Crash in Item_func::Item_func in maria-5.3

[Philip Stoev]

Repeatable in maria-5.3, maria-5.3-mwl89. Not repeatable in maria-5.2. Backtrace:

#4 <signal handler called>
#5 0x08210797 in Item_func::Item_func (this=0xae636890, a=0xae613b08, b=0x0) at item_func.h:82
#6 0x0821085b in Item_int_func::Item_int_func (this=0xae636890, a=0xae613b08, b=0x0) at item_func.h:402
#7 0x08210ee3 in Item_bool_func2::Item_bool_func2 (this=0xae636890, a=0xae613b08, b=0x0) at item_cmpfunc.h:356
#8 0x082110ed in Item_bool_rowready_func2::Item_bool_rowready_func2 (this=0xae636890, a=0xae613b08, b=0x0) at item_cmpfunc.h:389
#9 0x08211321 in Item_func_eq::Item_func_eq (this=0xae636890, a=0xae613b08, b=0x0) at item_cmpfunc.h:494
#10 0x0820f85e in Item_equal::add_const (this=0xae6361e8, c=0xae613b08, f=0x0) at item_cmpfunc.cc:5621
#11 0x0820fa91 in Item_equal::update_const (this=0xae6361e8) at item_cmpfunc.cc:5750
#12 0x08321778 in update_const_equal_items (cond=0xae6361e8, tab=0xae636328) at sql_select.cc:10349
#13 0x083216ea in update_const_equal_items (cond=0xae613cb0, tab=0xae636328) at sql_select.cc:10342
#14 0x0832a6c0 in join_read_const_table (tab=0xae636328, pos=0xae62c9f8) at sql_select.cc:14374
#15 0x08310e42 in make_join_statistics (join=0xae62a1b8, tables_arg=0xae613070, conds=0xae613cb0, keyuse_array=0xae62f2e0) at sql_select.cc:3023
#16 0x0830a44f in JOIN::optimize (this=0xae62a1b8) at sql_select.cc:992
#17 0x0830fd15 in mysql_select (thd=0xa8f3da8, rref_pointer_array=0xa8f5848, tables=0xae613070, wild_num=1, fields=..., conds=0xae613cb0, og_num=0,
    order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764740, result=0xae613de0, unit=0xa8f54a8, select_lex=0xa8f5744)
    at sql_select.cc:2687
#18 0x08338741 in mysql_explain_union (thd=0xa8f3da8, unit=0xa8f54a8, result=0xae613de0) at sql_select.cc:19883
#19 0x082a57be in execute_sqlcom_select (thd=0xa8f3da8, all_tables=0xae613070) at sql_parse.cc:5073
#20 0x0829c786 in mysql_execute_command (thd=0xa8f3da8) at sql_parse.cc:2239
#21 0x082a7edf in mysql_parse (thd=0xa8f3da8, rawbuf=0xae612eb0 "EXPLAIN SELECT *\nFROM t2 \nWHERE ( 3 , 4 ) IN ( SELECT 5 , 6 )\nAND t2.f3 = t2.f1",
    length=80, found_semicolon=0xae9a0228) at sql_parse.cc:6094
#22 0x0829a40f in dispatch_command (command=COM_QUERY, thd=0xa8f3da8, packet=0xa94e901 "", packet_length=81) at sql_parse.cc:1215
#23 0x0829986d in do_command (thd=0xa8f3da8) at sql_parse.cc:904
#24 0x08296920 in handle_one_connection (arg=0xa8f3da8) at sql_connect.cc:1154
#25 0x00821919 in start_thread () from /lib/libpthread.so.0
#26 0x00453cce in clone () from /lib/libc.so.6

test case. Table 2 needs to have 1 row

CREATE TABLE t1 (f11 int);
INSERT INTO t1 VALUES (2), (2);

CREATE TABLE t2 ( f1 int NOT NULL , f3 int);
INSERT IGNORE INTO t2 VALUES (2,7);

SELECT *
FROM t2
WHERE ( 3 , 4 ) IN ( SELECT 5 , 6 )
AND t2.f3 = t2.f1 ;

explain from 5.2. EXPLAIN on 5.3 crashes:

id select_type table type possible_keys key key_len ref rows Extra
1 PRIMARY NULL NULL NULL NULL NULL NULL NULL Impossible WHERE noticed after reading const tables
2 DEPENDENT SUBQUERY NULL NULL NULL NULL NULL NULL NULL Impossible HAVING

[Philip Stoev (pstoev-askmonty)]

See bug https://bugs.launchpad.net/maria/+bug/776285

[Igor Babaev (igorb-seattle)]

Both queries of the following test case cause crashes in 5.3:

CREATE TABLE t1 (a int NOT NULL , b int);
INSERT INTO t1 VALUES (2,2);

SELECT * FROM t1 WHERE a = b;
EXPLAIN
SELECT * FROM t1 WHERE a = b;