- commits - lists.mariadb.org

[Commits] f278a88: This commit adds the same call of st_select_lex::set_unique_exclude() that
by IgorBabaev 24 Apr '21

24 Apr '21

revision-id: f278a8826254f74ee0b5d7083d3aed2250e9148c (mariadb-10.3.26-137-gf278a88) parent(s): e3a25793be936d9682a711a00d6b4bf708b6fb8d author: Igor Babaev committer: Igor Babaev timestamp: 2021-04-24 15:50:25 -0700 message: This commit adds the same call of st_select_lex::set_unique_exclude() that complemented the fix for MDEV-24823 in 10.2. As it is the only call of this function in 10.3 the commit also has added the code of the function. --- sql/sql_delete.cc | 2 +- sql/sql_lex.cc | 21 +++++++++++++++++++++ sql/sql_lex.h | 2 ++ 3 files changed, 24 insertions(+), 1 deletion(-) diff --git a/sql/sql_delete.cc b/sql/sql_delete.cc index c78e8ed..4d6a2c6 100644 --- a/sql/sql_delete.cc +++ b/sql/sql_delete.cc @@ -1013,7 +1013,7 @@ int mysql_multi_delete_prepare(THD *thd) Multi-delete can't be constructed over-union => we always have single SELECT on top and have to check underlying SELECTs of it */ - lex->select_lex.exclude_from_table_unique_test= TRUE; + lex->select_lex.set_unique_exclude(); /* Fix tables-to-be-deleted-from list to point at opened tables */ for (target_tbl= (TABLE_LIST*) aux_tables; target_tbl; diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc index fe4d086..5604658 100644 --- a/sql/sql_lex.cc +++ b/sql/sql_lex.cc @@ -4927,6 +4927,27 @@ bool st_select_lex::save_prep_leaf_tables(THD *thd) } +/** + Set exclude_from_table_unique_test for selects of this select and all selects + belonging to the underlying units of derived tables or views +*/ + +void st_select_lex::set_unique_exclude() +{ + exclude_from_table_unique_test= TRUE; + for (SELECT_LEX_UNIT *unit= first_inner_unit(); + unit; + unit= unit->next_unit()) + { + if (unit->derived && unit->derived->is_view_or_derived()) + { + for (SELECT_LEX *sl= unit->first_select(); sl; sl= sl->next_select()) + sl->set_unique_exclude(); + } + } +} + + /* Return true if this select_lex has been converted into a semi-join nest within 'ancestor'. diff --git a/sql/sql_lex.h b/sql/sql_lex.h index b5b39fe..c3e48a7 100644 --- a/sql/sql_lex.h +++ b/sql/sql_lex.h @@ -1354,6 +1354,8 @@ class st_select_lex: public st_select_lex_node bool save_leaf_tables(THD *thd); bool save_prep_leaf_tables(THD *thd); + void set_unique_exclude(); + bool is_merged_child_of(st_select_lex *ancestor); /*

1 0

[Commits] b5a995ce608: MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker
by psergey 24 Apr '21

24 Apr '21

revision-id: b5a995ce6082a3fe4ccc453333be1019779fcbb6 (mariadb-10.3.26-138-gb5a995ce608) parent(s): c425d93b92acbf00f03a339c117616d2308669b6 author: Sergei Petrunia committer: Sergei Petrunia timestamp: 2021-04-24 23:27:52 +0300 message: MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker The optimizer removes redundant GROUP BY operations. If GROUP BY element is a subselect, it is "eliminated". However one must not eliminate the item if it is used both in the select list and in the GROUP BY, like so: select (select ... ) as SUBQ from ... group by SUBQ Do not eliminate such items. --- mysql-test/main/subselect4.result | 50 +++++++++++++++++++++++++++++++++++++++ mysql-test/main/subselect4.test | 32 +++++++++++++++++++++++++ sql/sql_select.cc | 11 ++++++++- 3 files changed, 92 insertions(+), 1 deletion(-) diff --git a/mysql-test/main/subselect4.result b/mysql-test/main/subselect4.result index 156e78e7778..456b9bcd829 100644 --- a/mysql-test/main/subselect4.result +++ b/mysql-test/main/subselect4.result @@ -2786,4 +2786,54 @@ id select_type table type possible_keys key key_len ref rows Extra set names default; set @@in_predicate_conversion_threshold= @save_in_predicate_conversion_threshold; DROP TABLE t1,t2; +# +# MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker +# +CREATE TABLE t1 (id INT PRIMARY KEY); +INSERT INTO t1 VALUES (1),(2); +SELECT +1 IN ( +SELECT +(SELECT COUNT(id) +FROM t1 +WHERE t1_outer.id <> id +) AS f +FROM +t1 AS t1_outer +GROUP BY f +); +1 IN ( +SELECT +(SELECT COUNT(id) +FROM t1 +WHERE t1_outer.id <> id +) AS f +FROM +t1 AS t1_outer +GROUP BY f +) +1 +SELECT +1 IN ( +SELECT +(SELECT COUNT(id) +FROM t1 +WHERE t1_outer.id <> id +) AS f +FROM +t1 AS t1_outer +GROUP BY 1 +); +1 IN ( +SELECT +(SELECT COUNT(id) +FROM t1 +WHERE t1_outer.id <> id +) AS f +FROM +t1 AS t1_outer +GROUP BY 1 +) +1 +DROP TABLE t1; # End of 10.3 tests diff --git a/mysql-test/main/subselect4.test b/mysql-test/main/subselect4.test index a5fcc507905..ab311d3e505 100644 --- a/mysql-test/main/subselect4.test +++ b/mysql-test/main/subselect4.test @@ -2308,4 +2308,36 @@ set names default; set @@in_predicate_conversion_threshold= @save_in_predicate_conversion_threshold; DROP TABLE t1,t2; +--echo # +--echo # MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker +--echo # +CREATE TABLE t1 (id INT PRIMARY KEY); +INSERT INTO t1 VALUES (1),(2); + +SELECT + 1 IN ( + SELECT + (SELECT COUNT(id) + FROM t1 + WHERE t1_outer.id <> id + ) AS f + FROM + t1 AS t1_outer + GROUP BY f + ); + +SELECT + 1 IN ( + SELECT + (SELECT COUNT(id) + FROM t1 + WHERE t1_outer.id <> id + ) AS f + FROM + t1 AS t1_outer + GROUP BY 1 + ); + +DROP TABLE t1; + --echo # End of 10.3 tests diff --git a/sql/sql_select.cc b/sql/sql_select.cc index b4e6c505261..d53c592ff7b 100644 --- a/sql/sql_select.cc +++ b/sql/sql_select.cc @@ -596,7 +596,16 @@ void remove_redundant_subquery_clauses(st_select_lex *subq_select_lex) { for (ORDER *ord= subq_select_lex->group_list.first; ord; ord= ord->next) { - (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL); + /* + Do not remove the item if it is used in select list and then referred + from GROUP BY clause by its name or number. Example: + + select (select ... ) as SUBQ ... group by SUBQ + + Here SUBQ cannot be removed. + */ + if (!ord->in_field_list) + (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL); } subq_select_lex->join->group_list= NULL; subq_select_lex->group_list.empty();

1 0

[Commits] c54a7d1f226: MDEV-24898: Server crashes in st_select_lex::next_select
by psergey 24 Apr '21

24 Apr '21

revision-id: c54a7d1f2267fd1f7072a34012f728ddaccbbd35 (mariadb-10.3.26-139-gc54a7d1f226) parent(s): b5a995ce6082a3fe4ccc453333be1019779fcbb6 author: Sergei Petrunia committer: Sergei Petrunia timestamp: 2021-04-24 23:27:52 +0300 message: MDEV-24898: Server crashes in st_select_lex::next_select Add a testcase --- mysql-test/main/subselect4.result | 11 +++++++++++ mysql-test/main/subselect4.test | 13 +++++++++++++ 2 files changed, 24 insertions(+) diff --git a/mysql-test/main/subselect4.result b/mysql-test/main/subselect4.result index 456b9bcd829..6940795a9c1 100644 --- a/mysql-test/main/subselect4.result +++ b/mysql-test/main/subselect4.result @@ -2836,4 +2836,15 @@ GROUP BY 1 ) 1 DROP TABLE t1; +# +# MDEV-24898: Server crashes in st_select_lex::next_select / Item_subselect::is_expensive +# (Testcase) +# +CREATE TABLE t1 (a INT); +INSERT INTO t1 VALUES (1),(2); +CREATE TABLE t2 (b INT); +INSERT INTO t2 VALUES (3),(4); +SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x); +ERROR 21000: Subquery returns more than 1 row +drop table t1,t2; # End of 10.3 tests diff --git a/mysql-test/main/subselect4.test b/mysql-test/main/subselect4.test index ab311d3e505..31f6f55b4e4 100644 --- a/mysql-test/main/subselect4.test +++ b/mysql-test/main/subselect4.test @@ -2340,4 +2340,17 @@ SELECT DROP TABLE t1; +--echo # +--echo # MDEV-24898: Server crashes in st_select_lex::next_select / Item_subselect::is_expensive +--echo # (Testcase) +--echo # +CREATE TABLE t1 (a INT); +INSERT INTO t1 VALUES (1),(2); # Optional, fails either way +CREATE TABLE t2 (b INT); +INSERT INTO t2 VALUES (3),(4); # Optional, fails either way + +--error ER_SUBQUERY_NO_1_ROW +SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x); +drop table t1,t2; + --echo # End of 10.3 tests

1 0

[Commits] 7f0dbe1: This patch complements the patch for MDEV-24823.
by IgorBabaev 24 Apr '21

24 Apr '21

revision-id: 7f0dbe128e50a04b0b5ee93639a620335c7ffce4 (mariadb-10.3.26-137-g7f0dbe1) parent(s): e3a25793be936d9682a711a00d6b4bf708b6fb8d author: Igor Babaev committer: Igor Babaev timestamp: 2021-04-23 22:58:29 -0700 message: This patch complements the patch for MDEV-24823. --- sql/sql_delete.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sql/sql_delete.cc b/sql/sql_delete.cc index c78e8ed..4d6a2c6 100644 --- a/sql/sql_delete.cc +++ b/sql/sql_delete.cc @@ -1013,7 +1013,7 @@ int mysql_multi_delete_prepare(THD *thd) Multi-delete can't be constructed over-union => we always have single SELECT on top and have to check underlying SELECTs of it */ - lex->select_lex.exclude_from_table_unique_test= TRUE; + lex->select_lex.set_unique_exclude(); /* Fix tables-to-be-deleted-from list to point at opened tables */ for (target_tbl= (TABLE_LIST*) aux_tables; target_tbl;

1 0

[Commits] 6444df4: This patch complements the patch for MDEV-24823.
by IgorBabaev 23 Apr '21

23 Apr '21

revision-id: 6444df48565155122b9030b365eacf55e05f2261 (mariadb-10.2.31-891-g6444df4) parent(s): b3b5d57e78f835473d13d383caacb7320b5938d5 author: Igor Babaev committer: Igor Babaev timestamp: 2021-04-23 14:32:20 -0700 message: This patch complements the patch for MDEV-24823. --- sql/sql_delete.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sql/sql_delete.cc b/sql/sql_delete.cc index 61a3b4e..e2bf2d7 100644 --- a/sql/sql_delete.cc +++ b/sql/sql_delete.cc @@ -845,7 +845,7 @@ int mysql_multi_delete_prepare(THD *thd) Multi-delete can't be constructed over-union => we always have single SELECT on top and have to check underlying SELECTs of it */ - lex->select_lex.exclude_from_table_unique_test= TRUE; + lex->select_lex.set_unique_exclude(); /* Fix tables-to-be-deleted-from list to point at opened tables */ for (target_tbl= (TABLE_LIST*) aux_tables; target_tbl;

1 0

[Commits] 5cb2624c392: MDEV-24898: Server crashes in st_select_lex::next_select
by psergey 23 Apr '21

23 Apr '21

revision-id: 5cb2624c3926f71e96de69c2d0227dd563237d27 (mariadb-10.3.26-138-g5cb2624c392) parent(s): c55145ede080f1bcedccda33dc66de7967b02dc8 author: Sergei Petrunia committer: Sergei Petrunia timestamp: 2021-04-23 19:57:51 +0300 message: MDEV-24898: Server crashes in st_select_lex::next_select Add a testcase --- mysql-test/main/subselect4.result | 11 +++++++++++ mysql-test/main/subselect4.test | 13 +++++++++++++ 2 files changed, 24 insertions(+) diff --git a/mysql-test/main/subselect4.result b/mysql-test/main/subselect4.result index 456b9bcd829..6940795a9c1 100644 --- a/mysql-test/main/subselect4.result +++ b/mysql-test/main/subselect4.result @@ -2836,4 +2836,15 @@ GROUP BY 1 ) 1 DROP TABLE t1; +# +# MDEV-24898: Server crashes in st_select_lex::next_select / Item_subselect::is_expensive +# (Testcase) +# +CREATE TABLE t1 (a INT); +INSERT INTO t1 VALUES (1),(2); +CREATE TABLE t2 (b INT); +INSERT INTO t2 VALUES (3),(4); +SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x); +ERROR 21000: Subquery returns more than 1 row +drop table t1,t2; # End of 10.3 tests diff --git a/mysql-test/main/subselect4.test b/mysql-test/main/subselect4.test index ab311d3e505..31f6f55b4e4 100644 --- a/mysql-test/main/subselect4.test +++ b/mysql-test/main/subselect4.test @@ -2340,4 +2340,17 @@ SELECT DROP TABLE t1; +--echo # +--echo # MDEV-24898: Server crashes in st_select_lex::next_select / Item_subselect::is_expensive +--echo # (Testcase) +--echo # +CREATE TABLE t1 (a INT); +INSERT INTO t1 VALUES (1),(2); # Optional, fails either way +CREATE TABLE t2 (b INT); +INSERT INTO t2 VALUES (3),(4); # Optional, fails either way + +--error ER_SUBQUERY_NO_1_ROW +SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x); +drop table t1,t2; + --echo # End of 10.3 tests

1 0

[Commits] 04e0f13dca5: MDEV-24898: Server crashes in st_select_lex::next_select
by psergey 23 Apr '21

23 Apr '21

revision-id: 04e0f13dca57cc5f404d5f3f9378632d24538a50 (mariadb-10.3.26-138-g04e0f13dca5) parent(s): c55145ede080f1bcedccda33dc66de7967b02dc8 author: Sergei Petrunia committer: Sergei Petrunia timestamp: 2021-04-23 19:45:09 +0300 message: MDEV-24898: Server crashes in st_select_lex::next_select Add a testcase --- mysql-test/main/subselect4.result | 11 +++++++++++ mysql-test/main/subselect4.test | 13 +++++++++++++ 2 files changed, 24 insertions(+) diff --git a/mysql-test/main/subselect4.result b/mysql-test/main/subselect4.result index 456b9bcd829..d79a12f1951 100644 --- a/mysql-test/main/subselect4.result +++ b/mysql-test/main/subselect4.result @@ -2836,4 +2836,15 @@ GROUP BY 1 ) 1 DROP TABLE t1; +# +# MDEV-24898: Server crashes in st_select_lex::next_select / Item_subselect::is_expensive +# (Testcase) +# +CREATE TABLE t1 (a INT); +INSERT INTO t1 VALUES (1),(2); +CREATE TABLE t2 (b INT); +INSERT INTO t2 VALUES (3),(4); +SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x); +ERROR 21000: Subquery returns more than 1 row +drop table t1,t2; # End of 10.3 tests diff --git a/mysql-test/main/subselect4.test b/mysql-test/main/subselect4.test index ab311d3e505..31f6f55b4e4 100644 --- a/mysql-test/main/subselect4.test +++ b/mysql-test/main/subselect4.test @@ -2340,4 +2340,17 @@ SELECT DROP TABLE t1; +--echo # +--echo # MDEV-24898: Server crashes in st_select_lex::next_select / Item_subselect::is_expensive +--echo # (Testcase) +--echo # +CREATE TABLE t1 (a INT); +INSERT INTO t1 VALUES (1),(2); # Optional, fails either way +CREATE TABLE t2 (b INT); +INSERT INTO t2 VALUES (3),(4); # Optional, fails either way + +--error ER_SUBQUERY_NO_1_ROW +SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x); +drop table t1,t2; + --echo # End of 10.3 tests

1 0

[Commits] c55145ede08: MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker
by psergey 23 Apr '21

23 Apr '21

revision-id: c55145ede080f1bcedccda33dc66de7967b02dc8 (mariadb-10.3.26-137-gc55145ede08) parent(s): e3a25793be936d9682a711a00d6b4bf708b6fb8d author: Sergei Petrunia committer: Sergei Petrunia timestamp: 2021-04-23 19:28:48 +0300 message: MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker The optimizer removes redundant GROUP BY operations. If GROUP BY element is a subselect, it is "eliminated". However one must not eliminate the item if it is used both in the select list and in the GROUP BY, like so: select (select ... ) as SUBQ from ... group by SUBQ Do not eliminate such items. --- mysql-test/main/subselect4.result | 50 +++++++++++++++++++++++++++++++++++++++ mysql-test/main/subselect4.test | 32 +++++++++++++++++++++++++ sql/sql_select.cc | 11 ++++++++- 3 files changed, 92 insertions(+), 1 deletion(-) diff --git a/mysql-test/main/subselect4.result b/mysql-test/main/subselect4.result index 156e78e7778..456b9bcd829 100644 --- a/mysql-test/main/subselect4.result +++ b/mysql-test/main/subselect4.result @@ -2786,4 +2786,54 @@ id select_type table type possible_keys key key_len ref rows Extra set names default; set @@in_predicate_conversion_threshold= @save_in_predicate_conversion_threshold; DROP TABLE t1,t2; +# +# MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker +# +CREATE TABLE t1 (id INT PRIMARY KEY); +INSERT INTO t1 VALUES (1),(2); +SELECT +1 IN ( +SELECT +(SELECT COUNT(id) +FROM t1 +WHERE t1_outer.id <> id +) AS f +FROM +t1 AS t1_outer +GROUP BY f +); +1 IN ( +SELECT +(SELECT COUNT(id) +FROM t1 +WHERE t1_outer.id <> id +) AS f +FROM +t1 AS t1_outer +GROUP BY f +) +1 +SELECT +1 IN ( +SELECT +(SELECT COUNT(id) +FROM t1 +WHERE t1_outer.id <> id +) AS f +FROM +t1 AS t1_outer +GROUP BY 1 +); +1 IN ( +SELECT +(SELECT COUNT(id) +FROM t1 +WHERE t1_outer.id <> id +) AS f +FROM +t1 AS t1_outer +GROUP BY 1 +) +1 +DROP TABLE t1; # End of 10.3 tests diff --git a/mysql-test/main/subselect4.test b/mysql-test/main/subselect4.test index a5fcc507905..ab311d3e505 100644 --- a/mysql-test/main/subselect4.test +++ b/mysql-test/main/subselect4.test @@ -2308,4 +2308,36 @@ set names default; set @@in_predicate_conversion_threshold= @save_in_predicate_conversion_threshold; DROP TABLE t1,t2; +--echo # +--echo # MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker +--echo # +CREATE TABLE t1 (id INT PRIMARY KEY); +INSERT INTO t1 VALUES (1),(2); + +SELECT + 1 IN ( + SELECT + (SELECT COUNT(id) + FROM t1 + WHERE t1_outer.id <> id + ) AS f + FROM + t1 AS t1_outer + GROUP BY f + ); + +SELECT + 1 IN ( + SELECT + (SELECT COUNT(id) + FROM t1 + WHERE t1_outer.id <> id + ) AS f + FROM + t1 AS t1_outer + GROUP BY 1 + ); + +DROP TABLE t1; + --echo # End of 10.3 tests diff --git a/sql/sql_select.cc b/sql/sql_select.cc index b4e6c505261..d53c592ff7b 100644 --- a/sql/sql_select.cc +++ b/sql/sql_select.cc @@ -596,7 +596,16 @@ void remove_redundant_subquery_clauses(st_select_lex *subq_select_lex) { for (ORDER *ord= subq_select_lex->group_list.first; ord; ord= ord->next) { - (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL); + /* + Do not remove the item if it is used in select list and then referred + from GROUP BY clause by its name or number. Example: + + select (select ... ) as SUBQ ... group by SUBQ + + Here SUBQ cannot be removed. + */ + if (!ord->in_field_list) + (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL); } subq_select_lex->join->group_list= NULL; subq_select_lex->group_list.empty();

1 0

[Commits] 55491d94a6c: MDEV-21603: Long WHERE IN mariadb 10.3.22 crash
by psergey 23 Apr '21

23 Apr '21

revision-id: 55491d94a6c0d61f9db9ef5bb7950e2417411633 (mariadb-10.3.26-135-g55491d94a6c) parent(s): 75c01f39b1b4a6d27d36d075f8baab9bdda7cc7e author: Sergei Petrunia committer: Sergei Petrunia timestamp: 2021-04-23 19:02:38 +0300 message: MDEV-21603: Long WHERE IN mariadb 10.3.22 crash I_S tables and SHOW COMMANDS use special logic for creating and populating temp.tables, e.g. table creation is delayed. The code attempted to apply the same logic for the IN-to-SELECT temptable, which resulted in an attempt to read from not-yet-created temptable and crash. Fix this by restricting use of I_S table logic only to I_S tables. --- mysql-test/main/information_schema2.result | 12 ++++++++++++ mysql-test/main/information_schema2.test | 13 +++++++++++++ sql/sql_base.cc | 1 - sql/sql_class.h | 12 ++++++++++-- sql/sql_derived.cc | 8 +++++--- sql/sql_prepare.cc | 2 +- 6 files changed, 41 insertions(+), 7 deletions(-) diff --git a/mysql-test/main/information_schema2.result b/mysql-test/main/information_schema2.result index e23e81b885c..0f24ca3f264 100644 --- a/mysql-test/main/information_schema2.result +++ b/mysql-test/main/information_schema2.result @@ -18,3 +18,15 @@ t2 t3 t4 drop table t1, t2, t3, t4; +# +# MDEV-21603: Long WHERE IN mariadb 10.3.22 crash +# +connect con1,localhost,root,,; +set @@in_predicate_conversion_threshold=10; +use mysql; +show tables where tables_in_mysql in ('1','2','3','4','5','6','7','8','9','boom'); +Tables_in_mysql +show fields from user where Field in ('1','2','3','4','5','6','7','8','9','boom'); +Field Type Null Key Default Extra +disconnect con1; +connection default; diff --git a/mysql-test/main/information_schema2.test b/mysql-test/main/information_schema2.test index d2fa3da2b5f..d0cfeefa31a 100644 --- a/mysql-test/main/information_schema2.test +++ b/mysql-test/main/information_schema2.test @@ -17,3 +17,16 @@ create table t4 AS select table_name from information_schema.TABLES where table_ delete from t4 where table_name not in (select table_name from information_schema.TABLES where table_schema = database() and table_type = 'BASE TABLE'); select * from t4 order by table_name; drop table t1, t2, t3, t4; + +--echo # +--echo # MDEV-21603: Long WHERE IN mariadb 10.3.22 crash +--echo # +connect (con1,localhost,root,,); + +set @@in_predicate_conversion_threshold=10; +use mysql; +show tables where tables_in_mysql in ('1','2','3','4','5','6','7','8','9','boom'); +show fields from user where Field in ('1','2','3','4','5','6','7','8','9','boom'); + +disconnect con1; +connection default; diff --git a/sql/sql_base.cc b/sql/sql_base.cc index 0b17032da8f..4e5b32ce1e5 100644 --- a/sql/sql_base.cc +++ b/sql/sql_base.cc @@ -5187,7 +5187,6 @@ bool open_normal_and_derived_tables(THD *thd, TABLE_LIST *tables, uint flags, uint counter; MDL_savepoint mdl_savepoint= thd->mdl_context.mdl_savepoint(); DBUG_ENTER("open_normal_and_derived_tables"); - DBUG_ASSERT(!thd->fill_derived_tables()); if (open_tables(thd, &tables, &counter, flags, &prelocking_strategy) || mysql_handle_derived(thd->lex, dt_phases)) goto end; diff --git a/sql/sql_class.h b/sql/sql_class.h index 5ab93de7957..de2dab3cc14 100644 --- a/sql/sql_class.h +++ b/sql/sql_class.h @@ -3636,9 +3636,17 @@ class THD :public Statement, { return server_status & SERVER_STATUS_IN_TRANS; } - inline bool fill_derived_tables() + inline bool fill_derived_table(TABLE_LIST *tl) { - return !stmt_arena->is_stmt_prepare() && !lex->only_view_structure(); + /* + Do not fill derived table when + 1. running a PREPARE command + 2. this is a SHOW command and the table is a temp.table representing + the I_S table. + */ + return !stmt_arena->is_stmt_prepare() && // (1) + !(lex->only_view_structure() && tl? tl->schema_table_reformed:false); // (2) + } inline bool fill_information_schema_tables() { diff --git a/sql/sql_derived.cc b/sql/sql_derived.cc index 50b0178c6c9..33cb6a50710 100644 --- a/sql/sql_derived.cc +++ b/sql/sql_derived.cc @@ -85,14 +85,16 @@ mysql_handle_derived(LEX *lex, uint phases) break; if (!(phases & phase_flag)) continue; - if (phase_flag >= DT_CREATE && !thd->fill_derived_tables()) - break; for (SELECT_LEX *sl= lex->all_selects_list; sl && !res; sl= sl->next_select_in_list()) { TABLE_LIST *cursor= sl->get_table_list(); + + if (phase_flag >= DT_CREATE && !thd->fill_derived_table(cursor)) + break; + sl->changed_elements|= TOUCHED_SEL_DERIVED; /* DT_MERGE_FOR_INSERT is not needed for views/derived tables inside @@ -193,7 +195,7 @@ mysql_handle_single_derived(LEX *lex, TABLE_LIST *derived, uint phases) if (phase_flag != DT_PREPARE && !(allowed_phases & phase_flag)) continue; - if (phase_flag >= DT_CREATE && !thd->fill_derived_tables()) + if (phase_flag >= DT_CREATE && !thd->fill_derived_table(derived)) break; if ((res= (*processors[phase])(lex->thd, lex, derived))) diff --git a/sql/sql_prepare.cc b/sql/sql_prepare.cc index 9775e99afdd..357c1334ee2 100644 --- a/sql/sql_prepare.cc +++ b/sql/sql_prepare.cc @@ -1452,7 +1452,7 @@ static int mysql_test_update(Prepared_statement *stmt, } /* - thd->fill_derived_tables() is false here for sure (because it is + thd->fill_derived_table(table_list) is false here for sure (because it is preparation of PS, so we even do not check it). */ if (table_list->handle_derived(thd->lex, DT_MERGE_FOR_INSERT))

1 0

[Commits] 18db45ff355: MDEV-21603: Long WHERE IN mariadb 10.3.22 crash
by psergey 23 Apr '21

23 Apr '21

revision-id: 18db45ff3553b6830ec1f72941301472abb3e706 (mariadb-10.3.26-135-g18db45ff355) parent(s): 75c01f39b1b4a6d27d36d075f8baab9bdda7cc7e author: Sergei Petrunia committer: Sergei Petrunia timestamp: 2021-04-23 16:00:29 +0300 message: MDEV-21603: Long WHERE IN mariadb 10.3.22 crash I_S tables and SHOW COMMANDS use special logic for creating and populating temp.tables, e.g. table creation is delayed. The code attempted to apply the same logic for the IN-to-SELECT temptable, which resulted in an attempt to read from not-yet-created temptable and crash. Fix this by restricting use of I_S table logic only to I_S tables. --- mysql-test/main/information_schema2.result | 12 ++++++++++++ mysql-test/main/information_schema2.test | 13 +++++++++++++ sql/sql_base.cc | 1 - sql/sql_class.h | 12 ++++++++++-- sql/sql_derived.cc | 8 +++++--- sql/sql_prepare.cc | 2 +- 6 files changed, 41 insertions(+), 7 deletions(-) diff --git a/mysql-test/main/information_schema2.result b/mysql-test/main/information_schema2.result index e23e81b885c..0f24ca3f264 100644 --- a/mysql-test/main/information_schema2.result +++ b/mysql-test/main/information_schema2.result @@ -18,3 +18,15 @@ t2 t3 t4 drop table t1, t2, t3, t4; +# +# MDEV-21603: Long WHERE IN mariadb 10.3.22 crash +# +connect con1,localhost,root,,; +set @@in_predicate_conversion_threshold=10; +use mysql; +show tables where tables_in_mysql in ('1','2','3','4','5','6','7','8','9','boom'); +Tables_in_mysql +show fields from user where Field in ('1','2','3','4','5','6','7','8','9','boom'); +Field Type Null Key Default Extra +disconnect con1; +connection default; diff --git a/mysql-test/main/information_schema2.test b/mysql-test/main/information_schema2.test index d2fa3da2b5f..d0cfeefa31a 100644 --- a/mysql-test/main/information_schema2.test +++ b/mysql-test/main/information_schema2.test @@ -17,3 +17,16 @@ create table t4 AS select table_name from information_schema.TABLES where table_ delete from t4 where table_name not in (select table_name from information_schema.TABLES where table_schema = database() and table_type = 'BASE TABLE'); select * from t4 order by table_name; drop table t1, t2, t3, t4; + +--echo # +--echo # MDEV-21603: Long WHERE IN mariadb 10.3.22 crash +--echo # +connect (con1,localhost,root,,); + +set @@in_predicate_conversion_threshold=10; +use mysql; +show tables where tables_in_mysql in ('1','2','3','4','5','6','7','8','9','boom'); +show fields from user where Field in ('1','2','3','4','5','6','7','8','9','boom'); + +disconnect con1; +connection default; diff --git a/sql/sql_base.cc b/sql/sql_base.cc index 0b17032da8f..4e5b32ce1e5 100644 --- a/sql/sql_base.cc +++ b/sql/sql_base.cc @@ -5187,7 +5187,6 @@ bool open_normal_and_derived_tables(THD *thd, TABLE_LIST *tables, uint flags, uint counter; MDL_savepoint mdl_savepoint= thd->mdl_context.mdl_savepoint(); DBUG_ENTER("open_normal_and_derived_tables"); - DBUG_ASSERT(!thd->fill_derived_tables()); if (open_tables(thd, &tables, &counter, flags, &prelocking_strategy) || mysql_handle_derived(thd->lex, dt_phases)) goto end; diff --git a/sql/sql_class.h b/sql/sql_class.h index 5ab93de7957..9d19e25f44f 100644 --- a/sql/sql_class.h +++ b/sql/sql_class.h @@ -3636,9 +3636,17 @@ class THD :public Statement, { return server_status & SERVER_STATUS_IN_TRANS; } - inline bool fill_derived_tables() + inline bool fill_derived_table(TABLE_LIST *tl) { - return !stmt_arena->is_stmt_prepare() && !lex->only_view_structure(); + /* + Do not fill derived table when + 1. running a PREPARE command + 2. this is a SHOW command and the table is a temp.table representing + the I_S table. + */ + return !stmt_arena->is_stmt_prepare() && // (1) + !(lex->only_view_structure() && tl->schema_table_reformed); // (2) + } inline bool fill_information_schema_tables() { diff --git a/sql/sql_derived.cc b/sql/sql_derived.cc index 50b0178c6c9..33cb6a50710 100644 --- a/sql/sql_derived.cc +++ b/sql/sql_derived.cc @@ -85,14 +85,16 @@ mysql_handle_derived(LEX *lex, uint phases) break; if (!(phases & phase_flag)) continue; - if (phase_flag >= DT_CREATE && !thd->fill_derived_tables()) - break; for (SELECT_LEX *sl= lex->all_selects_list; sl && !res; sl= sl->next_select_in_list()) { TABLE_LIST *cursor= sl->get_table_list(); + + if (phase_flag >= DT_CREATE && !thd->fill_derived_table(cursor)) + break; + sl->changed_elements|= TOUCHED_SEL_DERIVED; /* DT_MERGE_FOR_INSERT is not needed for views/derived tables inside @@ -193,7 +195,7 @@ mysql_handle_single_derived(LEX *lex, TABLE_LIST *derived, uint phases) if (phase_flag != DT_PREPARE && !(allowed_phases & phase_flag)) continue; - if (phase_flag >= DT_CREATE && !thd->fill_derived_tables()) + if (phase_flag >= DT_CREATE && !thd->fill_derived_table(derived)) break; if ((res= (*processors[phase])(lex->thd, lex, derived))) diff --git a/sql/sql_prepare.cc b/sql/sql_prepare.cc index 9775e99afdd..357c1334ee2 100644 --- a/sql/sql_prepare.cc +++ b/sql/sql_prepare.cc @@ -1452,7 +1452,7 @@ static int mysql_test_update(Prepared_statement *stmt, } /* - thd->fill_derived_tables() is false here for sure (because it is + thd->fill_derived_table(table_list) is false here for sure (because it is preparation of PS, so we even do not check it). */ if (table_list->handle_derived(thd->lex, DT_MERGE_FOR_INSERT))

1 0