Hi! Am 12.07.2017 um 10:39 schrieb serg@mariadb.org:

revision-id: c5975eaea174460e774e77717e972a8d32e6c8de (mariadb-5.5.56-38-gc5975eaea17) parent(s): f305a7ce4bccbd56520d874e1d81a4f29bc17a96 author: Sergei Golubchik committer: Sergei Golubchik timestamp: 2017-07-12 10:39:02 +0200 message:

MDEV-7339 Server crashes in Item_func_trig_cond::val_int

Item_in_subselect::pushed_cond_guards[] array is allocated only when left_expr->maybe_null. And it is used (for row expressions) when left_expr->element_index(i)->maybe_null.

For left_expr being a multi-column subquery, its maybe_null is always false when the subquery doesn't use tables (see Item_singlerow_subselect::fix_length_and_dec() and subselect_single_select_engine::fix_length_and_dec()), otherwise it's always true.

But row elements can be NULL regardless, so let's always allocate pushed_cond_guards for multi-column subqueries, no matter whether its maybe_null was forced to true or false.

OK to push! [skip]