MySQL Bugs: #1151: crash when specifing length for PRIMARY KEY

Bug #1151	crash when specifing length for PRIMARY KEY
Submitted:	27 Aug 2003 8:03	Modified:	27 Aug 2003 16:15
Reporter:	[ name withheld ]	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: InnoDB storage engine	Severity:	S3 (Non-critical)
Version:	4.0.14 standard	OS:	Linux (RH 9.0)
Assigned to:	Heikki Tuuri	CPU Architecture:	Any

Description:
Mysqld crashes when retrieving data from innodb table that has PRIMARY KEY with specified length. However using INDEX instead of PRIMARY KEY works fine.

How to repeat:
create table test (a char(2),primary key (a(1))) type=innodb;
insert into test (a) values ('b');
select * from test;

*CRASH HERE*

Verified. Backtrace:

InnoDB: Error: trying to access page number 9856 in space 0
InnoDB: which is outside the tablespace bounds.
InnoDB: Byte offset 0, len 16384, i/o type 10
030827 21:25:45  InnoDB: Assertion failure in thread 178099200 in file fil0fil.c line 1204
InnoDB: Failing assertion: 0
InnoDB: We intentionally generate a memory trap.
InnoDB: Send a detailed bug report to mysql@lists.mysql.com

Program received signal SIGSEGV, Segmentation fault.
0x81defb0 in fil_io (type=10, sync=1, space_id=0, block_offset=11520,
    byte_offset=0, len=16384, buf=0xa4f8000, message=0xa5ab1a0)
    at fil0fil.c:1204
1204                            ut_a(0);
Current language:  auto; currently c
(gdb) bt
#0  0x81defb0 in fil_io (type=10, sync=1, space_id=0, block_offset=11520, 
    byte_offset=0, len=16384, buf=0xa4f8000, message=0xa5ab1a0)
    at fil0fil.c:1204
#1  0x81c75ae in buf_read_page_low (sync=1, mode=132, space=0, offset=11520)
    at buf0rea.c:108
#2  0x81c784d in buf_read_page (space=0, offset=11520) at buf0rea.c:275
#3  0x81c10a4 in buf_page_get_gen (space=0, offset=11520, rw_latch=1, 
    guess=0x0, mode=10, 
    file=0x82f6280 "../../innobase/trx/../include/trx0undo.ic", line=147, 
    mtr=0xaa57680) at buf0buf.c:902
#4  0x81bb42c in trx_undo_page_get_s_latched (space=0, page_no=11520, 
    mtr=0xaa57680) at ../../innobase/trx/../include/trx0undo.ic:147
#5  0x81b36f5 in trx_undo_get_undo_rec_low (roll_ptr={high = 0, 
      low = 755008610}, heap=0x94b0020) at trx0rec.c:1212
#6  0x81b3755 in trx_undo_get_undo_rec (roll_ptr={high = 0, low = 755008610}, 
    trx_id={high = 0, low = 9175424}, undo_rec=0xaa57b90, heap=0x94b0020)
    at trx0rec.c:1250
#7  0x81b38a9 in trx_undo_prev_version_build (index_rec=0xa4fc087 "b", 
    index_mtr=0xaa58080, rec=0xa4fc087 "b", index=0x94af660, heap=0x94b0020, 
    old_vers=0xaa57fb8) at trx0rec.c:1336
#8  0x81982d3 in row_vers_build_for_consistent_read (rec=0xa4fc087 "b", 
    mtr=0xaa58080, index=0x94af660, view=0x94ae260, in_heap=0x94afe20, 
    old_vers=0xaa58074) at row0vers.c:408
#9  0x8193c6b in row_sel_build_prev_vers_for_mysql (read_view=0x94ae260, 
    clust_index=0x94af660, prebuilt=0x94af460, rec=0xa4fc087 "b", 
    old_vers=0xaa58074, mtr=0xaa58080) at row0sel.c:2280
#10 0x8194e2c in row_search_for_mysql (buf=0xaa5d980 "ÿ  ", mode=1, 
    prebuilt=0x94af460, match_mode=0, direction=0) at row0sel.c:3232
#11 0x80e4d9d in ha_innobase::index_read (this=0xaa5d898, buf=0xaa5d980 "ÿ  ", 
    key_ptr=0x0, key_len=0, find_flag=HA_READ_AFTER_KEY) at ha_innodb.cc:2699
#12 0x80e545c in ha_innobase::index_first (this=0xaa5d898, buf=0xaa5d980 "ÿ  ")
    at ha_innodb.cc:2935
#13 0x80a9eaf in join_read_first (tab=0xa9e7310) at sql_select.cc:5035
#14 0x80a907a in sub_select (join=0xaa586dc, join_tab=0xa9e7310, 
    end_of_records=false) at sql_select.cc:4598
#15 0x80a8db7 in do_select (join=0xaa586dc, fields=0xa9e61cc, table=0x0, 
    procedure=0x0) at sql_select.cc:4509
#16 0x80a0649 in mysql_select (thd=0xa9e6018, tables=0xa9e70c0, 
    fields=@0xa9e61cc, conds=0x0, order=0x0, group=0x0, having=0x0, 
    proc_param=0x0, select_options=17339392, result=0xa9e7110)
    at sql_select.cc:979
#17 0x809e66f in handle_select (thd=0xa9e6018, lex=0xa9e6148, result=0xa9e7110)
    at sql_select.cc:191
#18 0x8084396 in mysql_execute_command () at sql_parse.cc:1436
#19 0x8088319 in mysql_parse (thd=0xa9e6018, 
    inBuf=0xa9e7028 "select * from test", length=18) at sql_parse.cc:2958
#20 0x80834c7 in dispatch_command (command=COM_QUERY, thd=0xa9e6018, 
    packet=0xaa24019 "", packet_length=19) at sql_parse.cc:1065
#21 0x8082f36 in do_command (thd=0xa9e6018) at sql_parse.cc:940
#22 0x8082670 in handle_one_connection (arg=0xa9e6018) at sql_parse.cc:723
#23 0x2847341f in _thread_start () from /usr/lib/libc_r.so.4
#24 0x0 in ?? ()

Hi!

The bug is now fixed in upcoming 4.0.15, as well as a related bug I found in CHECK TABLE.

The bug happened if one created a column prefix index on a fixed size CHAR column.

Workaround: use VARCHAR.

Thank you for the bug report!

Heikki