> ------------------------------------------------------------
> revno: 2818.1.26
> revision-id: joro@sun.com-20091109140946-07wao5od7l1vn4x1
> parent: joro@sun.com-20091110082141-ldr8p6s1joczve2j
> committer: Georgi Kodinov <joro@sun.com>
> branch nick: B48458-5.0-bugteam
> timestamp: Mon 2009-11-09 16:09:46 +0200
> message:
> Bug #48458: simple query tries to allocate enormous amount of
> memory
>
> The server was doing a bad class typecast causing setting of
> wrong value for the maximum number of items in an internal
> structure used in equality propagation.
> Fixed by not doing the wrong typecast and asserting the type
> of the Item where it should be done.
> ------------------------------------------------------------
> revno: 2818.1.18
> revision-id: li-bing.song@sun.com-20091103090041-zj7nedx6ok5jgges
> parent: davi.arnaut@sun.com-20091102201021-1brn7cjb1kvqg9gr
> committer: <Li-Bing.Song@sun.com>
> branch nick: mysql-5.0-bugteam
> timestamp: Tue 2009-11-03 17:00:41 +0800
> message:
> BUG#48216 Replication fails on all slaves after upgrade to 5.0.86 on master
>
> When a sessione is closed, all temporary tables of the session are automatically
> dropped and are binlogged. But it will be binlogged with wrong database names when
> the length of the temporary tables' database names are greater than the
> length of the current database name or the current database is not set.
>
> Query_log_event's db_len is forgot to set when Query_log_event's db is set.
> This patch wrote code to set db_len immediately after db has set.
> ------------------------------------------------------------
> revno: 2818.4.1
> revision-id: alexey.kopytov@sun.com-20091030155453-0vlfwki805h9os62
> parent: joerg@mysql.com-20091016122941-rf6z0keqvmlgjfto
> committer: Alexey Kopytov <Alexey.Kopytov@Sun.com>
> branch nick: my50-bug48131
> timestamp: Fri 2009-10-30 18:54:53 +0300
> message:
> Bug #48131: crash group by with rollup, distinct, filesort,
> with temporary tables
>
> There were two problems the test case from this bug was
> triggering:
>
> 1. JOIN::rollup_init() was supposed to wrap all constant Items
> into another object for queries with the WITH ROLLUP modifier
> to ensure they are never considered as constants and therefore
> are written into temporary tables if the optimizer chooses to
> employ them for DISTINCT/GROUP BY handling.
>
> However, JOIN::rollup_init() was called before
> make_join_statistics(), so Items corresponding to fields in
> const tables could not be handled as intended, which was
> causing all kinds of problems later in the query execution. In
> particular, create_tmp_table() assumed all constant items
> except "hidden" ones to be removed earlier by remove_const()
> which led to improperly initialized Field objects for the
> temporary table being created. This is what was causing crashes
> and valgrind errors in storage engines.
>
> 2. Even when the above problem had been fixed, the query from
> the test case produced incorrect results due to some
> DISTINCT/GROUP BY optimizations being performed by the
> optimizer that are inapplicable in the WITH ROLLUP case.
>
> Fixed by disabling inapplicable DISTINCT/GROUP BY optimizations
> when the WITH ROLLUP modifier is present, and splitting the
> const-wrapping part of JOIN::rollup_init() into a separate
> method which is now invoked after make_join_statistics() when
> the const tables are already known.
> ------------------------------------------------------------
> revno: 2818.1.13
> revision-id: joro@sun.com-20091030131543-2b23fnqckgbzvete
> parent: joro@sun.com-20091030094044-quadg0bwjy7cwqzw
> committer: Georgi Kodinov <joro@sun.com>
> branch nick: B48291-5.0-bugteam
> timestamp: Fri 2009-10-30 15:15:43 +0200
> message:
> Bug #48291 : crash with row() operator,select into @var, and
> subquery returning multiple rows
>
> Error handling was missing when handling subqueires in WHERE
> and when assigning a SELECT result to a @variable.
> This caused crash(es).
>
> Fixed by adding error handling code to both the WHERE
> condition evaluation and to assignment to an @variable.
> ------------------------------------------------------------
> revno: 2818.1.12
> revision-id: joro@sun.com-20091030094044-quadg0bwjy7cwqzw
> parent: joro@sun.com-20091029152429-ks55fhrp4lhknyij
> committer: Georgi Kodinov <joro@sun.com>
> branch nick: B48293-5.0-bugteam
> timestamp: Fri 2009-10-30 11:40:44 +0200
> message:
> Bug #48293: crash with procedure analyse, view with > 10 columns,
> having clause...
>
> The fix for bug 46184 was not very complete. It was not covering
> views using temporary tables and multiple tables in a FROM clause.
> Fixed by reverting the fix for 46184 and making a more general
> check that is checking at the right execution stage and for all
> of the non-supported cases.
> Now PROCEDURE ANALYZE on non-top level SELECT is also forbidden.
> Updated the analyse.test and subselect.test accordingly.
> ------------------------------------------------------------
> revno: 2818.1.6
> revision-id: joro@sun.com-20091021084345-iki6z0uceieoupey
> parent: ramil@mysql.com-20091023112648-gie6o3odj57cxh1e
> committer: Georgi Kodinov <joro@sun.com>
> branch nick: B47780-5.0-bugteam
> timestamp: Wed 2009-10-21 11:43:45 +0300
> message:
> Bug #47780: crash when comparing GIS items from subquery
>
> If the first argument to GeomFromWKB function is a geometry
> field then the function just returns its value.
> However in doing so it's not preserving first argument's
> null_value flag and this causes unexpected null value to
> be returned to the calling function.
>
> Fixed by updating the null_value of the GeomFromWKB function
> in such cases (and all other cases that return a NULL e.g.
> because of not enough memory for the return buffer).
> ------------------------------------------------------------
> revno: 2818.1.5
> revision-id: ramil@mysql.com-20091023112648-gie6o3odj57cxh1e
> parent: ramil@mysql.com-20091021090408-208mvwwrcroi2j8c
> committer: Ramil Kalimullin <ramil@mysql.com>
> branch nick: b48258-5.0-bugteam
> timestamp: Fri 2009-10-23 16:26:48 +0500
> message:
> Fix for bug#48258: Assertion failed when using a spatial index
>
> Problem: involving a spatial index for "non-spatial" queries
> (that don't containt MBRXXX() functions) may lead to failed assert.
>
> Fix: don't use spatial indexes in such cases.
> ------------------------------------------------------------
> revno: 2818.1.4
> revision-id: ramil@mysql.com-20091021090408-208mvwwrcroi2j8c
> parent: azundris@mysql.com-20091021033856-ydodp4q42o58e7ka
> committer: Ramil Kalimullin <ramil@mysql.com>
> branch nick: b47019-5.0-bugteam
> timestamp: Wed 2009-10-21 14:04:08 +0500
> message:
> Fix for bug#47019: Assertion failed: 0, file .\rt_mbr.c,
> line 138 when forcing a spatial index
>
> Problem: "Spatial indexes can be involved in the search
> for queries that use a function such as MBRContains()
> or MBRWithin() in the WHERE clause".
> Using spatial indexes for JOINs with =, <=> etc.
> predicates is incorrect.
>
> Fix: disable spatial indexes for such queries.
On Mac OS X or Windows, sending a SIGHUP to the server or a
asynchronous flush (triggered by flush_time), would cause the
server to crash.
The problem was that a hook used to detach client API handles
wasn't prepared to handle cases where the thread does not have
a associated session.
The solution is to verify whether the thread has a associated
session before trying to detach a handle.
mysql-test/r/federated_debug.result:
Add test case result for Bug#47525
mysql-test/t/federated_debug-master.opt:
Debug point.
mysql-test/t/federated_debug.test:
Add test case for Bug#47525
sql/slave.cc:
Check whether a the thread has a associated session.
sql/sql_parse.cc:
Add debug code to simulate a reload without thread session.
The 'BEGIN/COMMIT/ROLLBACK' log event could be filtered out if the
database is not selected by --database option of mysqlbinlog command.
This can result in problem if there are some statements in the
transaction are not filtered out.
To fix the problem, mysqlbinlog will output 'BEGIN/ROLLBACK/COMMIT'
in regardless of the database filtering rules.
client/mysqlbinlog.cc:
Skip the database check for BEGIN/COMMIT/ROLLBACK log events.
mysql-test/r/mysqlbinlog.result:
Test result for bug#46998
mysql-test/t/mysqlbinlog.test:
Added test to verify if the 'BEGIN', 'COMMIT' and 'ROLLBACK' are output
in regardless of database filtering
query
The fix for bug 46749 removed the check for OUTER_REF_TABLE_BIT
and substituted it for a check on the presence of
Item_ident::depended_from.
Removing it altogether was wrong : OUTER_REF_TABLE_BIT should
still be checked in addition to depended_from (because it's not
set in all cases and doesn't contradict to the check of depended_from).
Fixed by returning the old condition back as a compliment to the
new one.
The problem is that argument buffer can be used as result buffer
and it leads to argument value change.
The fix is to use 'old buffer' as result buffer only
if first argument is not constant item.
mysql-test/r/func_str.result:
test result
mysql-test/t/func_str.test:
test case
sql/item_strfunc.cc:
The problem is that argument buffer can be used as result buffer
and it leads to argument value change.
The fix is to use 'old buffer' as result buffer only
if first argument is not constant item.
function,file sql_base.cc
When uncacheable queries are written to a temp table the optimizer must
preserve the original JOIN structure, because it is re-using the JOIN
structure to read from the resulting temporary table.
This was done only for uncacheable sub-queries.
But top level queries can also benefit from this mechanism, specially if
they're using index access and need a reset.
Fixed by not limiting the saving of JOIN structure to subqueries
exclusively.
Added a new test file to extend the existing (large) subquery.test.
Memory allocated in TMP_TABLE_PARAM::copy_field is not cleaned up.
The fix is to clean up TMP_TABLE_PARAM::copy_field array in JOIN::destroy.
mysql-test/r/explain.result:
test result
mysql-test/t/explain.test:
test case
sql/sql_select.cc:
Memory allocated in TMP_TABLE_PARAM::copy_field is not cleaned up.
The fix is to clean up TMP_TABLE_PARAM::copy_field array in JOIN::destroy.
name as existing view
When trying to create a table with the same name as existing view with
join, mysql server crashes.
The problem is when create table is issued with the same name as view, while
verifying with the existing tables, we assume that base table object is
created always.
In this case, since it is a view over multiple tables, we don't have the
mysql derived table object.
Fixed the logic which checks if there is an existing table to not to assume
that table object is created when the base table is view over multiple
tables.
mysql-test/r/create.result:
BUG#46384 - mysqld segfault when trying to create table with same
name as existing view
Testcase for the bug
mysql-test/t/create.test:
BUG#46384 - mysqld segfault when trying to create table with same
name as existing view
Testcase for the bug
sql/sql_insert.cc:
BUG#46384 - mysqld segfault when trying to create table with same
name as existing view
Fixed create_table_from_items() method to properly check, if the base table
is a view over multiple tables.
field references
This error requires a combination of factors :
1. An "impossible where" in the outermost SELECT
2. An aggregate in the outermost SELECT
3. A correlated subquery with a WHERE clause that includes an outer
field reference as a top level WHERE sargable predicate
When JOIN::optimize detects an "impossible WHERE" it will bail out
without doing the rest of the work and initializations. It will not
call make_join_statistics() as well. And make_join_statistics fills
in various structures for each table referenced.
When processing the result of the "impossible WHERE" the query must
send a single row of data if there are aggregate functions in it.
In this case the server marks all the aggregates as having received
no rows and calls the relevant Item::val_xxx() method on the SELECT
list. However if this SELECT list happens to contain a correlated
subquery this subquery is evaluated in a normal evaluation mode.
And if this correlated subquery has a reference to a field from the
outermost "impossible where" SELECT the add_key_fields will mistakenly
consider the outer field reference as a "local" field reference when
looking for sargable predicates.
But since the SELECT where the outer field reference refers to is not
completely initialized due to the "impossible WHERE" in this level
we'll get a NULL pointer reference.
Fixed by making a better condition for discovering if a field is "local"
to the SELECT level being processed.
It's not enough to look for OUTER_REF_TABLE_BIT in this case since
for outer references to constant tables the Item_field::used_tables()
will return 0 regardless of whether the field reference is from the
local SELECT or not.
When a connection is dropped any remaining temporary table is also automatically
dropped and the SQL statement of this operation is written to the binary log in
order to drop such tables on the slave and keep the slave in sync. Specifically,
the current code base creates the following type of statement:
DROP /*!40005 TEMPORARY */ TABLE IF EXISTS `db`.`table`;
Unfortunately, appending the database to the table name in this manner circumvents
the replicate-rewrite-db option (and any options that check the current database).
To solve the issue, we started writing the statement to the binary as follows:
use `db`; DROP /*!40005 TEMPORARY */ TABLE IF EXISTS `table`;
The crash happens because select_union object is used as result set
for queries which have derived tables.
select_union use temporary table as data storage and if
fields count exceeds 10(count of values for procedure ANALYSE())
then we get a crash on fill_record() function.
mysql-test/r/analyse.result:
test result
mysql-test/r/subselect.result:
result fix
mysql-test/t/analyse.test:
test case
mysql-test/t/subselect.test:
test fix
sql/sql_yacc.yy:
The crash happens because select_union object is used as result set
for queries which have derived tables.
select_union use temporary table as data storage and if
fields count exceeds 10(count of values for procedure ANALYSE())
then we get a crash on fill_record() function.
view manipulations
The bespoke flag was not properly reset after last call to
fill_record. Fixed by resetting in caller mysql_update.
mysql-test/r/auto_increment.result:
Bug#46616: Test result.
mysql-test/t/auto_increment.test:
Bug#46616: Test case.
sql/sql_update.cc:
Bug#46616: Fix.
view that has Group By
Table access rights checking function check_grant() assumed
that no view is opened when it's called.
This is not true with nested views where the inner view
needs materialization. In this case the view is already
materialized when check_grant() is called for it.
This caused check_grant() to not look for table level
grants on the materialized view table.
Fixed by checking if a view is already materialized and if
it is check table level grants using the original table name
(not the ones of the materialized temp table).
Replication SQL thread does not set database default charset to
thd->variables.collation_database properly, when executing LOAD DATA binlog.
This bug can be repeated by using "LOAD DATA" command in STATEMENT mode.
This patch adds code to find the default character set of the current database
then assign it to thd->db_charset when slave server begins to execute a relay log.
The test of this bug is added into rpl_loaddata_charset.test
The test for the 45806 entry in our bug DB got applied twice,
in different places for the "view.test" and "view.result" files.
The fix is to simply remove the erroneous insertion.
The problem is that the lexer could inadvertently skip over the
end of a query being parsed if it encountered a malformed multibyte
character. A specially crated query string could cause the lexer
to jump up to six bytes past the end of the query buffer. Another
problem was that the laxer could use unfiltered user input as
a signed array index for the parser maps (having upper and lower
bounds 0 and 256 respectively).
The solution is to ensure that the lexer only skips over well-formed
multibyte characters and that the index value of the parser maps
is always a unsigned value.
mysql-test/r/ctype_recoding.result:
Update test case result: ending backtick is not skipped over anymore.
sql/sql_lex.cc:
Characters being analyzed must be unsigned as they can be
used as indexes for the parser maps. Only skip over if the
string is a valid multi-byte sequence.
tests/mysql_client_test.c:
Add test case for Bug#45010
The test case fails sporadically on Windows while trying to overwrite an unused
binary log. The problem stems from the fact that MySQL on Windows does not
immediately unlock/release a file while the process that opened and closed it is
still running. In BUG 38603, this issue was circumvented by stopping the MySQL
process, copying the file and then restarting the MySQL process.
Unfortunately, such facilities are not available in the 5.0. Other approaches
such as stopping the slave and issuing change master do not work because the relay
log file and index are not closed when a slave is stopped. So to fix the problem,
we simply don't run on windows the part of the test that was failing.
In create_myisam_from_heap() mark all errors as fatal except
HA_ERR_RECORD_FILE_FULL for a HEAP table.
Not doing so could lead to problems, e.g. in a case when a
temporary MyISAM table gets overrun due to its MAX_ROWS limit
while executing INSERT/REPLACE IGNORE ... SELECT.
The SELECT execution was aborted, but the error was
converted to a warning due to IGNORE clause, so neither 'ok'
nor 'error' packet could be sent back to the client. This
condition led to hanging client when using 5.0 server, or
assertion failure in 5.1.
mysql-test/r/insert_select.result:
Added a test case for bug #46075.
mysql-test/t/insert_select.test:
Added a test case for bug #46075.
sql/sql_select.cc:
In create_myisam_from_heap() mark all errors as fatal except
HA_ERR_RECORD_FILE_FULL for a HEAP table.
> ------------------------------------------------------------
> revno: 2792
> revision-id: sergey.glukhov@sun.com-20090703083500-jq8vhw0tqr37j7te
> parent: bernt.johnsen@sun.com-20090703083610-o7l4s8syz05rc4w0
> committer: Sergey Glukhov <Sergey.Glukhov@sun.com>
> branch nick: mysql-5.0-bugteam
> timestamp: Fri 2009-07-03 13:35:00 +0500
> message:
> Bug#45806 crash when replacing into a view with a join!
> The crash happend because for views which are joins
> we have table_list->table == 0 and
> table_list->table->'any method' call leads to crash.
> The fix is to perform table_list->table->file->extra()
> method for all tables belonging to view.
> ------------------------------------------------------------
> revno: 2772
> revision-id: joro@sun.com-20090615133815-eb007p5793in33p5
> parent: joro@sun.com-20090612140659-4hj1tta9p8wvcw4k
> committer: Georgi Kodinov <joro@sun.com>
> branch nick: B44810-5.0-bugteam
> timestamp: Mon 2009-06-15 16:38:15 +0300
> message:
> Bug #44810: index merge and order by with low sort_buffer_size
> crashes server!
>
> The problem affects the scenario when index merge is followed by a filesort
> and the sort buffer is not big enough for all the sort keys.
> In this case the filesort function will read the data to the end through the
> index merge quick access method (and thus closing the cursor etc),
> but will leave the pointer to the quick select method in place.
> It will then create a temporary file to hold the results of the filesort and
> will add it as a sort output file (in sort.io_cache).
> Note that filesort will copy the original 'sort' structure in an automatic
> variable and restore it after it's done.
> As a result at exiting filesort() we have a sort.io_cache filled in and
> nothing else (as a result of close of the cursors at end of reading data
> through index merge).
> Now create_sort_index() will note that there is a select and will clean it up
> (as it's been used already by filesort() reading the data in). While doing that
> a special case in the index merge destructor will clean up the sort.io_cache,
> assuming it's an output of the index merge method and is not needed anymore.
> As a result the code that tries to read the data back from the filesort output
> will get no data in both memory and disk and will crash.
>
> Fixed similarly to how filesort() does it : by copying the sort.io_cache structure
> to a local variable, removing the pointer to the io_cache (so that it's not freed
> by QUICK_INDEX_MERGE_SELECT::~QUICK_INDEX_MERGE_SELECT) and restoring the original
> structure (together with the valid pointer) after the cleanup is done.
> This is a safe thing to do because all the structures are already cleaned up by
> hitting the end of the index merge's read method (QUICK_INDEX_MERGE_SELECT::get_next())
> and the cleanup code being written in a way that tolerates repeating cleanups.
> ------------------------------------------------------------
> revno: 2763
> revision-id: sergey.glukhov@sun.com-20090602063813-33mh88cz5vpa2jqe
> parent: alexey.kopytov@sun.com-20090601124224-zgt3yov9wou590e9
> committer: Sergey Glukhov <Sergey.Glukhov@sun.com>
> branch nick: mysql-5.0-bugteam
> timestamp: Tue 2009-06-02 11:38:13 +0500
> message:
> Bug#45152 crash with round() function on longtext column in a derived table
> The crash happens due to wrong max_length value which is set on
> Item_func_round::fix_length_and_dec() stage. The value is set to
> args[0]->max_length which is too big in case of LONGTEXT(LONGBLOB) fields.
> The fix is to set max_length using float_length() function.
> ------------------------------------------------------------
> revno: 2733
> revision-id: gshchepa@mysql.com-20090430192037-9p1etcynkglte2j3
> parent: aelkin@mysql.com-20090430143246-zfqaz0t7uoluzdz2
> committer: Gleb Shchepa <gshchepa@mysql.com>
> branch nick: mysql-5.0-bugteam
> timestamp: Fri 2009-05-01 00:20:37 +0500
> message:
> Bug #37362: Crash in do_field_eq
>
> EXPLAIN EXTENDED of nested query containing a error:
>
> 1054 Unknown column '...' in 'field list'
>
> may cause a server crash.
>
>
> Parse error like described above forces a call to
> JOIN::destroy() on malformed subquery.
> That JOIN::destroy function closes and frees temporary
> tables. However, temporary fields of these tables
> may be listed in st_select_lex::group_list of outer
> query, and that st_select_lex may not cleanup them
> properly. So, after the JOIN::destroy call that
> st_select_lex::group_list may have Item_field
> objects with dangling pointers to freed temporary
> table Field objects. That caused a crash.
When during the optimization an item is moved to the upper select
the item's context left unchanged. This caused wrong result in the
PS/SP mode.
The Item_ident::remove_dependence_processor now sets the context
of the select to which the item is moved to.
mysql-test/r/subselect.result:
The test case for the bug#46051 is adjusted.
mysql-test/t/subselect.test:
The test case for the bug#46051 is adjusted.
sql/item.cc:
Bug#46051: Incorrectly market field caused wrong result.
The Item_ident::remove_dependence_processor now sets the context
of the select to which the item is moved to.
In a subselect all fields from outer selects are marked as dependent on
selects they are belong to. In some cases optimizer substitutes it for an
equivalent expression. For example "a_field IN (SELECT outer_field)" is
substituted with "a_field = outer_field". As we moved the outer_field to the
upper select it's not really outer anymore. But it was left marked as outer.
If exists an index over a_field optimizer choose wrong execution plan and thus
return wrong result.
Now the Item_in_subselect::single_value_transformer function removes dependent
marking from fields when a subselect is optimized away.
mysql-test/r/subselect.result:
Added a test case for the bug#46051.
mysql-test/t/subselect.test:
Added a test case for the bug#46051.
sql/item_subselect.cc:
Bug#46051: Incorrectly market field caused wrong result.
Now the Item_in_subselect::single_value_transformer function removes dependent
marking from fields when a subselect is optimized away.
sort_buffer_size cannot allocate
The NULL return from tree_insert() (on low memory) was not
checked for in Item_func_group_concat::add(). As a result
on low memory conditions a crash happens.
Fixed by properly checking the return code.
match against.
Server crashes when executing prepared statement with duplicating
MATCH() function calls in SELECT and ORDER BY expressions, e.g.:
SELECT MATCH(a) AGAINST('test') FROM t1 ORDER BY MATCH(a) AGAINST('test')
This query gets optimized by the server, so the value returned
by MATCH() from the SELECT list is reused for ORDER BY purposes.
To make this optimization server is comparing items from
SELECT and ORDER BY lists. We were getting server crash because
comparision function for MATCH() item is not intended to be called
at this point of execution.
In 5.0 and 5.1 this problem is workarounded by resetting MATCH()
item to the state as it was during PREPARE.
In 6.0 correct comparision function will be implemented and
duplicating MATCH() items from the ORDER BY list will be
optimized.
mysql-test/r/fulltext.result:
Updated with the test case for Bug#37740
mysql-test/t/fulltext.test:
A test case for Bug#37740.
sql/item_func.h:
True initialization of 'table' happens in ::fix_fields(). As
Item_func_match::eq() may be called before ::fix_fields(), it is
expected that 'table' is initialized to 0 when it is reused.
This is mostly affecting prepared statements, when the same item
doesn't get destroyed, but rather cleaned up and reused.
without error
When using quick access methods for searching rows in UPDATE or
DELETE there was no check if a fatal error was not already sent
to the client while evaluating the quick condition.
As a result a false OK (following the error) was sent to the
client and the error was thus transformed into a warning.
Fixed by checking for errors sent to the client during
SQL_SELECT::check_quick() and treating them as real errors.
Fixed a wrong test case in group_min_max.test
Fixed a wrong return code in mysql_update() and mysql_delete()
mysql-test/r/bug40113.result:
Bug #40013: test case
mysql-test/r/group_min_max.result:
Bug #40013: fixed a wrong test case
mysql-test/t/bug40113-master.opt:
Bug #40013: test case
mysql-test/t/bug40113.test:
Bug #40013: test case
mysql-test/t/group_min_max.test:
Bug #40013: fixed a wrong test case
sql/sql_delete.cc:
Bug #40113: check for errors evaluating the quick select
sql/sql_update.cc:
Bug #40113: check for errors evaluating the quick select
