revision-id: 2f6912dabcb85382eea004f590ad51815c20e5c5 (mariadb-10.2.31-898-g2f6912dabcb) parent(s): c72c77ca3bcb9d29903f95bf37c9930224984d29 author: Sergei Petrunia committer: Sergei Petrunia timestamp: 2021-04-25 21:23:56 +0300 message: MDEV-24898: Server crashes in st_select_lex::next_select (trivial backport to 10.2) Add a testcase --- mysql-test/r/subselect4.result | 11 +++++++++++ mysql-test/t/subselect4.test | 13 +++++++++++++ 2 files changed, 24 insertions(+) diff --git a/mysql-test/r/subselect4.result b/mysql-test/r/subselect4.result index ef75bd97fcc..4021f717964 100644 --- a/mysql-test/r/subselect4.result +++ b/mysql-test/r/subselect4.result @@ -2772,3 +2772,14 @@ GROUP BY 1 ) 1 DROP TABLE t1; +# +# MDEV-24898: Server crashes in st_select_lex::next_select / Item_subselect::is_expensive +# (Testcase) +# +CREATE TABLE t1 (a INT); +INSERT INTO t1 VALUES (1),(2); +CREATE TABLE t2 (b INT); +INSERT INTO t2 VALUES (3),(4); +SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x); +ERROR 21000: Subquery returns more than 1 row +drop table t1,t2; diff --git a/mysql-test/t/subselect4.test b/mysql-test/t/subselect4.test index dae9e71fd92..e218e3aab18 100644 --- a/mysql-test/t/subselect4.test +++ b/mysql-test/t/subselect4.test @@ -2269,3 +2269,16 @@ SELECT ); DROP TABLE t1; + +--echo # +--echo # MDEV-24898: Server crashes in st_select_lex::next_select / Item_subselect::is_expensive +--echo # (Testcase) +--echo # +CREATE TABLE t1 (a INT); +INSERT INTO t1 VALUES (1),(2); # Optional, fails either way +CREATE TABLE t2 (b INT); +INSERT INTO t2 VALUES (3),(4); # Optional, fails either way + +--error ER_SUBQUERY_NO_1_ROW +SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x); +drop table t1,t2;