Bug #111373 Assertion `!sl->order_list.first' failed
Submitted: 13 Jun 2023 2:27 Modified: 13 Jun 2023 7:21
Reporter: Yu Liang Email Updates:
Status: Verified Impact on me:
None 
Category:MySQL Server: DDL Severity:S6 (Debug Builds)
Version:8.0.33 OS:Ubuntu (20.04 LTS)
Assigned to: CPU Architecture:x86 (Intel(R) Core(TM) i7-10700 CPU)

[13 Jun 2023 2:27] Yu Liang
Description:
The latest version of the MySQL Server (version 8.0.33) (git commit hash: ea7087d8850) crashes with Assertion Failure when executing the following query:

Config from "/etc/mysql/conf.d/mysql.cnf":

```
[mysqld]
sql_mode = "NO_ENGINE_SUBSTITUTION"
```

```sql
drop database if exists test123;
create database test123;
use test123;
create table v0(c1 INT);
CREATE TABLE IF NOT EXISTS v3 ( c4 INT  ) AS TABLE v0 ORDER BY c1 > ALL (VALUES ROW ( TRUE ) ORDER BY TRUE ) ;
```

The last query returns error: 

```
mysql> CREATE TABLE IF NOT EXISTS v3 ( c4 INT  ) AS TABLE v0 ORDER BY c1 > ALL (VALUES ROW ( TRUE ) ORDER BY TRUE ) ;
mysqld: /home/mysql/mysql-server/sql/item_subselect.cc:2415: bool Item_in_subselect::select_in_like_transformer(THD *, Query_block *, Comp_creator *): Assertion `!sl->order_list.first' failed.
2023-06-13T00:59:56Z UTC - mysqld got signal 6 ;
Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware.
BuildID[sha1]=1d55d4671b7469352fc317efb0121b604c26443d
Thread pointer: 0xffff10001040
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = ffffb45c8538 thread_stack 0x100000
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(my_print_stacktrace(unsigned char const*, unsigned long)+0x60) [0x4e6bc30]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(print_fatal_signal(int)+0x340) [0x1a89320]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(handle_fatal_signal+0x16c) [0x1a896dc]
linux-vdso.so.1(__kernel_rt_sigreturn+0) [0xffffb9c6d7a0]
/lib/aarch64-linux-gnu/libc.so.6(gsignal+0xe0) [0xffffb92e1d78]
/lib/aarch64-linux-gnu/libc.so.6(abort+0x114) [0xffffb92ceaac]
/lib/aarch64-linux-gnu/libc.so.6(+0x2d490) [0xffffb92db490]
/lib/aarch64-linux-gnu/libc.so.6(+0x2d4f4) [0xffffb92db4f4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_in_subselect::select_in_like_transformer(THD*, Query_block*, Comp_creator*)+0x604) [0x210ea08]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_allany_subselect::select_transformer(THD*, Query_block*)+0x9c) [0x210fd14]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_block::resolve_subquery(THD*)+0xd20) [0x16dfab0]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_block::prepare_values(THD*)+0x260) [0x16d8300]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_block::prepare(THD*, mem_root_deque<Item*>*)+0x140) [0x16d4b1c]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_expression::prepare(THD*, Query_result*, mem_root_deque<Item*>*, unsigned long long, unsigned long long)+0x7d8) [0x18abef0]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_subselect::fix_fields(THD*, Item**)+0x270) [0x20f93f8]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_in_subselect::fix_fields(THD*, Item**)+0x13c) [0x210ef2c]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_func::fix_func_arg(THD*, Item**)+0x60) [0x1fb93b4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_func::fix_fields(THD*, Item**)+0x1d4) [0x1fb9138]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(find_order_in_list(THD*, Bounds_checked_array<Item*>, Table_ref*, ORDER*, mem_root_deque<Item*>*, bool, bool)+0xe9c) [0x1701820]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(setup_order(THD*, Bounds_checked_array<Item*>, Table_ref*, mem_root_deque<Item*>*, ORDER*)+0x3fc) [0x16dd028]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_block::prepare(THD*, mem_root_deque<Item*>*)+0x1520) [0x16d5efc]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_expression::prepare(THD*, Query_result*, mem_root_deque<Item*>*, unsigned long long, unsigned long long)+0x7d8) [0x18abef0]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Sql_cmd_create_table::execute(THD*)+0x1dfc) [0x25737e8]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(mysql_execute_command(THD*, bool)+0x3884) [0x162cd40]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(dispatch_sql_command(THD*, Parser_state*)+0x1124) [0x16252c0]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(dispatch_command(THD*, COM_DATA const*, enum_server_command)+0x5434) [0x161e224]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(do_command(THD*)+0xb8c) [0x16228f4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld() [0x1a59a64]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld() [0x655c1a0]
/lib/aarch64-linux-gnu/libpthread.so.0(+0x7624) [0xffffb9c13624]
/lib/aarch64-linux-gnu/libc.so.6(+0xd149c) [0xffffb937f49c]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (ffff100243c0): CREATE TABLE IF NOT EXISTS v3 ( c4 INT  ) AS TABLE v0 ORDER BY c1 > ALL (VALUES ROW ( TRUE ) ORDER BY TRUE )
Connection ID (thread ID): 8
Status: NOT_KILLED
```

How to repeat:
Steps to repeat the Assertion Failure:
1. Download the MySQL Server source code from the official github repo: `https://github.com/mysql/mysql-server`
2. Checkout to the latest mysql released version: 8.0.33 (hash: `ea7087d8850`)
3. Compile MySQL using the command: 

```
mkdir -p bld
cd bld
cmake .. -DDOWNLOAD_BOOST=1 -DWITH_BOOST=../boost -DWITH_UNIT_TESTS=OFF -DUSE_LD_GOLD=1 -DWITH_DEBUG=1
make
```

4. Run the MySQL Server with command: 

```
./bin/mysqld --basedir=$(pwd) --datadir=$(pwd)/data_all/ori_data --port=7000  --socket=/tmp/mysql_0.sock --mysqlx=OFF --performance_schema=OFF
```

5. Setup the MySQL Server config in the path: "/etc/mysql/conf.d/mysql.cnf"

```
[mysqld]
sql_mode = "NO_ENGINE_SUBSTITUTION"
```

6. Run the MySQL Client with the PoC:

```
./bin/mysql --port=7000 --user=root --socket=/tmp/mysql_0.sock < poc_0.sql
```

where `poc_0.sql` is:

```sql
drop database if exists test123;
create database test123;
use test123;
create table v0(c1 INT);
CREATE TABLE IF NOT EXISTS v3 ( c4 INT  ) AS TABLE v0 ORDER BY c1 > ALL (VALUES ROW ( TRUE ) ORDER BY TRUE ) ;
```

Suggested fix:
The server should continue running instead of crashing by Assertion Failure.
[13 Jun 2023 7:21] MySQL Verification Team
Hello Yu Liang,

Thank you for the report and test case.
Observed that 8.0.33 only debug build is affected.

regards,
Umesh
[13 Jun 2023 7:23] MySQL Verification Team
-- release build
 ./mtr bug111373 --nocheck-testcases
Logging: ./mtr  bug111373 --nocheck-testcases
MySQL Version 8.0.33
Checking supported features
Using 'all' suites
Collecting tests
Checking leftover processes
Removing old var directory
Creating var directory '/export/home/tmp/ushastry/binaries/mysql-8.0.33/mysql-test/var'
Installing system database
Using parallel: 1

==============================================================================
                  TEST NAME                       RESULT  TIME (ms) COMMENT
------------------------------------------------------------------------------
drop database if exists test123;
Warnings:
Note    1008    Can't drop database 'test123'; database doesn't exist
create database test123;
use test123;
create table v0(c1 INT);
CREATE TABLE IF NOT EXISTS v3 ( c4 INT  ) AS TABLE v0 ORDER BY c1 > ALL (VALUES ROW ( TRUE ) ORDER BY TRUE ) ;
[ 50%] main.bug111373                            [ pass ]    111
[100%] shutdown_report                           [ pass ]

-- debug build - affected

./mtr bug111373 --nocheck-testcases --debug-server
Logging: ./mtr  bug111373 --nocheck-testcases --debug-server
MySQL Version 8.0.33
Checking supported features
 - Binaries are debug compiled
Using 'all' suites
Collecting tests
Checking leftover processes
Removing old var directory
Creating var directory '/export/home/tmp/ushastry/binaries/mysql-8.0.33/mysql-test/var'
Installing system database
Using parallel: 1

==============================================================================
                  TEST NAME                       RESULT  TIME (ms) COMMENT
------------------------------------------------------------------------------
drop database if exists test123;
Warnings:
Note    1008    Can't drop database 'test123'; database doesn't exist
create database test123;
use test123;
create table v0(c1 INT);
CREATE TABLE IF NOT EXISTS v3 ( c4 INT  ) AS TABLE v0 ORDER BY c1 > ALL (VALUES ROW ( TRUE ) ORDER BY TRUE ) ;
[ 50%] main.bug111373                            [ fail ]
        Test ended at 2023-06-13 09:20:30

CURRENT_TEST: main.bug111373
mysqltest: At line 6: Query 'CREATE TABLE IF NOT EXISTS v3 ( c4 INT  ) AS TABLE v0 ORDER BY c1 > ALL (VALUES ROW ( TRUE ) ORDER BY TRUE ) ' failed.
ERROR 2013 (HY000): Lost connection to MySQL server during query

-bt
#0  0x00007fc2f0cbeaa1 in pthread_kill () from /lib64/libpthread.so.0
#1  0x0000000004005426 in my_write_core(int) ()
#2  0x00000000032b0166 in handle_fatal_signal ()
#3  <signal handler called>
#4  0x00007fc2ef17f387 in raise () from /lib64/libc.so.6
#5  0x00007fc2ef180a78 in abort () from /lib64/libc.so.6
#6  0x00007fc2ef1781a6 in __assert_fail_base () from /lib64/libc.so.6
#7  0x00007fc2ef178252 in __assert_fail () from /lib64/libc.so.6
#8  0x00000000034a920d in Item_in_subselect::select_in_like_transformer(THD*, Query_block*, Comp_creator*) ()
#9  0x00000000034a9418 in Item_allany_subselect::select_transformer(THD*, Query_block*) ()
#10 0x000000000317f116 in Query_block::resolve_subquery(THD*) ()
#11 0x000000000317f460 in Query_block::prepare_values(THD*) ()
#12 0x0000000003187e04 in Query_block::prepare(THD*, mem_root_deque<Item*>*) ()
#13 0x0000000003209cd7 in Query_expression::prepare(THD*, Query_result*, mem_root_deque<Item*>*, unsigned long long, unsigned long long) ()
#14 0x00000000034a374a in SubqueryWithResult::prepare(THD*) ()
#15 0x00000000034a9cb6 in Item_subselect::fix_fields(THD*, Item**) ()
#16 0x00000000034a9ea5 in Item_in_subselect::fix_fields(THD*, Item**) ()
#17 0x00000000034583d5 in Item_func::fix_func_arg(THD*, Item**) ()
#18 0x00000000034585b8 in Item_func::fix_fields(THD*, Item**) ()
#19 0x000000000317e357 in find_order_in_list(THD*, Bounds_checked_array<Item*>, Table_ref*, ORDER*, mem_root_deque<Item*>*, bool, bool) ()
#20 0x000000000317e5ab in setup_order(THD*, Bounds_checked_array<Item*>, Table_ref*, mem_root_deque<Item*>*, ORDER*) ()
#21 0x00000000031884b7 in Query_block::prepare(THD*, mem_root_deque<Item*>*) ()
#22 0x0000000003209cd7 in Query_expression::prepare(THD*, Query_result*, mem_root_deque<Item*>*, unsigned long long, unsigned long long) ()
#23 0x00000000035eea00 in Sql_cmd_create_table::execute(THD*) ()
#24 0x000000000313d2da in mysql_execute_command(THD*, bool) ()
#25 0x0000000003140bc8 in dispatch_sql_command(THD*, Parser_state*) ()
#26 0x00000000031421fb in dispatch_command(THD*, COM_DATA const*, enum_server_command) ()
#27 0x0000000003143e97 in do_command(THD*) ()
#28 0x00000000032a219e in handle_connection ()
#29 0x00000000047b1601 in pfs_spawn_thread ()
#30 0x00007fc2f0cb9ea5 in start_thread () from /lib64/libpthread.so.0
#31 0x00007fc2ef247b2d in clone () from /lib64/libc.so.6