Re: [Maria-developers] [Commits] Rev 3166: Fixed bug lp:825018 in file:///home/tsk/mprog/src/5.3/
![](https://secure.gravatar.com/avatar/bccaf81a23eecaecd9feaf01c7c42ff4.jpg?s=120&d=mm&r=g)
Hi Timour, Ok to push. On Tue, Aug 23, 2011 at 03:41:55PM +0300, timour@askmonty.org wrote:
At file:///home/tsk/mprog/src/5.3/
------------------------------------------------------------ revno: 3166 revision-id: timour@askmonty.org-20110823123915-jxf9hvxq2hy03rr7 parent: timour@askmonty.org-20110822210013-egubev0wgyi00wjt fixes bug(s): https://launchpad.net/bugs/825018 committer: timour@askmonty.org branch nick: 5.3 timestamp: Tue 2011-08-23 15:39:15 +0300 message: Fixed bug lp:825018
Analysis: During the first execution of the query through the stored procedure, the optimization phase calls substitute_for_best_equal_field(), which calls Item_in_optimizer::transform(). The latter replaces Item_in_subselect::left_expr with args[0] via assignment. In this test case args[0] is an Item_outer_ref which is created/deallocated for each re-execution. As a result, during the second execution Item_in_subselect::left_expr pointed to freed memory, which resulted in a crash.
Solution: The solution is to use change_item_tree(), so that the origianal left expression is restored after each execution.
BR Sergey -- Sergey Petrunia, Software Developer Monty Program AB, http://askmonty.org Blog: http://s.petrunia.net/blog
participants (1)
-
Sergey Petrunya