MySQL Bugs: #59493: An assertion failure with a multiway join

Bug #59493	An assertion failure with a multiway join
Submitted:	14 Jan 2011 8:28	Modified:	15 Oct 2012 13:40
Reporter:	Igor Babaev	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Optimizer	Severity:	S2 (Serious)
Version:	5.1.56, 5.5.9	OS:	Any
Assigned to:		CPU Architecture:	Any
Tags:	regression

Description:
The following query triggers an assertion abort:

SELECT STRAIGHT_JOIN * FROM t2, (t1 LEFT JOIN (t3,t4) ON t1.f1 = t4.f1), t5, t6;

Version: '5.1.56-debug'  socket: '/tmp/mysql.sock'  port: 3306  Source distribution
[New Thread 0x7ffff161d710 (LWP 25679)]
mysqld: sql_select.cc:11974: int join_read_key(JOIN_TAB*): Assertion `tab->ref.has_record' failed.

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff161d710 (LWP 25679)]
0x00007ffff6dcf9e5 in raise () from /lib64/libc.so.6

This bug originally was discovered by Philip Stoev for the MariaDB 5.3 code.
I adjusted his test case to reproduce the problem for MySQL 5.1

How to repeat:
The problem is reproducible with the following test case:

CREATE TABLE t1 (f1 int) ;
INSERT INTO t1 VALUES (9);

CREATE TABLE t2 (f1 int);
INSERT INTO t2 VALUES (3),(7),(18);
INSERT INTO t2 VALUES (3),(7),(18);
INSERT INTO t2 VALUES (3),(7),(18);
INSERT INTO t2 VALUES (3),(7),(18);

CREATE TABLE t3 (f1 int);
INSERT INTO t3 VALUES (17);

CREATE TABLE t4  (f1 int PRIMARY KEY, f2 varchar(1024)) ;

CREATE TABLE t5 (f1 int) ;
INSERT INTO t5 VALUES (20),(5);

CREATE TABLE t6(f1 int);
INSERT INTO t6 VALUES (9),(7);

SET SESSION join_buffer_size = 9000;

SELECT STRAIGHT_JOIN * FROM t2, (t1 LEFT JOIN (t3,t4) ON t1.f1 = t4.f1), t5, t6;

Verified with current mysql-5.5 tree also:

openxs@ubuntu:/home2/openxs/dbs/5.5$ bin/mysql --no-defaults -uroot test
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 4
Server version: 5.5.9-debug Source distribution

Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> CREATE TABLE t1 (f1 int) ;
Query OK, 0 rows affected (0.29 sec)

mysql> INSERT INTO t1 VALUES (9);
Query OK, 1 row affected (0.08 sec)

mysql> CREATE TABLE t2 (f1 int);
Query OK, 0 rows affected (0.04 sec)

mysql> INSERT INTO t2 VALUES (3),(7),(18);
Query OK, 3 rows affected (0.00 sec)
Records: 3  Duplicates: 0  Warnings: 0

mysql> INSERT INTO t2 VALUES (3),(7),(18);
Query OK, 3 rows affected (0.00 sec)
Records: 3  Duplicates: 0  Warnings: 0

mysql> INSERT INTO t2 VALUES (3),(7),(18);
Query OK, 3 rows affected (0.01 sec)
Records: 3  Duplicates: 0  Warnings: 0

mysql> INSERT INTO t2 VALUES (3),(7),(18);
Query OK, 3 rows affected (0.01 sec)
Records: 3  Duplicates: 0  Warnings: 0

mysql> CREATE TABLE t3 (f1 int);
Query OK, 0 rows affected (0.04 sec)

mysql> INSERT INTO t3 VALUES (17);
Query OK, 1 row affected (0.01 sec)

mysql> CREATE TABLE t4  (f1 int PRIMARY KEY, f2 varchar(1024)) ;
Query OK, 0 rows affected (0.12 sec)

mysql> CREATE TABLE t5 (f1 int) ;
Query OK, 0 rows affected (0.01 sec)

mysql> INSERT INTO t5 VALUES (20),(5);
Query OK, 2 rows affected (0.01 sec)
Records: 2  Duplicates: 0  Warnings: 0

mysql> CREATE TABLE t6(f1 int);
Query OK, 0 rows affected (0.01 sec)

mysql> INSERT INTO t6 VALUES (9),(7);
Query OK, 2 rows affected (0.00 sec)
Records: 2  Duplicates: 0  Warnings: 0

mysql> SET SESSION join_buffer_size = 9000;
Query OK, 0 rows affected, 1 warning (0.01 sec)

mysql> SELECT STRAIGHT_JOIN * FROM t2, (t1 LEFT JOIN (t3,t4) ON t1.f1 = t4.f1), t5, t6;
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql> 110114 10:52:40 mysqld_safe Number of processes running now: 0
110114 10:52:40 mysqld_safe mysqld restarted

mysql> exit
Bye
openxs@ubuntu:/home2/openxs/dbs/5.5$ tail -100 data/ubuntu.err 

110113 17:35:53 mysqld_safe mysqld from pid file /home2/openxs/dbs/5.5/data/ubuntu.pid ended
110114 10:27:23 mysqld_safe Starting mysqld daemon with databases from /home2/openxs/dbs/5.5/data
110114 10:27:24 [Note] Plugin 'FEDERATED' is disabled.
110114 10:27:24 [ERROR] Invalid (old?) table or database name '-@'
InnoDB: !!!!!!!! UNIV_DEBUG switched on !!!!!!!!!
InnoDB: The InnoDB memory heap is disabled
InnoDB: Mutexes and rw_locks use GCC atomic builtins
InnoDB: Compressed tables use zlib 1.2.3
110114 10:27:25  InnoDB: Initializing buffer pool, size = 128.0M
110114 10:27:25  InnoDB: Completed initialization of buffer pool
110114 10:27:25  InnoDB: highest supported file format is Barracuda.
110114 10:27:26  InnoDB: 1.1.4 started; log sequence number 1609233
110114 10:27:26 [Note] Event Scheduler: Loaded 0 events
110114 10:27:26 [Note] /home2/openxs/dbs/5.5/bin/mysqld: ready for connections.
Version: '5.5.9-debug'  socket: '/tmp/mysql.sock'  port: 3306  Source distribution
mysqld: /home2/openxs/bzr2/mysql-5.5/sql/sql_select.cc:12214: int join_read_key(JOIN_TAB*): Assertion `tab->ref.has_record' failed.
110114 10:52:40 - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.

key_buffer_size=8388608
read_buffer_size=131072
max_used_connections=1
max_threads=151
thread_count=1
connection_count=1
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 337966 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0xa167ff8
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0xa918f348 thread_stack 0x30000
/home2/openxs/dbs/5.5/bin/mysqld(my_print_stacktrace+0x33)[0x84f4204]
/home2/openxs/dbs/5.5/bin/mysqld(handle_segfault+0x34c)[0x8172787]
[0x6d2400]
/lib/tls/i686/cmov/libc.so.6(abort+0x182)[0x16fa82]
/lib/tls/i686/cmov/libc.so.6(__assert_fail+0xf8)[0x165718]
/home2/openxs/dbs/5.5/bin/mysqld[0x825ce20]
/home2/openxs/dbs/5.5/bin/mysqld(_Z10sub_selectP4JOINP13st_join_tableb+0xb1)[0x825ba6b]
/home2/openxs/dbs/5.5/bin/mysqld[0x825bdc3]
/home2/openxs/dbs/5.5/bin/mysqld(_Z10sub_selectP4JOINP13st_join_tableb+0xcd)[0x825ba87]
/home2/openxs/dbs/5.5/bin/mysqld[0x825c30e]
/home2/openxs/dbs/5.5/bin/mysqld(_Z16sub_select_cacheP4JOINP13st_join_tableb+0x39)[0x825b898]
/home2/openxs/dbs/5.5/bin/mysqld(_Z10sub_selectP4JOINP13st_join_tableb+0x4e)[0x825ba08]
/home2/openxs/dbs/5.5/bin/mysqld[0x825b67a]
/home2/openxs/dbs/5.5/bin/mysqld(_ZN4JOIN4execEv+0x21af)[0x8245bf1]
/home2/openxs/dbs/5.5/bin/mysqld(_Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x384)[0x8246363]
/home2/openxs/dbs/5.5/bin/mysqld(_Z13handle_selectP3THDP3LEXP13select_resultm+0x204)[0x823ef2f]
/home2/openxs/dbs/5.5/bin/mysqld[0x821b465]
/home2/openxs/dbs/5.5/bin/mysqld(_Z21mysql_execute_commandP3THD+0x945)[0x82136dc]
/home2/openxs/dbs/5.5/bin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_state+0x1ff)[0x821d4d9]
/home2/openxs/dbs/5.5/bin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0xa56)[0x8211092]
/home2/openxs/dbs/5.5/bin/mysqld(_Z10do_commandP3THD+0x292)[0x8210423]
/home2/openxs/dbs/5.5/bin/mysqld(_Z24do_handle_one_connectionP3THD+0x3f7)[0x82ed282]
/home2/openxs/dbs/5.5/bin/mysqld(handle_one_connection+0x35)[0x82ece80]
/lib/tls/i686/cmov/libpthread.so.0(+0x596e)[0x55d96e]
/lib/tls/i686/cmov/libc.so.6(clone+0x5e)[0x20fa4e]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0xa1b3878): SELECT STRAIGHT_JOIN * FROM t2, (t1 LEFT JOIN (t3,t4) ON t1.f1 = t4.f1), t5, t6
Connection ID (thread ID): 4
Status: NOT_KILLED
...

see also bug #59651

Fixed in 5.6.3