MDEV-32395: update_depend_map_for_order: SEGV at /mariadb-11.3.0/sql/sql_select.cc:16583

MDEV-32329 (patch) pushdown from having into where: Server crashes at sub_select

When generating an Item_equal with a Item_ref that refers to a field
outside of a subselect, remove_item_direct_ref() causes the dependency
(depended_from) on the outer select to be lost, which causes trouble
for code downstream that can no longer determine the scope of the Item.
Not calling remove_item_direct_ref() retains the Item's dependency.

Test cases from MDEV-32395 and MDEV-32329 are included.

Some fixes from other developers:

Monty:
- Fixed wrong code in Item_equal::create_pushable_equalities()
  that could cause wrong item to be used if there was no matching items.
Daniel Black:
- Added test cases from MDEV-32329
Igor Babaev:
- Provided fix for removing call to remove_item_direct_ref() in
  eliminate_item_equal()

MDEV-32395: update_depend_map_for_order: SEGV at /mariadb-11.3.0/sql/sql_select.cc:16583

Include test cases from MDEV-32329.
This commit is contained in:
Jason Cu 2023-11-16 15:34:53 -08:00 committed by Monty
commit 2bf9f0d422
5 changed files with 112 additions and 21 deletions

View file

@ -2511,12 +2511,6 @@ public:
*/
virtual void under_not(Item_func_not * upper
__attribute__((unused))) {};
/*
If Item_field is wrapped in Item_direct_wrep remove this Item_direct_ref
wrapper.
*/
virtual Item *remove_item_direct_ref() { return this; }
void register_in(THD *thd);
@ -5758,11 +5752,6 @@ public:
With_sum_func_cache* get_with_sum_func_cache() override { return this; }
Item *field_transformer_for_having_pushdown(THD *thd, uchar *arg) override
{ return (*ref)->field_transformer_for_having_pushdown(thd, arg); }
Item *remove_item_direct_ref() override
{
*ref= (*ref)->remove_item_direct_ref();
return this;
}
};
@ -5810,8 +5799,6 @@ public:
Ref_Type ref_type() override { return DIRECT_REF; }
Item *do_get_copy(THD *thd) const override
{ return get_item_copy<Item_direct_ref>(thd, this); }
Item *remove_item_direct_ref() override
{ return (*ref)->remove_item_direct_ref(); }
};
@ -6194,7 +6181,6 @@ public:
{ return get_item_copy<Item_direct_view_ref>(thd, this); }
Item *field_transformer_for_having_pushdown(THD *, uchar *) override
{ return this; }
Item *remove_item_direct_ref() override { return this; }
};