ORDER BY could cause a server crash
Dependent subqueries like
SELECT COUNT(*) FROM t1, t2 WHERE t2.b
IN (SELECT DISTINCT t2.b FROM t2 WHERE t2.b = t1.a)
caused a memory leak proportional to the
number of outer rows.
The make_simple_join() function has been modified to
JOIN class method to store join_tab_reexec and
table_reexec values in the parent join only
(make_simple_join of tmp_join may access these values
via 'this' pointer of the parent JOIN).
NOTE: this patch doesn't include standard test case (this is
"out of memory" bug). See bug #42037 page for test cases.
sql/sql_select.cc:
Bug #42037: Queries containing a subquery with DISTINCT and
ORDER BY could cause a server crash
The make_simple_join() function has been modified to
JOIN class method to store join_tab_reexec and
table_reexec values in the parent join only.
sql/sql_select.h:
Bug #42037: Queries containing a subquery with DISTINCT and
ORDER BY could cause a server crash
1. The make_simple_join() function has been modified to
JOIN class method.
2. Type of JOIN::table_reexec field has been changed from
TABLE** to TABLE *table_reexec[1]: this field always was
NULL or a pointer to one-element array of pointers, so
a pointer to a pointer has been replaced with one pointer
and unnecessary memory allocation has been eliminated.
messed up
"ROW(...) IN (SELECT ... FROM DUAL)" always returned TRUE.
Item_in_subselect::row_value_transformer rewrites "ROW(...)
IN SELECT" conditions into the "EXISTS (SELECT ... HAVING ...)"
form.
For a subquery from the DUAL pseudotable resulting HAVING
condition is an expression on constant values, so further
transformation with optimize_cond() eliminates this HAVING
condition and resets JOIN::having to NULL.
Then JOIN::exec treated that NULL as an always-true-HAVING
and that caused a bug.
To distinguish an optimized out "HAVING TRUE" clause from
"HAVING FALSE" we already have the JOIN::having_value flag.
However, JOIN::exec() ignored JOIN::having_value as described
above as if it always set to COND_TRUE.
The JOIN::exec method has been modified to take into account
the value of the JOIN::having_value field.
mysql-test/r/subselect3.result:
Added test case for bug #39069.
mysql-test/t/subselect3.test:
Added test case for bug #39069.
sql/sql_select.cc:
Bug #39069: <row constructor> IN <table-subquery> seriously
messed up
The JOIN::exec method has been modified to take into account
the value of the JOIN::having_value field.
The greedy optimizer tracks the current level of nested joins and the position
inside these by setting and maintaining a state that's global for the whole FROM
clause.
This state was correctly maintained inside the selection of the next partial plan
table (in best_extension_by_limited_search()).
greedy_search() also moves the current position by adding the last partial match
table when there's not enough tables in the partial plan found by
best_extension_by_limited_search().
This may require update of the global state variables that describe the current
position in the plan if the last table placed by greedy_search is not a top-level
join table.
Fixed by updating the state after placing the partial plan table in greedy_search()
in the same way this is done on entering the best_extension_by_limited_search().
Fixed the signature of the function called to update the state :
check_interleaving_with_nj
mysql-test/r/greedy_optimizer.result:
Bug #38795: test case
mysql-test/t/greedy_optimizer.test:
Bug #38795: test case
sql/sql_select.cc:
Bug #38795: correctly update current position when placing
the next partial plan table in greedy_search().
Table could be marked dependent because it is
either 1) an inner table of an outer join, or 2) it is a part of
STRAIGHT_JOIN. In case of STRAIGHT_JOIN table->maybe_null should not
be assigned. The fix is to set st_table::maybe_null to 'true' only
for those tables which are used in outer join.
mysql-test/r/select.result:
test result
mysql-test/t/select.test:
test case
sql/sql_select.cc:
Table could be marked dependent because it is
either 1) an inner table of an outer join, or 2) it is a part of
STRAIGHT_JOIN. In case of STRAIGHT_JOIN table->maybe_null should not
be assigned. The fix is to set st_table::maybe_null to 'true' only
for those tables which are used in outer join.
sql/sql_select.h:
added comment
Bug#37671 crash on prepared statement + cursor + geometry + too many open files!
if mysql_execute_command() returns error then free materialized_cursor object.
is_rnd_inited is added to satisfy rnd_end() assertion
(handler may be uninitialized in some cases)
sql/sql_cursor.cc:
if mysql_execute_command() returns error then free materialized_cursor object.
is_rnd_inited is added to satisfy rnd_end() assertion
(handler may be uninitialized in some cases)
sql/sql_select.cc:
added result check
tests/mysql_client_test.c:
test case
if table has bit fields then uneven bits(if exist) are stored into null bits place.
So we need to copy null bits in case of uneven bit field presence.
mysql-test/r/type_bit.result:
test result
mysql-test/t/type_bit.test:
test case
sql/sql_select.cc:
if table has bit fields then uneven bits(if exist) are stored into null bits place.
So we need to copy null bits in case of uneven bit field presence.
ONLY_FULL_GROUP_BY
The check for non-aggregated columns in queries with aggregate function, but without
GROUP BY was treating all the parts of the query as if they are in the SELECT list.
Fixed by ignoring the non-aggregated fields in the WHERE clause.
mysql-test/r/func_group.result:
Bug #39656: test case
mysql-test/t/func_group.test:
Bug #39656: test case
sql/sql_select.cc:
Bug #39656: ignore the new non-aggregated column refs in a WHERE
by saving the state so far and then adding only the new values of the other
parts of the bitmask.
fails after the first time
Two separate problems :
1. When flattening joins the linked list used for name resolution
(next_name_resolution_table) was not updated.
Fixed by updating the pointers when extending the table list
2. The items created by expanding a * (star) as a column reference
were marked as fixed, but no cached table was assigned to them
(unlike what Item_field::fix_fields does).
Fixed by assigning a cached table (so the re-preparation is done
faster).
Note that the fix for #2 hides the fix for #1 in most cases
(except when a table reference cannot be cached).
mysql-test/r/sp.result:
Bug #33811: test case
mysql-test/t/sp.test:
Bug #33811: test case
sql/sql_base.cc:
Bug #33811: cache the table for Item_fields created by expanding '*'
sql/sql_select.cc:
Bug #33811: maintain a correct name resolution chain when
flattening joins.
Server crashed during a sort order optimization
of a dependent subquery:
SELECT
(SELECT t1.a FROM t1, t2
WHERE t1.a = t2.b AND t2.a = t3.c
ORDER BY t1.a)
FROM t3;
Bitmap of tables, that the reference to outer table
column uses, in addition to the regular table bit
has the OUTER_REF_TABLE_BIT bit set.
The only_eq_ref_tables function traverses this map
bit by bit simultaneously with join->map2table list.
Obviously join->map2table never contains an entry
for the OUTER_REF_TABLE_BIT pseudo-table, so the
server crashed there.
The only_eq_ref_tables function has been modified
to traverse regular table bits only like the
update_depend_map function (resetting of the
OUTER_REF_TABLE_BIT there is enough, but
resetting of the whole set of PSEUDO_TABLE_BITS
is used there for sure).
mysql-test/r/order_by.result:
Added test case for bug #39844.
mysql-test/t/order_by.test:
Added test case for bug #39844.
sql/sql_select.cc:
Bug #39844: Query Crash Mysql Server 5.0.67
The only_eq_ref_tables function has been modified
to traverse regular table bits only like the
update_depend_map function (resetting of the
OUTER_REF_TABLE_BIT there is enough, but
resetting of the whole set of PSEUDO_TABLE_BITS
is used there for sure).
with COALESCE and JOIN
The server returned to a client the VARBINARY column type
instead of the DATE type for a result of the COALESCE,
IFNULL, IF, CASE, GREATEST or LEAST functions if that result
was filesorted in an anonymous temporary table during
the query execution.
For example:
SELECT COALESCE(t1.date1, t2.date2) AS result
FROM t1 JOIN t2 ON t1.id = t2.id ORDER BY result;
To create a column of various date/time types in a
temporary table the create_tmp_field_from_item() function
uses the Item::tmp_table_field_from_field_type() method
call. However, fields of the MYSQL_TYPE_NEWDATE type were
missed there, and the VARBINARY columns were created
by default.
Necessary condition has been added.
mysql-test/r/metadata.result:
Added test case for bug #39283.
mysql-test/t/metadata.test:
Added test case for bug #39283.
sql/sql_select.cc:
Bug #39283: Date returned as VARBINARY to client for queries
with COALESCE and JOIN
To create a column of various date/time types in a
temporary table the create_tmp_field_from_item() function
uses the Item::tmp_table_field_from_field_type() method
call. However, fields of the MYSQL_TYPE_NEWDATE type were
missed there, and the VARBINARY columns were created
by default.
Necessary condition has been added.
crashes server
When creating temporary table that contains aggregate functions a
non-reversible source transformation was performed to redirect aggregate
function arguments towards temporary table columns.
This caused EXPLAIN EXTENDED to fail because it was trying to resolve
references to the (freed) temporary table.
Fixed by preserving the original aggregate function arguments and
using them (instead of the transformed ones) for EXPLAIN EXTENDED.
mysql-test/r/explain.result:
Bug#34773: test case
mysql-test/t/explain.test:
Bug#34773: test case
sql/item.cc:
Bug#34773: use accessor functions instead of public members
sql/item_sum.cc:
Bug#34773:
- Encapsulate the arguments into Item_sum and
provide accessor and mutator methods
- print the orginal arguments (if present)
in EXPLAIN EXTENDED
- preserve the original arguments list.
sql/item_sum.h:
Bug#34773:
- Encapsulate the arguments into Item_sum and
provide accessor and mutator methods
- print the orginal arguments (if present)
in EXPLAIN EXTENDED
- preserve the original arguments list.
sql/opt_range.cc:
Bug#34773: use accessor functions instead of public members
sql/opt_sum.cc:
Bug#34773: use accessor functions instead of public members
sql/sql_select.cc:
Bug#34773: use accessor functions instead of public members
The optimizer pulls up aggregate functions which should be aggregated in
an outer select. At some point it may substitute such a function for a field
in the temporary table. The setup_copy_fields function doesn't take this
into account and may overrun the copy_field buffer.
Fixed by filtering out the fields referenced through the specialized
reference for aggregates (Item_aggregate_ref).
Added an assertion to make sure bugs that cause similar discrepancy
don't go undetected.
mysql-test/r/func_group.result:
Bug #37348: test case
mysql-test/t/func_group.test:
Bug #37348: test case
sql/item.cc:
Bug #37348: Added a way to distinguish Item_aggregate_ref from the other types of refs
sql/item.h:
Bug #37348: Added a way to distinguish Item_aggregate_ref from the other types of refs
sql/sql_select.cc:
Bug #37348:
- Don't consider copying field references
seen through Item_aggregate_ref
- check for discrepancies between the number of expected
fields that need copying and the actual fields copied.
When switching to indexed ORDER BY we must be sure to reset the index read
flag if we are switching from a covering index to non-covering.
mysql-test/r/subselect.result:
Bug#37548: test case
mysql-test/t/subselect.test:
Bug#37548: test case
sql/sql_select.cc:
Bug#37548: update the index read flag if the index for indexed ORDER BY is not
covering.
used causes server crash.
When the loose index scan access method is used values of aggregated functions
are precomputed by it. Aggregation of such functions shouldn't be performed
in this case and functions should be treated as normal ones.
The create_tmp_table function wasn't taking this into account and this led to
a crash if a query has MIN/MAX aggregate functions and employs temporary table
and loose index scan.
Now the JOIN::exec and the create_tmp_table functions treat MIN/MAX aggregate
functions as normal ones when the loose index scan is used.
mysql-test/r/group_min_max.result:
Added a test case for the bug#38195.
mysql-test/t/group_min_max.test:
Added a test case for the bug#38195.
sql/sql_select.cc:
Bug#38195: Incorrect handling of aggregate functions when loose index scan is
used causes server crash.
The JOIN::exec and the create_tmp_table functions treat MIN/MAX aggregate
functions as normal ones when the loose index scan is used.
used causes server crash.
When the loose index scan access method is used values of aggregated functions
are precomputed by it. Aggregation of such functions shouldn't be performed
in this case and functions should be treated as normal ones.
The create_tmp_table function wasn't taking this into account and this led to
a crash if a query has MIN/MAX aggregate functions and employs temporary table
and loose index scan.
Now the JOIN::exec and the create_tmp_table functions treat MIN/MAX aggregate
functions as normal ones when the loose index scan is used.
mysql-test/r/group_min_max.result:
Added a test case for the bug#38195.
mysql-test/t/group_min_max.test:
Added a test case for the bug#38195.
sql/sql_select.cc:
Bug#38195: Incorrect handling of aggregate functions when loose index scan is
used causes server crash.
Now the JOIN::exec and the create_tmp_table functions treat MIN/MAX aggregate
functions as normal ones when the loose index scan is used.
Calling List<Cached_item>::delete_elements for the same list twice
caused a crash of the server in the function JOIN::cleaunup.
Ensured that delete_elements() in JOIN::cleanup would be called only once.
mysql-test/r/subselect.result:
Added a test case for bug #38191.
mysql-test/t/subselect.test:
Added a test case for bug #38191.
sql/sql_select.cc:
Fixed bug #38191.
Ensured that delete_elements() in JOIN::cleanup would be called only once.
Range scan in descending order for c <= <col> <= c type of
ranges was ignoring the DESC flag.
However some engines like InnoDB have the primary key parts
as a suffix for every secondary key.
When such primary key suffix is used for ordering ignoring
the DESC is not valid.
But we generally would like to do this because it's faster.
Fixed by performing only reverse scan if the primary key is used.
Removed some dead code in the process.
mysql-test/r/innodb_mysql.result:
Bug#37830 : test case
mysql-test/t/innodb_mysql.test:
Bug#37830 : test case
sql/opt_range.cc:
Bug#37830 :
- preserve and use used_key_parts to
distinguish when a primary key suffix is used
- removed some dead code
sql/opt_range.h:
Bug#37830 :
- preserve used_key_parts
- dead code removed
sql/sql_select.cc:
Bug#37830 : Do only reverse order traversal
if the primary key suffix is used.
Range scan in descending order for c <= <col> <= c type of
ranges was ignoring the DESC flag.
However some engines like InnoDB have the primary key parts
as a suffix for every secondary key.
When such primary key suffix is used for ordering ignoring
the DESC is not valid.
But we generally would like to do this because it's faster.
Fixed by performing only reverse scan if the primary key is used.
Removed some dead code in the process.
mysql-test/r/innodb_mysql.result:
Bug#37830 : test case
mysql-test/t/innodb_mysql.test:
Bug#37830 : test case
sql/opt_range.cc:
Bug#37830 :
- preserve and use used_key_parts to
distinguish when a primary key suffix is used
- removed some dead code
sql/opt_range.h:
Bug#37830 :
- preserve used_key_parts
- dead code removed
sql/sql_select.cc:
Bug#37830 : Do only reverse order traversal
if the primary key suffix is used.
- In QUICK_INDEX_MERGE_SELECT::read_keys_and_merge: when we got table->sort from Unique,
tell init_read_record() not to use rr_from_cache() because a) rowids are already sorted
and b) it might be that the the data is used by filesort(), which will need record rowids
(which rr_from_cache() cannot provide).
- Fully de-initialize the table->sort read in QUICK_INDEX_MERGE_SELECT::get_next(). This fixes BUG#35477.
(bk trigger: file as fix for BUG#35478).
sql/filesort.cc:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- make find_all_keys() use quick->get_next() instead of init_read_record(r)/r.read_record() calls
- added dbug printout
sql/mysql_priv.h:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- Added parameter to init_read_record
sql/opt_range.cc:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- In QUICK_INDEX_MERGE_SELECT::read_keys_and_merge: when we got table->sort from Unique,
tell init_read_record() not to use rr_from_cache() because a) rowids are already sorted
and b) it might be that the the data is used by filesort(), which will need record rowids
(which rr_from_cache() cannot provide).
- Fully de-initialize the table->sort read in QUICK_INDEX_MERGE_SELECT::get_next().
sql/records.cc:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- Added disable_rr_cache parameter to init_read_record
- Added comment
sql/sql_acl.cc:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- Added parameter to init_read_record
sql/sql_delete.cc:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- Added parameter to init_read_record
sql/sql_help.cc:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- Added parameter to init_read_record
sql/sql_select.cc:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- Added parameter to init_read_record
sql/sql_table.cc:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- Added parameter to init_read_record
sql/sql_udf.cc:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- Added parameter to init_read_record
sql/sql_update.cc:
BUG#35478: sort_union() returns bad data when sort_buffer_size is hit
- Added parameter to init_read_record
InnoDB table, where all selected columns
belong to the same unique index key, returns
incorrect results
Server executes some queries via QUICK_GROUP_MIN_MAX_SELECT
(MIN/MAX optimization for queries with GROUP BY or DISTINCT
clause) and that optimization implies loose index scan, so all
grouping is done by the QUICK_GROUP_MIN_MAX_SELECT::get_next
method.
The server does not set the precomputed_group_by flag for some
QUICK_GROUP_MIN_MAX_SELECT queries and duplicates grouping by
call to the end_send_group function.
Fix: when the test_if_skip_sort_order function selects loose
index scan as a best way to satisfy an ORDER BY/GROUP BY type
of query, the precomputed_group_by flag has been set to use
end_send/end_write functions instead of end_send_group/
end_write_group functions.
mysql-test/r/group_min_max_innodb.result:
Fixed bug #36632: SELECT DISTINCT from a simple view on an
InnoDB table, where all selected columns
belong to the same unique index key, returns
incorrect results
mysql-test/t/group_min_max_innodb.test:
Fixed bug #36632: SELECT DISTINCT from a simple view on an
InnoDB table, where all selected columns
belong to the same unique index key, returns
incorrect results
sql/sql_select.cc:
Fixed bug #36632: SELECT DISTINCT from a simple view on an
InnoDB table, where all selected columns
belong to the same unique index key, returns
incorrect results
