MySQL Bugs: #107722: Assertion `tab->ref().use

Bug #107722	Assertion `tab->ref().use_count' failed in MySQL 5.7.38
Submitted:	1 Jul 2022 10:58	Modified:	1 Jul 2022 11:37
Reporter:	Wang Ke	Email Updates:
Status:	Verified	Impact on me:	None
Category:	MySQL Server: Optimizer	Severity:	S6 (Debug Builds)
Version:	5.7.38	OS:	Any
Assigned to:		CPU Architecture:	Any
Tags:	assertion failure

Description:
An assertion failure occurred in mysql-5.7.38-debug-asan:

Log file:

```
2022-07-01T10:52:42.828619Z 0 [Note] /home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld: ready for connections.
Version: '5.7.38-debug-asan'  socket: '/tmp/mysql.sock'  port: 3306  Source distribution
mysqld: /home/mysql-server/mysql-5.7.38/sql/sql_executor.cc:2140: void join_read_key_unlock_row(QEP_TAB *): Assertion `tab->ref().use_count' failed.
10:53:00 UTC - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
Attempting to collect some information that could help diagnose the problem.
As this is a crash and something is definitely wrong, the information
collection process might fail.

key_buffer_size=8388608
read_buffer_size=131072
max_used_connections=1
max_threads=151
thread_count=1
connection_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 68262 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x628000090100
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7f3f98975d60 thread_stack 0x40000
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(__interceptor_backtrace+0x5b)[0xe4a13b]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(my_print_stacktrace+0x105)[0x32cf815]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(handle_fatal_signal+0x6ae)[0xf0c06e]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7f3fbf42e390]
/lib/x86_64-linux-gnu/libc.so.6(gsignal+0x38)[0x7f3fbe377438]
/lib/x86_64-linux-gnu/libc.so.6(abort+0x16a)[0x7f3fbe37903a]
/lib/x86_64-linux-gnu/libc.so.6(+0x2dbe7)[0x7f3fbe36fbe7]
/lib/x86_64-linux-gnu/libc.so.6(+0x2dc92)[0x7f3fbe36fc92]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(_Z24join_read_key_unlock_rowP7QEP_TAB+0x201)[0x2647a11]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld[0x263fe15]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(_Z10sub_selectP4JOINP7QEP_TABb+0xbb6)[0x263ea66]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld[0x2640df0]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(_Z10sub_selectP4JOINP7QEP_TABb+0xbb6)[0x263ea66]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld[0x26302a7]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(_ZN4JOIN4execEv+0xfb7)[0x262e5d7]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(_Z12handle_queryP3THDP3LEXP12Query_resultyy+0xb94)[0x2869e24]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld[0x2752fa4]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(_Z21mysql_execute_commandP3THDb+0x337c)[0x273842c]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(_Z11mysql_parseP3THDP12Parser_state+0x137a)[0x273140a]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(_Z16dispatch_commandP3THDPK8COM_DATA19enum_server_command+0x38de)[0x272b10e]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(_Z10do_commandP3THD+0x99a)[0x272e9fa]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(handle_connection+0x482)[0x2b5c6d2]
/home/mysql-server/mysql-5.7.38-origin-dev/bin/mysqld(pfs_spawn_thread+0x324)[0x433d7a4]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7f3fbf4246ba]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x6d)[0x7f3fbe44951d]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (60800003d6d0): SELECT ra0 . b FROM s ra0 NATURAL JOIN t ra1
Connection ID (thread ID): 2
Status: NOT_KILLED

The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.
```

How to repeat:
Test case:

```
CREATE TABLE t ( a INT , b INT ) ENGINE = innodb ;
INSERT INTO t VALUES ( 2 , 0 ) , ( 0 , 0 ) ;
CREATE TABLE s ( a INT AUTO_INCREMENT KEY , b INT ) ENGINE = archive ;
INSERT INTO s VALUES ( 1 , 1 ) , ( 2 , 2 ) , ( 3 , 2 ) , ( 4 , 3 ) , ( 5 , 3 ) ;
SELECT ra0 . b FROM s ra0 NATURAL JOIN t ra1 ;
```

Hello Wang Ke,

Thank you for the report and test case.
Observed that 5.7.38 debug build is affected with provided test case.

regards,
Umesh

- 5.7.38 release build not affected

rm -rf 107722/
bin/mysqld --initialize-insecure --basedir=$PWD --datadir=$PWD/107722 --log-error-verbosity=3
bin/mysqld --no-defaults --basedir=$PWD --datadir=$PWD/107722 --core-file --socket=/tmp/mysql.sock --port=3306 --log-error=$PWD/107722/log.err --log-error-verbosity=3 --secure-file-priv=""  --performance-schema=ON 2>&1 &

 bin/mysql -uroot -S /tmp/mysql.sock
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.7.38 MySQL Community Server (GPL)

Copyright (c) 2000, 2022, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> create database test;
Query OK, 1 row affected (0.00 sec)

mysql> use test
Database changed
mysql> CREATE TABLE t ( a INT , b INT ) ENGINE = innodb ;
Query OK, 0 rows affected (0.01 sec)

mysql> INSERT INTO t VALUES ( 2 , 0 ) , ( 0 , 0 ) ;
Query OK, 2 rows affected (0.00 sec)
Records: 2  Duplicates: 0  Warnings: 0

mysql> CREATE TABLE s ( a INT AUTO_INCREMENT KEY , b INT ) ENGINE = archive ;
Query OK, 0 rows affected (0.00 sec)

mysql> INSERT INTO s VALUES ( 1 , 1 ) , ( 2 , 2 ) , ( 3 , 2 ) , ( 4 , 3 ) , ( 5 , 3 ) ;
Query OK, 5 rows affected (0.00 sec)
Records: 5  Duplicates: 0  Warnings: 0

mysql> SELECT ra0 . b FROM s ra0 NATURAL JOIN t ra1 ;
Empty set (0.00 sec)

-- debug build affected

 bin/mysql -uroot -S /tmp/mysql.sock
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.7.38-debug MySQL Community Server - Debug (GPL)

Copyright (c) 2000, 2022, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> use test
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> SELECT ra0 . b FROM s ra0 NATURAL JOIN t ra1 ;
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql>

- 8.0.29 release/debug not affected