Bug #117999 crash when json_binary::parse_binary
Submitted: 17 Apr 1:47 Modified: 23 May 11:58
Reporter: han wang Email Updates:
Status: No Feedback Impact on me:
None 
Category:MySQL Server: JSON Severity:S3 (Non-critical)
Version:8.0.32 OS:Any
Assigned to: MySQL Verification Team CPU Architecture:Any

[17 Apr 1:47] han wang
Description:
2025-04-15T11:24:29Z UTC - mysqld got signal 11 ;
Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware.
BuildID[sha1]=cfc1c21377fb7dd79c8b7cc6c59a457d15fa06c2
Thread pointer: 0x7f5aa7b90000
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7f5ac203f2e0 thread_stack 0x100000
/usr/local/engine/bin/mysqld(my_print_stacktrace(unsigned char const*, unsigned long)+0x3d) [0x2de0c2d]
/usr/local/engine/bin/mysqld(print_fatal_signal(int)+0x3c3) [0x17c1da3]
/usr/local/engine/bin/mysqld(handle_fatal_signal+0x84) [0x17c1e34]
/lib64/libpthread.so.0(+0x13280) [0x7f5d817bb280]
/usr/local/engine/bin/mysqld(json_binary::parse_binary(char const*, unsigned long)+0x43) [0x1bc57b3]
/usr/local/engine/bin/mysqld(Field_json::val_json(Json_wrapper*) const+0x6b) [0x187e9db]
/usr/local/engine/bin/mysqld(Field_typed_array::key_cmp(unsigned char const*, unsigned int) const+0x16f) [0x188e5bf]
/usr/local/engine/bin/mysqld(key_cmp(KEY_PART_INFO*, unsigned char const*, unsigned int)+0xed) [0x13ef19d]
/usr/local/engine/bin/mysqld(handler::compare_key_in_buffer(unsigned char const*) const+0x92) [0x18bf662]
/usr/local/engine/bin/mysqld() [0x3084350]
/usr/local/engine/bin/mysqld(row_search_mvcc(unsigned char*, page_cur_mode_t, row_prebuilt_t*, unsigned long, unsigned long)+0x2c8e) [0x148fc0e]
/usr/local/engine/bin/mysqld(ha_innobase::index_next(unsigned char*)+0x8f) [0x144ed7f]
/usr/local/engine/bin/mysqld(handler::read_range_next()+0x5e) [0x13d9a6e]
/usr/local/engine/bin/mysqld(ha_innobase::read_range_next()+0x1c) [0x1450acc]
/usr/local/engine/bin/mysqld(DsMrr_impl::dsmrr_next(char**)+0x2f4) [0x13d9474]
/usr/local/engine/bin/mysqld(handler::ha_multi_range_read_next(char**)+0x28) [0x13d9118]
/usr/local/engine/bin/mysqld(IndexRangeScanIterator::Read()+0x42) [0x13fd252]
/usr/local/engine/bin/mysqld(FilterIterator::Read()+0xc3) [0x140ab33]
/usr/local/engine/bin/mysqld(LimitOffsetIterator::Read()+0x20) [0x1bf8670]
/usr/local/engine/bin/mysqld(Query_expression::ExecuteIteratorQuery(THD*)+0x25a) [0x139791a]
/usr/local/engine/bin/mysqld(Query_expression::execute(THD*)+0x26) [0x1397696]
/usr/local/engine/bin/mysqld(Sql_cmd_dml::execute(THD*)+0x4c8) [0x13888e8]
/usr/local/engine/bin/mysqld(mysql_execute_command(THD*, bool)+0x41e) [0x13760be]
/usr/local/engine/bin/mysqld(dispatch_sql_command(THD*, Parser_state*)+0xa24) [0x137ddd4]
/usr/local/engine/bin/mysqld(dispatch_command(THD*, COM_DATA const*, enum_server_command)+0x53a) [0x137efea]
/usr/local/engine/bin/mysqld(do_command(THD*)+0x14b) [0x137e81b]
/usr/local/engine/bin/mysqld(threadpool_process_request(THD*)+0x98) [0x150b858]
/usr/local/engine/bin/mysqld() [0x150c360]
/usr/local/engine/bin/mysqld() [0x370e086]
/lib64/libpthread.so.0(+0x8f4b) [0x7f5d817b0f4b]
/lib64/libc.so.6(clone+0x3f) [0x7f5d812437ef]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (7f5b206b9038): is an invalid pointer
Connection ID (thread ID): 7149000
Status: NOT_KILLED

How to repeat:
Concurrently execute the following statement:
select id from tree where 12345678 member of(path -> "$.p") and id > 7654321 order by id asc limit 5000;
type:
id bigint NOT NULL AUTO_INCREMENT
path json DEFAULT NULL.

key:
PRIMARY KEY (id),
KEY idx_path ((cast(json_extract(path,_utf8mb4'$.p') as unsigned array))
[23 Apr 11:58] MySQL Verification Team
Hi,

I need tables definitions and demo data for them to test this.

Also, did you try testing this on 8.0.42, you re using rather old release and lot of bugs are solved since then.
[24 May 1:00] Bugs System
No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".