mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-18 21:12:26 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed bug #28728: a crash when executing EXPLAIN EXTENDED for a query

Browse source 
using a derived table over a grouping subselect.

This crash happens only when materialization of the derived tables 
requires creation of auxiliary temporary table, for example when
a grouping operation is carried out with usage of a temporary table.

The crash happened because EXPLAIN EXTENDED when printing the query
expression made an attempt to use the objects created in the mem_root
of the temporary table which has been already freed by the moment
when printing is called.

This bug appeared after the method Item_field::print() had been 
introduced.
This commit is contained in:
igor@olga.mysql.com 2007-06-02 11:44:16 -07:00
parent 5a5410e40e
commit 5cbebf0a18
3 changed files with 35 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
mysql-test/r/subselect.result
View file

@ -4071,4 +4071,14 @@ id st
2 GA
4 FL
DROP TABLE t1,t2;
CREATE TABLE t1 (a int);
INSERT INTO t1 VALUES (1), (2);
EXPLAIN EXTENDED
SELECT * FROM (SELECT count(*) FROM t1 GROUP BY a) as res;
id select_type table type possible_keys key key_len ref rows Extra
1 PRIMARY <derived2> ALL NULL NULL NULL NULL 2
2 DERIVED t1 ALL NULL NULL NULL NULL 2 Using temporary; Using filesort
Warnings:
Note 1003 select `res`.`count(*)` AS `count(*)` from (select count(0) AS `count(*)` from `test`.`t1` group by `test`.`t1`.`a`) `res`
DROP TABLE t1;
End of 5.0 tests.

14
mysql-test/t/subselect.test
View file

@ -2906,4 +2906,18 @@ SELECT id, st FROM t1
DROP TABLE t1,t2;
#
# Bug #28728: crash with EXPLAIN EXTENDED for a query with a derived table
# over a grouping subselect
#
CREATE TABLE t1 (a int);
INSERT INTO t1 VALUES (1), (2);
EXPLAIN EXTENDED
SELECT * FROM (SELECT count(*) FROM t1 GROUP BY a) as res;
DROP TABLE t1;
--echo End of 5.0 tests.

11
sql/sql_select.cc
View file

@ -2075,6 +2075,17 @@ JOIN::exec()
thd->examined_row_count+= curr_join->examined_rows;
DBUG_PRINT("counts", ("thd->examined_row_count: %lu",
(ulong) thd->examined_row_count));
/*
With EXPLAIN EXTENDED we have to restore original ref_array
for a derived table which is always materialized.
Otherwise we would not be able to print the query correctly.
*/
if (items0 &&
(thd->lex->describe & DESCRIBE_EXTENDED) &&
select_lex->linkage == DERIVED_TABLE_TYPE)
set_items_ref_array(items0);
DBUG_VOID_RETURN;
}