revision-id: 0c5db9426b9091a28a7520cfb3821cc0131bdd46 (mariadb-10.4.11-437-g0c5db9426b9) parent(s): 31cde275c26ba5009d16dfc62654884b94b22322 author: Varun Gupta committer: Varun Gupta timestamp: 2020-10-27 13:06:07 +0530 message: MDEV-23804: Server crashes in st_select_lex::collect_grouping_fields_for_derived The issue here was we were trying to push an extracted condition for a view into the underlying table value constructor inside the view. The fix would be to not push conditions into table value constructors. --- mysql-test/main/derived_cond_pushdown.result | 70 ++++++++++++++++++++++++++++ mysql-test/main/derived_cond_pushdown.test | 13 ++++++ sql/sql_derived.cc | 2 + 3 files changed, 85 insertions(+) diff --git a/mysql-test/main/derived_cond_pushdown.result b/mysql-test/main/derived_cond_pushdown.result index 93b61730a03..0787cea6a2f 100644 --- a/mysql-test/main/derived_cond_pushdown.result +++ b/mysql-test/main/derived_cond_pushdown.result @@ -17039,4 +17039,74 @@ id select_type table type possible_keys key key_len ref rows Extra 3 DERIVED t1 ALL NULL NULL NULL NULL 3 Using temporary drop view v1; drop table t1; +# +# MDEV-23804: Server crashes in st_select_lex::collect_grouping_fields_for_derived +# +CREATE TABLE t1 (a INT); +INSERT INTO t1 VALUES (3),(4); +CREATE VIEW v1 AS SELECT a FROM t1 UNION VALUES (3),(4); +ANALYZE FORMAT=JSON SELECT * from v1 WHERE a=3; +ANALYZE +{ + "query_block": { + "select_id": 1, + "r_loops": 1, + "r_total_time_ms": "REPLACED", + "table": { + "table_name": "<derived2>", + "access_type": "ALL", + "r_loops": 1, + "rows": 4, + "r_rows": 2, + "r_total_time_ms": "REPLACED", + "filtered": 100, + "r_filtered": 50, + "attached_condition": "v1.a = 3", + "materialized": { + "query_block": { + "union_result": { + "table_name": "<union2,3>", + "access_type": "ALL", + "r_loops": 1, + "r_rows": 2, + "query_specifications": [ + { + "query_block": { + "select_id": 2, + "r_loops": 1, + "r_total_time_ms": "REPLACED", + "table": { + "table_name": "t1", + "access_type": "ALL", + "r_loops": 1, + "rows": 2, + "r_rows": 2, + "r_total_time_ms": "REPLACED", + "filtered": 100, + "r_filtered": 50, + "attached_condition": "t1.a = 3" + } + } + }, + { + "query_block": { + "select_id": 3, + "operation": "UNION", + "table": { + "message": "No tables used" + } + } + } + ] + } + } + } + } + } +} +SELECT * from v1 WHERE a=3; +a +3 +DROP VIEW v1; +DROP TABLE t1; # End of 10.4 tests diff --git a/mysql-test/main/derived_cond_pushdown.test b/mysql-test/main/derived_cond_pushdown.test index b2f97029ede..0a0e43e54ab 100644 --- a/mysql-test/main/derived_cond_pushdown.test +++ b/mysql-test/main/derived_cond_pushdown.test @@ -3461,4 +3461,17 @@ explain select * from v1; drop view v1; drop table t1; +--echo # +--echo # MDEV-23804: Server crashes in st_select_lex::collect_grouping_fields_for_derived +--echo # + +CREATE TABLE t1 (a INT); +INSERT INTO t1 VALUES (3),(4); +CREATE VIEW v1 AS SELECT a FROM t1 UNION VALUES (3),(4); +--source include/analyze-format.inc +ANALYZE FORMAT=JSON SELECT * from v1 WHERE a=3; +SELECT * from v1 WHERE a=3; +DROP VIEW v1; +DROP TABLE t1; + --echo # End of 10.4 tests diff --git a/sql/sql_derived.cc b/sql/sql_derived.cc index 3b312225937..995edd4d2eb 100644 --- a/sql/sql_derived.cc +++ b/sql/sql_derived.cc @@ -1450,6 +1450,8 @@ bool pushdown_cond_for_derived(THD *thd, Item *cond, TABLE_LIST *derived) st_select_lex *save_curr_select= thd->lex->current_select; for (; sl; sl= sl->next_select()) { + if (!sl->cond_pushdown_is_allowed()) + continue; Item *extracted_cond_copy; /* For each select of the unit except the last one