revision-id: 2087d47aaeadc06dd007ce9bd28984ecc8e2101e (mariadb-10.2.31-964-g2087d47aaea) parent(s): 8c8a6ed3b8e2bf6d9c0c155ba9a987c0ff27ac6c author: Sergei Petrunia committer: Sergei Petrunia timestamp: 2021-05-21 17:46:48 +0300 message: MDEV-22462: Item_in_subselect::create_single_in_to_exists_cond(JOIN *, Item **, Item **): Assertion `false' failed. Item_in_subselect::create_single_in_to_exists_cond() should handle the case where the subquery is a table-less select but it is not a result of a UNION. (Table-less subqueries like "(SELECT 1)" are "substituted" with their select list, but table-less subqueries with WHERE or HAVING clause, like "(SELECT 1 WHERE ...)" are not substituted. They are handled with regular execution path) --- mysql-test/r/subselect4.result | 11 ++++++++++- mysql-test/t/subselect4.test | 13 ++++++++++++- sql/item_subselect.cc | 44 ++++++++++++++++++++---------------------- 3 files changed, 43 insertions(+), 25 deletions(-) diff --git a/mysql-test/r/subselect4.result b/mysql-test/r/subselect4.result index 2a691799be5..b1db309ec18 100644 --- a/mysql-test/r/subselect4.result +++ b/mysql-test/r/subselect4.result @@ -2721,7 +2721,15 @@ id select_type table type possible_keys key key_len ref rows Extra SELECT a FROM t1 WHERE (a, a) IN (SELECT 1, 2) AND a = (SELECT MIN(b) FROM t2); a DROP TABLE t1,t2; -# End of 10.2 tests +# +# MDEV-22462: Item_in_subselect::create_single_in_to_exists_cond(JOIN *, Item **, Item **): Assertion `false' failed. +# +select 1 from dual where 1 in (select 5 from dual where 1); +1 +create table t1 (a int); +insert into t1 values (1),(2),(3); +update t1 set a = 2 where a in (select a from dual where a = a); +drop table t1; # # MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker # @@ -2793,3 +2801,4 @@ FROM (t1 JOIN t1 AS ref_t1 ON (t1.i1 > (SELECT ref_t1.i1 AS c0 FROM t1 b ORDER BY -c0))); ERROR 21000: Subquery returns more than 1 row DROP TABLE t1; +# End of 10.2 tests diff --git a/mysql-test/t/subselect4.test b/mysql-test/t/subselect4.test index 58aa7868815..bd1e20cb5d6 100644 --- a/mysql-test/t/subselect4.test +++ b/mysql-test/t/subselect4.test @@ -2236,7 +2236,17 @@ SELECT a FROM t1 WHERE (a, a) IN (SELECT 1, 2) AND a = (SELECT MIN(b) FROM t2); DROP TABLE t1,t2; ---echo # End of 10.2 tests +--echo # +--echo # MDEV-22462: Item_in_subselect::create_single_in_to_exists_cond(JOIN *, Item **, Item **): Assertion `false' failed. +--echo # + +select 1 from dual where 1 in (select 5 from dual where 1); + +create table t1 (a int); +insert into t1 values (1),(2),(3); + +update t1 set a = 2 where a in (select a from dual where a = a); +drop table t1; --echo # --echo # MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker @@ -2296,3 +2306,4 @@ FROM (t1 JOIN t1 AS ref_t1 ON DROP TABLE t1; +--echo # End of 10.2 tests diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc index ed8e5e900a2..1e3c9a77a26 100644 --- a/sql/item_subselect.cc +++ b/sql/item_subselect.cc @@ -2249,7 +2249,8 @@ Item_in_subselect::create_single_in_to_exists_cond(JOIN *join, */ Item *item= (Item*) select_lex->item_list.head(); - if (select_lex->table_list.elements) + if (select_lex->table_list.elements || + !(select_lex->master_unit()->is_union())) { Item *having= item; Item *orig_item= item; @@ -2297,31 +2298,28 @@ Item_in_subselect::create_single_in_to_exists_cond(JOIN *join, } else { - if (select_lex->master_unit()->is_union()) + DBUG_ASSERT(select_lex->master_unit()->is_union()); + + Item *new_having= + func->create(thd, expr, + new (thd->mem_root) Item_ref_null_helper(thd, + &select_lex->context, + this, + &select_lex->ref_pointer_array[0], + (char *)"<no matter>", + (char *)"<result>")); + if (!abort_on_null && left_expr->maybe_null) { - Item *new_having= - func->create(thd, expr, - new (thd->mem_root) Item_ref_null_helper(thd, - &select_lex->context, - this, - &select_lex->ref_pointer_array[0], - (char *)"<no matter>", - (char *)"<result>")); - if (!abort_on_null && left_expr->maybe_null) - { - disable_cond_guard_for_const_null_left_expr(0); - if (!(new_having= new (thd->mem_root) Item_func_trig_cond(thd, new_having, - get_cond_guard(0)))) - DBUG_RETURN(true); - } - - new_having->name= (char*) in_having_cond; - if (fix_having(new_having, select_lex)) + disable_cond_guard_for_const_null_left_expr(0); + if (!(new_having= new (thd->mem_root) Item_func_trig_cond(thd, new_having, + get_cond_guard(0)))) DBUG_RETURN(true); - *having_item= new_having; } - else - DBUG_ASSERT(false); + + new_having->name= (char*) in_having_cond; + if (fix_having(new_having, select_lex)) + DBUG_RETURN(true); + *having_item= new_having; } }