Bug #111379 Assertion `context->query_block == thd->lex->current_query_block()' failed
Submitted: 13 Jun 2023 2:48 Modified: 4 Jul 2023 0:18
Reporter: Yu Liang Email Updates:
Status: Verified Impact on me:
None 
Category:MySQL Server: Optimizer Severity:S6 (Debug Builds)
Version:8.0.33 OS:Ubuntu (20.04 LTS)
Assigned to: CPU Architecture:x86 (Intel(R) Core(TM) i7-10700 CPU)

[13 Jun 2023 2:48] Yu Liang
Description:
The latest version of the MySQL Server (version 8.0.33) (git commit hash: ea7087d8850) crashes with Assertion Failure when executing the following query:

Config from "/etc/mysql/conf.d/mysql.cnf":

```
[mysqld]
sql_mode = "NO_ENGINE_SUBSTITUTION"
```

```sql
drop database if exists test123;
create database test123;
use test123;
create table v0(c1 INT);
SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ;
```

The last query returns error: 

```
mysql> SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ;
mysqld: /home/mysql/mysql-server/sql/item.cc:8012: virtual bool Item_ref::fix_fields(THD *, Item **): Assertion `context->query_block == thd->lex->current_query_block()' failed.
2023-06-13T01:43:36Z UTC - mysqld got signal 6 ;
Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware.
BuildID[sha1]=1d55d4671b7469352fc317efb0121b604c26443d
Thread pointer: 0xfffefc001040
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = ffff984bb538 thread_stack 0x100000
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(my_print_stacktrace(unsigned char const*, unsigned long)+0x60) [0x4e6bc30]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(print_fatal_signal(int)+0x340) [0x1a89320]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(handle_fatal_signal+0x16c) [0x1a896dc]
linux-vdso.so.1(__kernel_rt_sigreturn+0) [0xffffa23a67a0]
/lib/aarch64-linux-gnu/libc.so.6(gsignal+0xe0) [0xffffa1a1ad78]
/lib/aarch64-linux-gnu/libc.so.6(abort+0x114) [0xffffa1a07aac]
/lib/aarch64-linux-gnu/libc.so.6(+0x2d490) [0xffffa1a14490]
/lib/aarch64-linux-gnu/libc.so.6(+0x2d4f4) [0xffffa1a144f4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_ref::fix_fields(THD*, Item**)+0x13b0) [0x1eb8b30]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_field::fix_outer_field(THD*, Field**, Item**)+0xfa4) [0x1ea2c08]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_field::fix_fields(THD*, Item**)+0xd0c) [0x1ea5758]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(find_order_in_list(THD*, Bounds_checked_array<Item*>, Table_ref*, ORDER*, mem_root_deque<Item*>*, bool, bool)+0xe9c) [0x1701820]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(setup_order(THD*, Bounds_checked_array<Item*>, Table_ref*, mem_root_deque<Item*>*, ORDER*)+0x3fc) [0x16dd028]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_block::prepare(THD*, mem_root_deque<Item*>*)+0x1520) [0x16d5efc]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_expression::prepare(THD*, Query_result*, mem_root_deque<Item*>*, unsigned long long, unsigned long long)+0x7d8) [0x18abef0]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_subselect::fix_fields(THD*, Item**)+0x270) [0x20f93f8]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_func::fix_func_arg(THD*, Item**)+0x60) [0x1fb93b4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_func::fix_fields(THD*, Item**)+0x1d4) [0x1fb9138]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_block::prepare(THD*, mem_root_deque<Item*>*)+0x1900) [0x16d62dc]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Sql_cmd_select::prepare_inner(THD*)+0x3d4) [0x17371ac]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Sql_cmd_dml::prepare(THD*)+0xa28) [0x173632c]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Sql_cmd_dml::execute(THD*)+0x538) [0x1737bb4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(mysql_execute_command(THD*, bool)+0x281c) [0x162bcd8]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(dispatch_sql_command(THD*, Parser_state*)+0x1124) [0x16252c0]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(dispatch_command(THD*, COM_DATA const*, enum_server_command)+0x5434) [0x161e224]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(do_command(THD*)+0xb8c) [0x16228f4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld() [0x1a59a64]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld() [0x655c1a0]
/lib/aarch64-linux-gnu/libpthread.so.0(+0x7624) [0xffffa234c624]
/lib/aarch64-linux-gnu/libc.so.6(+0xd149c) [0xffffa1ab849c]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (fffefc0243c0): SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) )
Connection ID (thread ID): 8
Status: NOT_KILLED
```

How to repeat:
Steps to repeat the Assertion Failure:
1. Download the MySQL Server source code from the official github repo: `https://github.com/mysql/mysql-server`
2. Checkout to the latest mysql released version: 8.0.33 (hash: `ea7087d8850`)
3. Compile MySQL using the command: 

```
mkdir -p bld
cd bld
cmake .. -DDOWNLOAD_BOOST=1 -DWITH_BOOST=../boost -DWITH_UNIT_TESTS=OFF -DUSE_LD_GOLD=1 -DWITH_DEBUG=1
make
```

4. Run the MySQL Server with command: 

```
./bin/mysqld --basedir=$(pwd) --datadir=$(pwd)/data_all/ori_data --port=7000  --socket=/tmp/mysql_0.sock --mysqlx=OFF --performance_schema=OFF
```

5. Setup the MySQL Server config in the path: "/etc/mysql/conf.d/mysql.cnf"

```
[mysqld]
sql_mode = "NO_ENGINE_SUBSTITUTION"
```

6. Run the MySQL Client with the PoC:

```
./bin/mysql --port=7000 --user=root --socket=/tmp/mysql_0.sock < poc_0.sql
```

where `poc_0.sql` is:

```sql
drop database if exists test123;
create database test123;
use test123;
create table v0(c1 INT);
SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ;
```

Suggested fix:
The server should continue running instead of crashing by Assertion Failure.
[13 Jun 2023 8:07] MySQL Verification Team
Hello Yu Liang,

Thank you for the report and test case.
Observed that 8.0.33 only debug build is affected.

regards,
Umesh
[13 Jun 2023 8:08] MySQL Verification Team
-- release build
 ./mtr bug111379 --nocheck-testcases
Logging: ./mtr  bug111379 --nocheck-testcases
MySQL Version 8.0.33
Checking supported features
Using 'all' suites
Collecting tests
Checking leftover processes
Removing old var directory
Creating var directory '/export/home/tmp/ushastry/binaries/mysql-8.0.33/mysql-test/var'
Installing system database
Using parallel: 1

==============================================================================
                  TEST NAME                       RESULT  TIME (ms) COMMENT
------------------------------------------------------------------------------
drop database if exists test123;
Warnings:
Note    1008    Can't drop database 'test123'; database doesn't exist
create database test123;
use test123;
create table v0(c1 INT);
SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ;
c1
[ 50%] main.bug111379                            [ pass ]     83
[100%] shutdown_report                           [ pass ]

-- debug build - affected

 ./mtr bug111379 --nocheck-testcases --debug-server
Logging: ./mtr  bug111379 --nocheck-testcases --debug-server
MySQL Version 8.0.33
Checking supported features
 - Binaries are debug compiled
Using 'all' suites
Collecting tests
Checking leftover processes
Removing old var directory
Creating var directory '/export/home/tmp/ushastry/binaries/mysql-8.0.33/mysql-test/var'
Installing system database
Using parallel: 1

==============================================================================
                  TEST NAME                       RESULT  TIME (ms) COMMENT
------------------------------------------------------------------------------
drop database if exists test123;
Warnings:
Note    1008    Can't drop database 'test123'; database doesn't exist
create database test123;
use test123;
create table v0(c1 INT);
SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ;
[ 50%] main.bug111379                            [ fail ]
        Test ended at 2023-06-13 10:06:28

CURRENT_TEST: main.bug111379
mysqltest: At line 5: Query 'SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ' failed.
ERROR 2013 (HY000): Lost connection to MySQL server during query

-bt

#0  0x00007f16457b8aa1 in pthread_kill () from /lib64/libpthread.so.0
#1  0x0000000004005426 in my_write_core(int) ()
#2  0x00000000032b0166 in handle_fatal_signal ()
#3  <signal handler called>
#4  0x00007f1643c79387 in raise () from /lib64/libc.so.6
#5  0x00007f1643c7aa78 in abort () from /lib64/libc.so.6
#6  0x00007f1643c721a6 in __assert_fail_base () from /lib64/libc.so.6
#7  0x00007f1643c72252 in __assert_fail () from /lib64/libc.so.6
#8  0x0000000003403b59 in Item_ref::fix_fields(THD*, Item**) ()
#9  0x00000000034051c9 in Item_field::fix_outer_field(THD*, Field**, Item**) ()
#10 0x0000000003405769 in Item_field::fix_fields(THD*, Item**) ()
#11 0x000000000317e357 in find_order_in_list(THD*, Bounds_checked_array<Item*>, Table_ref*, ORDER*, mem_root_deque<Item*>*, bool, bool) ()
#12 0x000000000317e5ab in setup_order(THD*, Bounds_checked_array<Item*>, Table_ref*, mem_root_deque<Item*>*, ORDER*) ()
#13 0x00000000031884b7 in Query_block::prepare(THD*, mem_root_deque<Item*>*) ()
#14 0x0000000003209cd7 in Query_expression::prepare(THD*, Query_result*, mem_root_deque<Item*>*, unsigned long long, unsigned long long) ()
#15 0x00000000034a374a in SubqueryWithResult::prepare(THD*) ()
#16 0x00000000034a9cb6 in Item_subselect::fix_fields(THD*, Item**) ()
#17 0x00000000034583d5 in Item_func::fix_func_arg(THD*, Item**) ()
#18 0x00000000034585b8 in Item_func::fix_fields(THD*, Item**) ()
#19 0x0000000003188327 in Query_block::prepare(THD*, mem_root_deque<Item*>*) ()
#20 0x0000000003194935 in Sql_cmd_select::prepare_inner(THD*) ()
#21 0x000000000319e16d in Sql_cmd_dml::prepare(THD*) ()
#22 0x000000000319e48e in Sql_cmd_dml::execute(THD*) ()
#23 0x000000000313f789 in mysql_execute_command(THD*, bool) ()
#24 0x0000000003140bc8 in dispatch_sql_command(THD*, Parser_state*) ()
#25 0x00000000031421fb in dispatch_command(THD*, COM_DATA const*, enum_server_command) ()
#26 0x0000000003143e97 in do_command(THD*) ()
#27 0x00000000032a219e in handle_connection ()
#28 0x00000000047b1601 in pfs_spawn_thread ()
#29 0x00007f16457b3ea5 in start_thread () from /lib64/libpthread.so.0
#30 0x00007f1643d41b2d in clone () from /lib64/libc.so.6
[4 Jul 2023 0:18] Yu Liang
After running bisecting, the bug seems to be introduced in commit: `8e7252ecf14290edc3b486245d34d4e3ea84126a`. The buggy introduced commit contains no commit messages, so I am not sure what has been changed under the hood. 

At the same time, bug #111305 and bug #111307 shares the same bug introduced commit in the bisecting process. We are not sure whether these three bugs are due to the same root cause.