Crash in Copy_field::set in maria-5.3

[Philip Stoev]

The following query:

SELECT alias2.f2
FROM t5 AS alias1
LEFT JOIN t4 AS alias2 JOIN t3 AS alias3 ON alias2.f3 = alias3.f3 ON alias1.f1 = alias3.f1
LEFT JOIN t2 AS alias4
RIGHT JOIN t5 AS alias6 JOIN t1 AS alias7 ON alias6.f3 = alias7.f1 ON alias4.f4 JOIN t4 AS alias8 ON alias4.f3 ON alias3.f1 = alias4.f3
WHERE alias8.f1 ;

causes various valgrind warnings and the following crash:

# 2011-01-25T18:42:48 #5 0x08402edd in Copy_field::get_copy_func (this=0x912d8454, to=0x912d8460, from=0x9106d250) at field_conv.cc:642
# 2011-01-25T18:42:48 #6 0x08402eb1 in Copy_field::set (this=0x912d8454, to=0x912d8460, from=0x9106d250, save=false) at field_conv.cc:632
# 2011-01-25T18:42:48 #7 0x08334e1f in store_key_field::change_source_field (this=0x912d8440, fld_item=0x912bafb0) at sql_select.h:1114
# 2011-01-25T18:42:48 #8 0x08305664 in JOIN::optimize (this=0x912d1ea8) at sql_select.cc:1075
# 2011-01-25T18:42:48 #9 0x0830a722 in mysql_select (thd=0xbd96fa8, rref_pointer_array=0xbd98a44, tables=0xa75f0eb0, wild_num=0, fields=..., conds=0x912d02b0, og_num=6,
# 2011-01-25T18:42:48 order=0x912d04f0, group=0x912d0418, having=0x0, proc_param=0x0, select_options=2147764740, result=0x912d0908, unit=0xbd986a4, select_lex=0xbd98940)
# 2011-01-25T18:42:48 at sql_select.cc:2635
# 2011-01-25T18:42:48 #10 0x08332ba9 in mysql_explain_union (thd=0xbd96fa8, unit=0xbd986a4, result=0x912d0908) at sql_select.cc:19652
# 2011-01-25T18:42:48 #11 0x082a0ab2 in execute_sqlcom_select (thd=0xbd96fa8, all_tables=0xa75f0eb0) at sql_parse.cc:5049
# 2011-01-25T18:42:48 #12 0x08297c3f in mysql_execute_command (thd=0xbd96fa8) at sql_parse.cc:2234
# 2011-01-25T18:42:48 #13 0x082a31c8 in mysql_parse (thd=0xbd96fa8,
# 2011-01-25T18:42:48 rawbuf=0xa75f0730 "EXPLAIN SELECT alias2 . `col_int` AS field1 FROM G AS alias1 LEFT JOIN C AS alias2 LEFT JOIN B AS alias3 ON alias2 . `col_int_key` = alias3 . `col_int_key` ON alias1 . `pk` = alias3 . `pk` LEFT JOIN E AS alias4 RIGHT OUTER JOIN K AS alias5 LEFT JOIN G AS alias6 ON alias5 . `col_varchar_10_utf8_key` = alias6 . `col_varchar_1024_latin1` RIGHT JOIN P AS alias7 ON alias6 . `col_int_key` = alias7 . `pk` ON alias4 . `col_varchar_1024_utf8` = alias5 . `col_varchar_1024_utf8_key` LEFT OUTER JOIN C AS alias8 ON alias4 . `col_int_key` = alias8 . `pk` ON alias3 . `pk` = alias4 . `col_int_key` WHERE ( alias8 . `pk` != alias2 . `col_int` AND alias2 . `pk` != 2 ) GROUP BY field1 ORDER BY field1 DESC , field1 DESC , field1 , field1 , field1", length=784, found_semicolon=0x911ff228) at sql_parse.cc:6077
# 2011-01-25T18:42:48 #14 0x082958d7 in dispatch_command (command=COM_QUERY, thd=0xbd96fa8, packet=0xbd98fb1 "", packet_length=786) at sql_parse.cc:1210
# 2011-01-25T18:42:48 #15 0x08294d84 in do_command (thd=0xbd96fa8) at sql_parse.cc:903
# 2011-01-25T18:42:48 #16 0x08291e62 in handle_one_connection (arg=0xbd96fa8) at sql_connect.cc:1154
# 2011-01-25T18:42:48 #17 0x00821919 in start_thread () from /lib/libpthread.so.0
# 2011-01-25T18:42:48 #18 0x0076acce in clone () from /lib/libc.so.6

test case:

CREATE TABLE t1 ( f1 int(11), PRIMARY KEY (f1)) ;
INSERT IGNORE INTO t1 VALUES ('100');

CREATE TABLE t2 ( f3 int(11), f4 varchar(1024) COLLATE utf8_general_ci, KEY (f3)) ;
INSERT IGNORE INTO t2 VALUES (NULL,'just'),('3','djwijiycejntxuvr');

CREATE TABLE t3 ( f1 int(11), f3 int(11), PRIMARY KEY (f1), KEY (f3)) ;
INSERT IGNORE INTO t3 VALUES ('1','494862336');

CREATE TABLE t4 ( f1 int(11), f3 int(11), f2 int(11), KEY (f3)) ;
INSERT IGNORE INTO t4 VALUES ('1',NULL,'3'),('2','7','8');

CREATE TABLE t5 ( f1 int(11), f3 int(11), PRIMARY KEY (f1), KEY (f3)) ;
INSERT IGNORE INTO t5 VALUES ('1',NULL),('8',NULL);

SELECT alias2.f2
FROM t5 AS alias1
LEFT JOIN t4 AS alias2 JOIN t3 AS alias3 ON alias2.f3 = alias3.f3 ON alias1.f1 = alias3.f1
LEFT JOIN t2 AS alias4
RIGHT JOIN t5 AS alias6 JOIN t1 AS alias7 ON alias6.f3 = alias7.f1 ON alias4.f4 JOIN t4 AS alias8 ON alias4.f3 ON alias3.f1 = alias4.f3
WHERE alias8.f1 ;

[Philip Stoev (philip-stoev)]

Not repeatable with maria-5.2 or mysql 5.5