The patch is ok, but there is a problem with the testcase: when I run the testcase on the unmodified 5.5 binary, it passes. When I run the tescase from the MDEV, I get the crash. Please fix the testcase. This will also provide test coverage (which was lacking, and this is why have this bug in the first place). On Fri, Dec 16, 2016 at 11:19:43AM +0530, Varun wrote:

revision-id: 12034aec831d776725a43c7537ab4256efb1c974 (mariadb-5.5.53-25-g12034ae) parent(s): 14e1f32894cdbe63a614738cfd93e9d0818dedee author: Varun Gupta committer: Varun Gupta timestamp: 2016-12-16 11:03:24 +0530 message:

MDEV-10927: Crash When Using sort_union Optimization

In file sql/filesort.cc,when merge_buffers() is called then - queue_remove(&queue,0) is called - For the function queue_remove there is assertion states that the element to be removed should have index >=1 - this is causing the assertion to fail.

Fixed by removing the top element.

--- mysql-test/r/index_merge_innodb.result | 52 ++++++++++++++++++++++++++++++++++ mysql-test/t/index_merge_innodb.test | 42 ++++++++++++++++++++++++++- sql/filesort.cc | 2 +- 3 files changed, 94 insertions(+), 2 deletions(-)

diff --git a/mysql-test/r/index_merge_innodb.result b/mysql-test/r/index_merge_innodb.result index b93d15f..49e0a57 100644 --- a/mysql-test/r/index_merge_innodb.result +++ b/mysql-test/r/index_merge_innodb.result @@ -792,4 +792,56 @@ a b c 8 m m 9 d d DROP TABLE t1; +# +# MDEV-10927: Crash When Using sort_union Optimization +# +SET optimizer_switch='index_merge_sort_intersection=on'; +CREATE TABLE IF NOT EXISTS t1 ( +id int(11) NOT NULL AUTO_INCREMENT, +contact_id int(11) NOT NULL, +role_id int(11) NOT NULL, +company_type_id int(11) NOT NULL, +company_id int(11) NOT NULL, +team_id int(11) NOT NULL, +user_id int(11) NOT NULL, +PRIMARY KEY (id), +KEY contact_id (contact_id), +KEY user_id (user_id), +KEY company_id (company_id), +KEY team_id (team_id) USING BTREE +) ENGINE=InnoDB AUTO_INCREMENT=12860259 DEFAULT CHARSET=utf8 ROW_FORMAT=COMPACT; +INSERT INTO t1 (id, contact_id, role_id, company_type_id, company_id, team_id, user_id) VALUES +(5343408, 23913609, 0, 6, 2321, 0, 0), +(7841449, 39582328, 1194, 0, 0, 0, 57291), +(7841507, 28707292, 1194, 0, 0, 0, 57291), +(7841543, 26376778, 1194, 0, 0, 0, 137571), +(7841563, 42475686, 1194, 0, 0, 0, 137571), +(7841573, 35956831, 1194, 0, 0, 0, 447223), +(7841575, 37975231, 1194, 0, 0, 0, 447223), +(7843049, 42693923, 1194, 0, 0, 0, 376261), +(7843600, 42696877, 1194, 0, 0, 0, 376261), +(12858344, 82851915, 1194, 0, 0, 0, 993011), +(12858554, 80183799, 1194, 0, 0, 0, 993011), +(12858803, 82649193, 1194, 0, 0, 0, 1288749), +(12858878, 82700925, 1194, 0, 0, 0, 1288749), +(12860248, 28642729, 1194, 0, 0, 0, 1234288), +(12860258, 28642729, 0, 0, 0, 0, 1234288), +(12860259, 28642729, 1194, 0, 0, 0, 0); +SELECT SQL_NO_CACHE contact_id FROM t1 FORCE INDEX (user_id,company_id) WHERE user_id = '57291' OR (user_id IN(55838,55839,56998,57260,57291,60227,121997,137571,173600,219233,306480,354991,358594,376261,398572,447223,472009,646282,932548,993011,1004609,1021262,1177117,1234288,1283121,1288749,1337771,57291) AND role_id = '1194') OR company_id = '2321'; +contact_id +23913609 +26376778 +28642729 +28707292 +35956831 +37975231 +39582328 +42475686 +42693923 +42696877 +80183799 +82649193 +82700925 +82851915 +DROP TABLE t1; set optimizer_switch= @optimizer_switch_save; diff --git a/mysql-test/t/index_merge_innodb.test b/mysql-test/t/index_merge_innodb.test index 6a1cb53..f1fdbbd 100644 --- a/mysql-test/t/index_merge_innodb.test +++ b/mysql-test/t/index_merge_innodb.test @@ -172,5 +172,45 @@ WHERE ( tb.b != ta.b OR tb.a = ta.a )

DROP TABLE t1;

-set optimizer_switch= @optimizer_switch_save; +--echo # +--echo # MDEV-10927: Crash When Using sort_union Optimization +--echo #

+SET optimizer_switch='index_merge_sort_intersection=on'; + +CREATE TABLE IF NOT EXISTS t1 ( + id int(11) NOT NULL AUTO_INCREMENT, + contact_id int(11) NOT NULL, + role_id int(11) NOT NULL, + company_type_id int(11) NOT NULL, + company_id int(11) NOT NULL, + team_id int(11) NOT NULL, + user_id int(11) NOT NULL, + PRIMARY KEY (id), + KEY contact_id (contact_id), + KEY user_id (user_id), + KEY company_id (company_id), + KEY team_id (team_id) USING BTREE + ) ENGINE=InnoDB AUTO_INCREMENT=12860259 DEFAULT CHARSET=utf8 ROW_FORMAT=COMPACT; + +INSERT INTO t1 (id, contact_id, role_id, company_type_id, company_id, team_id, user_id) VALUES + (5343408, 23913609, 0, 6, 2321, 0, 0), + (7841449, 39582328, 1194, 0, 0, 0, 57291), + (7841507, 28707292, 1194, 0, 0, 0, 57291), + (7841543, 26376778, 1194, 0, 0, 0, 137571), + (7841563, 42475686, 1194, 0, 0, 0, 137571), + (7841573, 35956831, 1194, 0, 0, 0, 447223), + (7841575, 37975231, 1194, 0, 0, 0, 447223), + (7843049, 42693923, 1194, 0, 0, 0, 376261), + (7843600, 42696877, 1194, 0, 0, 0, 376261), + (12858344, 82851915, 1194, 0, 0, 0, 993011), + (12858554, 80183799, 1194, 0, 0, 0, 993011), + (12858803, 82649193, 1194, 0, 0, 0, 1288749), + (12858878, 82700925, 1194, 0, 0, 0, 1288749), + (12860248, 28642729, 1194, 0, 0, 0, 1234288), + (12860258, 28642729, 0, 0, 0, 0, 1234288), + (12860259, 28642729, 1194, 0, 0, 0, 0); +--sorted_result +SELECT SQL_NO_CACHE contact_id FROM t1 FORCE INDEX (user_id,company_id) WHERE user_id = '57291' OR (user_id IN(55838,55839,56998,57260,57291,60227,121997,137571,173600,219233,306480,354991,358594,376261,398572,447223,472009,646282,932548,993011,1004609,1021262,1177117,1234288,1283121,1288749,1337771,57291) AND role_id = '1194') OR company_id = '2321'; +DROP TABLE t1; +set optimizer_switch= @optimizer_switch_save; diff --git a/sql/filesort.cc b/sql/filesort.cc index 5bb5c64..38404b0 100644 --- a/sql/filesort.cc +++ b/sql/filesort.cc @@ -1411,7 +1411,7 @@ int merge_buffers(SORTPARAM *param, IO_CACHE *from_file, if (!(error= (int) read_to_buffer(from_file, buffpek, rec_length))) { - queue_remove(&queue,0); + (void) queue_remove_top(&queue); reuse_freed_buff(&queue, buffpek, rec_length); } else if (error == -1)

BR Sergei -- Sergei Petrunia, Software Developer MariaDB Corporation | Skype: sergefp | Blog: http://s.petrunia.net/blog