1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug#13012483:EXPLAIN EXTENDED, PREPARED STATEMENT, CRASH IN

Browse Source 
CHECK_SIMPLE_EQUALITY

PROBLEM:
Crash in "check_simple_equality" when using a subquery with "IN" and
"ALL" in prepare.

ANALYSIS:
Crash can be reproduced using a simplified query like this one:
prepare s from "select 1 from g1 where 1 < all (
                select @:=(1 in (select 1 from g1)) from g1)";

This bug is currently present only on 5.5.and 5.1. Its fixed as part
of work log(#1110) in 5.6. We are taking one change to fix this
in 5.5 and 5.1.

Problem seems to be present because we are trying to evaluate "is_null"
on an argument which is part of a subquery
(In Item_is_not_null_test::update_used_tables()).
But the condition to evaluate is only when we do not have a sub query
present, which means to say that "with_subselect" is not set.
With respect to the above query, we create an object of type
"Item_in_optimizer" which by definition is always associated with a
subquery. While in 5.6 we set "with_subselect" to true for
"Item_in_optimizer" object, we do not do the same in 5.5. This results in
the evaluation for "is_null" resulting in a coredump.
So, we are now setting "with_subselect" to true for "Item_in_optimizer"
in 5.1 and 5.5.
This commit is contained in:
Chaithra Gopalareddy 2012-02-24 11:53:36 +05:30
parent a66f29c30c
commit df8827d0e6
3 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
mysql-test/r/func_in.result
View File

@ -776,4 +776,14 @@ SELECT 1 IN (YEAR(FROM_UNIXTIME(NULL)) ,1);
1 IN (YEAR(FROM_UNIXTIME(NULL)) ,1) 1 IN (YEAR(FROM_UNIXTIME(NULL)) ,1)
1 1
# #
#
# Bug#13012483: EXPLAIN EXTENDED, PREPARED STATEMENT, CRASH IN CHECK_SIMPLE_EQUALITY
#
CREATE TABLE t1 (a INT);
PREPARE s FROM "SELECT 1 FROM t1 WHERE 1 < ALL (SELECT @:= (1 IN (SELECT 1 FROM t1)) FROM t1)";
EXECUTE s;
1
DROP TABLE t1;
# End of test BUG#13012483
#
End of 5.1 tests End of 5.1 tests

13
mysql-test/t/func_in.test
View File

@ -562,4 +562,17 @@ SELECT 1 IN (YEAR(FROM_UNIXTIME(NULL)) ,1);
--echo # --echo #
--echo #
--echo # Bug#13012483: EXPLAIN EXTENDED, PREPARED STATEMENT, CRASH IN CHECK_SIMPLE_EQUALITY
--echo #
CREATE TABLE t1 (a INT);
PREPARE s FROM "SELECT 1 FROM t1 WHERE 1 < ALL (SELECT @:= (1 IN (SELECT 1 FROM t1)) FROM t1)";
EXECUTE s;
DROP TABLE t1;
--echo # End of test BUG#13012483
--echo #
--echo End of 5.1 tests --echo End of 5.1 tests

2
sql/item_cmpfunc.h
View File

@ -254,7 +254,7 @@ public:
Item_in_optimizer(Item *a, Item_in_subselect *b): Item_in_optimizer(Item *a, Item_in_subselect *b):
Item_bool_func(a, my_reinterpret_cast(Item *)(b)), cache(0), Item_bool_func(a, my_reinterpret_cast(Item *)(b)), cache(0),
save_cache(0), result_for_null_param(UNKNOWN) save_cache(0), result_for_null_param(UNKNOWN)
{} { with_subselect= true; }
bool fix_fields(THD *, Item **); bool fix_fields(THD *, Item **);
bool fix_left(THD *thd, Item **ref); bool fix_left(THD *thd, Item **ref);
bool is_null(); bool is_null();