mirror of
https://github.com/MariaDB/server.git
synced 2025-08-08 11:22:35 +03:00
MDEV-24953: 10.5.9 crashes with large IN() list
The problem was in and_all_keys(), the code of MDEV-9759 which calculates the new tree weight: First, it didn't take into account the case when (next->next_key_part=tmp) == NULL and dereferenced a NULL pointer when getting tmp->weight. Second, "if (param->alloced_sel_args > SEL_ARG::MAX_SEL_ARGS) break" could leave the loop with incorrect value of weight. Fixed by introducing SEL_ARG::update_weight_locally() and calling it at the end of the function. This allows to avoid caring about all the above cases.
This commit is contained in:
@@ -9800,7 +9800,6 @@ and_all_keys(RANGE_OPT_PARAM *param, SEL_ARG *key1, SEL_ARG *key2,
|
||||
key1->right= key1->left= &null_element;
|
||||
key1->next= key1->prev= 0;
|
||||
}
|
||||
uint new_weight= 0;
|
||||
|
||||
for (next=key1->first(); next ; next=next->next)
|
||||
{
|
||||
@@ -9813,22 +9812,21 @@ and_all_keys(RANGE_OPT_PARAM *param, SEL_ARG *key1, SEL_ARG *key2,
|
||||
continue;
|
||||
}
|
||||
next->next_key_part=tmp;
|
||||
new_weight += 1 + tmp->weight;
|
||||
if (use_count)
|
||||
next->increment_use_count(use_count);
|
||||
if (param->alloced_sel_args > SEL_ARG::MAX_SEL_ARGS)
|
||||
break;
|
||||
}
|
||||
else
|
||||
{
|
||||
new_weight += 1 + key2->weight;
|
||||
next->next_key_part=key2;
|
||||
}
|
||||
}
|
||||
if (!key1)
|
||||
return &null_element; // Impossible ranges
|
||||
key1->use_count++;
|
||||
key1->weight= new_weight;
|
||||
|
||||
/* Re-compute the result tree's weight. */
|
||||
key1->update_weight_locally();
|
||||
|
||||
key1->max_part_no= MY_MAX(key2->max_part_no, key2->part+1);
|
||||
return key1;
|
||||
}
|
||||
@@ -9992,6 +9990,30 @@ get_range(SEL_ARG **e1,SEL_ARG **e2,SEL_ARG *root1)
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
@brief
|
||||
Update the tree weight.
|
||||
|
||||
@detail
|
||||
Utility function to be called on a SEL_ARG tree root after doing local
|
||||
modifications concerning changes at this key part.
|
||||
Assumes that the weight of the graphs connected via next_key_part is
|
||||
up to dayte.
|
||||
*/
|
||||
void SEL_ARG::update_weight_locally()
|
||||
{
|
||||
uint new_weight= 0;
|
||||
const SEL_ARG *sl;
|
||||
for (sl= first(); sl ; sl= sl->next)
|
||||
{
|
||||
new_weight++;
|
||||
if (sl->next_key_part)
|
||||
new_weight += sl->next_key_part->weight;
|
||||
}
|
||||
weight= new_weight;
|
||||
}
|
||||
|
||||
|
||||
#ifndef DBUG_OFF
|
||||
/*
|
||||
Verify SEL_TREE's weight.
|
||||
@@ -10728,17 +10750,7 @@ end:
|
||||
key1->use_count++;
|
||||
|
||||
/* Re-compute the result tree's weight. */
|
||||
{
|
||||
uint new_weight= 0;
|
||||
const SEL_ARG *sl;
|
||||
for (sl= key1->first(); sl ; sl= sl->next)
|
||||
{
|
||||
new_weight++;
|
||||
if (sl->next_key_part)
|
||||
new_weight += sl->next_key_part->weight;
|
||||
}
|
||||
key1->weight= new_weight;
|
||||
}
|
||||
key1->update_weight_locally();
|
||||
|
||||
key1->max_part_no= max_part_no;
|
||||
return key1;
|
||||
|
Reference in New Issue
Block a user