1
0
mirror of https://github.com/MariaDB/server.git synced 2025-11-25 17:25:02 +03:00
Commit Graph

62059 Commits

Author SHA1 Message Date
Varun Gupta
f9b43c2565 MDEV-16751: Server crashes in st_join_table::cleanup or TABLE_LIST::is_with_table_recursive_reference
with join_cache_level>2

During muliple equality propagation for a query in which we have an IN subquery, the items in the select list of the
subquery may not be part of the multiple equality because there might be another occurence of the same field in the
where clause of the subquery.
So we keyuse_is_valid_for_access_in_chosen_plan function which expects the items in the select list of the subquery to
be same to the ones in the multiple equality (through these multiple equalities we create keyuse array).
The solution would be that we expect the same field not the same Item because when we have SEMI JOIN MATERIALIZATION SCAN,
we use copy back technique to copies back the materialised table fields to the original fields of the base tables.
2018-07-25 14:20:16 +05:30
Igor Babaev
d567f1611e MDEV-16820 Lost 'Impossible where' from query with inexpensive subquery
This patch fixes another problem introduced by the patch for mdev-4817.
The latter changed Item_cond::fix_fields() in such a way that it could
call the virtual method is_expensive(). With the first its call
the method saves the result in Item::is_expensive_cache. For all next
calls the method returns the result from this cache. So if the item
once was determined as expensive the method always returns true.
For subqueries it's not good, because non-optimized subqueries always
is considered as expensive.
It means that the cache should be invalidated after the call of
optimize_constant_subqueries().
2018-07-24 20:00:28 -07:00
Igor Babaev
9cea4ccf12 MDEV-16726 Assertion `tab->type == JT_REF || tab->type == JT_EQ_REF' failed
Due to a legacy bug in the code of make_join_statistics() detecting
so-called constant tables could miss some of them in rare queries
that used RIGHT JOIN. As a result these queries had execution plans
different from the execution plans of the equivalent queries with
LEFT JOIN.
Besides starting from 10.2 this could trigger an assertion failure.
2018-07-19 15:31:46 -07:00
Sergei Petrunia
2fbf2277ff MDEV-15982: Incorrect results when subquery is materialized
fix_semijoin_strategies_for_picked_join_order() should set
join->sjm_lookup_tables to be a bitmap of tables inside
SJ-Materialization-Lookup nests.
2018-07-11 10:43:38 +03:00
Varun Gupta
24a0a74f5d MDEV-16307: Incorrect results when using BNLH join instead of BNL join with views
In this issue we are using derived_with_keys optimization and we are using these keys to do a hash join which is incorrect.
We cannot create keys for dervied tables whose keyparts have types are of BLOB or TEXT type. TEXT or BLOB  columns can only be
indexed over a specified length.
2018-07-10 13:54:04 +05:30
Igor Babaev
90cb721274 MDEV-16603 Crash with set join_cache_level=4
When the definition of the index used for hash join was created
in create_hj_key_for_table() it could cause memory overwrite
due to a bug that led to an underestimation of the number of
the index component.
2018-06-29 22:46:38 -07:00
Sergey Vojtovich
9d41dd2f39 MDEV-8540 - Crash on server shutdown since 10.0.16
For the purpose of reporting an error to error log, shutdown thread was
attempting to access current_thd->variables.lc_messages->errmsgs->errmsgs.
Whereas current_thd was NULL.

We should log errors according to global lc_messages setting instead of
session setting.
2018-06-27 17:25:26 +04:00
Michael Widenius
937c193188 Fixed MDEV-16512, crashing on re-execution of failing SP
MDEV-16512 Server crashes in find_field_in_table_ref on 2nd
execution of SP referring to non-existing field

Problem was in the natural join code that it changed TABLE_LIST and
Item_fields but didn't restore changed things if things goes wrong
and was not able to re-execute after failure.
Some of the problems could have been avoided if we would have run
fix_fields before doing natural join transformations.

Fixed by marking functions complete AFTER they had executed, instead at
start.
I had also to change some tests that checked if Item_fields are usable.

This doesn't fix all known problems, but at least avoids some crashes.
What should be done in the near future is to mark the statement in the SP
as 'not re-executable' and force a reparse of it on next execution.

Reviewer: Sergei Petrunia <psergey@askmonty.org>
2018-06-27 13:41:19 +03:00
Alexander Barkov
15b92915ed MDEV-15834 The code in TABLE_SHARE::init_from_binary_frm_image() is not safe 2018-06-19 13:02:02 +04:00
Igor Babaev
147744d455 MDEV-16235 Server crashes in my_utf8_uni or in my_strtod_int upon
SELECT .. LIMIT 0 (new variant)

This is another attempt to fix the problem of mdev-14515.
2018-06-11 08:52:49 -07:00
Sergei Golubchik
ca733d03c8 MDEV-15729 Server crashes in Field::make_field upon HANDLER READ executed with PS protocol
update table->pos_in_table_list during prepare,
just like it's done in normal execution.

otherwise it'll be a dangling pointer
2018-06-11 09:57:54 +02:00
Oleksandr Byelkin
75b4eb5cc9 Catch of OOM situation. 2018-06-06 15:27:57 +02:00
Varun Gupta
5fb2c586f2 MDEV-16225: wrong resultset from query with semijoin=on
For non-semi-join subquery optimization we do a cost based decision between
Materialisation and IN -> EXIST transformation. The issue in this case is that for IN->EXIST transformation
we run JOIN::reoptimize with the IN->EXISt conditions and we come up with a new query plan. But when we compare
the cost with Materialization, we make the decision to chose Materialization so we need to restore the query plan
for Materilization.
The saving and restoring for keyuse array and join_tab keyuse is only done when we have atleast
one element in the keyuse_array , we are now changing to do it even for 0 elements to main the generality.
2018-06-02 11:52:48 +05:30
Igor Babaev
6a04c2a1aa MDEV-16235 Server crashes in my_utf8_uni or in my_strtod_int
upon SELECT .. LIMIT 0

The code must differentiate between a SELECT with contradictory
WHERE/HAVING and one with LIMIT 0.
Also for the latter printed 'Zero limit' instead of 'Impossible where'
in the EXPLAIN output.
2018-05-22 12:09:05 -07:00
Sergei Golubchik
1b2078b4d8 MDEV-15318 CREATE .. SELECT VALUES produces invalid table structure
When Item_insert_value needs a dummy field,
use zero-length Field_string, not Field_null.
The latter isn't compatible with CREATE ... SELECT.
2018-05-17 11:32:13 +02:00
Sergei Golubchik
fab383aac0 Use after free in authentication 2018-05-01 00:30:17 +02:00
Igor Babaev
eb057dce20 MDEV-15035 Wrong results when calling a stored procedure
multiple times with different arguments.

If the ON expression of an outer join is an OR formula with one
of the disjunct being a constant formula then the expression
cannot be null-rejected if the constant formula is true. Otherwise
it can be null-rejected and if so the outer join can be converted
into inner join. This optimization was added in the patch for
mdev-4817. Yet the code had a defect: if the query was used in
a stored procedure with parameters and the constant item contained
some of them then the value of this constant item depended on the
values of the parameters. With some parameters it may be true,
for others not. The validity of conversion to inner join is checked
only once and it happens only for the first call of procedure.
So if the  parameters in the first call allowed the conversion it
was done and next calls used the transformed query though there
could be calls whose parameters made the conversion invalid.

Fixed by cheking whether the constant disjunct in the ON expression
originally contained an SP parameter. If so the expression is not
considered as null-rejected. For this check a new item's attribute
was intruduced: Item::with_param. It is calculated for each item
by fix fields() functions.
Also moved the call of optimize_constant_subqueries() in
JOIN::optimize after the call of simplify_joins(). The reason
for this is that after the optimization introduced by the patch
for mdev-4817 simplify_joins() can use the results of execution
of non-expensive constant subqueries and this is not valid.
2018-04-25 09:22:06 -07:00
Oleksandr Byelkin
adaa891ae7 MDEV-13699: Assertion `!new_field->field_name.str || strlen(new_field->field_name.str) == new_field->field_name.length' failed in create_tmp_table on 2nd execution of PS with semijoin
The problem was that SJ (semi-join) used secondary list (array) of subquery select list. The items there was prepared once then cleaned up (but not really freed from memory because it was made in statement memory).
Original list was not prepared after first execution because select was removed by conversion to SJ.
The solution is to use original list but prepare it first.
2018-04-25 08:47:43 +02:00
Sergei Golubchik
1a019d0801 Merge branch 'mysql/5.5' into 5.5 2018-04-19 22:31:26 +02:00
Igor Babaev
5e61e1716e MDEV-14515 ifnull result depends on number of rows in joined table
Any expensive WHERE condition for a table-less query with
implicit aggregation was lost. As a result the used aggregate
functions were calculated over a non-empty set of rows even
in the case when the condition was false.
2018-04-16 16:59:19 -07:00
Alexey Botchkov
3eb2a265ea MDEV-14185 CREATE TEMPORARY TABLE AS SELECT causes error 1290 with read_only and InnoDB.
condition fixed.
2018-04-08 09:05:00 +04:00
Alexey Botchkov
d6f3a0064b MDEV-14185 CREATE TEMPORARY TABLE AS SELECT causes error 1290 with read_only and InnoDB.
handler::ha_create_handler_files shouldn't call the
mark_trx_read_write() for the temporary table.
2018-04-07 21:51:15 +04:00
Alexander Barkov
6beb08c7b6 MDEV-15624 Changing the default character set to utf8mb4 changes query evaluation in a very surprising way 2018-04-04 09:12:44 +04:00
Alexander Barkov
606e21867c MDEV-15630 uuid() function evaluates at wrong time in query 2018-04-03 16:28:52 +04:00
Varun Gupta
bdab8b74ff MDEV-11274: Executing EXPLAIN of complex query over join limit causes server to crash
For this case we have a view that is mergeable but we are not able to merge it in the
parent select because that would exceed the maximum tables allowed in the join list, so we
materialise this view
TABLE_LIST::dervied is NULL for such views, it is only set for views which have ALGORITHM=TEMPTABLE
Fixed by making sure TABLE_LIST::derived is set for views that could not be merged
2018-03-27 11:16:15 +03:00
Alexander Barkov
e8c2366bf8 MDEV-15620 Crash when using "SET @@NEW.a=expr" inside a trigger
A simple patch fixing the problem in 5.5.
Note, a full patch was previously fixed to 10.3.
2018-03-27 09:40:10 +04:00
Varun Gupta
ddc5c65333 MDEV-14779: using left join causes incorrect results with materialization and derived tables
Conversion of a subquery to a semi-join is blocked when we have an
IN subquery predicate in the on_expr of an outer join. Currently this
scenario is handled but the cases when an IN subquery predicate is wrapped
inside a Item_in_optimizer item then this blocking is not done.
2018-03-22 03:01:53 +05:30
Oleksandr Byelkin
f3994b7432 MDEV-15492: Subquery crash similar to MDEV-10050
Detection of first execution of PS fixed.
More debug info.
2018-03-21 19:47:42 +01:00
Varun Gupta
2dd4e50d5f MDEV-15555: select from DUAL where false yielding wrong result when in a IN
For the query having an IN subquery with no tables, we were converting the subquery with an expression between
the left part and the select list of the subquery . This can give incorrect results when we have a condition
in the subquery with a dual table (as this is treated as a no table).

The fix is that we don't do this conversion when we have conds in the subquery with a dual table.
2018-03-21 09:38:56 +02:00
Varun Gupta
926edd48e1 MDEV-15235: Assertion `length > 0' failed in create_ref_for_key
The issue is that we are creating a materialised table with key of length 0 which is incorrect, we should
disable materialisation for such a case.
2018-03-11 16:17:14 +05:30
Nisha Gopalakrishnan
c0b4d74b52 BUG#27216817: INNODB: FAILING ASSERTION:
PREBUILT->TABLE->N_MYSQL_HANDLES_OPENED == 1

ANALYSIS:
=========

Adding unique index to a InnoDB table which is locked as
mutliple instances may trigger an InnoDB assert.

When we add a primary key or an unique index, we need to
drop the original table and rebuild all indexes. InnoDB
expects that only the instance of the table that is being
rebuilt, is open during the process. In the current
scenario we have opened multiple instances of the table.
This triggers an assert during table rebuild.
'Locked_tables_list' encapsulates a list of all
instances of tables locked by LOCK TABLES statement.

FIX:
===
We are now temporarily closing all the instances of the
table except the one which is being altered and later
reopen them via Locked_tables_list::reopen_tables().
2018-02-26 14:37:39 +05:30
Sergei Golubchik
03de234baf MDEV-13982 Server crashes in in ha_partition::engine_name
use the correct handlerton when looking for TRANSACTIONAL=1 support
2018-02-14 19:12:23 +01:00
Joao Gramacho
3fb2f8db17 BUG#24365972 BINLOG DECODING ISN'T RESILIENT TO CORRUPT BINLOG FILES
Problem
=======

When facing decoding of corrupt binary log files, server may misbehave
without detecting the events corruption.

This patch makes MySQL server more resilient to binary log decoding.

Fixes for events de-serialization and apply
===========================================

@sql/log_event.cc

Query_log_event::Query_log_event: added a check to ensure query length
is respecting event buffer limits.

Query_log_event::do_apply_event: extended a debug print, added a check
to character set to determine if it is "parseable" or not, verified if
database name is valid for system collation.

Start_log_event_v3::do_apply_event: report an error on applying a
non-supported binary log version.

Load_log_event::copy_log_event: added a check to table_name length.

User_var_log_event::User_var_log_event: added checks to avoid reading
out of buffer limits.

User_var_log_event::do_apply_event: reported an sanity check error
properly and added individual sanity checks for variable types that
expect fixed (or minimum) amount of bytes to be read.

Rows_log_event::Rows_log_event: added checks to avoid reading out of
buffer limits.

@sql/log_event_old.cc

Old_rows_log_event::Old_rows_log_event: added a sanity check to avoid
reading out of buffer limits.

@sql/sql_priv.h

Added a sanity check to available_buffer() function.
2018-02-02 11:45:56 +00:00
Vicențiu Ciorbaru
5edd129fbf Fix ASAN failure in main.lock (and others)
Whenever one copies an IO_CACHE struct, one must remember to call
setup_io_cache, if not, the IO_CACHE's current_pos and end_pos
self-references will point to the previous struct's memory, which
could go out of scope. Commit 9003869390
fixes this problem in a more general fashion by removing the
self-references altogether, but for 5.5 we'll keep the old behaviour.
2018-01-30 21:13:24 +02:00
Vicențiu Ciorbaru
ded07724ee MDEV-15014 Assertion `m_cache_lock_status == LOCKED_NO_WAIT || m_cache_status == DISABLE_REQUEST' failed in Query_cache::free_cache on startup
The assert guards against not-locked or not-requested query cache
disabling. If during startup we disable query cache, we failed to
request disabling.
2018-01-30 21:13:24 +02:00
Oleksandr Byelkin
ee8755e3c5 MDEV-15012: ASAN: numerous test failures in PS
First roll back changes, then free Items which can lead to memory freeing.
2018-01-24 14:42:52 +01:00
Oleksandr Byelkin
76577e1e26 typo fix 2018-01-24 10:58:27 +01:00
Oleksandr Byelkin
ba8d0fa700 MDEV-14786: Server crashes in Item_cond::transform on 2nd execution of SP querying from a view
MDEV-14957: JOIN::prepare gets unusable "conds" as argument

Do not touch merged derived (it is irreversible)

Fix first argument of in_optimizer for calls possible before fix_fields()
2018-01-23 13:42:41 +01:00
Oleksandr Byelkin
11408a69ad Fix Item tree changes/rollback debug print 2018-01-23 13:42:41 +01:00
Sachin Setiya
94da1cb4a6 MDEV-14586 Assertion `0' failed in retrieve_auto_increment ...
Problem:-
 If we create table using myisam/aria then this crashes the server.
  CREATE TABLE t1(a bit(1), b int auto_increment , index(a,b));
  insert into t1 values(1,1);
 Or this query
  CREATE TABLE t1 (b BIT(1), pk INTEGER AUTO_INCREMENT PRIMARY KEY);
  ALTER TABLE t1 ADD INDEX(b,pk);
  INSERT INTO t1 VALUES (1,b'1');
  ALTER TABLE t1 DROP PRIMARY KEY;

Reason:-
 The reason for this is
 1st- find_ref_key() finds what key an auto_increment field belongs to by
  comparing key_part->offset and field->ptr. But BIT fields might have
  zero length in the record, so a key might have many key parts with the
  same offset. That is, comparing offsets cannot uniquely identify the
  correct key part.
 2nd- Since next_number_key_offset is zero it myisam/aria will think that
  auto_increment is in first part of key.
 3nd- myisam/aria will call retrieve_auto_key which will see first key_part
  field as a bit field and call assert(0)

Solution:-
  Many key parts might have the same offset, but BIT fields do not
  support auto_increment. So, we can skip all key parts over BIT fields,
  and then comparing offsets will be unambiguous.
2018-01-23 17:29:58 +05:30
Karim Geiger
701c7e777f Fix error message typo 2018-01-23 15:26:54 +04:00
Eugene Kosov
3532a421f6 fix build for recent clang
/home/kevg/work/mariadb/sql/sql_partition.cc:286:47: error: cannot initialize a parameter of type 'HA_CREATE_INFO *' (aka 'st_ha_create_information *') with an rvalue of type 'ulonglong' (aka 'unsigned long long')
                                              (ulonglong)0, (uint)0);
                                              ^~~~~~~~~~~~
/home/kevg/work/mariadb/sql/partition_info.h:281:72: note: passing argument to parameter 'info' here
  bool set_up_defaults_for_partitioning(handler *file, HA_CREATE_INFO *info,
                                                                       ^
2018-01-23 14:45:37 +04:00
Vicențiu Ciorbaru
b20c3dc664 MDEV-14715: Assertion `!table || (!table->read_set... failed in Field_num::val_decimal
The assertion failure was caused by an incorrectly set read_set for
functions in the ORDER BY clause in part of a union, when we are using
a mergeable view and the order by clause can be skipped (removed).

An order by clause can be skipped if it's part of one part of the UNION as
the result set is not meaningful when multiple SELECT queries are UNIONed. The
server is aware of this optimization and tries to remove the order by
clause before JOIN::prepare. The problem is that we need to throw an
error when the ORDER BY clause contains invalid columns. To do this, we
attempt resolving the ORDER BY expressions, then subsequently drop them
if resolution succeeded. However, ORDER BY resolution had the side
effect of adding the expressions to the all_fields list, which is used
to construct temporary tables to store the result. We may be ignoring
the ORDER BY statement, but the tmp table still tried to compute the
values for the expressions, even if the columns are never used.

The assertion only shows itself if the order by clause contains members
which were not previously in the select list, and are part of a
function.

There is an additional question as to why this only manifests when using
VIEWS and not when using a regular table. The difference lies with the
"reset" of the read_set for the temporary table during
SELECT_LEX::update_used_tables() in JOIN::optimize(). The changes
introduced in fdf789a7ea cleared the
read_set when a mergeable view is encountered in the TABLE_LIST
defintion.

Upon initial order_list resolution, the table's read_set is updated
correctly. JOIN::optimize() will only reset the read_set if it
encounters a VIEW. Since we no longer have ORDER BY clause in
JOIN::optimize() we never get to correctly update the read_set again.

Other relevant commit by Timour, which first introduced the order
resolution when we "can_skip_sort_order":
883af99e7d

Solution:
Don't add the resolved ORDER BY elements to all_fields. We only resolve
them to check if an error should be returned for the query. Ignore them
completely otherwise.
2018-01-22 15:39:42 +02:00
Vicențiu Ciorbaru
6d826e3d7e Remove commented out code post merge fix in 2011 2018-01-22 15:39:42 +02:00
Sergei Golubchik
36eb0b7a55 improve ASAN instrumentation: table->record[0]
instrument table->record[0], table->record[1] and share->default_values.

One should not access record image beyond share->reclength, even
if table->record[0] has some unused space after it (functions that
work with records, might get a copy of the record as an argument,
and that copy - not being record[0] - might not have this buffer space
at the end). See b80fa4000d and 444587d8a3
2018-01-22 11:39:54 +01:00
Sergei Golubchik
22ae3843db Correct TRASH() macro usage
TRASH was mapped to TRASH_FREE and was supposed to be used for memory
that should not be accessed anymore, while TRASH_ALLOC() is to be
used for uninitialized but to-be-used memory.

But sometimes TRASH() was used in the latter sense.

Remove TRASH() macro, always use explicit TRASH_ALLOC() or TRASH_FREE().
2018-01-22 11:39:54 +01:00
Sergei Golubchik
204cb85aab Fix compilation without dlopen 2018-01-22 11:39:54 +01:00
Varun Gupta
a7a4519a40 MDEV-14241: Server crash in key_copy / get_matching_chain_by_join_key or valgrind warnings
In this case we were using the optimization derived_with_keys but we could not create a key
because the length of the key was greater than the max allowed(MI_MAX_KEY_LENGTH).
To do the join we needed to create a hash join key instead, but in the explain output it
showed that we were still referring to derived keys which were created but not used.
2018-01-19 13:29:31 +05:30
Igor Babaev
4f96b401d9 Fixed mdev-14960 [ERROR] mysqld got signal 11 with join_buffer and join_cache
In the function JOIN::shrink_join_buffers the iteration over joined
tables was organized in a wrong way. This could cause a crash if
the optimizer chose to materialize a semi-join that used join caches
for which the sizes must be adjusted.
2018-01-18 09:57:25 -08:00
Sergei Golubchik
2d52d3c1bf Merge branch 'mysql/5.5' into 5.5 2018-01-18 17:54:48 +01:00