1
0
mirror of https://github.com/MariaDB/server.git synced 2025-08-26 01:44:06 +03:00
Commit Graph

1925 Commits

Author SHA1 Message Date
Tor Didriksen
1cf483aa58 Bug#12329653 - EXPLAIN, UNION, PREPARED STATEMENT, CRASH, SQL_FULL_GROUP_BY
The query was re-written *after* we had tagged it with NON_AGG_FIELD_USED.
Remove the flag before continuing.


mysql-test/r/explain.result:
  Update test case for Bug#48295.
mysql-test/r/subselect.result:
  New test case.
mysql-test/t/explain.test:
  Update test case for Bug#48295.
mysql-test/t/subselect.test:
  New test case.
sql/item.cc:
  Use accessor functions for non_agg_field_used/agg_func_used.
sql/item_subselect.cc:
  Remove non_agg_field_used when we rewrite query '1 < some (...)' => '1 < max(...)'
sql/item_sum.cc:
  Use accessor functions for non_agg_field_used/agg_func_used.
sql/mysql_priv.h:
  Remove unused #defines.
sql/sql_lex.cc:
  Initialize new member variables.
sql/sql_lex.h:
  Replace full_group_by_flag with two boolean flags,
  and itroduce accessors for manipulating them.
sql/sql_select.cc:
  Use accessor functions for non_agg_field_used/agg_func_used.
2011-05-04 16:18:21 +02:00
Georgi Kodinov
b831c6dbbb automerge 2011-01-07 15:28:36 +02:00
Kent Boortz
85323eda8a - Added/updated copyright headers
- Removed files specific to compiling on OS/2
- Removed files specific to SCO Unix packaging
- Removed "libmysqld/copyright", text is included in documentation
- Removed LaTeX headers for NDB Doxygen documentation
- Removed obsolete NDB files
- Removed "mkisofs" binaries
- Removed the "cvs2cl.pl" script
- Changed a few GPL texts to use "program" instead of "library"
2010-12-28 19:57:23 +01:00
Gleb Shchepa
47bb750c9d backport: Bug #55568 from 5.1-security to 5.0-security
> revision-id: alexey.kopytov@sun.com-20100824103548-ikm79qlfrvggyj9h
> parent: sunny.bains@oracle.com-20100816001222-xqc447tr6jwh8c53
> committer: Alexey Kopytov <Alexey.Kopytov@Sun.com>
> branch nick: 5.1-security
> timestamp: Tue 2010-08-24 14:35:48 +0400
> message:
>   Bug #55568: user variable assignments crash server when used
>               within query
>   
>   The server could crash after materializing a derived table
>   which requires a temporary table for grouping.
>   
>   When destroying the temporary table used to execute a query for
>   a derived table, JOIN::destroy() did not clean up Item_fields
>   pointing to fields in the temporary table. This led to
>   dereferencing a dangling pointer when printing out the items
>   tree later in the outer SELECT.
>   
>   The solution is an addendum to the patch for bug37362: in
>   addition to cleaning up items in tmp_all_fields3, do the same
>   for items in tmp_all_fields1, since now we have an example
>   where this is necessary.


sql/field.cc:
  Make sure field->table_name is not set to NULL in
  Field::make_field() to avoid assertion failure in 
  Item_field::make_field() after cleaning up items
  (the assertion fired in udf.test when running
  the test suite with the patch applied).
sql/sql_select.cc:
  In addition to cleaning up items in tmp_all_fields3, do the
  same for items in tmp_all_fields1.
  Introduce a new helper function to avoid code duplication.
sql/sql_select.h:
  Introduce a new helper function to avoid code duplication in
  JOIN::destroy().
2010-11-23 00:29:47 +03:00
Sergey Glukhov
50a3c55ee7 Bug#52711 Segfault when doing EXPLAIN SELECT with union...order by (select... where...)
backport from 5.1


mysql-test/r/subselect.result:
  backport from 5.1
mysql-test/t/subselect.test:
  backport from 5.1
sql/sql_select.cc:
  backport from 5.1
2010-11-08 13:51:39 +03:00
Martin Hansson
1eada91053 Bug#52357: Assertion failed: join->best_read in
greedy_search optimizer_search_depth=0

The algorithm inside restore_prev_nj_state failed to
properly update the counters within the NESTED_JOIN
tree. The counter was decremented each time a table in the
node was removed from the QEP, the correct thing to do being
only to decrement it when the last table in the child node
was removed from the plan. This lead to node counters
getting negative values and the plan thus appeared
impossible. An assertion caught this.

Fixed by not recursing up the tree unless the last table in
the join nest node is removed from the plan
2010-05-06 10:45:00 +02:00
Alexey Kopytov
6d43510a42 Backport of the fix for bug #50335 to 5.0.
The problem was in an incorrect debug assertion. The expression
used in the failing assertion states that when finding
references matching ORDER BY expressions, there can be only one
reference to a single table. But that does not make any sense,
all test cases for this bug are valid examples with multiple
identical WHERE expressions referencing the same table which
are also present in the ORDER BY list.

Fixed by removing the failing assertion. We also have to take
care of the 'found' counter so that we count multiple
references only once. We rely on this fact later in
eq_ref_table().

mysql-test/r/join.result:
  Added a test case for bug #50335.
mysql-test/t/join.test:
  Added a test case for bug #50335.
sql/sql_select.cc:
  Removing the assertion in eq_ref_table() as it does not make
  any sense. We also have to take care of the 'found' counter so
  that we count multiple references only once. We rely on this
  fact later in eq_ref_table().
2010-04-27 00:06:00 +04:00
Sergey Glukhov
f57839cd60 Bug#52177 crash with explain, row comparison, join, text field
The crash is the result of an attempt made by JOIN::optimize to evaluate
the WHERE condition when no records have been actually read.
The fix is to remove erroneous 'outer_join' variable check.


mysql-test/r/join.result:
  test result
mysql-test/t/join.test:
  test case
sql/sql_select.cc:
  removed erroneous 'outer_join' variable check.
2010-03-26 11:44:24 +04:00
Sergey Glukhov
bccf219bfc Bug#48483 crash in get_best_combination()
The crash happens because greedy_serach
can not determine best plan due to
wrong inner table dependences. These
dependences affects join table sorting
which performs before greedy_search starting.
In our case table which has real 'no dependences'
should be put on top of the list but it does not
happen as inner tables have no dependences as well.
The fix is to exclude RAND_TABLE_BIT mask from
condition which checks if table dependences
should be updated.


mysql-test/r/join.result:
  test result
mysql-test/t/join.test:
  test case
sql/sql_select.cc:
  RAND_TABLE_BIT mask should not be counted as it
  prevents update of inner table dependences.
  For example it might happen if RAND() function
  is used in JOIN ON clause.
2010-03-24 14:37:28 +04:00
Georgi Kodinov
1ff667c995 fixed a typo in bug #49897. 2010-02-01 13:40:16 +02:00
Ramil Kalimullin
172af3722e Fix for bug#49897: crash in ptr_compare when char(0) NOT NULL
column is used for ORDER BY

Problem: filesort isn't meant for null length sort data
(e.g. char(0)), that leads to a server crash.

Fix: disregard sort order if sort data record length is 0 (nothing
to sort).


mysql-test/r/select.result:
  Fix for bug#49897: crash in ptr_compare when char(0) NOT NULL 
  column is used for ORDER BY
    - test result.
mysql-test/t/select.test:
  Fix for bug#49897: crash in ptr_compare when char(0) NOT NULL 
  column is used for ORDER BY
    - test case.
sql/filesort.cc:
  Fix for bug#49897: crash in ptr_compare when char(0) NOT NULL 
  column is used for ORDER BY
    - assert added as filesort cannot handle null length sort data.
sql/sql_select.cc:
  Fix for bug#49897: crash in ptr_compare when char(0) NOT NULL 
  column is used for ORDER BY
    - don't sort null length data e.g. in case of ORDER BY CHAR(0).
2010-01-29 13:17:57 +04:00
Ramil Kalimullin
7344b58c32 Fix for bug#49570: Assertion failed: !(order->used & map)
on re-execution of prepared statement

Problem: some (see eq_ref_table()) ORDER BY/GROUP BY optimization
is called before each PS execution. However, we don't properly 
initialize its stucture every time before the call.

Fix: properly initialize the sturture used.



mysql-test/r/ps.result:
  Fix for bug#49570: Assertion failed: !(order->used & map) 
  on re-execution of prepared statement
    - test result.
mysql-test/t/ps.test:
  Fix for bug#49570: Assertion failed: !(order->used & map) 
  on re-execution of prepared statement
    - test case.
sql/sql_select.cc:
  Fix for bug#49570: Assertion failed: !(order->used & map) 
  on re-execution of prepared statement
    - set order->used to 0 before each eq_ref_table() call,
  as the function relies on that.
2009-12-22 10:39:29 +04:00
Georgi Kodinov
b72f278958 Bug #48709: Assertion failed in sql_select.cc:11782:
int join_read_key(JOIN_TAB*)

The eq_ref access method TABLE_REF (accessed through 
JOIN_TAB) to save state and to track if this is the 
first row it finds or not.
This state was not reset on subquery re-execution
causing an assert.

Fixed by resetting the state before the subquery 
re-execution.
2009-12-15 19:10:06 +02:00
Georgi Kodinov
bd308d1256 Bug #42760: Select doesn't return desired results when we have null values
Part 2 : 
There was a special optimization on the ref access method for 
ORDER BY ... DESC that was set without actually looking on the type of the 
selected index for ORDER BY.
Fixed the SELECT ... ORDER BY .. DESC (it uses a different code path compared
to the ASC that has been fixed with the previous fix).
2009-12-07 16:38:56 +02:00
Ramil Kalimullin
f5b51bc1e2 Fix for bug#49199: Optimizer handles incorrectly:
field='const1' AND field='const2' in some cases

Building multiple equality predicates containing
a constant which is compared as a datetime (with a field)
we should take this fact into account and compare the 
constant with another possible constatns as datetimes 
as well.

E.g. for the
SELECT ... WHERE a='2001-01-01' AND a='2001-01-01 00:00:00'
we should compare '2001-01-01' with '2001-01-01 00:00:00' as
datetimes but not as strings.


mysql-test/r/select.result:
  Fix for bug#49199: Optimizer handles incorrectly: 
  field='const1' AND field='const2' in some cases
    - test result.
mysql-test/t/select.test:
  Fix for bug#49199: Optimizer handles incorrectly: 
  field='const1' AND field='const2' in some cases
    - test case.
sql/item_cmpfunc.cc:
  Fix for bug#49199: Optimizer handles incorrectly: 
  field='const1' AND field='const2' in some cases
    - adding a constant to Item_equal compare it as
  a datetime value with stored one if there's a 
  date[time] field in a equality predicate.
sql/item_cmpfunc.h:
  Fix for bug#49199: Optimizer handles incorrectly: 
  field='const1' AND field='const2' in some cases
    - adding a constant to Item_equal compare it as
  a datetime value with stored one if there's a 
  date[time] field in a equality predicate.
sql/sql_select.cc:
  Fix for bug#49199: Optimizer handles incorrectly: 
  field='const1' AND field='const2' in some cases
    - adding a constant to Item_equal compare it as
  a datetime value with stored one if there's a 
  date[time] field in a equality predicate.
2009-12-04 21:58:40 +04:00
Alexey Kopytov
b31c544eec Automerge. 2009-11-12 20:13:08 +03:00
Alexey Kopytov
fb2e17903f Fixed a gcc warning introduced by the patch for bug #48475. 2009-11-12 20:11:33 +03:00
Georgi Kodinov
4519d5e4f1 Bug #48458: simple query tries to allocate enormous amount of
memory

The server was doing a bad class typecast causing setting of 
wrong value for the maximum number of items in an internal
structure used in equality propagation.
Fixed by not doing the wrong typecast and asserting the type
of the Item where it should be done.
2009-11-09 16:09:46 +02:00
Georgi Kodinov
ddd90017e7 Bug #42760: Select doesn't return desired results when we have null
values
 
 We should re-set the access method functions when changing the access
 method when switching to another index to avoid sorting.
 
 Fixed by doing a little re-engineering : encapsulating all the function
 assignment into a special function and calling it when flipping the 
 indexes.
2009-11-10 10:21:41 +02:00
Alexey Kopytov
39f9a3ffd0 Bug #48475: DISTINCT is ignored with GROUP BY WITH ROLLUP and
only const tables

The problem was caused by two shortcuts in the optimizer that
are inapplicable in the ROLLUP case.

Normally in a case when only const tables are involved in a
query, DISTINCT clause can be safely optimized away since there
may be only one row produced by the join. Similarly, we don't
need to create a temporary table to resolve DISTINCT/GROUP
BY/ORDER BY. Both of these are inapplicable when the WITH
ROLLUP modifier is present.

Fixed by disabling the said optimizations for the WITH ROLLUP
case.

mysql-test/r/olap.result:
  Added a test case for bug #48475.
mysql-test/t/olap.test:
  Added a test case for bug #48475.
sql/sql_select.cc:
  Disabled const-only table optimizations for the WITH ROLLUP
  case.
2009-11-06 09:44:01 +03:00
Konstantin Osipov
06c9d62a9f A fix and a test case for
Bug#41756 "Strange error messages about locks from InnoDB".

In JT_EQ_REF (join_read_key()) access method,
don't try to unlock rows in the handler, unless certain that
a) they were locked
b) they are not used.

Unlocking of rows is done by the logic of the nested join loop,
and is unaware of the possible caching that the access method may
have. This could lead to double unlocking, when a row
was unlocked first after reading into the cache, and then
when taken from cache, as well as to unlocking of rows which
were actually used (but taken from cache).

Delegate part of the unlocking logic to the access method,
and in JT_EQ_REF count how many times a record was actually
used in the join. Unlock it only if it's usage count is 0.

Implemented review comments.


mysql-test/r/bug41756.result:
  Add result file (Bug#41756)
mysql-test/t/bug41756-master.opt:
  Use --innodb-locks-unsafe-for-binlog, as in 5.0 just
  using read_committed isolation is not sufficient to 
  reproduce the bug.
mysql-test/t/bug41756.test:
  Add a test file (Bug#41756)
sql/item_subselect.cc:
  Complete struct READ_RECORD initialization with a new
  member to unlock records.
sql/records.cc:
  Extend READ_RECORD API with a method to unlock read records.
sql/sql_select.cc:
  In JT_EQ_REF (join_read_key()) access method,
  don't try to unlock rows in the handler, unless certain that
  a) they were locked
  b) they are not used.
sql/sql_select.h:
  Add members to TABLE_REF to count TABLE_REF buffer usage count.
sql/structs.h:
  Update declarations.
2009-11-03 19:58:54 +03:00
Alexey Kopytov
7f9656369f Automerge. 2009-10-30 19:16:25 +03:00
Alexey Kopytov
b67cdaa351 Bug #48131: crash group by with rollup, distinct, filesort,
with temporary tables

There were two problems the test case from this bug was
triggering:

1. JOIN::rollup_init() was supposed to wrap all constant Items
into another object for queries with the WITH ROLLUP modifier
to ensure they are never considered as constants and therefore
are written into temporary tables if the optimizer chooses to
employ them for DISTINCT/GROUP BY handling.

However, JOIN::rollup_init() was called before
make_join_statistics(), so Items corresponding to fields in
const tables could not be handled as intended, which was
causing all kinds of problems later in the query execution. In
particular, create_tmp_table() assumed all constant items
except "hidden" ones to be removed earlier by remove_const()
which led to improperly initialized Field objects for the
temporary table being created. This is what was causing crashes
and valgrind errors in storage engines.

2. Even when the above problem had been fixed, the query from
the test case produced incorrect results due to some
DISTINCT/GROUP BY optimizations being performed by the
optimizer that are inapplicable in the WITH ROLLUP case.

Fixed by disabling inapplicable DISTINCT/GROUP BY optimizations
when the WITH ROLLUP modifier is present, and splitting the
const-wrapping part of JOIN::rollup_init() into a separate
method which is now invoked after make_join_statistics() when
the const tables are already known.

mysql-test/r/olap.result:
  Added a test case for bug #48131.
mysql-test/t/olap.test:
  Added a test case for bug #48131.
sql/sql_select.cc:
  1. Disabled inapplicable DISTINCT/GROUP BY optimizations when
  the WITH ROLLUP modifier is present.
  2. Split the const-wrapping part of JOIN::rollup_init() into a
  separate method.
sql/sql_select.h:
  Added rollup_process_const_fields() declaration.
2009-10-30 18:54:53 +03:00
Georgi Kodinov
9d96cd6dcb Bug #48291 : crash with row() operator,select into @var, and
subquery returning multiple rows

Error handling was missing when handling subqueires in WHERE 
and when assigning a SELECT result to a @variable.
This caused crash(es). 

Fixed by adding error handling code to both the WHERE 
condition evaluation and to assignment to an @variable.
2009-10-30 15:15:43 +02:00
Georgi Kodinov
851e250953 Bug #48293: crash with procedure analyse, view with > 10 columns,
having clause...

The fix for bug 46184 was not very complete. It was not covering
views using temporary tables and multiple tables in a FROM clause.
Fixed by reverting the fix for 46184 and making a more general
check that is checking at the right execution stage and for all
of the non-supported cases.
Now PROCEDURE ANALYZE on non-top level SELECT is also forbidden.
Updated the analyse.test and subselect.test accordingly.
2009-10-30 11:40:44 +02:00
Georgi Kodinov
ac37324843 Bug #42116 : Mysql crash on specific query
Queries with nested outer joins may lead to crashes or 
bad results because an internal data structure is not handled
correctly.
The optimizer uses bitmaps of nested JOINs to determine
if certain table can be placed at a certain place in the
JOIN order.
It does maintain a bitmap describing in which JOINs 
last placed table is nested.
When it puts a table it makes sure the bit of every JOIN that
contains the table in question is set (because JOINs can be nested).
It does that by recursively setting the bit for the next enclosing
JOIN when this is the first table in the JOIN and recursively 
resetting the bit if it's the last table in the JOIN.
When it removes a table from the join order it should do the
opposite : recursively unset the bit if it's the only remaining 
table in this join and and recursively set the bit if it's removing
the last table of a JOIN.
There was an error in how the bits was set for the upper levels :
when removing a table it was setting the bit for all the enclosing 
nested JOINs even if there were more tables left in the current JOIN
(which practically means that the upper nested JOINs were not affected).
Fixed by stopping the recursion at the relevant level.

mysql-test/r/join.result:
  Bug #42116: test case
mysql-test/t/join.test:
  Bug #42116: test case
sql/sql_select.cc:
  Bug #41116: don't go up and set the bits if more tables in
  at the current JOIN level
2009-10-29 17:24:29 +02:00
Ramil Kalimullin
17ed6b9abd Fix for bug#47019: Assertion failed: 0, file .\rt_mbr.c,
line 138 when forcing a spatial index

Problem: "Spatial indexes can be involved in the search 
for queries that use a function such as MBRContains() 
or MBRWithin() in the WHERE clause".
Using spatial indexes for JOINs with =, <=> etc.
predicates is incorrect.

Fix: disable spatial indexes for such queries.


mysql-test/r/select.result:
  Fix for bug#47019: Assertion failed: 0, file .\rt_mbr.c, 
  line 138 when forcing a spatial index
    - test result.
mysql-test/t/select.test:
  Fix for bug#47019: Assertion failed: 0, file .\rt_mbr.c, 
  line 138 when forcing a spatial index
    - test case.
sql/sql_select.cc:
  Fix for bug#47019: Assertion failed: 0, file .\rt_mbr.c, 
  line 138 when forcing a spatial index
    - disable spatial indexes for queries which use 
  non-spatial conditions (e.g. NATURAL JOINs).
2009-10-21 14:04:08 +05:00
Georgi Kodinov
5dda6c18cd Bug #47106: Crash / segfault on adding EXPLAIN to a non-crashing
query
      
The fix for bug 46749 removed the check for OUTER_REF_TABLE_BIT 
and substituted it for a check on the presence of 
Item_ident::depended_from.
Removing it altogether was wrong : OUTER_REF_TABLE_BIT should 
still be checked in addition to depended_from (because it's not 
set in all cases and doesn't contradict to the check of depended_from).
Fixed by returning the old condition back as a compliment to the 
new one.
2009-09-18 12:34:08 +03:00
Staale Smedseng
e5888b16af Bug #43414 Parenthesis (and other) warnings compiling MySQL
with gcc 4.3.2
      
This is the fifth patch cleaning up more GCC warnings about
variables used before initialized using the new macro
UNINIT_VAR().
2009-09-17 17:10:30 +02:00
Georgi Kodinov
629557ff13 Bug #46791: Assertion failed:(table->key_read==0),function unknown
function,file sql_base.cc

When uncacheable queries are written to a temp table the optimizer must 
preserve the original JOIN structure, because it is re-using the JOIN 
structure to read from the resulting temporary table.
This was done only for uncacheable sub-queries. 
But top level queries can also benefit from this mechanism, specially if 
they're using index access and need a reset.
Fixed by not limiting the saving of JOIN structure to subqueries
exclusively.
Added a new test file to extend the existing (large) subquery.test.
2009-09-03 18:03:46 +03:00
Sergey Glukhov
643fbe4234 Bug#45989 memory leak after explain encounters an error in the query
Memory allocated in TMP_TABLE_PARAM::copy_field is not cleaned up.
The fix is to clean up TMP_TABLE_PARAM::copy_field array in JOIN::destroy.


mysql-test/r/explain.result:
  test result
mysql-test/t/explain.test:
  test case
sql/sql_select.cc:
  Memory allocated in TMP_TABLE_PARAM::copy_field is not cleaned up.
  The fix is to clean up TMP_TABLE_PARAM::copy_field array in JOIN::destroy.
2009-09-04 12:20:53 +05:00
Georgi Kodinov
a22c29d5e4 Bug #46749: Segfault in add_key_fields() with outer subquery level
field references

This error requires a combination of factors : 
1. An "impossible where" in the outermost SELECT
2. An aggregate in the outermost SELECT
3. A correlated subquery with a WHERE clause that includes an outer 
field reference as a top level WHERE sargable predicate

When JOIN::optimize detects an "impossible WHERE" it will bail out
without doing the rest of the work and initializations. It will not
call make_join_statistics() as well.  And make_join_statistics fills 
in various structures for each table referenced.
When processing the result of the "impossible WHERE" the query must
send a single row of data if there are aggregate functions in it.
In this case the server marks all the aggregates as having received 
no rows and calls the relevant Item::val_xxx() method on the SELECT
list. However if this SELECT list happens to contain a correlated 
subquery this subquery is evaluated in a normal evaluation mode.
And if this correlated subquery has a reference to a field from the 
outermost "impossible where" SELECT the add_key_fields will mistakenly
consider the outer field reference as a "local" field reference when 
looking for sargable predicates.
But since the SELECT where the outer field reference refers to is not
completely initialized due to the "impossible WHERE" in this level
we'll get a NULL pointer reference.
Fixed by making a better condition for discovering if a field is "local"
to the SELECT level being processed. 
It's not enough to look for OUTER_REF_TABLE_BIT in this case since 
for outer references to constant tables the Item_field::used_tables() 
will return 0 regardless of whether the field reference is from the 
local SELECT or not.
2009-08-27 14:40:42 +03:00
Alexey Kopytov
85c97e6c69 Automerge. 2009-07-24 16:13:31 +04:00
Alexey Kopytov
885292e424 Bug #46075: Assertion failed: 0, file .\protocol.cc, line 416
In create_myisam_from_heap() mark all errors as fatal except 
HA_ERR_RECORD_FILE_FULL for a HEAP table.

Not doing so could lead to problems, e.g. in a case when a
temporary MyISAM table gets overrun due to its MAX_ROWS limit
while executing INSERT/REPLACE IGNORE ... SELECT. 
The SELECT execution was aborted, but the error was 
converted to a warning due to IGNORE clause, so neither 'ok' 
nor 'error' packet could be sent back to the client. This 
condition led to hanging client when using 5.0 server, or 
assertion failure in 5.1.


mysql-test/r/insert_select.result:
  Added a test case for bug #46075.
mysql-test/t/insert_select.test:
  Added a test case for bug #46075.
sql/sql_select.cc:
  In create_myisam_from_heap() mark all errors as fatal except 
  HA_ERR_RECORD_FILE_FULL for a HEAP table.
2009-07-24 15:50:45 +04:00
Georgi Kodinov
7a91bf8c91 Bug #46003 and bug #46034: backported the fixes from azalea. 2009-07-16 15:19:22 +03:00
Staale Smedseng
3b0e6e4109 Bug #43414 Parenthesis (and other) warnings compiling MySQL
with gcc 4.3.2
      
Compiling MySQL with gcc 4.3.2 and later produces a number of 
warnings, many of which are new with the recent compiler
versions.
                  
This bug will be resolved in more than one patch to limit the
size of changesets. This is the second patch, fixing more
of the warnings.
2009-06-17 15:54:01 +02:00
Georgi Kodinov
6df6c8ee95 Bug #44810: index merge and order by with low sort_buffer_size
crashes server!

The problem affects the scenario when index merge is followed by a filesort
and the sort buffer is not big enough for all the sort keys.
In this case the filesort function will read the data to the end through the 
index merge quick access method (and thus closing the cursor etc), 
but will leave the pointer to the quick select method in place.
It will then create a temporary file to hold the results of the filesort and
will add it as a sort output file (in sort.io_cache).
Note that filesort will copy the original 'sort' structure in an automatic
variable and restore it after it's done.
As a result at exiting filesort() we have a sort.io_cache filled in and 
nothing else (as a result of close of the cursors at end of reading data 
through index merge).
Now create_sort_index() will note that there is a select and will clean it up
(as it's been used already by filesort() reading the data in). While doing that
a special case in the index merge destructor will clean up the sort.io_cache,
assuming it's an output of the index merge method and is not needed anymore.
As a result the code that tries to read the data back from the filesort output 
will get no data in both memory and disk and will crash.
      
Fixed similarly to how filesort() does it : by copying the sort.io_cache structure
to a local variable, removing the pointer to the io_cache (so that it's not freed 
by QUICK_INDEX_MERGE_SELECT::~QUICK_INDEX_MERGE_SELECT) and restoring the original 
structure (together with the valid pointer) after the cleanup is done.
This is a safe thing to do because all the structures are already cleaned up by
hitting the end of the index merge's read method (QUICK_INDEX_MERGE_SELECT::get_next()) 
and the cleanup code being written in a way that tolerates repeating cleanups.

mysql-test/r/index_merge.result:
  Bug #44810: test case
mysql-test/t/index_merge.test:
  Bug #44810: test case
sql/sql_select.cc:
  Bug #44810: preserve the io_cache produced by filesort while cleaning up
  the index merge quick access method (QUICK_INDEX_MERGE_SELECT).
2009-06-15 16:38:15 +03:00
Tatiana A. Nurnberg
e34085fe13 Bug#32149: Long semaphore wait for adaptive hash latch
Holding on to the temporary inno hash index latch is an optimization in
many cases, but a pessimization in some others.

Release temporary latches for those corner cases we (or rather, or customers,
thanks!) have identified, that is, when we are about to do something that
might take a really long time, like REPAIR or filesort.

sql/ha_myisam.cc:
  Let go of (inno, for now) latch when doing MyISAM-repair.
  (optimize passes through repair.) ("Stuck" in "Repair with
  keycache".)
sql/sql_insert.cc:
  Let go of (inno, for now) latch when doing CREATE...SELECT
  in select_insert::send_data() -- it might take a while.
  ("stuck" in "Sending data")
sql/sql_select.cc:
  Release temporary (inno, for now) latch on
  - free_tmp_table() (this can take surprisingly long, "removing tmp table")
  - create_myisam_from_heap() (HEAP table overflowing onto disk as MyISAM,
    "converting HEAP to MyISAM")
2009-06-05 00:23:08 +02:00
Georgi Kodinov
812d2559b5 merged 5.0-main -> 5.0-bugteam 2009-05-15 12:29:41 +03:00
Chad MILLER
767501a9b1 Merge community up to enterprise, thus ending the community-server
adventure.
2009-05-06 09:06:32 -04:00
Gleb Shchepa
f0791b8b6b Bug #37362: Crash in do_field_eq
EXPLAIN EXTENDED of nested query containing a error:

   1054 Unknown column '...' in 'field list'

may cause a server crash.


Parse error like described above forces a call to
JOIN::destroy() on malformed subquery.
That JOIN::destroy function closes and frees temporary
tables. However, temporary fields of these tables
may be listed in st_select_lex::group_list of outer
query, and that st_select_lex may not cleanup them
properly. So, after the JOIN::destroy call that
st_select_lex::group_list may have Item_field
objects with dangling pointers to freed temporary
table Field objects. That caused a crash.


mysql-test/r/subselect3.result:
  Added test case for bug #37362.
mysql-test/t/subselect3.test:
  Added test case for bug #37362.
sql/sql_select.cc:
  Bug #37362: Crash in do_field_eq
  
  The JOIN::destroy function has been modified to
  cleanup temporary table column items.
2009-05-01 00:20:37 +05:00
Alexey Botchkov
ddc9a19550 merging 2009-04-28 14:48:54 +05:00
Chad MILLER
14f923c028 Merge 5.0.80 release and 5.0 community. Version left at 5.0.80. 2009-04-14 13:20:13 -04:00
Gleb Shchepa
02884a4d98 Backport bug #37348 fix 5.1 --> 5.0.
Original commentary:

Bug #37348: Crash in or immediately after JOIN::make_sum_func_list
            
The optimizer pulls up aggregate functions which should be aggregated in
an outer select. At some point it may substitute such a function for a field
in the temporary table. The setup_copy_fields function doesn't take this
into account and may overrun the copy_field buffer.
            
Fixed by filtering out the fields referenced through the specialized
reference for aggregates (Item_aggregate_ref).
Added an assertion to make sure bugs that cause similar discrepancy 
don't go undetected.


mysql-test/r/func_group.result:
  Backport bug #37348 fix 5.1 --> 5.0.
mysql-test/t/func_group.test:
  Backport bug #37348 fix 5.1 --> 5.0.
sql/item.cc:
  Backport bug #37348 fix 5.1 --> 5.0.
sql/item.h:
  Backport bug #37348 fix 5.1 --> 5.0.
sql/sql_select.cc:
  Backport bug #37348 fix 5.1 --> 5.0.
2009-04-01 16:02:26 +05:00
Ignacio Galarza
675c3ce2bb auto-merge 2009-03-19 09:44:58 -04:00
Georgi Kodinov
29476d879f Bug #42419: Server crash with "Pure virtual method called" on two concurrent
connections
The problem is that tables can enter open table cache for a thread without 
being properly cleaned up. This can happen if make_join_statistics() fails 
to read a const table because of e.g. a deadlock. It does set a member of 
TABLE structure to a value it allocates, but doesn't clean-up this setting 
on error nor does it set the rest of the members in JOIN to allow for 
automatic cleanup.
As a result when such an error occurs and the next statement depends re-uses 
the table from the open tables cache it will get it with this 
TABLE::reginfo.join_tab pointing to a memory area that's freed.
Fixed by making sure make_join_statistics() cleans up TABLE::reginfo.join_tab 
on error.

mysql-test/r/innodb_mysql.result:
  Bug #42419: test case
mysql-test/t/innodb_mysql-master.opt:
  Bug #42419: increase the timeout so it covers te conservative 
  sleep 3 in the test
mysql-test/t/innodb_mysql.test:
  Bug #42419: test case
sql/sql_select.cc:
  Bug #42419: clean up the members of TABLE on failure in 
          make_join_statisitcs()
2009-02-19 17:30:03 +02:00
Ignacio Galarza
54fbbf9591 Bug#29125 Windows Server X64: so many compiler warnings
- Remove bothersome warning messages.  This change focuses on the warnings 
that are covered by the ignore file: support-files/compiler_warnings.supp.
- Strings are guaranteed to be max uint in length
2009-02-10 17:47:54 -05:00
Gleb Shchepa
061bf717e0 Bug #42037: Queries containing a subquery with DISTINCT and
ORDER BY could cause a server crash

Dependent subqueries like

  SELECT COUNT(*) FROM t1, t2 WHERE t2.b
   IN (SELECT DISTINCT t2.b FROM t2 WHERE t2.b = t1.a)

caused a memory leak proportional to the
number of outer rows.


The make_simple_join() function has been modified to
JOIN class method to store join_tab_reexec and
table_reexec values in the parent join only
(make_simple_join of tmp_join may access these values
via 'this' pointer of the parent JOIN).

NOTE: this patch doesn't include standard test case (this is
"out of memory" bug). See bug #42037 page for test cases.


sql/sql_select.cc:
  Bug #42037: Queries containing a subquery with DISTINCT and
              ORDER BY could cause a server crash
  
  The make_simple_join() function has been modified to
  JOIN class method to store join_tab_reexec and
  table_reexec values in the parent join only.
sql/sql_select.h:
  Bug #42037: Queries containing a subquery with DISTINCT and
              ORDER BY could cause a server crash
  
  1. The make_simple_join() function has been modified to
     JOIN class method.
  
  2. Type of JOIN::table_reexec field has been changed from
     TABLE** to TABLE *table_reexec[1]: this field always was
     NULL or a pointer to one-element array of pointers, so
     a pointer to a pointer has been replaced with one pointer
     and unnecessary memory allocation has been eliminated.
2009-02-05 13:30:39 +04:00
Gleb Shchepa
334e249f91 Bug #39069: <row constructor> IN <table-subquery> seriously
messed up

"ROW(...) IN (SELECT ... FROM DUAL)" always returned TRUE.

Item_in_subselect::row_value_transformer rewrites "ROW(...)
IN SELECT" conditions into the "EXISTS (SELECT ... HAVING ...)"
form.
For a subquery from the DUAL pseudotable resulting HAVING
condition is an expression on constant values, so further
transformation with optimize_cond() eliminates this HAVING
condition and resets JOIN::having to NULL.
Then JOIN::exec treated that NULL as an always-true-HAVING
and that caused a bug.

To distinguish an optimized out "HAVING TRUE" clause from
"HAVING FALSE" we already have the JOIN::having_value flag.
However, JOIN::exec() ignored JOIN::having_value as described
above as if it always set to COND_TRUE.

The JOIN::exec method has been modified to take into account
the value of the JOIN::having_value field.


mysql-test/r/subselect3.result:
  Added test case for bug #39069.
mysql-test/t/subselect3.test:
  Added test case for bug #39069.
sql/sql_select.cc:
  Bug #39069: <row constructor> IN <table-subquery> seriously
              messed up
  
  The JOIN::exec method has been modified to take into account
  the value of the JOIN::having_value field.
2009-01-28 22:46:45 +04:00
Chad MILLER
d3629d7489 Merge from Tim's 5.0.76-release tree to make 5.0.77 . 2009-01-21 13:45:23 -05:00