Commit graph

1255 commits

Author SHA1 Message Date
Sergei Golubchik
d31ee64da6 compiler warning 2018-01-15 15:57:04 +01:00
Oleksandr Byelkin
235b68299b MDEV-9619: Assertion `null_ref_table' failed in virtual table_map Item_direct_view_ref::used_tables() const on 2nd execution of PS
Refer left expression indirectly in case it changes from execution to execution.
2017-10-13 19:32:38 +02:00
Sergei Golubchik
be55bbc2b2 MDEV-7826 Server crashes in Item_subselect::enumerate_field_refs_processor
upper->item can be NULL if we're referring to an aggregate function
2017-07-12 12:49:29 +02:00
Sergei Golubchik
c5975eaea1 MDEV-7339 Server crashes in Item_func_trig_cond::val_int
Item_in_subselect::pushed_cond_guards[] array is allocated only when
left_expr->maybe_null. And it is used (for row expressions) when
left_expr->element_index(i)->maybe_null.

For left_expr being a multi-column subquery, its maybe_null is
always false when the subquery doesn't use tables (see
Item_singlerow_subselect::fix_length_and_dec()
and subselect_single_select_engine::fix_length_and_dec()),
otherwise it's always true.

But row elements can be NULL regardless, so let's always allocate
pushed_cond_guards for multi-column subqueries, no matter whether
its maybe_null was forced to true or false.
2017-07-12 10:39:02 +02:00
Igor Babaev
e0352fb079 Fixed the bug mdev-7599.
At some conditions the function opt_sum_query() can apply MIN/MAX
optimizations to to Item_sum objects of a select These optimizations
becomes invalid if this select is the subquery of an IN subquery
predicate that is converted to a EXISTS subquery. Thus in this case
the MIX/MAX optimizations that have been applied in opt_sum_query()
must be rolled back.
This bug appeared in 5.3 when the code for the cost base choice between
materialization and in-to-exists transformation of non-correlated
IN subqueries was introduced. Before this code in-to-exists
transformations were always performed before the call of opt_sum_query().
2017-05-15 10:00:00 -07:00
Igor Babaev
6b97fe067d Fixed the bugs mdev-12670 and mdev-12675.
The code that blocked conversion of a IN subselect pedicate to a semi-join
if it occurred in the ON expression of an outer join did not do it correctly.
As a result, the conversion was blocked for IN subselect predicates
encountered in ON expressions of INNER joins or in WHERE conditions
of mergeable views / derived tables. This patch fixes this problem.
2017-05-09 15:09:15 -07:00
Varun Gupta
43903745e5 MDEV-11078: NULL NOT IN (non-empty subquery) should never return results
Disabling the cond guards during the creation of Tricond Item for
constant and NULL left expression items
2017-03-05 10:58:05 +05:30
Igor Babaev
46eef1ede2 Fixed bug mdev-11859.
As the function Item_subselect::fix_fields does it the function
Item_subselect::update_used_tables must ignore UNCACHEABLE_EXPLAIN
when deciding whether the subquery item should be considered as a
constant item.
2017-01-23 19:40:22 -08:00
Sergei Golubchik
9fefe97336 Merge branch 'mysql/5.5' into 5.5 2016-12-22 12:49:06 +01:00
iangilfillan
c4d9dc705b Typo, update limit in comment 2016-12-17 09:49:47 +04:00
Oleksandr Byelkin
f988bcecfd MDEV-10776: Server crash on query
Exclude untouched in prepare phese subqueries from the select/unit tree
because they became unreachable by execution.
2016-12-06 16:14:56 +01:00
Kailasnath Nagarkar
97fad8518b Bug #23303485 : HANDLE_FATAL_SIGNAL (SIG=11) IN
SUBSELECT_UNION_ENGINE::NO_ROWS

This patch is specific for mysql-5.5

ISSUE: When max_join_size is used and union query
       results in evaluation of tuples greater than
       max_join_size, the join object is not created,
       and is set to NULL.
       However, this join object is further dereferenced
       by union logic to determine if query resulted in
       any number of rows being returned.
       Since, the object is NULL, it results in
       program terminating abnormally.

SOLUTION: Added check to verify if join object is created.
          If join object is created, it will be used to
          determine if query resulted in any number of rows.
          Else, when join object is not created, we return
          'false' indicating that there were no rows for the
          query.
2016-08-26 11:11:27 +05:30
Oleksandr Byelkin
5fdb3cfcd4 MDEV-10419: crash in mariadb 10.1.16-MariaDB-1~trusty
Fixed initialization and usage of THD reference in subselect engines.
2016-07-30 20:13:03 +02:00
Oleksandr Byelkin
79f852a069 MDEV-10050: Crash in subselect
thd should not be taken earlier then fix_field and reset on fix_fields if it is needed.
2016-06-24 14:15:35 +02:00
Sergei Golubchik
265e833fdd revert 415faa122b
that was mistakenly merged from mysql-5.5.47
2015-12-11 23:25:20 +01:00
Sergei Golubchik
abf9d35213 Merge branch 'mysql/5.5' into 5.5 2015-12-09 10:00:49 +01:00
Oleksandr Byelkin
54b998173b MDEV-7846: Server crashes in Item_subselect::fix_fields or fails with Thread stack overrun
Substitute into transformed subselects original left expression and than register its change in case it was substituted.
2015-10-06 13:12:58 +02:00
Oleksandr Byelkin
0ab93fd6f3 MDEV-7445:Server crash with Signal 6
MDEV-7565: Server crash with Signal 6 (part 2)

followup test suite and its fix.
2015-10-06 13:12:58 +02:00
Sreeharsha Ramanavarapu
415faa122b Bug #19434916: FATAL_SIGNAL IN ADD_KEY_EQUAL_FIELDS() WITH
UPDATE VIEW USING OUTER SUBQUERY

Issue:
-----
While resolving a column which refers to a table/view in an
outer query, it's respecitve item object is marked with the
outer query's select_lex object. But when the column refers
to a view or if the column is part of a subquery in the
HAVING clause, an Item_ref object is created. While the
reference to the outer query is stored by the Item_ref
object, the same is not stored in it's real_item.

This creates a problem with the IN-TO-EXISTS optmization.
When there is an index over the column in the inner query,
it will be considered since the column's real_item object
will be mistaken for a local field. This will lead to a
crash.

SOLUTION:
---------
Under the current design, the only way to fix this issue is
to check the reginfo.join_tab for a NULL value. If yes, the
query should not be worrying about the key use.

The testcase and comments added as part of the fix for
Bug#17766653 have been backported.
2015-10-01 07:45:27 +05:30
Sergei Golubchik
4d5772c578 MDEV-7810 Wrong result on execution of a query as a PS (both 1st and further executions)
Alternative fix that doesn't cause view.test crash in --ps:
Remember when Item_ref was fixed right in the constructor
and did not have a full Item_ref::fix_fields() call. Later
in PS/SP, after Item_ref::cleanup, we use this knowledge
to avoid doing full fix_fields() for items that were never
supposed to be fix_field'ed.

Simplify the test case.
2015-07-31 17:17:33 +02:00
Monty
7115341473 Fixed warnings and errors found by buildbot
field.cc
- Fixed warning about overlapping memory copy (backport from 10.0)

Item_subselect.cc
- Fixed core dump in main.view
- Problem was that thd->lex->current_select->master_unit()->item was not set, which caused crash in maxr_as_dependent

sql/mysqld.cc
- Got error on shutdown as we where freeing mutex before all THD objects was freed
  (~THD uses some mutex). Fixed by during shutdown freeing THD inside mutex.

sql/log.cc
- log_space_lock and LOCK_log where locked in inconsistenly. Fixed by not having a log_space_lock around purge_logs.

sql/slave.cc
- Remove unnecessary log_space_lock
- Move cond_broadcast inside lock to ensure we don't miss the signal
2015-07-25 15:15:52 +03:00
Monty
67c56ab1e4 Simple cleanups
- Removing use of calls to current_thd
- More DBUG_PRINT
- Code style changes
- Made some local functions static
Ensure that calls to print_keyuse are locked with mutex to get all lines in same debug packet
2015-06-25 23:34:54 +03:00
Monty
8c815751c9 Problem was that for cases like:
SELECT ... WHERE XX IN (SELECT YY)
this was transformed to something like:
SELECT ... WHERE IF_EXISTS(SELECT ... HAVING XX=YY)

The bug was that for normal execution XX was fixed in the original outer SELECT context while in PS it was fixed in the sub query context and this confused the optimizer.

Fixed by ensuring that XX is always fixed in the outer context.
2015-06-25 23:26:29 +03:00
Sergey Petrunya
6b353dd1de MDEV-6289 : Unexpected results when querying information_schema
- When traversing JOIN_TABs with first_linear_tab/next_linear_tab(), don't forget
  to enter the semi-join nest when it is the first table in the join order.
  Failure to do so could cause e.g. I_S tables not to be filled.
2014-07-23 19:53:29 +04:00
Sergei Golubchik
fb27ce22f7 5.3 merge 2014-02-14 14:09:29 +01:00
Sergei Golubchik
642495345f Remove the fix from MySQL-5.1 that's not necessary in 5.3 2014-02-13 20:18:07 +01:00
unknown
c98a054fde MDEV-5153: Server crashes in Item_ref::fix_fields on 2nd execution of PS with LEFT JOIN and MERGE view or SELECT SQ
1. Transformation of row IN subquery made the same as single value.
2. replace_where_subcondition() made working on several layers of OR/AND because it called on expression before fix_fields().
2013-11-11 17:28:14 +02:00
unknown
dfed447888 merge 5.3->5.5 2013-11-11 20:38:04 +02:00
unknown
52dea41052 Merge 5.3->5.5 2013-10-29 18:50:36 +02:00
timour@askmonty.org
883af99e7d MDEV-5104 crash in Item_field::used_tables with broken order by
Analysis:
st_select_lex_unit::prepare() computes can_skip_order_by as TRUE.
As a result join->prepare() gets called with order == NULL, and
doesn't do name resolution for the inner ORDER clause. Due to this
the prepare phase doesn't detect that the query references non-exiting
function and field.
  
Later join->optimize() calls update_used_tables() for a non-resolved
Item_field, which understandably has no Field object. This call results
in a crash.

Solution:
Resolve unnecessary ORDER BY clauses to detect if they reference non-exising
objects. Then remove such clauses from the JOIN object.
2013-10-29 12:39:03 +02:00
Sergei Golubchik
e7c4e6d870 MDEV-5012 Server crashes in Item_ref::real_item on EXPLAIN with select subqueries or views, constant table, derived_merge+derived_with_keys
revert incorrect change, merged from mysql-5.5
2013-09-13 23:42:00 +02:00
Sergei Golubchik
b838d081ad mysql-5.5.33 merge 2013-09-06 22:31:30 +02:00
Neeraj Bisht
0cf9f5e773 Bug#17029399 - CRASH IN ITEM_REF::FIX_FIELDS WITH TRIGGER ERRORS
Problem:-
In a Procedure, when we are comparing value of select query 
with IN clause and they both have different collation, cause 
error on first time execution and assert second time.
procedure will have query like
set @x = ((select a from t1) in (select d from t2));<---proc1
              sel1                   sel2

Analysis:-
When we execute this proc1(first time)
While resolving the fields of user variable, we will call 
Item_in_subselect::fix_fields while will resolve sel2. There 
in Item_in_subselect::select_transformer, we evaluate the 
left expression(sel1) and store it in Item_cache_* object 
(to avoid re-evaluating it many times during subquery execution) 
by making Item_in_optimizer class.
While evaluating left expression we will prepare sel1.
After that, we will put a new condition in sel2  
in Item_in_subselect::select_transformer() which will compare 
t2.d and sel1(which is cached in Item_in_optimizer).

Later while checking the collation in agg_item_collations() 
we get error and we cleanup the item. While cleaning up we cleaned 
the cached value in Item_in_optimizer object.

When we execute the procedure second time, we have condition for 
sel2 and while setup_cond(), we can't able to find reference item 
as it is cleanup while item cleanup.So it assert.


Solution:-
We should not cleanup the cached value for Item_in_optimizer object, 
if we have put the condition to subselect.
2013-08-23 16:56:17 +05:30
Neeraj Bisht
4f0e7c036d Bug#17029399 - CRASH IN ITEM_REF::FIX_FIELDS WITH TRIGGER ERRORS
Problem:-
In a Procedure, when we are comparing value of select query 
with IN clause and they both have different collation, cause 
error on first time execution and assert second time.
procedure will have query like
set @x = ((select a from t1) in (select d from t2));<---proc1
              sel1                   sel2

Analysis:-
When we execute this proc1(first time)
While resolving the fields of user variable, we will call 
Item_in_subselect::fix_fields while will resolve sel2. There 
in Item_in_subselect::select_transformer, we evaluate the 
left expression(sel1) and store it in Item_cache_* object 
(to avoid re-evaluating it many times during subquery execution) 
by making Item_in_optimizer class.
While evaluating left expression we will prepare sel1.
After that, we will put a new condition in sel2  
in Item_in_subselect::select_transformer() which will compare 
t2.d and sel1(which is cached in Item_in_optimizer).

Later while checking the collation in agg_item_collations() 
we get error and we cleanup the item. While cleaning up we cleaned 
the cached value in Item_in_optimizer object.

When we execute the procedure second time, we have condition for 
sel2 and while setup_cond(), we can't able to find reference item 
as it is cleanup while item cleanup.So it assert.


Solution:-
We should not cleanup the cached value for Item_in_optimizer object, 
if we have put the condition to subselect.
2013-08-23 16:54:25 +05:30
Sergey Glukhov
7e2c2bb9cc 5.1 -> 5.5 merge 2013-05-07 13:14:01 +04:00
Sergey Glukhov
1414a0ed7f 5.1 -> 5.5 merge 2013-05-07 13:14:01 +04:00
Sergey Glukhov
a250331593 Bug#16095534 CRASH: PREPARED STATEMENT CRASHES IN ITEM_BOOL_FUNC2::FIX_LENGTH_AND_DEC
The problem happened due to broken left expression in Item_in_optimizer object.
In case of the bug left expression is runtime created Item_outer_ref item which
is deleted at the end of the statement and one of Item_in_optimizer arguments
becomes bad when re-executed. The fix is to use real_item() instead of original
left expression. Note: It feels a bit weird that after preparing, the field is
directly part of the generated Item_func_eq, whereas in execution it is replaced
with an Item_outer_ref wrapper object.
2013-05-07 13:10:58 +04:00
Sergey Glukhov
2ec9dcf6a1 Bug#16095534 CRASH: PREPARED STATEMENT CRASHES IN ITEM_BOOL_FUNC2::FIX_LENGTH_AND_DEC
The problem happened due to broken left expression in Item_in_optimizer object.
In case of the bug left expression is runtime created Item_outer_ref item which
is deleted at the end of the statement and one of Item_in_optimizer arguments
becomes bad when re-executed. The fix is to use real_item() instead of original
left expression. Note: It feels a bit weird that after preparing, the field is
directly part of the generated Item_func_eq, whereas in execution it is replaced
with an Item_outer_ref wrapper object.


sql/item_subselect.cc:
  use left_expr->real_item() instead of original left expression
  because left_expr can be runtime created Ref item which is deleted
  at the end of the statement. Thus one of 'substitution' arguments
  can be broken in case of PS.
2013-05-07 13:10:58 +04:00
unknown
599a1384af Fix for MDEV-4144
Analysis:
The reason for the inefficent plan was that Item_subselect::is_expensive()
didn't detect the special case when a subquery was optimized, but had no
join plan because it either has no table, or its tables have been optimized
away, or the optimizer detected that the result set is empty.
  
Solution:
Identify the special cases above in the Item_subselect::is_expensive(),
and consider such degenerate subqueries inexpensive.
2013-03-29 17:53:21 +02:00
Murthy Narkedimilli
d20a70fb55 Bug 16395495 - OLD FSF ADDRESS IN GPL HEADER 2013-03-19 13:29:12 +01:00
Murthy Narkedimilli
fe85f54640 Bug 16395495 - OLD FSF ADDRESS IN GPL HEADER 2013-03-19 13:29:12 +01:00
Sergei Golubchik
495fd27c0e MDEV-4284 Assertion `cmp_items[(uint)cmp_type]' fails in sql/item_cmpfunc.cc
Flip the switch and create Item_cache based on the argument's cmp_type, not argument's result_type().
Fix subselect_engine to calculate cmp_type correctly

sql/item_subselect.h:
  mdev:4284
2013-03-17 11:41:25 +01:00
Sergei Golubchik
8161c6772d merge with mysql-5.5.30 minus few incorrect or not applicable changesets 2013-02-28 18:42:49 +01:00
Murthy Narkedimilli
69d8812a61 Updated/added copyright headers. 2013-02-25 15:26:00 +01:00
Murthy Narkedimilli
053d7e775c Updated/added copyright headers. 2013-02-25 15:26:00 +01:00
Sergei Golubchik
d3935adf7a mysql-5.5.29 merge 2013-01-15 19:13:32 +01:00
Roy Lyseng
96c373c51a Bug#15972635: Incorrect results returned in 32 table join with HAVING
The problem is a shift operation that is not 64-bit safe.
The consequence is that used tables information for a join with 32 tables
or more will be incorrect.

Fixed by adding a type cast in Item_sum::update_used_tables().

Also used the opportunity to fix some other potential bugs by adding an
explicit type-cast to an integer in a left-shift operation.
Some of them were quite harmless, but was fixed in order to get the same
signed-ness as the other operand of the operation it was used in.

sql/item_cmpfunc.cc
  Adjusted signed-ness for some integers in left-shift.

sql/item_subselect.cc
  Added type-cast to nesting_map (which is a 32/64 bit type, so
  potential bug for deeply nested queries).

sql/item_sum.cc
  Added type-cast to nesting_map (32/64-bit type) and table_map
  (64-bit type).

sql/opt_range.cc
  Added type-cast to ulonglong (which is a 64-bit type).

sql/sql_base.cc
  Added type-cast to nesting_map (which is a 32/64-bit type).

sql/sql_select.cc
  Added type-cast to nesting_map (32/64-bit type) and key_part_map
  (64-bit type).

sql/strfunc.cc
  Changed type-cast from longlong to ulonglong, to preserve signed-ness.
2012-12-21 09:53:42 +01:00
Roy Lyseng
8b1d1cf5c0 Bug#15972635: Incorrect results returned in 32 table join with HAVING
The problem is a shift operation that is not 64-bit safe.
The consequence is that used tables information for a join with 32 tables
or more will be incorrect.

Fixed by adding a type cast in Item_sum::update_used_tables().

Also used the opportunity to fix some other potential bugs by adding an
explicit type-cast to an integer in a left-shift operation.
Some of them were quite harmless, but was fixed in order to get the same
signed-ness as the other operand of the operation it was used in.

sql/item_cmpfunc.cc
  Adjusted signed-ness for some integers in left-shift.

sql/item_subselect.cc
  Added type-cast to nesting_map (which is a 32/64 bit type, so
  potential bug for deeply nested queries).

sql/item_sum.cc
  Added type-cast to nesting_map (32/64-bit type) and table_map
  (64-bit type).

sql/opt_range.cc
  Added type-cast to ulonglong (which is a 64-bit type).

sql/sql_base.cc
  Added type-cast to nesting_map (which is a 32/64-bit type).

sql/sql_select.cc
  Added type-cast to nesting_map (32/64-bit type) and key_part_map
  (64-bit type).

sql/strfunc.cc
  Changed type-cast from longlong to ulonglong, to preserve signed-ness.
2012-12-21 09:53:42 +01:00
unknown
3f59033536 Merge MariaDB 5.1.66 -> 5.2 -> 5.3 2012-11-09 10:11:20 +02:00
unknown
c5cef4b166 Merge MariaDB 5.1.66 -> 5.2.12 2012-11-08 15:24:35 +02:00