Bug #111374 Assertion `m_return_field_def.auto_flags == Field::NONE' failed
Submitted: 13 Jun 2:30 Modified: 13 Jun 7:27
Reporter: Yu Liang Email Updates:
Status: Verified Impact on me:
None 
Category:MySQL Server: Stored Routines Severity:S6 (Debug Builds)
Version:8.0.33 OS:Ubuntu (20.04 LTS)
Assigned to: CPU Architecture:x86 (Intel(R) Core(TM) i7-10700 CPU)

[13 Jun 2:30] Yu Liang
Description:
The latest version of the MySQL Server (version 8.0.33) (git commit hash: ea7087d8850) crashes with Assertion Failure when executing the following query:

Config from "/etc/mysql/conf.d/mysql.cnf":

```
[mysqld]
sql_mode = "NO_ENGINE_SUBSTITUTION"
```

```sql
drop database if exists test123;
create database test123;
use test123;
CREATE FUNCTION v0 ( ) RETURNS SERIAL READS SQL DATA DETERMINISTIC RETURN PARAM_MARKER ;
```

The last query returns error: 

```
mysql> CREATE FUNCTION v0 ( ) RETURNS SERIAL READS SQL DATA DETERMINISTIC RETURN PARAM_MARKER ;
mysqld: /home/mysql/mysql-server/sql/sp_head.cc:1957: void sp_head::returns_type(THD *, String *) const: Assertion `m_return_field_def.auto_flags == Field::NONE' failed.
2023-06-13T01:12:04Z UTC - mysqld got signal 6 ;
Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware.
BuildID[sha1]=1d55d4671b7469352fc317efb0121b604c26443d
Thread pointer: 0xffff00001040
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = ffff94657538 thread_stack 0x100000
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(my_print_stacktrace(unsigned char const*, unsigned long)+0x60) [0x4e6bc30]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(print_fatal_signal(int)+0x340) [0x1a89320]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(handle_fatal_signal+0x16c) [0x1a896dc]
linux-vdso.so.1(__kernel_rt_sigreturn+0) [0xffff9ed217a0]
/lib/aarch64-linux-gnu/libc.so.6(gsignal+0xe0) [0xffff9e395d78]
/lib/aarch64-linux-gnu/libc.so.6(abort+0x114) [0xffff9e382aac]
/lib/aarch64-linux-gnu/libc.so.6(+0x2d490) [0xffff9e38f490]
/lib/aarch64-linux-gnu/libc.so.6(+0x2d4f4) [0xffff9e38f4f4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(sp_head::returns_type(THD*, String*) const+0x700) [0x13db700]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld() [0x24e4f84]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(sp_create_routine(THD*, sp_head*, LEX_USER const*, bool, bool&)+0x1e40) [0x24e37b8]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(mysql_execute_command(THD*, bool)+0xa060) [0x163351c]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(dispatch_sql_command(THD*, Parser_state*)+0x1124) [0x16252c0]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(dispatch_command(THD*, COM_DATA const*, enum_server_command)+0x5434) [0x161e224]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(do_command(THD*)+0xb8c) [0x16228f4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld() [0x1a59a64]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld() [0x655c1a0]
/lib/aarch64-linux-gnu/libpthread.so.0(+0x7624) [0xffff9ecc7624]
/lib/aarch64-linux-gnu/libc.so.6(+0xd149c) [0xffff9e43349c]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (ffff000d2230): CREATE FUNCTION v0 ( ) RETURNS SERIAL READS SQL DATA DETERMINISTIC RETURN PARAM_MARKER
Connection ID (thread ID): 8
Status: NOT_KILLED
```

How to repeat:
Steps to repeat the Assertion Failure:
1. Download the MySQL Server source code from the official github repo: `https://github.com/mysql/mysql-server`
2. Checkout to the latest mysql released version: 8.0.33 (hash: `ea7087d8850`)
3. Compile MySQL using the command: 

```
mkdir -p bld
cd bld
cmake .. -DDOWNLOAD_BOOST=1 -DWITH_BOOST=../boost -DWITH_UNIT_TESTS=OFF -DUSE_LD_GOLD=1 -DWITH_DEBUG=1
make
```

4. Run the MySQL Server with command: 

```
./bin/mysqld --basedir=$(pwd) --datadir=$(pwd)/data_all/ori_data --port=7000  --socket=/tmp/mysql_0.sock --mysqlx=OFF --performance_schema=OFF
```

5. Setup the MySQL Server config in the path: "/etc/mysql/conf.d/mysql.cnf"

```
[mysqld]
sql_mode = "NO_ENGINE_SUBSTITUTION"
```

6. Run the MySQL Client with the PoC:

```
./bin/mysql --port=7000 --user=root --socket=/tmp/mysql_0.sock < poc_0.sql
```

where `poc_0.sql` is:

```sql
drop database if exists test123;
create database test123;
use test123;
CREATE FUNCTION v0 ( ) RETURNS SERIAL READS SQL DATA DETERMINISTIC RETURN PARAM_MARKER ;
```

Suggested fix:
The server should continue running instead of crashing by Assertion Failure.
[13 Jun 7:27] MySQL Verification Team
Hello Yu Liang,

Thank you for the report and test case.
Observed that 8.0.33 only debug build is affected.

regards,
Umesh
[13 Jun 7:28] MySQL Verification Team
-- release build
 ./mtr bug111374 --nocheck-testcases
Logging: ./mtr  bug111374 --nocheck-testcases
MySQL Version 8.0.33
Checking supported features
Using 'all' suites
Collecting tests
Checking leftover processes
Removing old var directory
Creating var directory '/export/home/tmp/ushastry/binaries/mysql-8.0.33/mysql-test/var'
Installing system database
Using parallel: 1

==============================================================================
                  TEST NAME                       RESULT  TIME (ms) COMMENT
------------------------------------------------------------------------------
drop database if exists test123;
Warnings:
Note    1008    Can't drop database 'test123'; database doesn't exist
create database test123;
use test123;
CREATE FUNCTION v0 ( ) RETURNS SERIAL READS SQL DATA DETERMINISTIC RETURN PARAM_MARKER ;
[ 50%] main.bug111374                            [ pass ]     13
[100%] shutdown_report                           [ pass ]

-- debug build - affected

 ./mtr bug111374 --nocheck-testcases --debug-server
Logging: ./mtr  bug111374 --nocheck-testcases --debug-server
MySQL Version 8.0.33
Checking supported features
 - Binaries are debug compiled
Using 'all' suites
Collecting tests
Checking leftover processes
Removing old var directory
Creating var directory '/export/home/tmp/ushastry/binaries/mysql-8.0.33/mysql-test/var'
Installing system database
Using parallel: 1

==============================================================================
                  TEST NAME                       RESULT  TIME (ms) COMMENT
------------------------------------------------------------------------------
drop database if exists test123;
Warnings:
Note    1008    Can't drop database 'test123'; database doesn't exist
create database test123;
use test123;
CREATE FUNCTION v0 ( ) RETURNS SERIAL READS SQL DATA DETERMINISTIC RETURN PARAM_MARKER ;
[ 50%] main.bug111374                            [ fail ]
        Test ended at 2023-06-13 09:26:29

CURRENT_TEST: main.bug111374
mysqltest: At line 4: Query 'CREATE FUNCTION v0 ( ) RETURNS SERIAL READS SQL DATA DETERMINISTIC RETURN PARAM_MARKER ' failed.
ERROR 2013 (HY000): Lost connection to MySQL server during query

-bt

#0  0x00007fd80c191aa1 in pthread_kill () from /lib64/libpthread.so.0
#1  0x0000000004005426 in my_write_core(int) ()
#2  0x00000000032b0166 in handle_fatal_signal ()
#3  <signal handler called>
#4  0x00007fd80a652387 in raise () from /lib64/libc.so.6
#5  0x00007fd80a653a78 in abort () from /lib64/libc.so.6
#6  0x00007fd80a64b1a6 in __assert_fail_base () from /lib64/libc.so.6
#7  0x00007fd80a64b252 in __assert_fail () from /lib64/libc.so.6
#8  0x0000000003073f06 in sp_head::returns_type(THD*, String*) const ()
#9  0x00000000035c0f83 in sp_binlog_create_routine_stmt(THD*, sp_head*, LEX_USER const*, bool, bool) ()
#10 0x00000000035c3529 in sp_create_routine(THD*, sp_head*, LEX_USER const*, bool, bool&) ()
#11 0x000000000313eee4 in mysql_execute_command(THD*, bool) ()
#12 0x0000000003140bc8 in dispatch_sql_command(THD*, Parser_state*) ()
#13 0x00000000031421fb in dispatch_command(THD*, COM_DATA const*, enum_server_command) ()
#14 0x0000000003143e97 in do_command(THD*) ()
#15 0x00000000032a219e in handle_connection ()
#16 0x00000000047b1601 in pfs_spawn_thread ()
#17 0x00007fd80c18cea5 in start_thread () from /lib64/libpthread.so.0
#18 0x00007fd80a71ab2d in clone () from /lib64/libc.so.6