_of_key = {map = 4}, part_of_key_not_clustered = {map = 4}, part_of_sortkey = {map = 4}, part_of_key_wo_keyread = {map = 4}, unireg_check = Field::NONE, field_length = 10, flags = 16520, field_index = 3, null_bit = 8 '\b', is_created_from_null_item = false} How to repeat: If this crash happens again, a repeatable test case will be provided.