MySQL Bugs: #58200: Assertion failed: param.sort_length when grouping by functions.... (part III)

Bug #58200	Assertion failed: param.sort_length when grouping by functions.... (part III)
Submitted:	15 Nov 2010 12:35	Modified:	29 Sep 2011 13:11
Reporter:	Shane Bester (Platinum Quality Contributor)	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Optimizer	Severity:	S1 (Critical)
Version:	5.1.54-debug, 5.5.8-debug, 5.6.1-debug	OS:	Any
Assigned to:		CPU Architecture:	Any
Tags:	GROUP BY, rand, sleep, SYSDATE

Description:
sequel to bug 52164 and to bug 54459

Version: '5.5.7-rc-debug'  socket: ''  port: 3306  MySQL Community Server - Debug (GPL)
Assertion failed: param.sort_length, file ..\..\mysql-5.5.7-rc\sql\filesort.cc, line 153
mysqld-debug.exe!my_sigabrt_handler()[my_thr_init.c:521]
mysqld-debug.exe!raise()[winsig.c:590]
mysqld-debug.exe!abort()[abort.c:71]
mysqld-debug.exe!_wassert()[assert.c:163]
mysqld-debug.exe!filesort()[filesort.cc:153]
mysqld-debug.exe!create_sort_index()[sql_select.cc:13945]
mysqld-debug.exe!JOIN::exec()[sql_select.cc:2326]
mysqld-debug.exe!mysql_select()[sql_select.cc:2560]
mysqld-debug.exe!handle_select()[sql_select.cc:296]
mysqld-debug.exe!execute_sqlcom_select()[sql_parse.cc:4463]
mysqld-debug.exe!mysql_execute_command()[sql_parse.cc:2065]
mysqld-debug.exe!mysql_parse()[sql_parse.cc:5499]
mysqld-debug.exe!dispatch_command()[sql_parse.cc:1029]
mysqld-debug.exe!do_command()[sql_parse.cc:769]
mysqld-debug.exe!do_handle_one_connection()[sql_connect.cc:745]
mysqld-debug.exe!handle_one_connection()[sql_connect.cc:684]
mysqld-debug.exe!pthread_start()[my_winthread.c:61]
mysqld-debug.exe!_callthreadstartex()[threadex.c:348]
mysqld-debug.exe!_threadstartex()[threadex.c:331]

How to repeat:
on debug build:

drop table if exists `t`;
create table `t`(`a` int)engine=myisam;
insert into `t` values (0),(0);
select 1 from `t` group by if(`a`,'','');

Verified on 32-bit Ubuntu 10.04:

101115 14:57:03 [Note] /home/openxs/dbs/5.5/bin/mysqld: ready for connections.
Version: '5.5.7-rc-debug'  socket: '/tmp/mysql.sock'  port: 3306  Source distribution
mysqld: /home2/openxs/bzr2/mysql-5.5/sql/filesort.cc:153: ha_rows filesort(THD*, TABLE*, SORT_FIELD*, uint, SQL_SELECT*, ha_rows, bool, ha_rows*): Assertion `param.sort_length' failed.
101115 14:57:06 - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.

key_buffer_size=8388608
read_buffer_size=131072
max_used_connections=1
max_threads=151
thread_count=1
connection_count=1
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 337925 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

thd: 0x95e0cc0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0xa91e835c thread_stack 0x30000
/home/openxs/dbs/5.5/bin/mysqld(my_print_stacktrace+0x33)[0x861321a]
/home/openxs/dbs/5.5/bin/mysqld(handle_segfault+0x2dd)[0x816b495]
[0x188400]
/lib/tls/i686/cmov/libc.so.6(abort+0x182)[0x9bda82]
/lib/tls/i686/cmov/libc.so.6(__assert_fail+0xf8)[0x9b3718]
/home/openxs/dbs/5.5/bin/mysqld(_Z8filesortP3THDP5TABLEP13st_sort_fieldjP10SQL_SELECTybPy+0x22f)[0x833fb57]
/home/openxs/dbs/5.5/bin/mysqld[0x8241cad]
/home/openxs/dbs/5.5/bin/mysqld(_ZN4JOIN4execEv+0x1ef7)[0x8226e5f]
/home/openxs/dbs/5.5/bin/mysqld(_Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x2fd)[0x82276be]
/home/openxs/dbs/5.5/bin/mysqld(_Z13handle_selectP3THDP3LEXP13select_resultm+0x1d4)[0x8220692]
/home/openxs/dbs/5.5/bin/mysqld[0x81ff8cd]
/home/openxs/dbs/5.5/bin/mysqld(_Z21mysql_execute_commandP3THD+0x9d0)[0x81f7c8d]
/home/openxs/dbs/5.5/bin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_state+0x244)[0x82017c1]
/home/openxs/dbs/5.5/bin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0xabe)[0x81f5627]
/home/openxs/dbs/5.5/bin/mysqld(_Z10do_commandP3THD+0x242)[0x81f496f]
/home/openxs/dbs/5.5/bin/mysqld(_Z24do_handle_one_connectionP3THD+0x1d1)[0x82c8365]
/home/openxs/dbs/5.5/bin/mysqld(handle_one_connection+0x28)[0x82c818d]
/lib/tls/i686/cmov/libpthread.so.0(+0x596e)[0x33796e]
/lib/tls/i686/cmov/libc.so.6(clone+0x5e)[0xa5da4e]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at 0x9607700 = select 1 from `t` group by if(`a`,'','')
thd->thread_id=1
thd->killed=NOT_KILLED
...

another testcase:

drop table if exists `t`;
create table `t`(`a` int)engine=myisam;
insert into `t` values (0),(0);
select 1 from t group by trim(leading rand() from '');

drop table if exists `t`;
create table `t`(`a` int)engine=myisam;
insert into `t` values (0),(0);
select 1 from t group by substring('',sleep(0),'');

drop table if exists t;
create table t(a int)engine=myisam;
insert into t values (0),(0);
select 1 from t group by substring(sysdate() from 'K' for 'jxW<');

Noted in 5.1.60, 5.5.17, 5.6.4 changelogs.

An assertion designed to detect zero-length sort keys also was raised
when the entire key set fit in memory.