MySQL Bugs: #93154: MySQL crash with InnoDB assertion failure in file row0sel.cc

Bug #93154	MySQL crash with InnoDB assertion failure in file row0sel.cc
Submitted:	11 Nov 2018 5:02	Modified:	11 Nov 2018 8:08
Reporter:	Hao Gong	Email Updates:
Status:	Can't repeat	Impact on me:	None
Category:	MySQL Server: InnoDB storage engine	Severity:	S1 (Critical)
Version:	5.7.22	OS:	Linux ( Amazon Linux AMI)
Assigned to:		CPU Architecture:	Any
Tags:	crash, innodb, row0sel.cc

Description:
We are running 5.7.22 for months, but recent two days the below crash has happened 3 times already, the mysqld process crashed totally.

It refers to file row0sel.cc line 3183, but when looking into the source code I can't tell what might be wrong. I just find out some related bug fixes modified the assertion.

It is so critical for us to meet the random crash, so we just upgraded to 5.7.23 to check is this crash still there.

Here is the assertion modified we found:
https://github.com/mysql/mysql-server/commit/8809dd1a7b50a28f3418f4494dc23f928143235f

Here is the full crash log:

2018-11-11 10:53:27 0x7f30a7fbd700  InnoDB: Assertion failure in thread 139846953457408 in file row0sel.cc line 3183
InnoDB: Failing assertion: (!prebuilt->idx_cond && prebuilt->m_mysql_handler->end_range != NULL) || (prebuilt->trx->isolation_level == TRX_ISO_READ_UNCOMMITTED)
InnoDB: We intentionally generate a memory trap.
InnoDB: Submit a detailed bug report to http://bugs.mysql.com.
InnoDB: If you get repeated assertion failures or crashes, even
InnoDB: immediately after the mysqld startup, there may be
InnoDB: corruption in the InnoDB tablespace. Please refer to
InnoDB: http://dev.mysql.com/doc/refman/5.7/en/forcing-innodb-recovery.html
InnoDB: about forcing recovery.
02:53:27 UTC - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
Attempting to collect some information that could help diagnose the problem.
As this is a crash and something is definitely wrong, the information
collection process might fail.
Please help us make Percona Server better by reporting any
bugs at http://bugs.percona.com/

key_buffer_size=2097152
read_buffer_size=2097152
max_used_connections=4894
max_threads=25601
thread_count=4893
connection_count=4893
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 105221862 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x7f32700db760
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7f30a7fbcd80 thread_stack 0x40000
/usr/sbin/mysqld(my_print_stacktrace+0x2c)[0xec60ec]
/usr/sbin/mysqld(handle_fatal_signal+0x461)[0x79e811]
/lib64/libpthread.so.0(+0xf690)[0x7f4b3d90f690]
/lib64/libc.so.6(gsignal+0x37)[0x7f4b3ba1b277]
/lib64/libc.so.6(abort+0x148)[0x7f4b3ba1c968]
/usr/sbin/mysqld[0x76c292]
/usr/sbin/mysqld[0x107ff3e]
/usr/sbin/mysqld(_Z15row_search_mvccPh15page_cur_mode_tP14row_prebuilt_tmm+0x2d6f)[0x1083cdf]
/usr/sbin/mysqld(_ZN11ha_innobase13general_fetchEPhjj+0x1b8)[0xf6eb08]
/usr/sbin/mysqld(_ZN7handler13ha_index_nextEPh+0xdc)[0x8012bc]
/usr/sbin/mysqld(_ZN7handler15read_range_nextEv+0x20)[0x8057e0]
/usr/sbin/mysqld(_ZN7handler21multi_range_read_nextEPPc+0xd2)[0x7fae02]
/usr/sbin/mysqld(_ZN18QUICK_RANGE_SELECT8get_nextEv+0x4b)[0xdc9c2b]
/usr/sbin/mysqld[0xc0356a]
/usr/sbin/mysqld(_Z10sub_selectP4JOINP7QEP_TABb+0x147)[0xc73a97]
/usr/sbin/mysqld(_ZN4JOIN4execEv+0x237)[0xc6c977]
/usr/sbin/mysqld(_Z12handle_queryP3THDP3LEXP12Query_resultyy+0x17d)[0xcdc49d]
/usr/sbin/mysqld[0x75c543]
/usr/sbin/mysqld(_Z21mysql_execute_commandP3THDb+0x4816)[0xc9f396]
/usr/sbin/mysqld(_Z11mysql_parseP3THDP12Parser_state+0x5ad)[0xca258d]
/usr/sbin/mysqld(_Z16dispatch_commandP3THDPK8COM_DATA19enum_server_command+0xabd)[0xca314d]
/usr/sbin/mysqld(_Z10do_commandP3THD+0x1b7)[0xca4b27]
/usr/sbin/mysqld(handle_connection+0x2a0)[0xd6a430]
/usr/sbin/mysqld(pfs_spawn_thread+0x1b4)[0xeddd84]
/lib64/libpthread.so.0(+0x7de5)[0x7f4b3d907de5]
/lib64/libc.so.6(clone+0x6d)[0x7f4b3bae3bad]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (7f3270035dc0): is an invalid pointer
Connection ID (thread ID): 312271
Status: NOT_KILLED

You may download the Percona Server operations manual by visiting
http://www.percona.com/software/percona-server/. You may find information
in the manual which will help you identify the cause of the crash.

How to repeat:
It is so hard for us to repeat this crash, it just happened randomly.

Sorry, we have no idea about for how to repeat accurately.

Thank you for the bug report. To process this bug report we need a repeatable test case, please test with latest released version 5.7.24 if the issue continues comment here when you will find a repeatable test case. Thanks in advance.

By seeing the call stacks, it seems  involving subslect or subquery in sql statement, and range conditions are also in.  so we can provides more information, such ash query plan, SQL statement, etc. and the assertion failed occurs many times, not only on 5.7.22 but also on 5.7.23.

Server version:   5.6.37-20180904-log Source distribution

2019-07-19 11:38:11 2b310e105700  InnoDB: Assertion failure in thread 47489689343744 in file row0sel.cc line 2859
InnoDB: Failing assertion: prebuilt->trx->isolation_level == TRX_ISO_READ_UNCOMMITTED
InnoDB: We intentionally generate a memory trap.
InnoDB: Submit a detailed bug report to http://bugs.mysql.com.
InnoDB: If you get repeated assertion failures or crashes, even
InnoDB: immediately after the mysqld startup, there may be
InnoDB: corruption in the InnoDB tablespace. Please refer to
InnoDB: http://dev.mysql.com/doc/refman/5.6/en/forcing-innodb-recovery.html
InnoDB: about forcing recovery.
03:38:11 UTC - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.

Server version:   5.6.37-20180904-log Source distribution

2019-07-19 11:38:11 2b310e105700  InnoDB: Assertion failure in thread 47489689343744 in file row0sel.cc line 2859
InnoDB: Failing assertion: prebuilt->trx->isolation_level == TRX_ISO_READ_UNCOMMITTED
InnoDB: We intentionally generate a memory trap.
InnoDB: Submit a detailed bug report to http://bugs.mysql.com.
InnoDB: If you get repeated assertion failures or crashes, even
InnoDB: immediately after the mysqld startup, there may be
InnoDB: corruption in the InnoDB tablespace. Please refer to
InnoDB: http://dev.mysql.com/doc/refman/5.6/en/forcing-innodb-recovery.html
InnoDB: about forcing recovery.
03:38:11 UTC - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.