revision-id: 7f80ad9658fb5b46ce1fff4514656905b744c8c5 (mariadb-10.2.31-295-g7f80ad9658f) parent(s): f6106da70a740af784bedcc299ca9bf4aaff342a author: Varun Gupta committer: Varun Gupta timestamp: 2020-07-07 10:45:06 +0530 message: MDEV-22463: Element_type &Bounds_checked_array<Item *>::operator[](size_t) [Element_type = Item *]: Assertion `n < m_size' failed. Allocate space for fields inside the window function (arguments, PARTITION BY and ORDER BY clause) in the ref pointer array. All fields inside the window function are part of the temporary table that is required for the window function computation. --- mysql-test/r/win.result | 35 +++++++++++++++++++++++++++++++++++ mysql-test/t/win.test | 16 ++++++++++++++++ sql/sql_lex.cc | 4 +++- sql/sql_lex.h | 13 +++++++++---- sql/sql_parse.cc | 10 ++++++++++ sql/sql_window.cc | 8 ++++++++ 6 files changed, 81 insertions(+), 5 deletions(-) diff --git a/mysql-test/r/win.result b/mysql-test/r/win.result index 71953871295..019cfd6115d 100644 --- a/mysql-test/r/win.result +++ b/mysql-test/r/win.result @@ -3808,5 +3808,40 @@ MIN(d) OVER () 1 DROP TABLE t1; # +# MDEV-22463: Element_type &Bounds_checked_array<Item *>::operator[](size_t) [Element_type = Item *]: +# Assertion `n < m_size' failed +# +CREATE TABLE t1 (a INT, b INT, c INT, d INT, e INT, f INT, g int, h INT, i INT); +INSERT INTO t1 SELECT seq,seq,seq,seq, seq,seq,seq,seq,seq FROM seq_1_to_5; +SELECT ROW_NUMBER() OVER w2 FROM t1 WINDOW w2 AS (PARTITION BY -1,0,1,2,3,4,5,6); +ROW_NUMBER() OVER w2 +1 +2 +3 +4 +5 +SELECT a FROM t1 ORDER BY ROW_NUMBER() OVER (PARTITION BY -1,1,0,2,3,4,5,6,7,8); +a +1 +2 +3 +4 +5 +SELECT a,b FROM t1 WINDOW w2 AS (PARTITION BY -1,1,0,2,3,4); +a b +1 1 +2 2 +3 3 +4 4 +5 5 +SELECT ROW_NUMBER() OVER w2 FROM t1 WINDOW w2 AS (PARTITION BY -1,0,1,2,3,4,5,6); +ROW_NUMBER() OVER w2 +1 +2 +3 +4 +5 +DROP TABLE t1; +# # End of 10.2 tests # diff --git a/mysql-test/t/win.test b/mysql-test/t/win.test index a768b893432..deed7de2d23 100644 --- a/mysql-test/t/win.test +++ b/mysql-test/t/win.test @@ -1,6 +1,7 @@ # # Window Functions Tests # +--source include/have_sequence.inc --disable_warnings drop table if exists t1,t2; @@ -2481,6 +2482,21 @@ INSERT INTO t1 VALUES (1),(2); SELECT MIN(d) OVER () FROM t1; DROP TABLE t1; +--echo # +--echo # MDEV-22463: Element_type &Bounds_checked_array<Item *>::operator[](size_t) [Element_type = Item *]: +--echo # Assertion `n < m_size' failed +--echo # + +CREATE TABLE t1 (a INT, b INT, c INT, d INT, e INT, f INT, g int, h INT, i INT); +INSERT INTO t1 SELECT seq,seq,seq,seq, seq,seq,seq,seq,seq FROM seq_1_to_5; + +SELECT ROW_NUMBER() OVER w2 FROM t1 WINDOW w2 AS (PARTITION BY -1,0,1,2,3,4,5,6); +--sorted_result +SELECT a FROM t1 ORDER BY ROW_NUMBER() OVER (PARTITION BY -1,1,0,2,3,4,5,6,7,8); +SELECT a,b FROM t1 WINDOW w2 AS (PARTITION BY -1,1,0,2,3,4); +SELECT ROW_NUMBER() OVER w2 FROM t1 WINDOW w2 AS (PARTITION BY -1,0,1,2,3,4,5,6); +DROP TABLE t1; + --echo # --echo # End of 10.2 tests --echo # diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc index 2312ec34e7b..c39afdf9e10 100644 --- a/sql/sql_lex.cc +++ b/sql/sql_lex.cc @@ -2140,6 +2140,7 @@ void st_select_lex::init_query() n_sum_items= 0; n_child_sum_items= 0; hidden_bit_fields= 0; + fields_in_window_functions= 0; subquery_in_having= explicit_limit= 0; is_item_list_lookup= 0; changed_elements= 0; @@ -2707,7 +2708,8 @@ bool st_select_lex::setup_ref_array(THD *thd, uint order_group_num) select_n_having_items + select_n_where_fields + order_group_num + - hidden_bit_fields) * 5; + hidden_bit_fields + + fields_in_window_functions) * 5; if (!ref_pointer_array.is_null()) { /* diff --git a/sql/sql_lex.h b/sql/sql_lex.h index d14843d0c24..965c3f29834 100644 --- a/sql/sql_lex.h +++ b/sql/sql_lex.h @@ -871,6 +871,14 @@ class st_select_lex: public st_select_lex_node converted to a GROUP BY involving BIT fields. */ uint hidden_bit_fields; + /* + Number of fields used in the definition of all the windows functions. + This includes: + 1) Fields in the arguments + 2) Fields in the PARTITION BY clause + 3) Fields in the ORDER BY clause + */ + uint fields_in_window_functions; enum_parsing_place parsing_place; /* where we are parsing expression */ enum_parsing_place context_analysis_place; /* where we are in prepare */ bool with_sum_func; /* sum function indicator */ @@ -1180,10 +1188,7 @@ class st_select_lex: public st_select_lex_node SQL_I_List<ORDER> win_order_list, Window_frame *win_frame); List<Item_window_func> window_funcs; - bool add_window_func(Item_window_func *win_func) - { - return window_funcs.push_back(win_func); - } + bool add_window_func(Item_window_func *win_func); bool have_window_funcs() const { return (window_funcs.elements !=0); } diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc index f1c9479adc7..dee658dea79 100644 --- a/sql/sql_parse.cc +++ b/sql/sql_parse.cc @@ -8564,6 +8564,11 @@ bool st_select_lex::add_window_def(THD *thd, win_frame); group_list= thd->lex->save_group_list; order_list= thd->lex->save_order_list; + if (parsing_place != SELECT_LIST) + { + fields_in_window_functions+= win_part_list_ptr->elements + + win_order_list_ptr->elements; + } return (win_def == NULL || window_specs.push_back(win_def)); } @@ -8585,6 +8590,11 @@ bool st_select_lex::add_window_spec(THD *thd, win_frame); group_list= thd->lex->save_group_list; order_list= thd->lex->save_order_list; + if (parsing_place != SELECT_LIST) + { + fields_in_window_functions+= win_part_list_ptr->elements + + win_order_list_ptr->elements; + } thd->lex->win_spec= win_spec; return (win_spec == NULL || window_specs.push_back(win_spec)); } diff --git a/sql/sql_window.cc b/sql/sql_window.cc index 18075d179d5..612c6e692fe 100644 --- a/sql/sql_window.cc +++ b/sql/sql_window.cc @@ -2969,6 +2969,14 @@ Window_funcs_computation::save_explain_plan(MEM_ROOT *mem_root, return xpl; } + +bool st_select_lex::add_window_func(Item_window_func *win_func) +{ + if (parsing_place != SELECT_LIST) + fields_in_window_functions+= win_func->window_func()->argument_count(); + return window_funcs.push_back(win_func); +} + ///////////////////////////////////////////////////////////////////////////// // Unneeded comments (will be removed when we develop a replacement for // the feature that was attempted here