diff --git a/mysql-test/r/order_by.result b/mysql-test/r/order_by.result index 1e65f889ea0..9ad8e940fe5 100644 --- a/mysql-test/r/order_by.result +++ b/mysql-test/r/order_by.result @@ -1665,6 +1665,13 @@ a 1 3 1 2 1 DROP TABLE t1; +# +# Bug#11765255 58201: +# VALGRIND/CRASH WHEN ORDERING BY MULTIPLE AGGREGATE FUNCTIONS +# +select 1 order by max(1) + min(1); +1 +1 End of 5.1 tests # # Bug #38745: MySQL 5.1 optimizer uses filesort for ORDER BY diff --git a/mysql-test/r/union.result b/mysql-test/r/union.result index 1f3422c1767..0fd1526684a 100644 --- a/mysql-test/r/union.result +++ b/mysql-test/r/union.result @@ -1643,6 +1643,63 @@ b 1 2 DROP TABLE t1,t2; +# +# Bug#11765255 58201: +# VALGRIND/CRASH WHEN ORDERING BY MULTIPLE AGGREGATE FUNCTIONS +# +select 1 as foo +union +select 2 +union +select 3 +union +select 4 +order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1) +; +foo +1 +prepare stmt1 from 'select 1 as foo +union +select 2 +union +select 3 +union +select 4 +order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1) +'; +execute stmt1; +foo +1 +execute stmt1; +foo +1 +select 1 as foo +union +select 2 +union +select 3 +union +(select 4) +order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1) +; +foo +1 +prepare stmt1 from 'select 1 as foo +union +select 2 +union +select 3 +union +(select 4) +order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1) +'; +execute stmt1; +foo +1 +execute stmt1; +foo +1 +deallocate prepare stmt1; End of 5.1 tests # # Bug#57986 ORDER BY clause is not used after a UNION, diff --git a/mysql-test/t/order_by.test b/mysql-test/t/order_by.test index 726dfa154b8..81e5d4fca70 100644 --- a/mysql-test/t/order_by.test +++ b/mysql-test/t/order_by.test @@ -1509,6 +1509,13 @@ SELECT DISTINCT a,1 FROM t1 WHERE a <> 1 ORDER BY a DESC; DROP TABLE t1; +--echo # +--echo # Bug#11765255 58201: +--echo # VALGRIND/CRASH WHEN ORDERING BY MULTIPLE AGGREGATE FUNCTIONS +--echo # + +select 1 order by max(1) + min(1); + --echo End of 5.1 tests diff --git a/mysql-test/t/union.test b/mysql-test/t/union.test index c6599517e90..f5a5cad77e8 100644 --- a/mysql-test/t/union.test +++ b/mysql-test/t/union.test @@ -1116,6 +1116,47 @@ SELECT * FROM t2 UNION SELECT * FROM t2 DROP TABLE t1,t2; +--echo # +--echo # Bug#11765255 58201: +--echo # VALGRIND/CRASH WHEN ORDERING BY MULTIPLE AGGREGATE FUNCTIONS +--echo # + +let $my_stmt= +select 1 as foo +union +select 2 +union +select 3 +union +select 4 +order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1) +; + +eval $my_stmt; + +eval prepare stmt1 from '$my_stmt'; +execute stmt1; +execute stmt1; + +let $my_stmt= +select 1 as foo +union +select 2 +union +select 3 +union +(select 4) +order by max(42) + max(1) + max(1) + max(1) + max(1) + max(1) +; + +eval $my_stmt; + +eval prepare stmt1 from '$my_stmt'; +execute stmt1; +execute stmt1; + +deallocate prepare stmt1; + --echo End of 5.1 tests --echo # diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc index 44c7879694b..62fb6fc94b5 100644 --- a/sql/sql_lex.cc +++ b/sql/sql_lex.cc @@ -2120,6 +2120,9 @@ bool st_select_lex::setup_ref_array(THD *thd, uint order_group_num) if (ref_pointer_array) return 0; + // find_order_in_list() may need some extra space, so multiply by two. + order_group_num*= 2; + /* We have to create array in prepared statement memory if it is prepared statement diff --git a/sql/sql_union.cc b/sql/sql_union.cc index d34027ddc86..b0a25c2df97 100644 --- a/sql/sql_union.cc +++ b/sql/sql_union.cc @@ -1,4 +1,4 @@ -/* Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved. +/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -404,15 +404,27 @@ bool st_select_lex_unit::prepare(THD *thd_arg, select_result *sel_result, fake_select_lex->table_list.empty(); DBUG_RETURN(TRUE); } + + /* + Fake st_select_lex should have item list for correct ref_array + allocation. + */ fake_select_lex->item_list= item_list; thd_arg->lex->current_select= fake_select_lex; + + /* + We need to add up n_sum_items in order to make the correct + allocation in setup_ref_array(). + */ + fake_select_lex->n_child_sum_items+= global_parameters->n_sum_items; + saved_error= fake_select_lex->join-> prepare(&fake_select_lex->ref_pointer_array, fake_select_lex->table_list.first, 0, 0, - fake_select_lex->order_list.elements, - fake_select_lex->order_list.first, + global_parameters->order_list.elements, // og_num + global_parameters->order_list.first, // order NULL, NULL, NULL, fake_select_lex, this); fake_select_lex->table_list.empty(); @@ -581,11 +593,21 @@ bool st_select_lex_unit::exec() } fake_select_lex->join->no_const_tables= TRUE; - /* - Fake st_select_lex should have item list for correctref_array - allocation. - */ - fake_select_lex->item_list= item_list; + /* + Fake st_select_lex should have item list for correct ref_array + allocation. + */ + fake_select_lex->item_list= item_list; + + /* + We need to add up n_sum_items in order to make the correct + allocation in setup_ref_array(). + Don't add more sum_items if we have already done JOIN::prepare + for this (with a different join object) + */ + if (!fake_select_lex->ref_pointer_array) + fake_select_lex->n_child_sum_items+= global_parameters->n_sum_items; + saved_error= mysql_select(thd, &fake_select_lex->ref_pointer_array, &result_table_list, 0, item_list, NULL,