MySQL Bugs: #119802: Assertion 'is_nullable()' failed in Item_typecast_signed::val

Bug #119802	Assertion 'is_nullable()' failed in Item_typecast_signed::val_int()
Submitted:	28 Jan 13:49	Modified:	28 Jan 15:52
Reporter:	Jason Tang	Email Updates:
Status:	Verified	Impact on me:	None
Category:	MySQL Server: Optimizer	Severity:	S2 (Serious)
Version:	8.0.42+	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
When executing queries containing nested BETWEEN and CAST(... AS SIGNED), the MySQL server triggers an assertion failure and crashes.

How to repeat:
DROP DATABASE IF EXISTS database0;
CREATE DATABASE database0;
USE database0;

CREATE TABLE t0(c0 BIGINT UNIQUE KEY PRIMARY KEY NOT NULL) ENGINE = MEMORY;

INSERT INTO t0(c0) VALUES (-1373303868), (1), (0);

SELECT ALL t0.c0 AS ref0 FROM t0
WHERE ((- ((-1446481176) | (t0.c0)))) BETWEEN
    (((178959534) && (t0.c0)) BETWEEN
        ((CASE t0.c0 WHEN 178959534 THEN '' WHEN t0.c0 THEN t0.c0 WHEN t0.c0 THEN t0.c0 ELSE t0.c0 END))
        AND ((t0.c0) IS NOT TRUE))
    AND (CAST(('461765998') > (t0.c0) AS SIGNED));

this is the callback:

mysqld: /home/tzx/mysql-server-mysql-8.0.42/sql/item_func.cc:1879: virtual longlong Item_typecast_signed::val_int(): Assertion `is_nullable()' failed.
2026-01-28T13:38:13Z UTC - mysqld got signal 6 ;
Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware.
BuildID[sha1]=74c66055f3de3ce92689b61f26f34703359b2316
Thread pointer: 0x7f3720001050
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7f37986f69b8 thread_stack 0x100000
/usr/local/mysql/bin/mysqld(my_print_stacktrace(unsigned char const*, unsigned long)+0x4c) [0x560b8e47dedc]
/usr/local/mysql/bin/mysqld(print_fatal_signal(int)+0x398) [0x560b8c3872e8]
/usr/local/mysql/bin/mysqld(handle_fatal_signal+0x69) [0x560b8c3874c9]
/lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x7f37e6369520]
/lib/x86_64-linux-gnu/libc.so.6(pthread_kill+0x12c) [0x7f37e63bd9fc]
/lib/x86_64-linux-gnu/libc.so.6(raise+0x16) [0x7f37e6369476]
/lib/x86_64-linux-gnu/libc.so.6(abort+0xd3) [0x7f37e634f7f3]
/lib/x86_64-linux-gnu/libc.so.6(+0x2871b) [0x7f37e634f71b]
/lib/x86_64-linux-gnu/libc.so.6(+0x39e96) [0x7f37e6360e96]
/usr/local/mysql/bin/mysqld(Item_typecast_signed::val_int()+0x930) [0x560b8c730b00]
/usr/local/mysql/bin/mysqld(Item_func_between::val_int()+0x113f) [0x560b8c69badf]
/usr/local/mysql/bin/mysqld(FilterIterator::Read()+0x6e) [0x560b8cbe776e]
/usr/local/mysql/bin/mysqld(Query_expression::ExecuteIteratorQuery(THD*)+0x6a9) [0x560b8c22ee29]
/usr/local/mysql/bin/mysqld(Query_expression::execute(THD*)+0xdb) [0x560b8c22f82b]
/usr/local/mysql/bin/mysqld(Sql_cmd_dml::execute_inner(THD*)+0xb2) [0x560b8c1220c2]
/usr/local/mysql/bin/mysqld(Sql_cmd_dml::execute(THD*)+0x99d) [0x560b8c12099d]
/usr/local/mysql/bin/mysqld(mysql_execute_command(THD*, bool)+0x4e93) [0x560b8c0518a3]
/usr/local/mysql/bin/mysqld(dispatch_sql_command(THD*, Parser_state*)+0xfa8) [0x560b8c0490d8]
/usr/local/mysql/bin/mysqld(dispatch_command(THD*, COM_DATA const*, enum_server_command)+0x4792) [0x560b8c043d32]
/usr/local/mysql/bin/mysqld(do_command(THD*)+0x9de) [0x560b8c046a8e]
/usr/local/mysql/bin/mysqld(+0x170b554) [0x560b8c362554]
/usr/local/mysql/bin/mysqld(+0x48e64dc) [0x560b8f53d4dc]
/lib/x86_64-linux-gnu/libc.so.6(+0x94ac3) [0x7f37e63bbac3]
/lib/x86_64-linux-gnu/libc.so.6(+0x1268c0) [0x7f37e644d8c0]

Hi Jason Tang,

Thank you for the test case. Verified as described.