MySQL Bugs: #74221: ctype-ucs2.c:1545: my_strnncollsp_utf16_bin: Assertion `(slen % 2) == 0' failed.

Bug #74221	ctype-ucs2.c:1545: my_strnncollsp_utf16_bin: Assertion `(slen % 2) == 0' failed.
Submitted:	4 Oct 2014 6:23	Modified:	11 Apr 2018 16:17
Reporter:	Roel Van de Paar	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Charsets	Severity:	S6 (Debug Builds)
Version:	5.6.20	OS:	Any
Assigned to:		CPU Architecture:	Any
Tags:	debug

Description:
Server: mysql-5.6.20-linux-x86_64-debug

Stack:

(gdb) bt
#0  0x00007fa622845771 in pthread_kill () from /lib64/libpthread.so.0
#1  0x0000000000a9035e in my_write_core (sig=6) at /bzr/mysql-5.6/mysys/stacktrace.c:422
#2  0x0000000000723688 in handle_fatal_signal (sig=6) at /bzr/mysql-5.6/sql/signal_handler.cc:230
#3  <signal handler called>
#4  0x00007fa6216515c9 in raise () from /lib64/libc.so.6
#5  0x00007fa621652cd8 in abort () from /lib64/libc.so.6
#6  0x00007fa62164a536 in __assert_fail_base () from /lib64/libc.so.6
#7  0x00007fa62164a5e2 in __assert_fail () from /lib64/libc.so.6
#8  0x0000000000e3e56f in my_strnncollsp_utf16_bin (cs=0x1720ce0 <my_charset_utf16le_bin>, s=0x7fa544014510 "1", slen=1, t=0x7fa5440074a8 "", tlen=0, diff_if_only_endspace_difference=0 '\000') at /bzr/mysql-5.6/strings/ctype-ucs2.c:1545
#9  0x000000000082ddb9 in sortcmp (s=0x7fa5440086c8, t=0x7fa5440074c0, cs=0x1720ce0 <my_charset_utf16le_bin>) at /bzr/mysql-5.6/sql/sql_string.cc:757
#10 0x0000000000686e35 in cmp_item_sort_string_in_static::compare (this=0x7fa5440086b0, ci=0x7fa544008770) at /bzr/mysql-5.6/sql/item_cmpfunc.h:1299
#11 0x000000000067c340 in cmp_item_row::compare (this=0x7fa544008528, c=0x7fa544008548) at /bzr/mysql-5.6/sql/item_cmpfunc.cc:4252
#12 0x000000000067ac67 in cmp_row (cmp_arg=0x0, a=0x7fa544008528, b=0x7fa544008548) at /bzr/mysql-5.6/sql/item_cmpfunc.cc:3865
#13 0x0000000000a81ac7 in my_qsort2 (base_ptr=0x7fa544008528, count=3, size=32, cmp=0x67ac35 <cmp_row(void*, cmp_item_row*, cmp_item_row*)>, cmp_argument=0x0) at /bzr/mysql-5.6/mysys/mf_qsort.c:130
#14 0x000000000068619f in in_vector::sort (this=0x7fa5440084d0) at /bzr/mysql-5.6/sql/item_cmpfunc.h:930
#15 0x000000000067d489 in Item_func_in::fix_length_and_dec (this=0x7fa544007b68) at /bzr/mysql-5.6/sql/item_cmpfunc.cc:4612
#16 0x00000000006a2734 in Item_func::fix_fields (this=0x7fa544007b68, thd=0x1b77820, ref=0x7fa544007cb0) at /bzr/mysql-5.6/sql/item_func.cc:231
#17 0x000000000067c6f3 in Item_func_in::fix_fields (this=0x7fa544007b68, thd=0x1b77820, ref=0x7fa544007cb0) at /bzr/mysql-5.6/sql/item_cmpfunc.cc:4362
#18 0x000000000076dfc2 in setup_fields (thd=0x1b77820, ref_pointer_array=..., fields=..., mark_used_columns=MARK_COLUMNS_READ, sum_func_list=0x7fa544008008, allow_sum_func=true) at /bzr/mysql-5.6/sql/sql_base.cc:8303
#19 0x00000000007f654c in JOIN::prepare (this=0x7fa544007dc0, tables_init=0x0, wild_num=0, conds_init=0x0, og_num=0, order_init=0x0, group_init=0x0, having_init=0x0, select_lex_arg=0x1b7a098, unit_arg=0x1b79a50) at /bzr/mysql-5.6/sql/sql_resolver.cc:168
#20 0x00000000007fe013 in mysql_prepare_select (thd=0x1b77820, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, select_options=2147748608, result=0x7fa544007d98, unit=0x1b79a50, select_lex=0x1b7a098, free_join=0x7fa56ff22c77) at /bzr/mysql-5.6/sql/sql_select.cc:1054
#21 0x00000000007fe2ed in mysql_select (thd=0x1b77820, tables=0x0, wild_num=0, fields=..., conds=0x0, order=0x1b7a260, group=0x1b7a198, having=0x0, select_options=2147748608, result=0x7fa544007d98, unit=0x1b79a50, select_lex=0x1b7a098) at /bzr/mysql-5.6/sql/sql_select.cc:1177
#22 0x00000000007fc4c7 in handle_select (thd=0x1b77820, result=0x7fa544007d98, setup_tables_done_option=0) at /bzr/mysql-5.6/sql/sql_select.cc:110
#23 0x00000000007d681b in execute_sqlcom_select (thd=0x1b77820, all_tables=0x0) at /bzr/mysql-5.6/sql/sql_parse.cc:5103
#24 0x00000000007cf5cb in mysql_execute_command (thd=0x1b77820) at /bzr/mysql-5.6/sql/sql_parse.cc:2649
#25 0x00000000007d8fa4 in mysql_parse (thd=0x1b77820, rawbuf=0x7fa544006d50 "select row('',1.5,3)IN (row(1,2,3),row('',1.5,3),row('','',''))", length=63, parser_state=0x7fa56ff23eb0) at /bzr/mysql-5.6/sql/sql_parse.cc:6245
#26 0x00000000007cc557 in dispatch_command (command=COM_QUERY, thd=0x1b77820, packet=0x7833d61 "select row('',1.5,3)IN (row(1,2,3),row('',1.5,3),row('','',''))", packet_length=63) at /bzr/mysql-5.6/sql/sql_parse.cc:1332
#27 0x00000000007cb646 in do_command (thd=0x1b77820) at /bzr/mysql-5.6/sql/sql_parse.cc:1034
#28 0x0000000000793a61 in do_handle_one_connection (thd_arg=0x1b77820) at /bzr/mysql-5.6/sql/sql_connect.cc:982
#29 0x000000000079354a in handle_one_connection (arg=0x1b77820) at /bzr/mysql-5.6/sql/sql_connect.cc:898
#30 0x0000000000ade888 in pfs_spawn_thread (arg=0x76db400) at /bzr/mysql-5.6/storage/perfschema/pfs.cc:1860
#31 0x00007fa622840df3 in start_thread () from /lib64/libpthread.so.0
#32 0x00007fa62171201d in clone () from /lib64/libc.so.6

How to repeat:
DROP DATABASE test;CREATE DATABASE test;USE test;
SET NAMES utf8,collation_connection=utf16le_bin;
select row('',1.5,3)IN (row(1,2,3),row('',1.5,3),row('','',''));

Another similar, but not the same, case

ctype-ucs2.c:1346: my_strnncollsp_utf16: Assertion `(tlen % 2) == 0' failed.

DROP DATABASE test;CREATE DATABASE test;USE test;
SET NAMES utf8,collation_connection='utf16le_general_ci';
select row('',1.5,3)IN (row(3,NULL,3),row('',1.5,3),row(1,3,3));

Another similar, but not the same, case

ctype-ucs2.c:2653: my_strnncollsp_utf32_bin: Assertion `(tlen % 4) == 0' failed.

DROP DATABASE test;CREATE DATABASE test;USE test;
set collation_connection=utf32_bin;
select row('',1.5,3)IN (row(3,NULL,3),row('',1.5,3),row(1,3,3));

Probably a duplicate of internal:
Bug 18487049 - ASSERTION FAILED: (SLEN % 4) == 0 IN MY_STRNNCOLLSP_UTF32

and probably already fixed:
C:\dbs>c:\dbs\5.6\bin\mysql -uroot --port=3560 --debug-info --prompt="mysql 5.6 > "
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1
Server version: 5.6.22 Source distribution

Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql 5.6 > DROP DATABASE test;CREATE DATABASE test;USE test;
ERROR 1008 (HY000): Can't drop database 'test'; database doesn't exist
Query OK, 1 row affected (0.01 sec)

Database changed
mysql 5.6 > SET NAMES utf8,collation_connection=utf16le_bin;
Query OK, 0 rows affected (0.05 sec)

mysql 5.6 > select row('',1.5,3)IN (row(1,2,3),row('',1.5,3),row('','',''));
+----------------------------------------------------------+
| row('',1.5,3)IN (row(1,2,3),row('',1.5,3),row('','','')) |
+----------------------------------------------------------+
|                                                        1 |
+----------------------------------------------------------+
1 row in set, 2 warnings (0.03 sec)

mysql 5.6 > SHOW WARNINGS;
+---------+------+---------------------------------------+
| Level   | Code | Message                               |
+---------+------+---------------------------------------+
| Warning | 1292 | Truncated incorrect DECIMAL value: '' |
| Warning | 1292 | Truncated incorrect INTEGER value: '' |
+---------+------+---------------------------------------+
2 rows in set (0.00 sec)

Sorry I didn't noticed only debug version is affected:

C:\dbs>c:\dbs\5.6\bin\mysql -uroot --port=3560 --debug-info --prompt="mysql 5.6 > "
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1
Server version: 5.6.22-debug Source distribution

Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql 5.6 > DROP DATABASE test;CREATE DATABASE test;USE test;
Query OK, 0 rows affected (0.06 sec)

Query OK, 1 row affected (0.00 sec)

Database changed
mysql 5.6 > SET NAMES utf8,collation_connection=utf16le_bin;
Query OK, 0 rows affected (0.00 sec)

mysql 5.6 > select row('',1.5,3)IN (row(1,2,3),row('',1.5,3),row('','',''));
ERROR 2013 (HY000): Lost connection to MySQL server during query

Thank you for the bug report. Similar call stack with internal bug pointed by Shane:

Thread pointer: 0x16a46bf0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
13f5c4155    mysqld.exe!my_sigabrt_handler()[my_thr_init.c:458]
13fb99f4f    mysqld.exe!raise()[winsig.c:594]
13fba6850    mysqld.exe!abort()[abort.c:82]
13fb9751b    mysqld.exe!_wassert()[assert.c:380]
13fb0baec    mysqld.exe!my_strnncollsp_utf16_bin()[ctype-ucs2.c:1545]
13f0fbe73    mysqld.exe!sortcmp()[sql_string.cc:758]
13f0c398d    mysqld.exe!cmp_item_sort_string_in_static::compare()[item_cmpfunc.h:1300]
13f0b5b96    mysqld.exe!cmp_item_row::compare()[item_cmpfunc.cc:4252]
13f0bdbdd    mysqld.exe!cmp_row()[item_cmpfunc.cc:3866]
13f5e488b    mysqld.exe!my_qsort2()[mf_qsort.c:131]
13f0c64d8    mysqld.exe!in_vector::sort()[item_cmpfunc.h:931]
13f0b5174    mysqld.exe!Item_func_in::fix_length_and_dec()[item_cmpfunc.cc:4615]
13f170173    mysqld.exe!Item_func::fix_fields()[item_func.cc:232]
13f0b3fdc    mysqld.exe!Item_func_in::fix_fields()[item_cmpfunc.cc:4362]
13f27050c    mysqld.exe!setup_fields()[sql_base.cc:8304]
13f46e7fe    mysqld.exe!JOIN::prepare()[sql_resolver.cc:169]
13f40ea5e    mysqld.exe!mysql_prepare_select()[sql_select.cc:1054]
13f401999    mysqld.exe!mysql_select()[sql_select.cc:1180]
13f40172d    mysqld.exe!handle_select()[sql_select.cc:110]
13f212783    mysqld.exe!execute_sqlcom_select()[sql_parse.cc:5103]
13f204375    mysqld.exe!mysql_execute_command()[sql_parse.cc:2649]
13f202e02    mysqld.exe!mysql_parse()[sql_parse.cc:6357]
13f20c33e    mysqld.exe!dispatch_command()[sql_parse.cc:1335]
13f20b4a2    mysqld.exe!do_command()[sql_parse.cc:1034]
13f25c082    mysqld.exe!do_handle_one_connection()[sql_connect.cc:982]
13f25beb2    mysqld.exe!handle_one_connection()[sql_connect.cc:899]
13f5c26d6    mysqld.exe!pthread_start()[my_winthread.c:62]
13fbaa775    mysqld.exe!_callthreadstartex()[threadex.c:376]
13fbaa9c7    mysqld.exe!_threadstartex()[threadex.c:359]
771059ed    kernel32.dll!BaseThreadInitThunk()
7733c541    ntdll.dll!RtlUserThreadStart()

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (141a0db0): select row('',1.5,3)IN (row(1,2,3),row('',1.5,3),row('','',''))Connection ID (thread ID): 1
Status: NOT_KILLED

Please do not close an external bug until the internal one is fixed.

Fixed in 8.0.0 under the heading of

Bug#18487049 	ASSERTION FAILED: (SLEN % 4) == 0 IN MY_STRNNCOLLSP_UTF32