MDEV-35745 Assertion failure, ASAN errors, crash in mhnsw_read_first/mhnsw_read_next

vuvova · vuvova · commit 8ef37ade1778 · 2025-01-13T19:57:12.000+01:00
If the table has many deleted nodes, they can overflow
`candidates` even when `best` isn't full yet
diff --git a/sql/vector_mhnsw.cc b/sql/vector_mhnsw.cc
@@ -1092,7 +1092,7 @@ static int search_layer(MHNSW_Share *ctx, TABLE *graph, const FVector *target,
         if (!best.is_full())
         {
           max_distance= std::max(max_distance, v->distance_to_target);
-          candidates.push(v);
+          candidates.safe_push(v);
           if (skip_deleted && v->node->deleted)
             continue;
           best.push(v);

Original file line number	Diff line number	Diff line change
`@@ -1092,7 +1092,7 @@ static int search_layer(MHNSW_Share ctx, TABLE graph, const FVector *target,`
`1092`	`1092`	`if (!best.is_full())`
`1093`	`1093`	`{`
`1094`	`1094`	`max_distance= std::max(max_distance, v->distance_to_target);`
`1095`		`- candidates.push(v);`
	`1095`	`+ candidates.safe_push(v);`
`1096`	`1096`	`if (skip_deleted && v->node->deleted)`
`1097`	`1097`	`continue;`
`1098`	`1098`	`best.push(v);`