MDEV-41631 Check the class of the copy made by Item::shallow_copy()

Item::shallow_copy() was meant to create a copy of the same class as the
item it is called on, but nothing enforced that. A class that does not
declare its own override inherits the one of its nearest concrete parent,
and get_item_copy<Parent>() then silently creates an object of the parent
class, losing the child's virtual behaviour (see MDEV-38801 for an earlier
instance with Item_cache_year).

Add the ITEM_SHALLOW_COPY(CLASS) macro, which declares the override, and
Item::dbug_check_shallow_copy_type(), a debug-only check called from
Query_arena::free_items() for every item freed. Once per dynamic type it
creates a shallow copy and asserts that it has the same typeid as the
original. Then, the copy is destroyed, which provides additional
coverage.

The check found these classes copied as their parent class, now fixed with
ITEM_SHALLOW_COPY():
  Item_join_operator_plus, Item_null_result, Item_old_field, Item_datetime,
  Item_empty_string, Item_return_int, Item_trigger_type_of_statement,
  in_string::Item_string_for_in_vector, Item_is_not_null_test,
  Item_interval_DDhhmmssff_typecast, Item_string_xml_non_const,
  Item_func_trt_trx_sees_eq, Item_field_refcursor (type_cursor plugin),
  Item_field_packable_scalar (type_assoc_array plugin).

These two classes do not support copying so the patch makes their
shallow_copy() to return NULL:
  Item_cache_wrapper, Item_sum_sp

Item_field_packable_row::shallow_copy() has assert(0). The patch makes
it return NULL.

This commit was prepared with help of Claude Code (Opus 5).
Sergei Petrunia added "delete item_copy" and did other minor edits.

plugin/type_assoc_array/sql_type_assoc_array.cc

@@ -244,6 +244,8 @@ public:
     unpack();
     return Item_field::save_in_field(field, no_conversions);
   }
+protected:
+  ITEM_SHALLOW_COPY(Item_field_packable_scalar)
 };
 
 
@@ -280,11 +282,7 @@ public:
     return false;
   }
 
-  Item *shallow_copy(THD *thd) const override
-  {
-    DBUG_ASSERT(0);
-    return get_item_copy<Item_field_packable_row>(thd, this);
-  }
+  Item *shallow_copy(THD *thd) const override { return nullptr; }
 
   static uint packed_col_length(Field *field)
   {

plugin/type_cursor/plugin.cc

@@ -367,6 +367,8 @@ public:
     DBUG_ASSERT(fc);
     return fc->resolve_spvar_cursor_rowtype(thd, cursor);
   }
+protected:
+  ITEM_SHALLOW_COPY(Item_field_refcursor)
 };
 
 

sql/item.cc

@@ -12608,3 +12608,50 @@ bool ignored_list_includes_table(ignored_tables_list_t list, TABLE_LIST *tbl)
   }
   return false;
 }
+
+
+#ifndef DBUG_OFF
+#include <typeindex>
+#include <unordered_set>
+#include <mutex>
+
+/*
+  Check that this item has implemented shallow_copy()
+*/
+void Item::dbug_check_shallow_copy_type(THD *thd) const
+{
+  /*
+    Maintain a set of Item_xxx types that were already checked and don't check
+    them again.
+  */
+  static std::unordered_set<std::type_index> checked_types;
+  static std::mutex checked_mutex;
+  {
+    std::lock_guard<std::mutex> lock(checked_mutex);
+    if (!checked_types.insert(typeid(*this)).second)
+      return;
+  }
+
+  Item *item_copy= shallow_copy(thd);
+  if (!item_copy)
+    return; /* This item cannot be cloned */
+
+  /*
+    We don't want cleanup() to be called for the item_copy, as it is not
+    fixed.
+    To achieve this, unlink it from thd->free_list and delete ourselves.
+    item_copy is the last item that was created, so it is the first in
+    thd->free_list.
+  */
+  DBUG_ASSERT(thd->free_list == item_copy);
+  if (thd->free_list == item_copy)
+    thd->free_list= item_copy->next;
+  if (typeid(*item_copy) != typeid(*this))
+  {
+    fprintf(stderr, "SHALLOW_COPY_TYPE_MISMATCH: %s copied as %s\n",
+            typeid(*this).name(), typeid(*item_copy).name());
+    DBUG_ASSERT(0);
+  }
+  delete item_copy;
+}
+#endif

sql/item.h

@@ -1971,6 +1971,15 @@ public:
     return clone;
   }
 
+#ifndef DBUG_OFF
+  /*
+    Check, once per dynamic type, that shallow_copy() creates an object of
+    the same class as this item, i.e. that the class did not inherit
+    shallow_copy() from a concrete parent.
+  */
+  void dbug_check_shallow_copy_type(THD *thd) const;
+#endif
+
   /*
     Clones the constant item (not necessary returning the same item type)
 
@@ -2912,6 +2921,15 @@ inline T* get_item_copy (THD *thd, const T* item)
   return copy;
 }
 
+/*
+  Every instantiable Item class must declare its own shallow_copy(): one
+  inherited from a concrete parent creates an object of the parent class.
+  Item::dbug_check_shallow_copy_type() asserts that in debug builds.
+*/
+#define ITEM_SHALLOW_COPY(CLASS)                                  \
+  Item *shallow_copy(THD *thd) const override                     \
+  { return get_item_copy<CLASS>(thd, this); }
+
 
 #ifndef DBUG_OFF
 /**
@@ -4214,6 +4232,8 @@ public:
 
 private:
   uchar *saved_row_ref;
+protected:
+  ITEM_SHALLOW_COPY(Item_old_field)
 };
 
 /**
@@ -4330,6 +4350,8 @@ public:
     str->append("(+)"_LEX_CSTRING);
   }
   static List<Item> *make_as_item_list(THD *thd);
+protected:
+  ITEM_SHALLOW_COPY(Item_join_operator_plus)
 };
 
 
@@ -4360,6 +4382,8 @@ public:
   {
     return mark_unsupported_function(full_name(), arg, VCOL_IMPOSSIBLE);
   }
+protected:
+  ITEM_SHALLOW_COPY(Item_null_result)
 };
 
 /*
@@ -5048,6 +5072,8 @@ public:
     return false;
   }
   void print(String *str, enum_query_type query_type) override;
+protected:
+  ITEM_SHALLOW_COPY(Item_datetime)
 };
 
 
@@ -5459,6 +5485,8 @@ public:
                                     length * cs->mbmaxlen, cs)
   { }
   void make_send_field(THD *thd, Send_field *field) override;
+protected:
+  ITEM_SHALLOW_COPY(Item_empty_string)
 };
 
 
@@ -5478,6 +5506,8 @@ public:
       Type_handler::get_handler_by_field_type(int_field_type);
     return unsigned_flag ? h->type_handler_unsigned() : h;
   }
+protected:
+  ITEM_SHALLOW_COPY(Item_return_int)
 };
 
 
@@ -6763,7 +6793,7 @@ public:
   }
 protected:
   Item *shallow_copy(THD *thd) const override
-  { return get_item_copy<Item_cache_wrapper>(thd, this); }
+  { return NULL; /* Not supported */ }
   Item *deep_copy(THD *) const override { return nullptr; }
   bool add_maybe_null_after_ora_join_processor(void *arg) override
   {
@@ -7983,6 +8013,8 @@ public:
 private:
   THD *m_thd;
   active_dml_stmt m_trigger_stmt_type;
+protected:
+  ITEM_SHALLOW_COPY(Item_trigger_type_of_statement)
 };
 
 

sql/item_cmpfunc.h

@@ -1699,6 +1699,8 @@ class in_string :public in_vector
       str_value= *str;
       collation.set(str->charset());
     }
+  protected:
+    ITEM_SHALLOW_COPY(Item_string_for_in_vector)
   };
 public:
   in_string(THD *thd, uint elements, qsort_cmp2 cmp_func, CHARSET_INFO *cs);
@@ -3005,6 +3007,8 @@ public:
   table_map used_tables() const override
     { return used_tables_cache | RAND_TABLE_BIT; }
   bool const_item() const override { return FALSE; }
+protected:
+  ITEM_SHALLOW_COPY(Item_is_not_null_test)
 };
 
 

sql/item_sum.h

@@ -1586,7 +1586,7 @@ public:
 
 protected:
   Item *shallow_copy(THD *thd) const override
-  { return get_item_copy<Item_sum_sp>(thd, this); }
+  { return NULL; /* not supported */ }
 };
 
 /* Items to get the value of a stored sum function */

sql/item_timefunc.h

@@ -1505,6 +1505,8 @@ public:
     null_value= !it.is_valid_interval_DDhhmmssff();
     return it.to_string(to, m_fsp);
   }
+protected:
+  ITEM_SHALLOW_COPY(Item_interval_DDhhmmssff_typecast)
 };
 
 

sql/item_vers.h

@@ -148,6 +148,8 @@ public:
     static LEX_CSTRING name= {STRING_WITH_LEN("trt_trx_sees_eq") };
     return name;
   }
+protected:
+  ITEM_SHALLOW_COPY(Item_func_trt_trx_sees_eq)
 };
 
 #endif /* ITEM_VERS_INCLUDED */

sql/item_xmlfunc.cc

@@ -614,6 +614,8 @@ public:
     */
     return this;
   }
+protected:
+  ITEM_SHALLOW_COPY(Item_string_xml_non_const)
 };
 
 

sql/sql_class.cc

@@ -4352,6 +4352,11 @@ void Query_arena::free_items()
 {
   Item *next;
   DBUG_ENTER("Query_arena::free_items");
+#ifndef DBUG_OFF
+  if (THD *thd= current_thd)
+    for (Item *item= free_list; item; item= item->next)
+      item->dbug_check_shallow_copy_type(thd);
+#endif
   /* This works because items are allocated on THD::mem_root */
   for (; free_list; free_list= next)
   {