database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

fixed crash on non-well-constructed reference

Browse Source 
mysql-test/r/subselect.result:
  test of IN with error
mysql-test/t/subselect.test:
  test of IN with error
This commit is contained in:
unknown
2003-03-10 16:38:06 +02:00
parent 9cbc3df7c3
commit c2ce5116f3
4 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mysql-test/r/subselect.result
View File

@ -1012,3 +1012,5 @@ id select_type table type possible_keys key key_len ref rows Extra
2 UNCACHEABLE SUBSELECT t1 ALL NULL NULL NULL NULL 3
3 UNCACHEABLE SUBSELECT t1 ALL NULL NULL NULL NULL 3
drop table t1;
select t1.Continent, t2.Name, t2.Population from t1 LEFT JOIN t2 ON t1.Code = t2.Country where t2.Population IN (select max(t2.Population) AS Population from t2, t1 where t2.Country = t1.Code group by Continent);
Table 'test.t1' doesn't exist

6
mysql-test/t/subselect.test
View File

@ -595,3 +595,9 @@ insert into t1 values (1), (2), (3);
explain select a,(select (select rand() from t1 limit 1) from t1 limit 1)
from t1;
drop table t1;
#
# error in IN
#
-- error 1146
select t1.Continent, t2.Name, t2.Population from t1 LEFT JOIN t2 ON t1.Code = t2.Country where t2.Population IN (select max(t2.Population) AS Population from t2, t1 where t2.Country = t1.Code group by Continent);

2
sql/item.h
View File

@ -486,7 +486,7 @@ public:
enum Type type() const { return REF_ITEM; }
bool eq(const Item *item, bool binary_cmp) const
{ return ref && (*ref)->eq(item, binary_cmp); }
~Item_ref() { if (ref && (*ref) != this) delete *ref; }
~Item_ref() { if (ref && (*ref) && (*ref) != this) delete *ref; }
double val()
{
double tmp=(*ref)->val_result();

2
sql/item_subselect.cc
View File

@ -487,6 +487,8 @@ void Item_in_subselect::single_value_transformer(THD *thd,
setup_ref_array(thd, &sl->ref_pointer_array,
1 + sl->with_sum_func +
sl->order_list.elements + sl->group_list.elements);
// To prevent crash on Item_ref_null_helper destruction in case of error
sl->ref_pointer_array[0]= 0;
item= (*func)(expr, new Item_ref_null_helper(this,
sl->ref_pointer_array,
(char *)"<ref>",