Second crash/valgrind warning in sel_trees_must_be_ored

[Philip Stoev]

even afer the fix for bug #702403 , valgrind reports the following failure:

==7344== Conditional jump or move depends on uninitialised value(s)
==7344== at 0x83B26C0: sel_trees_must_be_ored(RANGE_OPT_PARAM*, SEL_TREE*, SEL_TREE*, Bitmap<64u>) (opt_range.cc:8132)
==7344== by 0x83B2B80: tree_or(RANGE_OPT_PARAM*, SEL_TREE*, SEL_TREE*) (opt_range.cc:8327)
==7344== by 0x83AF566: get_ne_mm_tree(RANGE_OPT_PARAM*, Item_func*, Field*, Item*, Item*, Item_result) (opt_range.cc:6765)
==7344== by 0x83AF60C: get_func_mm_tree(RANGE_OPT_PARAM*, Item_func*, Field*, Item*, Item_result, bool) (opt_range.cc:6798)
==7344== by 0x83AFEEA: get_full_func_mm_tree(RANGE_OPT_PARAM*, Item_func*, Item_field*, Item*, bool) (opt_range.cc:7103)
==7344== by 0x83B0BCC: get_mm_tree(RANGE_OPT_PARAM*, Item*) (opt_range.cc:7293)
==7344== by 0x83B012E: get_mm_tree(RANGE_OPT_PARAM*, Item*) (opt_range.cc:7145)
==7344== by 0x83A8418: SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool) (opt_range.cc:3025)
==7344== by 0x831A967: make_join_select(JOIN*, SQL_SELECT*, Item*) (sql_select.cc:7418)
==7344== by 0x8309B2B: JOIN::optimize() (sql_select.cc:1130)
==7344== by 0x830EA44: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2687)
==7344== by 0x8307326: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:282)
==7344== by 0x82A4748: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5090)
==7344== by 0x829B5BA: mysql_execute_command(THD*) (sql_parse.cc:2235)
==7344== by 0x82A6CEB: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6090)
==7344== by 0x8299243: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1211)

Unfortunately, simplification for valgrind failures is not available. So the test case consists of a mysqldump on the table and the unsimplified offending query. If the valgrind failure is converted into an assertion, then I will be able to apply simplification.

[Philip Stoev (pstoev-askmonty)]

Simplified test case, now crashing:

CREATE TABLE t1 ( f1 int) ;
INSERT IGNORE INTO t1 VALUES (0),(0);

CREATE TABLE t2 ( f2 int, f3 int, f10 int, f11 int, KEY (f10,f3)) ;
INSERT IGNORE INTO t2 VALUES (5,6,0,0),(0,4,0,0);

CREATE TABLE t3 ( f3 int, f10 int, KEY (f10,f3) , KEY (f3) ) ;
INSERT IGNORE INTO t3 VALUES (6,0),(4,0);

SELECT *
FROM t1 JOIN
( t2 JOIN t3 ON t2.f10 = 1 OR t3.f3 = t2.f2 )
 ON t3.f3 <> t2.f3 AND t3.f10 = t2.f11 ;

backtrace:

#5 0x082693ae in Field::eq (this=0xae623cc0, field=0x3) at field.h:236
#6 0x083b525b in sel_trees_must_be_ored (param=0xae7fba58, tree1=0xae622020, tree2=0xae6221d8, oredable_keys=...) at opt_range.cc:8136
#7 0x083b5759 in tree_or (param=0xae7fba58, tree1=0xae622020, tree2=0xae6221d8) at opt_range.cc:8327
#8 0x083b213f in get_ne_mm_tree (param=0xae7fba58, cond_func=0xae613a48, field=0xae623cc0, lt_value=0xae6139a8, gt_value=0xae6139a8, cmp_type=INT_RESULT)
    at opt_range.cc:6765
#9 0x083b21e5 in get_func_mm_tree (param=0xae7fba58, cond_func=0xae613a48, field=0xae623cc0, value=0xae6139a8, cmp_type=INT_RESULT, inv=false)
    at opt_range.cc:6798
#10 0x083b2ac3 in get_full_func_mm_tree (param=0xae7fba58, cond_func=0xae613a48, field_item=0xae6138f8, value=0xae6139a8, inv=false) at opt_range.cc:7103
#11 0x083b37a5 in get_mm_tree (param=0xae7fba58, cond=0xae613a48) at opt_range.cc:7293
#12 0x083b2d07 in get_mm_tree (param=0xae7fba58, cond=0xae62d138) at opt_range.cc:7145
#13 0x083aaff1 in SQL_SELECT::test_quick_select (this=0xae62d2a8, thd=0xb305c80, keys_to_use=..., prev_tables=4611686018427387907,
    limit=18446744073709551615, force_quick_range=false, ordered_output=false) at opt_range.cc:3025
#14 0x0831b588 in make_join_select (join=0xae625b00, select=0xae62c8d0, cond=0xae62af60) at sql_select.cc:7418
#15 0x0830a74c in JOIN::optimize (this=0xae625b00) at sql_select.cc:1130
#16 0x0830f665 in mysql_select (thd=0xb305c80, rref_pointer_array=0xb30771c, tables=0xae612808, wild_num=1, fields=..., conds=0x0, og_num=0, order=0x0,
    group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xae614150, unit=0xb30737c, select_lex=0xb307618) at sql_select.cc:2687
#17 0x08307f47 in handle_select (thd=0xb305c80, lex=0xb307320, result=0xae614150, setup_tables_done_option=0) at sql_select.cc:282
#18 0x082a5324 in execute_sqlcom_select (thd=0xb305c80, all_tables=0xae612808) at sql_parse.cc:5094
#19 0x0829c18a in mysql_execute_command (thd=0xb305c80) at sql_parse.cc:2239
#20 0x082a78c7 in mysql_parse (thd=0xb305c80,
    rawbuf=0xae612618 "SELECT *\nFROM t1 JOIN\n( t2 JOIN t3 ON t2.f10 = 1 OR t3.f3 = t2.f2 )\nON t3.f3 <> t2.f3 AND t3.f10 = t2.f11", length=105,
    found_semicolon=0xae7ff228) at sql_parse.cc:6094
#21 0x08299e13 in dispatch_command (command=COM_QUERY, thd=0xb305c80,
    packet=0xb360961 "SELECT *\nFROM t1 JOIN\n( t2 JOIN t3 ON t2.f10 = 1 OR t3.f3 = t2.f2 )\nON t3.f3 <> t2.f3 AND t3.f10 = t2.f11 ", packet_length=106)
    at sql_parse.cc:1215
#22 0x08299271 in do_command (thd=0xb305c80) at sql_parse.cc:904
#23 0x08296324 in handle_one_connection (arg=0xb305c80) at sql_connect.cc:1154
#24 0x00821919 in start_thread () from /lib/libpthread.so.0
#25 0x0076acce in clone () from /lib/li...