Bug in eliminate_item_equal leads to crash in Item_func::Item_func
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
MariaDB |
Fix Released
|
High
|
Timour Katchaounov |
Bug Description
When executing the following query, MariaDB 5.3 (and not 5.2 or mysql-server) crashes as follows:
query:
SELECT `col_varchar_key`
FROM (
SELECT * FROM C
WHERE ( `col_int_key` ) IN (
ON CHILD_SUBQUERY1_t2 .`col_varchar_key` = CHILD_SUBQUERY1_t1 .`col_varchar_key`
)
) table1 ;
backtrace:
#3 0x082776c0 in handle_segfault (sig=11) at mysqld.cc:2683
#4 <signal handler called>
#5 0x081ff02b in Item_func:
#6 0x081ff0c9 in Item_int_
#7 0x081ff6bd in Item_bool_
#8 0x081ff8a5 in Item_bool_
#9 0x081ffad5 in Item_func_
#10 0x0830c765 in eliminate_
#11 0x0830ca86 in substitute_
#12 0x082f6b4e in JOIN::optimize (this=0xb3114e8) at sql_select.cc:995
#13 0x082fb8fa in mysql_select (thd=0xb1021a0, rref_pointer_
group=0x0, having=0x0, proc_param=0x0, select_
#14 0x0843a7d9 in mysql_derived_
#15 0x0843a0cb in mysql_handle_
#16 0x082dda48 in open_and_
#17 0x0829ac49 in open_and_
#18 0x08294446 in execute_
#19 0x0828b069 in mysql_execute_
#20 0x08296857 in mysql_parse (thd=0xb1021a0,
inBuf=0xb25acc8 "SELECT `col_varchar_
#21 0x08288b11 in dispatch_command (command=COM_QUERY, thd=0xb1021a0,
packet=
#22 0x08287d4f in do_command (thd=0xb1021a0) at sql_parse.cc:891
#23 0x08284e96 in handle_
#24 0x00a08919 in start_thread () from /lib/libpthread
#25 0x00951e5e in clone () from /lib/libc.so.6
Notice that b = 0x0 , which gets propagated from eliminate_
(gdb) list
9130 if (produce_equality)
9131 {
9132 if (eq_item)
9133 eq_list.
9134
9135 eq_item= new Item_func_
9136
9137 if (!eq_item)
9138 return 0;
9139 eq_item-
(gdb) print current_sjm
$3 = (TABLE_LIST *) 0xb30c650
(gdb) print current_sjm_head
$1 = (Item *) 0x0
Related branches
Changed in maria: | |
milestone: | none → 5.3 |
Changed in maria: | |
status: | Confirmed → In Progress |
Changed in maria: | |
status: | In Progress → Invalid |
status: | Invalid → Fix Released |
Test case:
--disable_warnings
DROP TABLE /*! IF EXISTS */ CC;
DROP TABLE /*! IF EXISTS */ C;
--enable_warnings
CREATE TABLE `CC` ( key`,`col_ int_key` ) key`,`col_ int_key` )
`col_int_nokey` int(11) DEFAULT NULL,
`col_int_key` int(11) DEFAULT NULL,
`col_varchar_key` varchar(1) DEFAULT NULL,
KEY `col_int_key` (`col_int_key`),
KEY `col_varchar_key` (`col_varchar_
) ENGINE=MyISAM DEFAULT CHARSET=latin1;
INSERT INTO `CC` VALUES (7,8,'v');
INSERT INTO `CC` VALUES (1,9,'r');
INSERT INTO `CC` VALUES (5,9,'a');
INSERT INTO `CC` VALUES (3,186,'m');
INSERT INTO `CC` VALUES (6,NULL,'y');
INSERT INTO `CC` VALUES (92,2,'j');
INSERT INTO `CC` VALUES (7,3,'d');
INSERT INTO `CC` VALUES (NULL,0,'z');
INSERT INTO `CC` VALUES (3,133,'e');
INSERT INTO `CC` VALUES (5,1,'h');
INSERT INTO `CC` VALUES (1,8,'b');
INSERT INTO `CC` VALUES (2,5,'s');
INSERT INTO `CC` VALUES (NULL,5,'e');
INSERT INTO `CC` VALUES (1,8,'j');
INSERT INTO `CC` VALUES (0,6,'e');
INSERT INTO `CC` VALUES (210,51,'f');
INSERT INTO `CC` VALUES (8,4,'v');
INSERT INTO `CC` VALUES (7,7,'x');
INSERT INTO `CC` VALUES (5,6,'m');
INSERT INTO `CC` VALUES (NULL,4,'c');
CREATE TABLE `C` (
`col_int_nokey` int(11) DEFAULT NULL,
`col_int_key` int(11) DEFAULT NULL,
`col_varchar_key` varchar(1) DEFAULT NULL,
KEY `col_int_key` (`col_int_key`),
KEY `col_varchar_key` (`col_varchar_
) ENGINE=MyISAM DEFAULT CHARSET=latin1;
INSERT INTO `C` VALUES (NULL,2,'w');
INSERT INTO `C` VALUES (7,9,'m');
INSERT INTO `C` VALUES (9,3,'m');
INSERT INTO `C` VALUES (7,9,'k');
INSERT INTO `C` VALUES (4,NULL,'r');
INSERT INTO `C` VALUES (2,9,'t');
INSERT INTO `C` VALUES (6,3,'j');
INSERT INTO `C` VALUES (8,8,'u');
INSERT INTO `C` VALUES (NULL,8,'h');
INSERT INTO `C` VALUES (5,53,'o');
INSERT INTO `C` VALUES (NULL,0,NULL);
INSERT INTO `C` VALUES (6,5,'k');
INSERT INTO `C` VALUES (188,166,'e');
INSERT INTO `C` VALUES (2,3,'n');
INSERT INTO `C` VALUES (1,0,'t');
INSERT INTO `C` VALUES (1,1,'c');
INSERT INTO `C` VALUES (0,9,'m');
INSERT INTO `C` VALUES (9,5,'y');
INSERT INTO `C` VALUES (NULL,6,'f');
INSERT INTO `C` VALUES (4,2,'d');
SELECT `col_varchar_key`
SELECT CHILD_SUBQUERY1_t1 .`col_int_nokey`
FROM CC CHILD_SUBQUERY1_t1
STRAIGHT_ JOIN C CHILD_SUBQUERY1_t2
WHERE CHILD_SUBQUERY1_t2 .`col_varchar_key` = 'c'
FROM (
SELECT * FROM C
WHERE ( `col_int_key` ) IN (
ON CHILD_SUBQUERY1_t2 .`col_varchar_key` = CHILD_SUBQUERY1_t1 .`col_varchar_key`
)
) table1 ;
DROP TABLE CC;
DROP TABLE C;