MySQL Bugs: #92868: Assertion "Geometry::is_valid

Bug #92868	Assertion "Geometry::is_valid_geotype(gt)"
Submitted:	19 Oct 2018 19:25	Modified:	19 Oct 2018 23:52
Reporter:	Hrvoje Matijakovic	Email Updates:
Status:	Verified	Impact on me:	None
Category:	MySQL Server: GIS	Severity:	S6 (Debug Builds)
Version:	5.7.23, 5.7.24	OS:	CentOS
Assigned to:		CPU Architecture:	x86
Tags:	debug

Description:
gdb:

(gdb) bt
+bt
#0  0x00007f6dda30ea01 in __pthread_kill (threadid=<optimized out>, signo=6) at ../nptl/sysdeps/unix/sysv/linux/pthread_kill.c:61
#1  0x000000000184b4b9 in my_write_core (sig=6) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/mysys/stacktrace.c:249
#2  0x0000000000e8d0d0 in handle_fatal_signal (sig=6) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/signal_handler.cc:220
#3  <signal handler called>
#4  0x00007f6dd8412277 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#5  0x00007f6dd8413968 in __GI_abort () at abort.c:90
#6  0x00007f6dd840b096 in __assert_fail_base (fmt=0x7f6dd8566580 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x1dbf818 "Geometry::is_valid_geotype(gt)", file=file@entry=0x1dbf7c0 "/home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/spatial.h", line=line@entry=1194, function=function@entry=0x1dc70c0 <get_wkb_geotype(void const*)::__PRETTY_FUNCTION__> "Geometry::wkbType get_wkb_geotype(const void*)") at assert.c:92
#7  0x00007f6dd840b142 in __GI___assert_fail (assertion=0x1dbf818 "Geometry::is_valid_geotype(gt)", file=0x1dbf7c0 "/home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/spatial.h", line=1194, function=0x1dc70c0 <get_wkb_geotype(void const*)::__PRETTY_FUNCTION__> "Geometry::wkbType get_wkb_geotype(const void*)") at assert.c:101
#8  0x0000000000fc6245 in get_wkb_geotype (p0=0x7f6d9bca8055) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/spatial.h:1194
#9  0x0000000000fbffbc in Item_func_spatial_collection::val_str (this=0x7f6d9bc27c98, str=0x7f6d9bd04a40) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item_geofunc.cc:3557
#10 0x0000000000ef13ec in Item::str_result (this=0x7f6d9bc27c98, tmp=0x7f6d9bd04a40) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item.h:1602
#11 0x0000000000f3c102 in Item_cache_str::cache_value (this=0x7f6d9bd04928) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item.cc:10186
#12 0x00000000013b7688 in Item_singlerow_subselect::store (this=0x7f6d9bd037f8, i=0, item=0x7f6d9bc27c98) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item_subselect.cc:1167
#13 0x00000000013b6640 in Query_result_scalar_subquery::send_data (this=0x7f6d9bc28fc8, items=...) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item_subselect.cc:832
#14 0x00000000014cf80d in end_send (join=0x7f6d9bd062c8, qep_tab=0x7f6d9bd06b20, end_of_records=false) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:2913
#15 0x00000000014cc589 in evaluate_join_record (join=0x7f6d9bd062c8, qep_tab=0x7f6d9bd069a8) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:1645
#16 0x00000000014cb9c9 in sub_select (join=0x7f6d9bd062c8, qep_tab=0x7f6d9bd069a8, end_of_records=false) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:1297
#17 0x00000000014cb24a in do_select (join=0x7f6d9bd062c8) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:950
#18 0x00000000014c91b1 in JOIN::exec (this=0x7f6d9bd062c8) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:199
#19 0x00000000013bd9cd in subselect_single_select_engine::exec (this=0x7f6d9bc28ff0) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item_subselect.cc:3159
#20 0x00000000013b5d6f in Item_subselect::exec (this=0x7f6d9bd037f8) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item_subselect.cc:620
#21 0x00000000013b7be3 in Item_singlerow_subselect::val_str (this=0x7f6d9bd037f8, str=0x7f6d9bd03808) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item_subselect.cc:1282
#22 0x0000000000f323f3 in Item::save_in_field_inner (this=0x7f6d9bd037f8, field=0x7f6d9bca7af8, no_conversions=true) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item.cc:6836
#23 0x0000000000f31ea0 in Item::save_in_field (this=0x7f6d9bd037f8, field=0x7f6d9bca7af8, no_conversions=true) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item.cc:6751
#24 0x0000000000f41ef3 in Item_result_field::save_in_result_field (this=0x7f6d9bd037f8, no_conversions=true) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/item.h:4004
#25 0x00000000014ca340 in copy_funcs (func_ptr=0x7f6d9bca7830, thd=0x7f6d9bc19000) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:562
#26 0x00000000014d0afe in end_write (join=0x7f6d9bd05030, qep_tab=0x7f6d9bd05858, end_of_records=false) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:3360
#27 0x00000000014d40bb in QEP_tmp_table::put_record (this=0x7f6d9bd04f90, end_of_records=false) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:4639
#28 0x00000000014d4dff in QEP_tmp_table::put_record (this=0x7f6d9bd04f90) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.h:248
#29 0x00000000014cb66d in sub_select_op (join=0x7f6d9bd05030, qep_tab=0x7f6d9bd05858, end_of_records=false) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:1083
#30 0x00000000014cc589 in evaluate_join_record (join=0x7f6d9bd05030, qep_tab=0x7f6d9bd056e0) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:1645
#31 0x00000000014cb9c9 in sub_select (join=0x7f6d9bd05030, qep_tab=0x7f6d9bd056e0, end_of_records=false) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:1297
#32 0x00000000014cb24a in do_select (join=0x7f6d9bd05030) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:950
#33 0x00000000014c91b1 in JOIN::exec (this=0x7f6d9bd05030) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_executor.cc:199
#34 0x0000000001561b4e in handle_query (thd=0x7f6d9bc19000, lex=0x7f6d9bc1b318, result=0x7f6d9bd040e8, added_options=0, removed_options=0) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_select.cc:184
#35 0x0000000001517aff in execute_sqlcom_select (thd=0x7f6d9bc19000, all_tables=0x7f6d9bd03980) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_parse.cc:5128
#36 0x000000000151163a in mysql_execute_command (thd=0x7f6d9bc19000, first_level=true) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_parse.cc:2814
#37 0x00000000015189d9 in mysql_parse (thd=0x7f6d9bc19000, parser_state=0x7f6dda905510) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_parse.cc:5554
#38 0x000000000150e586 in dispatch_command (thd=0x7f6d9bc19000, com_data=0x7f6dda905c70, command=COM_QUERY) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_parse.cc:1484
#39 0x000000000150d4ba in do_command (thd=0x7f6d9bc19000) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/sql_parse.cc:1025
#40 0x000000000163e15e in handle_connection (arg=0x7f6daf717a00) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/sql/conn_handler/connection_handler_per_thread.cc:300
#41 0x00000000018f3178 in pfs_spawn_thread (arg=0x7f6dc0be3e20) at /home/hrvoje/worktable/MySQL-5.7.23_dbg/storage/perfschema/pfs.cc:2190
#42 0x00007f6dda309e25 in start_thread (arg=0x7f6dda906700) at pthread_create.c:308
#43 0x00007f6dd84dabad in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

How to repeat:
Testcase:

CREATE DATABASE test;
USE test;
set @@sql_mode=cast(pow(2,32)-1 as unsigned INT);
create table t1(a INT)partition by key (a);
INSERT INTO t1 VALUES(6243);
alter TABLE t1 change a a char(15);
SELECT(SELECT MULTILINESTRING(d.a,d.a,d.a)FROM t1) FROM t1 AS d GROUP BY d.a;

Thank you for the bug report. Only 5.7 version affected.

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.7.25-debug Source distribution BUILD: 2018-OCT-04

Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql 5.7 > drop database test;
Query OK, 1 row affected (0,13 sec)

mysql 5.7 > CREATE DATABASE test;
Query OK, 1 row affected (0,00 sec)

mysql 5.7 > USE test;
set @@sql_mode=cast(pow(2,32)-1 as unsigned INT);
create table t1(a INT)partition by key (a);
INSERT INTO t1 VALUES(6243);
Database changed
mysql 5.7 > set @@sql_mode=cast(pow(2,32)-1 as unsigned INT);
alter TABLE t1 change a a char(15);
SELECT(SELECT MULTILINESTRING(d.a,d.a,d.a)FROM t1) FROM t1 AS d GROUP BY d.a;Query OK, 0 rows affected, 1 warning (0,03 sec)

mysql 5.7 > create table t1(a INT)partition by key (a);
Query OK, 0 rows affected (1,54 sec)

mysql 5.7 > INSERT INTO t1 VALUES(6243);
Query OK, 1 row affected (0,14 sec)

mysql 5.7 > alter TABLE t1 change a a char(15);
Query OK, 1 row affected (2,50 sec)
Records: 1  Duplicates: 0  Warnings: 0

mysql 5.7 > SELECT(SELECT MULTILINESTRING(d.a,d.a,d.a)FROM t1) FROM t1 AS d GROUP BY d.a;
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql 5.7 >
2018-10-19T23:41:37.423863Z 0 [Note] /home/miguel/dbsd/5.7/bin/mysqld: ready for connections.
Version: '5.7.25-debug'  socket: '/tmp/mysql57.sock'  port: 3357  Source distribution BUILD: 2018-OCT-04
mysqld: /home/miguel/buildd/2018OCT04/mysql-5.7/sql/spatial.h:1194: Geometry::wkbType get_wkb_geotype(const void*): Assertion `Geometry::is_valid_geotype(gt)' failed.
23:42:31 UTC - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
Attempting to collect some information that could help diagnose the problem.
As this is a crash and something is definitely wrong, the information
collection process might fail.

key_buffer_size=8388608
read_buffer_size=131072
max_used_connections=1
max_threads=151
thread_count=1
connection_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 68260 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x7fe350000dd0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7fe390446e18 thread_stack 0x40000
/home/miguel/dbsd/5.7/bin/mysqld(my_print_stacktrace+0x47)[0x5649e1727cdb]
/home/miguel/dbsd/5.7/bin/mysqld(handle_fatal_signal+0x3f3)[0x5649e0cdaadc]
/usr/lib/libpthread.so.0(+0x123c0)[0x7fe3b10d13c0]
/usr/lib/libc.so.6(gsignal+0x10f)[0x7fe3b09add7f]
/usr/lib/libc.so.6(abort+0x125)[0x7fe3b0998672]
/usr/lib/libc.so.6(+0x22548)[0x7fe3b0998548]
/usr/lib/libc.so.6(+0x30396)[0x7fe3b09a6396]
/home/miguel/dbsd/5.7/bin/mysqld(_Z15get_wkb_geotypePKv+0x50)[0x5649e0e1ee35]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN28Item_func_spatial_collection7val_strEP6String+0x2c5)[0x5649e0e186a9]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN4Item10str_resultEP6String+0x30)[0x5649e0d41528]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN14Item_cache_str11cache_valueEv+0x98)[0x5649e0d903a2]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN24Item_singlerow_subselect5storeEjP4Item+0x9c)[0x5649e1257bb4]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN28Query_result_scalar_subquery9send_dataER4ListI4ItemE+0x132)[0x5649e12569f0]
/home/miguel/dbsd/5.7/bin/mysqld(+0x1484957)[0x5649e137f957]
/home/miguel/dbsd/5.7/bin/mysqld(+0x1481488)[0x5649e137c488]
/home/miguel/dbsd/5.7/bin/mysqld(_Z10sub_selectP4JOINP7QEP_TABb+0x36d)[0x5649e137b82f]
/home/miguel/dbsd/5.7/bin/mysqld(+0x1480028)[0x5649e137b028]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN4JOIN4execEv+0x66b)[0x5649e1378e09]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN30subselect_single_select_engine4execEv+0x49c)[0x5649e125e466]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN14Item_subselect4execEv+0x2cb)[0x5649e1256085]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN24Item_singlerow_subselect7val_strEP6String+0x3b)[0x5649e125811d]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN4Item19save_in_field_innerEP5Fieldb+0x52c)[0x5649e0d85ee6]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN4Item13save_in_fieldEP5Fieldb+0x34)[0x5649e0d85970]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN17Item_result_field20save_in_result_fieldEb+0x2f)[0x5649e0d96365]
/home/miguel/dbsd/5.7/bin/mysqld(_Z10copy_funcsP14Mem_root_arrayIP4ItemLb1EEPK3THD+0x67)[0x5649e137a04c]
/home/miguel/dbsd/5.7/bin/mysqld(+0x1485dbf)[0x5649e1380dbf]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN13QEP_tmp_table10put_recordEb+0x8b)[0x5649e13848e3]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN13QEP_tmp_table10put_recordEv+0x1d)[0x5649e1385601]
/home/miguel/dbsd/5.7/bin/mysqld(_Z13sub_select_opP4JOINP7QEP_TABb+0x184)[0x5649e137b495]
/home/miguel/dbsd/5.7/bin/mysqld(+0x1481488)[0x5649e137c488]
/home/miguel/dbsd/5.7/bin/mysqld(_Z10sub_selectP4JOINP7QEP_TABb+0x36d)[0x5649e137b82f]
/home/miguel/dbsd/5.7/bin/mysqld(+0x1480028)[0x5649e137b028]
/home/miguel/dbsd/5.7/bin/mysqld(_ZN4JOIN4execEv+0x66b)[0x5649e1378e09]
/home/miguel/dbsd/5.7/bin/mysqld(_Z12handle_queryP3THDP3LEXP12Query_resultyy+0x378)[0x5649e14192dd]
/home/miguel/dbsd/5.7/bin/mysqld(+0x14cefb4)[0x5649e13c9fb4]
/home/miguel/dbsd/5.7/bin/mysqld(_Z21mysql_execute_commandP3THDb+0xde4)[0x5649e13c3194]
/home/miguel/dbsd/5.7/bin/mysqld(_Z11mysql_parseP3THDP12Parser_state+0x592)[0x5649e13caf2a]
/home/miguel/dbsd/5.7/bin/mysqld(_Z16dispatch_commandP3THDPK8COM_DATA19enum_server_command+0xc3a)[0x5649e13bfe9c]
/home/miguel/dbsd/5.7/bin/mysqld(_Z10do_commandP3THD+0x51d)[0x5649e13bed27]
/home/miguel/dbsd/5.7/bin/mysqld(handle_connection+0x1ee)[0x5649e1500025]
/home/miguel/dbsd/5.7/bin/mysqld(pfs_spawn_thread+0x173)[0x5649e1be4d10]
/usr/lib/libpthread.so.0(+0x7a9d)[0x7fe3b10c6a9d]
/usr/lib/libc.so.6(clone+0x43)[0x7fe3b0a71a43]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (7fe350005ae0): SELECT(SELECT MULTILINESTRING(d.a,d.a,d.a)FROM t1) FROM t1 AS d GROUP BY d.a
Connection ID (thread ID): 2
Status: NOT_KILLED

Bug 23573720 - ASSERTION FAILED: GEOMETRY::IS_VALID_GEOTYPE(GT)

Bug #93092 marked as duplicate of this one, updating version.