Commit graph

599 commits

Author SHA1 Message Date
Murthy Narkedimilli
c92223e198 Updated/added copyright headers 2014-01-06 10:52:35 +05:30
Guilhem Bichot
c90cdf5d49 Bug#16539979 - BASIC SELECT COUNT(DISTINCT ID) IS BROKEN
Bug#17867117 - ERROR RESULT WHEN "COUNT + DISTINCT + CASE WHEN" NEED MERGE_WALK 

Problem:
COUNT DISTINCT gives incorrect result when it uses a Unique
Tree and its last inserted record has null value.

Here is how COUNT DISTINCT is processed, given that this query is not
using loose index scan.

When a row is produced as a result of joining tables (there is only
one table here), we store the SELECTed value in a Unique tree. This
allows elimination of any duplicates, and thus implements DISTINCT.

When we have processed all rows like this, we walk the Unique tree,
counting its elements, in Aggregator_distinct::endup() (tree->walk());
for each element we call Item_sum_count::add(). Such function wants to
ignore any NULL value, for that it checks item_sum -> args[0] ->
null_value. It is a mistake: when walking the Unique tree, the value
to be aggregated is not item_sum ->args[0] but rather table ->
field[0].

Solution:
instead of item_sum -> args[0] -> null_value, use arg_is_null(), which
knows where to look (like in fix for bug 57932).

As a consequence of this solution, we have to make arg_is_null() a
little more general:
1) Because it was so far only used for AVG() (which always has a
single argument), this function was looking at a single argument; now
that it has to work with COUNT(DISTINCT expression1,expression2), it
must look at all arguments.
2) Because we start using arg_is_null () for COUNT(DISTINCT), i.e. in
Item_sum_count::add (), it implies that we are also using it for
COUNT(no DISTINCT) (same add ()). For COUNT(no DISTINCT), the
nullness to check is that of item_sum -> args[0]. But the null_value
of such item is reliable only if val_*() has been called on it. So far
arg_is_null() was always used after a call to arg_val*(), so could
rely on null_value; but for COUNT, there is no call to arg_val*(), so
arg_is_null() has to call is_null() instead.

Testcase for 16539979 by Neeraj. Testcase for 17867117 contributed by
Xiaobin Lin from Taobao.
2013-12-04 12:32:42 +01:00
Neeraj Bisht
e203951cb1 Bug#17222452 - SELECT COUNT(DISTINCT A,B) INCORRECTLY COUNTS ROWS
CONTAINING NULL

Problem:-
In MySQL, We can obtain the number of distinct expression
combinations that do not contain NULL by giving a list of 
expressions in COUNT(DISTINCT).
However rows with NULL values are
incorrectly included in the count when loose index scan is 
used.

Analysis:-
In case of loose index scan, we check whether the field is null or 
not and increase the count in Item_sum_count::add().
But there we are checking for the first field in COUNT(DISTINCT), 
not for every field. This is causing an incorrect result.

Solution:-
Check all field in Item_sum_count::add(), whether there values 
are null or not. Then only increment the count.
******
Bug#17222452 - SELECT COUNT(DISTINCT A,B) INCORRECTLY COUNTS ROWS 
	       CONTAINING NULL

Problem:-
In MySQL, We can obtain the number of distinct expression
combinations that do not contain NULL by giving a list of 
expressions in COUNT(DISTINCT).
However rows with NULL values are
incorrectly included in the count when loose index scan is 
used.

Analysis:-
In case of loose index scan, we check whether the field is null or 
not and increase the count in Item_sum_count::add().
But there we are checking for the first field in COUNT(DISTINCT), 
not for every field. This is causing an incorrect result.

Solution:-
Check all field in Item_sum_count::add(), whether there values 
are null or not. Then only increment the count.
2013-09-04 10:45:55 +05:30
Chaithra Gopalareddy
51555d2ae3 Merge from 5.1 to 5.5
sql/sql_class.h:
  Parsing for group_concat's order by  is made independent.
  As a result, add_order_to_list cannot be used anymore.
2013-04-14 08:09:56 +05:30
Chaithra Gopalareddy
2d83663380 Bug#16347426:ASSERTION FAILED: (SELECT_INSERT &&
!TABLES->NEXT_NAME_RESOLUTION_TABLE) || !TAB
      
Problem:
The context info of select query gets corrupted when a query
with group_concat having order by is present in an order by
clause of the select query. As a result, server crashes with
an assert.
      
Analysis:
While parsing order by for group_concat, it is presumed that
it is always present before the actual order by for the
select query.
As a result, parser uses select->order_list to populate the
order by items of group_concat and creates a select->gorder_list
to which select->order_list is copied onto. Once this is done,
it empties the select->order_list.
In the case presented in the bugpage, as order by is already
parsed when group_concat's order by is encountered, parser
presumes that it is the second order by in the select query
and creates fake_lex_unit which results in the change of
context info.
      
Solution:
Make group_concat's order by parsing independent of the select


sql/item_sum.cc:
  Change the argument as, select->gorder_list is not pointer anymore
sql/item_sum.h:
  Change the argument as, select->gorder_list is not pointer anymore
sql/mysql_priv.h:
  Parsing for group_concat's order by is made independent.
  As a result, add_order_to_list cannot be used anymore.
sql/sql_lex.cc:
  Parsing for group_concat's order by is made independent.
  As a result, add_order_to_list cannot be used anymore.
sql/sql_lex.h:
  Parsing for group_concat's order by is made independent.
  As a result, add_order_to_list cannot be used anymore.
sql/sql_yacc.yy:
   Make group_concat's order by parsing independent of the select
  queries order by.
2013-04-14 07:30:49 +05:30
Chaithra Gopalareddy
911934db18 Merge from 5.1 to 5.5 2013-03-31 06:52:16 +05:30
Chaithra Gopalareddy
cfb3bbac27 Bug #16347343 : CRASH, GROUP_CONCAT, DERIVED TABLES
Problem:
A select query inside a group_concat function having an 
outer reference results in a crash.
      
Analysis:
In function Item_group_concat::add, we do not check if 
return value of get_tmp_table_field can be NULL for 
a non-const item. This can happen for a query with a 
outer reference.
While resolving the outer reference in the query present
inside group_concat function, we set the "const_item_cache" 
to false. As a result in the call to const_item() from 
Item_func_group_concat::add, it returns false and goes on 
to check if this can be NULL resulting in the crash.
get_tmp_table_field does not return NULL for Items of type 
Item_field, Item_result_field and Item_ref. 
For all other items, it returns NULL. 
     
Solution:
Check for the return value of get_tmp_table_field before we 
access field contents.

sql/item_sum.cc:
  Check for the return value of get_tmp_table_field before accessing
2013-03-31 06:48:30 +05:30
Murthy Narkedimilli
fe85f54640 Bug 16395495 - OLD FSF ADDRESS IN GPL HEADER 2013-03-19 13:29:12 +01:00
Sergey Glukhov
662feebc92 5.1 -> 5.5 merge 2013-03-14 11:22:08 +03:00
Sergey Glukhov
6077a41a66 Bug#16075310 SERVER CRASH OR VALGRIND ERRORS IN ITEM_FUNC_GROUP_CONCAT::SETUP AND ::ADD
Item_func_group_concat::copy_or_same() creates a copy of original object.
It also creates a copy of ORDER structure because ORDER struct elements may
be modified in find_order_in_list() called from Item_func_group_concat::setup().
As ORDER copy is created using memcpy, ORDER::next elements point to original
ORDER structs. Thus find_order_in_list() called from EXECUTE stmt modifies
ordinal ORDER item pointers so they point to runtime items, these items are
freed after execution, so original ORDER structure becomes invalid.
The fix is to properly update ORDER::next fields so that they point to
new ORDER elements.



sql/item_sum.cc:
  update ORDER::next fields so that they point to new ORDER elements.
2013-03-14 11:11:17 +03:00
Nisha Gopalakrishnan
d01b5c392c Bug#11757464:SERVER CRASH IN RECURSIVE CALL WHEN OOM
Analysis:
---------

When the server is out of memory, an error is raised
to indicate the same. Handling the error requires
more memory to be allocated which fails, hence the
error handling loops in a recursion and causes the
server to crash.

Fix:
---
a) Prevents pushing the 'out of memory' error condition
to the diagnostic area as it requires memory allocation.
GET DIAGNOSTICS, SHOW WARNINGS and SHOW ERRORS statements
will not show information about this error. However the
'out of memory' error is returned to the client.
b) It sets the ME_FATALERROR flag when 'out of memory' errors
are reported (for places where the flag is not already set).
This flag prevents activation of SP error handlers which also
require memory allocation and therefore are likely to fail.
2013-01-15 15:30:26 +05:30
Roy Lyseng
96c373c51a Bug#15972635: Incorrect results returned in 32 table join with HAVING
The problem is a shift operation that is not 64-bit safe.
The consequence is that used tables information for a join with 32 tables
or more will be incorrect.

Fixed by adding a type cast in Item_sum::update_used_tables().

Also used the opportunity to fix some other potential bugs by adding an
explicit type-cast to an integer in a left-shift operation.
Some of them were quite harmless, but was fixed in order to get the same
signed-ness as the other operand of the operation it was used in.

sql/item_cmpfunc.cc
  Adjusted signed-ness for some integers in left-shift.

sql/item_subselect.cc
  Added type-cast to nesting_map (which is a 32/64 bit type, so
  potential bug for deeply nested queries).

sql/item_sum.cc
  Added type-cast to nesting_map (32/64-bit type) and table_map
  (64-bit type).

sql/opt_range.cc
  Added type-cast to ulonglong (which is a 64-bit type).

sql/sql_base.cc
  Added type-cast to nesting_map (which is a 32/64-bit type).

sql/sql_select.cc
  Added type-cast to nesting_map (32/64-bit type) and key_part_map
  (64-bit type).

sql/strfunc.cc
  Changed type-cast from longlong to ulonglong, to preserve signed-ness.
2012-12-21 09:53:42 +01:00
Sergey Glukhov
bd4785a6b7 Bug#11750518 41090: ORDER BY TRUNCATES GROUP_CONCAT RESULT
When temporary tables is used for result sorting
result field for gconcat function is created using
group_concat_max_len size. It leads to result truncation
when character_set_results is multi-byte character set due
to insufficient tmp table field size.
The fix is to increase temporary table field size for
gconcat. Method make_string_field() is overloaded
for Item_func_group_concat class and uses
max_characters * collation.collation->mbmaxlen size for
result field. max_characters is maximum number of characters
what can fit into max_length size.


mysql-test/r/ctype_utf16.result:
  test result
mysql-test/r/ctype_utf32.result:
  test result
mysql-test/r/ctype_utf8.result:
  test result
mysql-test/t/ctype_utf16.test:
  test case
mysql-test/t/ctype_utf32.test:
  test case
mysql-test/t/ctype_utf8.test:
  test case
sql/item.h:
  make Item::make_string_field() virtual
sql/item_sum.cc:
  added Item_func_group_concat::make_string_field(TABLE *table) method
  which uses max_characters * collation.collation->mbmaxlen size for
  result item. max_characters is maximum number of characters what can
  fit into max_length size.
sql/item_sum.h:
  added Item_func_group_concat::make_string_field(TABLE *table) method
2011-10-12 17:41:25 +04:00
unknown
7d605ec45f Merge from mysql-5.5.14-release 2011-07-06 01:13:50 +02:00
Karen Langford
f6398a86dd Merge from mysql-5.1.58-release 2011-07-06 00:56:51 +02:00
Kent Boortz
027b5f1ed4 Updated/added copyright headers 2011-07-03 17:47:37 +02:00
Kent Boortz
02e07e3b51 Updated/added copyright headers 2011-06-30 17:46:53 +02:00
Georgi Kodinov
c4c808d606 weave merge of mysql-5.5->mysql-5.5-security 2011-05-10 17:20:26 +03:00
Georgi Kodinov
d706f1a768 weave merge of mysql-5.1->mysql-5.1-security 2011-05-10 16:57:40 +03:00
Tor Didriksen
6848f6c0d6 merge 5.1 => 5.5 : Bug#12329653 2011-05-05 08:13:22 +02:00
Tor Didriksen
e257fb3319 merge 5.0 => 5.1 : Bug#12329653 2011-05-04 17:12:45 +02:00
Tor Didriksen
1cf483aa58 Bug#12329653 - EXPLAIN, UNION, PREPARED STATEMENT, CRASH, SQL_FULL_GROUP_BY
The query was re-written *after* we had tagged it with NON_AGG_FIELD_USED.
Remove the flag before continuing.


mysql-test/r/explain.result:
  Update test case for Bug#48295.
mysql-test/r/subselect.result:
  New test case.
mysql-test/t/explain.test:
  Update test case for Bug#48295.
mysql-test/t/subselect.test:
  New test case.
sql/item.cc:
  Use accessor functions for non_agg_field_used/agg_func_used.
sql/item_subselect.cc:
  Remove non_agg_field_used when we rewrite query '1 < some (...)' => '1 < max(...)'
sql/item_sum.cc:
  Use accessor functions for non_agg_field_used/agg_func_used.
sql/mysql_priv.h:
  Remove unused #defines.
sql/sql_lex.cc:
  Initialize new member variables.
sql/sql_lex.h:
  Replace full_group_by_flag with two boolean flags,
  and itroduce accessors for manipulating them.
sql/sql_select.cc:
  Use accessor functions for non_agg_field_used/agg_func_used.
2011-05-04 16:18:21 +02:00
Sergey Glukhov
7fa7a0cad9 Bug#11766270 59343: YEAR(4): INCORRECT RESULT AND VALGRIND WARNINGS WITH MIN/MAX, UNION
When we create temporary result table for UNION
incorrect max_length for YEAR field is used and
it leads to incorrect field value and incorrect
result string length as YEAR field value calculation
depends on field length.
The fix is to use underlying item max_length for
Item_sum_hybrid::max_length intialization.


mysql-test/r/func_group.result:
  test case
mysql-test/t/func_group.test:
  test case
sql/field.cc:
  added assert
sql/item_sum.cc:
  init Item_sum_hybrid::max_length with 
  use underlying item max_length for
  INT result type.
2011-04-12 14:01:33 +04:00
Sergey Glukhov
bdefd2ad3b 5.1 -> 5.5 merge 2011-04-12 14:13:15 +04:00
Tor Didriksen
768c56e4d8 Bug #59686 crash in String::copy() with time data type
The problem was that Item_sum_hybrid::val_xxx() did not propagate null values
up the expression tree.


mysql-test/r/func_time.result:
  New test case.
mysql-test/t/func_time.test:
  New test case.
sql/item_sum.cc:
  Check for null_value when evaluating sub-items in sub-trees in Item_sum_hybrid::val_xxx()
2011-02-11 16:20:27 +01:00
Tor Didriksen
b503d77d5c Backport of fix for Bug#52123 2011-02-02 10:18:44 +01:00
Kent Boortz
be6c3fd8aa Merge 2010-12-29 01:26:31 +01:00
Kent Boortz
4acfdb9df1 Merge 2010-12-29 00:47:05 +01:00
Kent Boortz
85323eda8a - Added/updated copyright headers
- Removed files specific to compiling on OS/2
- Removed files specific to SCO Unix packaging
- Removed "libmysqld/copyright", text is included in documentation
- Removed LaTeX headers for NDB Doxygen documentation
- Removed obsolete NDB files
- Removed "mkisofs" binaries
- Removed the "cvs2cl.pl" script
- Changed a few GPL texts to use "program" instead of "library"
2010-12-28 19:57:23 +01:00
Sergey Glukhov
41f17a8707 5.1-bugteam->5.5-bugteam merge 2010-12-21 14:50:03 +03:00
Sergey Glukhov
e2db8e6ccb Bug#58030 crash in Item_func_geometry_from_text::val_str
Item_sum_max/Item_sum_min incorrectly set null_value flag and
attempt to get result in parent functions leads to crash.
This happens due to double evaluation of the function argumet.
First evaluation happens in the comparator and second one
happens in Item_cache::cache_value().
The fix is to introduce new Item_cache object which
holds result of the argument and use this cached value
as an argument of the comparator.

mysql-test/r/func_group.result:
  test case
mysql-test/t/func_group.test:
  test case
sql/item.cc:
  added assertion that ether we have some result or result is NULL.
sql/item_sum.cc:
  introduce new Item_cache object which
  holds result of the argument and use this cached value
  as an argument of the comparator.
sql/item_sum.h:
  introduce new Item_cache object which
  holds result of the argument and use this cached value
  as an argument of the comparator.
2010-12-21 14:34:11 +03:00
Gleb Shchepa
086130e3c0 backport of bug #54476 fix from 5.1-bugteam to 5.0-bugteam.
Original revid: alexey.kopytov@sun.com-20100723115254-jjwmhq97b9wl932l

 > Bug #54476: crash when group_concat and 'with rollup' in
 >                      prepared statements
 >
 > Using GROUP_CONCAT() together with the WITH ROLLUP modifier
 > could crash the server.
 >
 > The reason was a combination of several facts:
 >
 > 1. The Item_func_group_concat class stores pointers to ORDER
 > objects representing the columns in the ORDER BY clause of
 > GROUP_CONCAT().
 >
 > 2. find_order_in_list() called from
 > Item_func_group_concat::setup() modifies the ORDER objects so
 > that their 'item' member points to the arguments list
 > allocated in the Item_func_group_concat constructor.
 >
 > 3. In some cases (e.g. in JOIN::rollup_make_fields) a copy of
 > the original Item_func_group_concat object could be created by
 > using the Item_func_group_concat::Item_func_group_concat(THD
 > *thd, Item_func_group_concat *item) copy constructor. The
 > latter essentially creates a shallow copy of the source
 > object. Memory for the arguments array is allocated on
 > thd->mem_root, but the pointers for arguments and ORDER are
 > copied verbatim.
 >
 > What happens in the test case is that when executing the query
 > for the first time, after a copy of the original
 > Item_func_group_concat object has been created by
 > JOIN::rollup_make_fields(), find_order_in_list() is called for
 > this new object. It then resolves ORDER BY by modifying the
 > ORDER objects so that they point to elements of the arguments
 > array which is local to the cloned object. When thd->mem_root
 > is freed upon completing the execution, pointers in the ORDER
 > objects become invalid. Those ORDER objects, however, are also
 > shared with the original Item_func_group_concat object which is
 > preserved between executions of a prepared statement. So the
 > first call to find_order_in_list() for the original object on
 > the second execution tries to dereference an invalid pointer.
 >
 > The solution is to create copies of the ORDER objects when
 > copying Item_func_group_concat to not leave any stale pointers
 > in other instances with different lifecycles.


mysql-test/r/func_gconcat.result:
  Test case for bug #54476.
mysql-test/t/func_gconcat.test:
  Test case for bug #54476.
sql/item_sum.cc:
  Copy the ORDER objects pointed to by the elements of the
  'order' array in the copy constructor of
  Item_func_group_concat.
sql/table.h:
  Removed the unused 'item_copy' member of the ORDER class.
2010-12-14 23:52:53 +03:00
Sergey Glukhov
6330815a0c Bug#58396 group_concat and explain extended are still crashy
Explain fails at fix_fields stage and some items are left unfixed,
particulary Item_group_concat. Item_group_concat::orig_args field
is uninitialized in this case and Item_group_concat::print call 
leads to crash.
The fix:
move the initialization of Item_group_concat::orig_args
into constructor.


mysql-test/r/func_gconcat.result:
  test case
mysql-test/t/func_gconcat.test:
  test case
sql/item_sum.cc:
  move the initialization of Item_group_concat::orig_args
  into constructor.
2010-12-13 13:39:26 +03:00
Sergey Glukhov
8394b6a271 5.1-bugteam->5.5-bugteam merge 2010-12-13 13:48:16 +03:00
Georgi Kodinov
352ce1b596 Bug #57954: BIT_AND function returns incorrect results
when semijoin=on

When setting the aggregate function as having no rows to report
the function no_rows_in_result() was calling Item_sum::reset().
However this function in addition to cleaning up the aggregate 
value by calling aggregator_clear() was also adding the current
value to the aggregate value by calling aggregator_add().
Fixed by making no_rows_in_result() to call aggregator_clear()
directly.
Renamed Item_sum::reset to Item_sum::reset_and_add() to
and added a comment to avoid misinterpretation of what the
function does.
2010-12-08 14:28:06 +02:00
Guilhem Bichot
39b0af1e8c Fix for Bug#57932 "query with avg returns incorrect results":
when there was one NULL value, AVG(DISTINCT) could forget about other values.
See commit comment of item_sum.cc.

mysql-test/r/func_group.result:
  before the code fix, both SELECTs would return NULL
sql/item_sum.cc:
  Assume we are executing "SELECT AVG([DISTINCT] some_field) FROM some_table".
  and some_field is the single field of some_table for simplicity.
  Each time a row is processed (evaluate_join_record()->
  end_send_group()->update_sum_func()) an aggregator is notified,
  which itself notifies an Item_sum_avg.
  Without DISTINCT, this Item_sum_avg immediately increments its
  internal "sum of values" and "count of values" (the latter being
  Item_sum_avg::count). The count is incremented only if the row's value
  is not NULL (in Item_sum_avg::add()), per AVG() semantices. This row's value
  is available in args[0] of Item_sum_avg ("args[0]" stands for
  "the first argument of the item": it's an Item_field which automatically
  receives the row's value when a row is read from the table).
  bool Item_sum_avg::add()
  {
    if (Item_sum_sum::add()) << calculates the sum (ignores NULL)
      return TRUE;
    if (!args[0]->null_value)<<if added value is not NULL
      count++;       <<increment "count"
    return FALSE;
  }
  and everything works.
  With DISTINCT, when a row is processed by evaluate_join_record(),
  Item_sum_avg does no immediate computation, rather stores
  the row's value in a tree (to throw the value away if it is a duplicate
  of previous value, otherwise to remember all
  distinct values). It's only when it's time to send the average to the
  user (at end of the query:
  sub_select(end_of_records=true)->end_send_group()->
  select_send->send_data()->Protocol::send_result_set_row()->
  Item::send()->Item_sum_avg->val_str()), that we iterate over the tree,
  compute the sum and count: for this, for each element of the tree,
  Item_sum_avg::add() is called and has the same two steps as before:
  * Item_sum_sum::add() updates the sum (finding the tree element's value
  correctly, and determining correctly its NULLness - look for "arg_is_null"
  in that function)
  * the "if (!args[0]->null_value)" test right after, breaks: it uses args[0],
  which isn't the tree's element but rather the value for the last row
  processed by evaluate_join_record(). So if that last row was NULL,
  "count" stays 0 for each row, and AVG() then returns NULL (count==0 =>
  NULL, per AVG() semantics).
  The fix is to let the aggregator tell whether the value
  it just saw was NULL. The aggregator knows where to get the info
  thanks to virtual functions. Item_sum_sum::add() now asks
  the aggregator. Item_sum_avg() also asks the aggregator
  and then knows it shouldn't increment "count".
sql/item_sum.h:
  Aggregator can now tell about value/NULLness of just-aggregated value
2010-12-07 16:59:32 +01:00
Georgi Kodinov
6fe1b33f20 merge 2010-11-26 16:32:51 +02:00
Sergey Glukhov
c04bf683fe Bug#57194 group_concat cause crash and/or invalid memory reads with type errors
The problem is caused by bug49487 fix and became visible
after after bug56679 fix.
Items are cleaned up and set to unfixed state after filling derived table.
So we can not rely on item::fixed state in Item_func_group_concat::print
and we can not use 'args' array as items there may be cleaned up.
The fix is always to use orig_args array of items as it
always should contain the correct data.


mysql-test/r/func_gconcat.result:
  test case
mysql-test/t/func_gconcat.test:
  test case
sql/item_sum.cc:
  The fix is always to use orig_args array of items.
2010-10-29 11:44:32 +04:00
Alexey Kopytov
4124f1f467 Automerge. 2010-08-30 11:36:04 +04:00
Alexey Kopytov
d7d0f6390b Bug #54465: assert: field_types == 0 || field_types[field_pos]
== MYSQL_TYPE_LONGLONG

A MIN/MAX() function with a subquery as its argument could lead
to a debug assertion on debug builds or wrong data on release
ones.

The problem was a combination of the following factors:

- Item_sum_hybrid::fix_fields() might use the argument
(args[0]) to calculate 'hybrid_field_type' which was later used
to decide how the data should be sent to the client.

- Item_sum::make_field() might use the argument again to
calculate the field's type when sending result set metadata to
the client.

- The argument could be changed in between these two calls via
  Item::set_arg() leading to inconsistent metadata being
  reported.

Here is what was happening for the bug's test case:

1. Item_sum_hybrid::fix_fields() calculates hybrid_field_type
as MYSQL_TYPE_LONGLONG based on args[0] which is an
Item::SUBSELECT_ITEM at that time.

2. A temporary table is created to execute the
query. create_tmp_field_from_item() creates a Field_long object
according to the subselect's max_length.

3. The subselect item in Item_sum_hybrid is replaced by the
Item_field object referencing the newly created Field_long.

4. Item_sum::make_field() rightfully returns the
MYSQL_TYPE_LONG type when calculating the result set metadata.

5. When sending the actual data, Item::send() relies on the
virtual field_type() function which in our case returns
previously calculated hybrid_field_type == MYSQL_TYPE_LONGLONG.

It looks like the only solution is to never refer to the
argument's metadata after the result metadata has been
calculated in fix_fields(), since the argument itself may be
different by then. In this sense, Item_sum::make_field() should
never be used, because it may rely on the argument's metadata
and is only called after fix_fields(). The "default"
implementation in Item::make_field() should be used instead as
it relies only on field_type(), but not on the argument's type.

Fixed by removing Item_sum::make_field() so that the superclass
implementation Item::make_field() is always used.

mysql-test/r/func_group.result:
  Added a test case for bug #54465.
mysql-test/t/func_group.test:
  Added a test case for bug #54465.
sql/item_sum.cc:
  Removed Item_sum::make_field() so that the superclass
  implementation Item::make_field() is always used.
sql/item_sum.h:
  Removed Item_sum::make_field() so that the superclass
  implementation Item::make_field() is always used.
2010-08-27 13:44:35 +04:00
Georgi Kodinov
c9d20d6c08 merge 2010-08-20 14:22:46 +03:00
Georgi Kodinov
7d3a9b4cf6 merge 2010-08-20 12:09:17 +03:00
Georgi Kodinov
612f449598 merge 2010-08-17 15:12:52 +03:00
Georgi Kodinov
790852c0c9 Bug #55580 : segfault in read_view_sees_trx_id
The server was not checking for errors generated during
the execution of Item::val_xxx() methods when copying
data to the group, order, or distinct temp table's row.
Fixed by extending the copy_funcs() to return an error
code and by checking for that error code on the places
copy_funcs() is called. 
Test case added.
2010-08-13 11:07:39 +03:00
Alexey Kopytov
1837dcfee7 Bug #54476: crash when group_concat and 'with rollup' in
prepared statements

Using GROUP_CONCAT() together with the WITH ROLLUP modifier
could crash the server.

The reason was a combination of several facts:

1. The Item_func_group_concat class stores pointers to ORDER
objects representing the columns in the ORDER BY clause of
GROUP_CONCAT().

2. find_order_in_list() called from
Item_func_group_concat::setup() modifies the ORDER objects so
that their 'item' member points to the arguments list
allocated in the Item_func_group_concat constructor.

3. In some cases (e.g. in JOIN::rollup_make_fields) a copy of
the original Item_func_group_concat object could be created by
using the Item_func_group_concat::Item_func_group_concat(THD
*thd, Item_func_group_concat *item) copy constructor. The
latter essentially creates a shallow copy of the source
object. Memory for the arguments array is allocated on
thd->mem_root, but the pointers for arguments and ORDER are
copied verbatim.

What happens in the test case is that when executing the query
for the first time, after a copy of the original
Item_func_group_concat object has been created by
JOIN::rollup_make_fields(), find_order_in_list() is called for
this new object. It then resolves ORDER BY by modifying the
ORDER objects so that they point to elements of the arguments
array which is local to the cloned object. When thd->mem_root
is freed upon completing the execution, pointers in the ORDER
objects become invalid. Those ORDER objects, however, are also
shared with the original Item_func_group_concat object which is
preserved between executions of a prepared statement. So the
first call to find_order_in_list() for the original object on
the second execution tries to dereference an invalid pointer.

The solution is to create copies of the ORDER objects when
copying Item_func_group_concat to not leave any stale pointers
in other instances with different lifecycles.



mysql-test/r/func_gconcat.result:
  Test case for bug #54476.
mysql-test/t/func_gconcat.test:
  Test case for bug #54476.
sql/item_sum.cc:
  Copy the ORDER objects pointed to by the elements of the 
  'order' array in the copy constructor of 
  Item_func_group_concat.
sql/table.h:
  Removed the unused 'item_copy' member of the ORDER class.
2010-07-23 15:52:54 +04:00
Evgeny Potemkin
4777370bb3 Bug#49771: Incorrect MIN/MAX for date/time values.
This bug is a design flaw of the fix for the bug#33546. It assumed that an
item can be used only in one comparison context, but actually it isn't the
case. Item_cache_datetime is used to store result for MIX/MAX aggregate
functions. Because Arg_comparator always compares datetime values as INTs when
possible the Item_cache_datetime most time caches only INT value. But
since all datetime values has STRING result type MIN/MAX functions are asked
for a STRING value when the result is being sent to a client. The
Item_cache_datetime was designed to avoid conversions and get INT/STRING
values from an underlying item, but at the moment the values is asked
underlying item doesn't hold it anymore thus wrong result is returned.
Beside that MIN/MAX aggregate functions was wrongly initializing cached result
and this led to a wrong result.

The Item::has_compatible_context helper function is added. It checks whether
this and given items has the same comparison context or can be compared as
DATETIME values by Arg_comparator. The equality propagation optimization is
adjusted to take into account that items which being compared as DATETIME
can have different comparison contexts.
The Item_cache_datetime now converts cached INT value to a correct STRING
DATETIME value by means of number_to_datetime & my_TIME_to_str functions.
The Arg_comparator::set_cmp_context_for_datetime helper function is added. 
It sets comparison context of items being compared as DATETIMEs to INT if
items will be compared as longlong.
The Item_sum_hybrid::setup function now correctly initializes its result
value.
In order to avoid unnecessary conversions Item_sum_hybrid now states that it
can provide correct longlong value if the item being aggregated can do it
too.

mysql-test/r/group_by.result:
  Added a test case for the bug#49771.
sql/item.cc:
  Bug#49771: Incorrect MIN/MAX for date/time values.
  The equality propagation mechanism is adjusted to take into account that
  items which being compared as DATETIME can have different comparison
  contexts.
  The Item_cache_datetime now converts cached INT value to a correct STRING
  DATETIME/TIME value.
sql/item.h:
  Bug#49771: Incorrect MIN/MAX for date/time values.
  The Item::has_compatible_context helper function is added. It checks whether
  this and given items has the same comparison context or can be compared as
  DATETIME values by Arg_comparator.
  Added Item_cache::clear helper function.
sql/item_cmpfunc.cc:
  Bug#49771: Incorrect MIN/MAX for date/time values.
  The Arg_comparator::set_cmp_func now sets the correct comparison context
  for items being compared as DATETIME values.
sql/item_cmpfunc.h:
  Bug#49771: Incorrect MIN/MAX for date/time values.
  The Arg_comparator::set_cmp_context_for_datetime helper function is added. 
  It sets comparison context of items being compared as DATETIMEs to INT if
  items will be compared as longlong.
sql/item_sum.cc:
  Bug#49771: Incorrect MIN/MAX for date/time values.
  The Item_sum_hybrid::setup function now correctly initializes its result
  value.
sql/item_sum.h:
  Bug#49771: Incorrect MIN/MAX for date/time values.
  In order to avoid unnecessary conversions Item_sum_hybrid now states that it
  can provide correct longlong value if the item being aggregated can do it
  too.
2010-07-19 21:11:47 +04:00
Davi Arnaut
db2fe44c84 Merge of mysql-5.1-bugteam into mysql-trunk-merge. 2010-06-10 22:30:49 -03:00
Davi Arnaut
0f9ddfa9d8 Bug#42733: Type-punning warnings when compiling MySQL --
strict aliasing violations.

One somewhat major source of strict-aliasing violations and
related warnings is the SQL_LIST structure. For example,
consider its member function `link_in_list` which takes
a pointer to pointer of type T (any type) as a pointer to
pointer to unsigned char. Dereferencing this pointer, which
is done to reset the next field, violates strict-aliasing
rules and might cause problems for surrounding code that
uses the next field of the object being added to the list.

The solution is to use templates to parametrize the SQL_LIST
structure in order to deference the pointers with compatible
types. As a side bonus, it becomes possible to remove quite
a few casts related to acessing data members of SQL_LIST.

sql/handler.h:
  Use the appropriate template type argument.
sql/item.cc:
  Remove now-unnecessary cast.
sql/item_subselect.cc:
  Remove now-unnecessary casts.
sql/item_sum.cc:
  Use the appropriate template type argument.
  Remove now-unnecessary cast.
sql/mysql_priv.h:
  Move SQL_LIST structure to sql_list.h
  Use the appropriate template type argument.
sql/sp.cc:
  Remove now-unnecessary casts.
sql/sql_delete.cc:
  Use the appropriate template type argument.
  Remove now-unnecessary casts.
sql/sql_derived.cc:
  Remove now-unnecessary casts.
sql/sql_lex.cc:
  Remove now-unnecessary casts.
sql/sql_lex.h:
  SQL_LIST now takes a template type argument which must
  match the type of the elements of the list. Use forward
  declaration when the type is not available, it is used
  in pointers anyway.
sql/sql_list.h:
  Rename SQL_LIST to SQL_I_List. The template parameter is
  the type of object that is stored in the list.
sql/sql_olap.cc:
  Remove now-unnecessary casts.
sql/sql_parse.cc:
  Remove now-unnecessary casts.
sql/sql_prepare.cc:
  Remove now-unnecessary casts.
sql/sql_select.cc:
  Remove now-unnecessary casts.
sql/sql_show.cc:
  Remove now-unnecessary casts.
sql/sql_table.cc:
  Remove now-unnecessary casts.
sql/sql_trigger.cc:
  Remove now-unnecessary casts.
sql/sql_union.cc:
  Remove now-unnecessary casts.
sql/sql_update.cc:
  Remove now-unnecessary casts.
sql/sql_view.cc:
  Remove now-unnecessary casts.
sql/sql_yacc.yy:
  Remove now-unnecessary casts.
storage/myisammrg/ha_myisammrg.cc:
  Remove now-unnecessary casts.
2010-06-10 17:45:22 -03:00
Davi Arnaut
a8c288054e Bug#53445: Build with -Wall and fix warnings that it generates
Fix various mismatches between function's language linkage. Any
particular function that is declared in C++ but should be callable
from C must have C linkage. Note that function types with different
linkages are also distinct. Thus, if a function type is declared in
C code, it will have C linkage (same if declared in a extern "C"
block).

client/mysql.cc:
  Mismatch between prototype and declaration.
client/mysqltest.cc:
  mysqltest used to be C code. Use C linkage where appropriate.
cmd-line-utils/readline/input.c:
  Isolate unreachable code.
include/my_alloc.h:
  Function type must have C linkage.
include/my_base.h:
  Function type must have C linkage.
include/my_global.h:
  Add helper macros to avoid spurious namespace indentation.
include/mysql.h.pp:
  Update ABI file.
mysys/my_gethwaddr.c:
  Remove stray carriage return and fix coding style.
plugin/semisync/semisync_master_plugin.cc:
  Callback function types have C linkage.
plugin/semisync/semisync_slave_plugin.cc:
  Callback function types have C linkage.
sql/derror.cc:
  Expected function type has C linkage.
sql/field.cc:
  Use helper macro and fix indentation.
sql/handler.cc:
  Expected function type has C linkage.
sql/item_sum.cc:
  Correct function linkages. Remove now unnecessary cast.
sql/item_sum.h:
  Add prototypes with the appropriate linkage as otherwise they
  are distinct.
sql/mysqld.cc:
  Wrap functions in C linkage mode.
sql/opt_range.cc:
  C language linkage is ignored for class member functions.
sql/partition_info.cc:
  Add wrapper functions with C linkage for class member functions.
sql/rpl_utility.h:
  Use helper macro and fix indentation.
sql/sql_class.cc:
  Change type of thd argument -- THD is a class.
  Use helper macro and fix indentation.
sql/sql_class.h:
  Change type of thd argument -- THD is a class.
sql/sql_select.cc:
  Expected function type has C linkage.
sql/sql_select.h:
  Move prototype to sql_test.h
sql/sql_show.cc:
  Expected function type has C linkage.
sql/sql_test.cc:
  Fix required function prototype and fix coding style.
sql/sql_test.h:
  Removed unnecessary export and add another.
storage/myisammrg/ha_myisammrg.cc:
  Expected function type has C linkage.
storage/perfschema/pfs.cc:
  PSI headers are declared with C language linkage, which also
  applies to function types.
2010-05-31 12:29:54 -03:00
Alexey Kopytov
fa3b2dcb83 Manual merge of mysql-5.1-bugteam to
mysql-trunk-merge.

Conflicts:

Text conflict in sql/sql_priv.h
2010-04-19 16:09:44 +04:00