Crash in Field::eq in maria-5.3 and NOT NULL fields

[Philip Stoev]

Not repeatable in maria-5.2. The following query:

SELECT * FROM t1 LEFT JOIN v2 ON t1.f10 != 0 WHERE v2.f1 = v2.f3 AND v2.f1 = 68 AND v2.f1 IS NULL

crashes as follows:

#3 0x08289e44 in handle_segfault (sig=11) at mysqld.cc:2774
#4 <signal handler called>
#5 0x082698f6 in Field::eq (this=0xae61ae60, field=0x8f8f8f00) at field.h:236
#6 0x0820f900 in Item_equal::contains (this=0xae623a00, field=0xae61ae60) at item_cmpfunc.cc:5652
#7 0x081ccb68 in Item_field::find_item_equal (this=0xae613550, cond_equal=0xae623908) at item.cc:4658
#8 0x081ccd9f in Item_field::equal_fields_propagator (this=0xae613550, arg=0xae623908 ":\314w\b") at item.cc:4767
#9 0x081d939c in Item::compile (this=0xae613550, analyzer=&virtual Item::subst_argument_checker(uchar**), arg_p=0xae99ee20,
    transformer=&virtual Item::equal_fields_propagator(uchar*), arg_t=0xae623908 ":\314w\b") at item.h:951
#10 0x081eb195 in Item_func::compile (this=0xae613660, analyzer=&virtual table offset 336, arg_p=0xae99ee8c, transformer=&virtual table offset 344,
    arg_t=0xae623908 ":\314w\b") at item_func.cc:382
#11 0x0832082e in build_equal_items_for_cond (thd=0xb101da8, cond=0xae613660, inherited=0xae623908) at sql_select.cc:9796
#12 0x08320433 in build_equal_items_for_cond (thd=0xb101da8, cond=0xae623870, inherited=0xae623908) at sql_select.cc:9713
#13 0x083208a5 in build_equal_items (thd=0xb101da8, cond=0xae623870, inherited=0x0, join_list=0xb103808, cond_equal_ref=0xae62a30c) at sql_select.cc:9878
#14 0x083233f1 in optimize_cond (join=0xae625140, conds=0xae623870, join_list=0xb103808, cond_value=0xae62a27c, cond_equal=0xae62a30c) at sql_select.cc:11256
#15 0x08309d7c in JOIN::optimize (this=0xae625140) at sql_select.cc:855
#16 0x0830fd2d in mysql_select (thd=0xb101da8, rref_pointer_array=0xb103848, tables=0xae6130c8, wild_num=1, fields=..., conds=0xae613e58, og_num=0,
    order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xae614e88, unit=0xb1034a8, select_lex=0xb103744)
    at sql_select.cc:2687
#17 0x0830860f in handle_select (thd=0xb101da8, lex=0xb10344c, result=0xae614e88, setup_tables_done_option=0) at sql_select.cc:282
#18 0x082a5954 in execute_sqlcom_select (thd=0xb101da8, all_tables=0xae6130c8) at sql_parse.cc:5094
#19 0x0829c79e in mysql_execute_command (thd=0xb101da8) at sql_parse.cc:2239
#20 0x082a7ef7 in mysql_parse (thd=0xb101da8,
    rawbuf=0xae612ee8 "SELECT * FROM t1 LEFT JOIN v2 ON t1.f10 != 0\nWHERE v2.f1 = v2.f3 AND v2.f1 = 68 AND v2.f1 IS NULL", length=98,
    found_semicolon=0xae9a0228) at sql_parse.cc:6094
#21 0x0829a427 in dispatch_command (command=COM_QUERY, thd=0xb101da8,
    packet=0xb15c901 "SELECT * FROM t1 LEFT JOIN v2 ON t1.f10 != 0\nWHERE v2.f1 = v2.f3 AND v2.f1 = 68 AND v2.f1 IS NULL", packet_length=98)
    at sql_parse.cc:1215
#22 0x08299885 in do_command (thd=0xb101da8) at sql_parse.cc:904
#23 0x08296938 in handle_one_connection (arg=0xb101da8) at sql_connect.cc:1154
#24 0x00821919 in start_thread () from /lib/libpthread.so.0
#25 0x0076acce in clone () from /lib/libc.so.6

test case:

CREATE TABLE t1 ( f10 int NOT NULL ) ;
INSERT IGNORE INTO t1 VALUES (2),(2);

DROP TABLE IF EXISTS t2;
CREATE TABLE t2 ( f1 int NOT NULL , f3 int NOT NULL ) ;
INSERT INTO t2 VALUES (2,2),(2,2);
CREATE OR REPLACE VIEW v2 AS SELECT * FROM t2;

SELECT * FROM t1 LEFT JOIN v2 ON t1.f10 != 0 WHERE v2.f1 = v2.f3 AND v2.f1 = 68 AND v2.f1 IS NULL;

 bzr version-info
revision-id: <email address hidden>
date: 2011-05-04 18:08:44 -0700
build-date: 2011-05-05 13:56:40 +0300
revno: 2980
branch-nick: maria-5.3

[Philip Stoev (pstoev-askmonty)]

Also observed without IS NULL