Bug #37937 Assertion bitmap_is_set_all (&table->s->all_set) fails in handler::ha_reset

Description:
When executing a SELECT query, mysqld asserted as follows:

#0  0x00110416 in __kernel_vsyscall ()
#1  0x00581c78 in pthread_kill () from /lib/libpthread.so.0
#2  0x085b0da4 in my_print_stacktrace (stack_bottom=0x6 <Address 0x6 out of bounds>, thread_stack=1) at stacktrace.c:109
#3  0x08213e98 in handle_segfault (sig=140665984) at mysqld.cc:2638
#4  <signal handler called>
#5  0x00110416 in __kernel_vsyscall ()
#6  0x003e6660 in raise () from /lib/libc.so.6
#7  0x003e8028 in abort () from /lib/libc.so.6
#8  0x003df57e in __assert_fail () from /lib/libc.so.6
#9  0x083038c8 in handler::ha_reset (this=0xa10e480) at handler.cc:5297
#10 0x08259b77 in close_thread_table (thd=0xa1015e0, table_ptr=0xa10162c) at sql_base.cc:1468
#11 0x08259fd1 in close_open_tables (thd=0xa1015e0) at sql_base.cc:1186
#12 0x0825a240 in close_thread_tables (thd=0xa1015e0, skip_mdl=false) at sql_base.cc:1430
#13 0x0822b4c3 in dispatch_command (command=COM_QUERY, thd=0xa1015e0, packet=0xa11ba19 "", packet_length=266) at sql_parse.cc:1431
#14 0x0822ba49 in do_command (thd=0xa1015e0) at sql_parse.cc:724
#15 0x0821bef0 in handle_one_connection (arg=0xa1015e0) at sql_connect.cc:1153
#16 0x0057d32f in start_thread () from /lib/libpthread.so.0
#17 0x0049a27e in clone () from /lib/libc.so.6

The assert is here:

5292                  table->s->column_bitmap_size ==
5293                  (uchar*) table->def_write_set.bitmap);
5294    /*  DBUG_ASSERT(bitmap_is_set_all(&table->s->all_set)); */
5295      DBUG_ASSERT(table->key_read == 0);
5296      /* ensure that ha_index_end / ha_rnd_end has been called */
5297      DBUG_ASSERT(inited == NONE); <<<<<<<<<<<< HERE
5298      /* Free cache used by filesort */
5299      free_io_cache(table);
5300      /* reset the bitmaps to point to defaults */
5301      table->default_column_bitmaps();

(gdb) print inited
$2 = handler::NONE

How to repeat:
A simplifed test case will follow shortly.

Grammar file for bug 37937

Attachment: bug37937.yy (application/octet-stream, text), 4.08 KiB.

Please find attached a grammar file for this bug. To run, please clone the mysql-test-extra-6.0 tree and execute:

$ cd mysql-test-extra-6.0/mysql-test/gentest
$ perl runall.pl \
 --basedir=/path/to/mysql-5.1 \
 --grammar=/location/of/bug37937.yy \
 --engine=innodb --threads=1 --queries=10000

* A crash will happen after about 1400 queries. Using more threads may speed up the crash.

* Both 5.1 and 6.0 are affected. If 6.0 asserts in a different place, please remove the mentions of XOR from the grammar and run the test again.

* If the bitmap_is_set_all assertion is commented out, the server asserts in inited == NULL .

Crash also happens on the grammar for the bug#37870.
Number of concurrent threads should be set to 1 or 2.
It occurs on the first 1-2 queries.
Verified on 5.1.30-debug, 6.0-bzr.

Bug #37936 is probably a duplicate of this bug

Duplicate of bug #37936.
Just tried the test case against a server patched with the 37936 fix:
=======================================================

TEST                           RESULT         TIME (ms)
-------------------------------------------------------

Servers started, exiting
Autoreleasing /tmp/mysql-test-ports:200
# 12:35:14 Starting 
# 12:35:14  gentest.pl \ 
# 12:35:14  --gendata= \ 
# 12:35:14  --engine=innodb \ 
# 12:35:14  --threads=1 \ 
# 12:35:14  --queries=10000 \ 
# 12:35:14  --duration=3600 \ 
# 12:35:14  --dsn1=dbi:mysql:host=127.0.0.1:port=19306:user=root:database=test \ 
# 12:35:14  --grammar=bug37937.yy
# 12:35:14 Starting 
# 12:35:14 # gendata-old.pl \ 
# 12:35:14 # --dsn=dbi:mysql:host=127.0.0.1:port=19306:user=root:database=test \ 
# 12:35:14 # --engine=innodb
# 12:35:14 Creating table A, size 0 rows, engine innodb .
# 12:35:14 Creating table B, size 2 rows, engine innodb .
# 12:35:14 Creating table C, size 20 rows, engine innodb .
# 12:35:14 Creating table D, size 100 rows, engine innodb .
# 12:35:14 Creating table E, size 1000 rows, engine innodb .
# 12:35:16 Creating table AA, size 0 rows, engine innodb .
# 12:35:16 Creating table BB, size 2 rows, engine innodb .
# 12:35:16 Creating table CC, size 20 rows, engine innodb .
# 12:35:16 Creating table DD, size 100 rows, engine innodb .
# 12:35:16 Creating table AAA, size 0 rows, engine innodb .
# 12:35:16 Creating table BBB, size 1 rows, engine innodb .
# 12:35:16 Creating table CCC, size 20 rows, engine innodb .
# 12:35:16 Reporters: ErrorLog, Backtrace
# 12:35:16 Validators: FalconErrors, ErrorMessageCorruption
# 12:35:16 Starting 1 processes, 10000 queries each, duration 3600 seconds.
# 12:35:18 Started periodic reporting process...
# 12:35:50 Query: SELECT  BIT_XOR( OUTR . `varchar_nokey` ) AS X FROM C AS OUTR2 LEFT JOIN A AS OUTR ON ( OUTR2 . `varchar_nokey` = OUTR . `varchar_key` ) WHERE OUTR . `int_key` <> ( SELECT  STD( INNR . `int_key` ) AS Y FROM AA AS INNR WHERE INNR . `date_nokey` <> '2007-09-17' AND NOT INNR . `varchar_key` = 'w' ORDER BY INNR . `pk` LIMIT 1 ) OR OUTR . `int_nokey` <> 5  HAVING X = '2004-10-20' ORDER BY OUTR . `datetime_key` , OUTR . `pk`  failed: 1048 Column '%s' cannot be null. Further errors of this kind will be suppressed.
# 12:35:58 Child process completed successfully.
# 12:36:03 Killing periodic reporting process with pid 10404...
# 12:36:08 Test completed successfully.