BUG#19021, Crash in ROR-index_merge optimizer:

get_best_covering_ror_intersect() was copying ror_scans starting from the 
end of the array and not from its beginning.


mysql-test/r/index_merge_innodb.result:
  Testcase for BUG#19021
mysql-test/t/index_merge_innodb.test:
  Testcase for BUG#19021
sql/opt_range.cc:
  BUG#19021: In get_best_covering_ror_intersect(), the array of pointers to
  scans to be used is [tree->ror_scans, ror_scan_mark), and not
  [ror_scan_mark, ...)

3 files changed, 75 insertions, 1 deletions

diff --git a/mysql-test/r/index_merge_innodb.result b/mysql-test/r/index_merge_innodb.result
index 4dac5f3b62b..c0c850ee310 100644
--- a/mysql-test/r/index_merge_innodb.result
+++ b/mysql-test/r/index_merge_innodb.result
@@ -260,3 +260,25 @@ t_vers	t_rele	t_cust	filler1
 7.6 	a 	    	
 7.6 	a 	    	
 drop table t1;
+create table t1 (
+pk int(11) not null auto_increment,
+a int(11) not null default '0',
+b int(11) not null default '0',
+c int(11) not null default '0',
+filler1 datetime, filler2 varchar(15),
+filler3 longtext,
+kp1 varchar(4), kp2 varchar(7),
+kp3 varchar(2), kp4 varchar(4),
+kp5 varchar(7),
+filler4 char(1),
+primary key (pk),
+key idx1(a,b,c),
+key idx2(c),
+key idx3(kp1,kp2,kp3,kp4,kp5)
+) engine=innodb default charset=latin1;
+set @fill=NULL;
+SELECT COUNT(*) FROM t1 WHERE b = 0 AND a = 0 AND c = 13286427 AND 
+kp1='279' AND kp2='ELM0678' AND kp3='6' AND kp4='10' AND  kp5 = 'R        ';
+COUNT(*)
+1
+drop table t1;
diff --git a/mysql-test/t/index_merge_innodb.test b/mysql-test/t/index_merge_innodb.test
index a48626a9ec3..25f4e0b4e65 100644
--- a/mysql-test/t/index_merge_innodb.test
+++ b/mysql-test/t/index_merge_innodb.test
@@ -248,3 +248,55 @@ select t_vers,t_rele,t_cust,filler1 from t1 where t_vers = '7.6'
 
 drop table t1;
 
+# BUG#19021: Crash in index_merge/ROR-intersection optimizer under
+# specific circumstances.
+create table t1 (
+  pk int(11) not null auto_increment,
+  a int(11) not null default '0',
+  b int(11) not null default '0',
+  c int(11) not null default '0',
+
+  filler1 datetime, filler2 varchar(15),
+  filler3 longtext,
+  
+  kp1 varchar(4), kp2 varchar(7),
+  kp3 varchar(2), kp4 varchar(4),
+  kp5 varchar(7),
+  filler4 char(1),
+
+  primary key (pk),
+  key idx1(a,b,c),
+  key idx2(c),
+  key idx3(kp1,kp2,kp3,kp4,kp5)
+) engine=innodb default charset=latin1;
+--disable_query_log
+set @fill= uncompress(unhex(concat(
+'F91D0000789CDD993D6FDB301086F7FE0A6D4E0105B8E3F1335D5BA028DA0EEDE28E1D320408',
+'52A0713BF4D7571FB62C51A475924839080307B603E77DEE787C8FA41F9E9EEF7F1F8A87A7C3',
+'AFE280C5DF9F8F7FEE9F8B1B2CB114D6902E918455245DB91300FA16E42D5201FA4EE29DA05D',
+'B9FB3718A33718A3FA8C30AEFAFDE1F317D016AA67BA7A60FDE45BF5F8BA7B5BDE8812AA9F1A',
+'069DB03C9804346644F3A3A6A1338DB572756A3C4D1BCC804CABF912C654AE9BB855A2B85962',
+'3A479259CAE6A86C0411D01AE5483581EDCBD9A39C45252D532E533979EB9F82E971D979BDB4',
+'8531105670740AFBFD1E34AAB0029E4AD0A1D46A6D0946A21A16038A5CD965CD2D524673F712',
+'20C304477315CE18405EAF9BD0AFFEAC74FDA14F1FBF5BD34C769D73FBBEDF4750ADD4E5A99C',
+'5C8DC04934AFA275D483D536D174C11B12AF27F8F888B41B6FC9DBA569E1FD7BD72D698130B7',
+'91B23A98803512B3D31881E8DCDA2AC1754E3644C4BB3A8466750B911681274A39E35E8624B7',
+'444A42AC1213F354758E3CF1A4CDD5A688C767CF1B11ABC5867CB15D8A18E0B91E9EC275BB94',
+'58F33C2936F64690D55BC29E4A293D95A798D84217736CEAAA538CE1354269EE2162053FBC66',
+'496D90CB53323CB279D3A6AF651B4B22B9E430743D83BE48E995A09D4FC9871C22D8D189B945',
+'706911BCB8C3C774B9C08D2FC6ED853ADACA37A14A4CB2E027630E5B80ECACD939431B1CDF62',
+'7D71487536EA2C678F59685E91F4B6C144BCCB94C1EBA9FA6F5552DDCA4E4539BE326A2720CB',
+'45ED028EB3616AC93C46E775FEA9FA6DA7CFCEC6DEBA5FCD1F915EED4D983BDDB881528AD9AB',
+'43C1576F29AAB35BDFBC21D422F52B307D350589D45225A887AC46C8EDD72D99EC3ED2E1BCEF',
+'7AF26FC4C74097B6768A5EDAFA660CC64278F7E63F99AC954B')));
+prepare x from @fill; 
+execute x;
+deallocate prepare x;
+--enable_query_log
+set @fill=NULL;
+SELECT COUNT(*) FROM t1 WHERE b = 0 AND a = 0 AND c = 13286427 AND 
+ kp1='279' AND kp2='ELM0678' AND kp3='6' AND kp4='10' AND  kp5 = 'R        ';
+
+drop table t1;
+
+
diff --git a/sql/opt_range.cc b/sql/opt_range.cc
index d76495a0678..ae02bb8934c 100644
--- a/sql/opt_range.cc
+++ b/sql/opt_range.cc
@@ -3176,7 +3176,7 @@ TRP_ROR_INTERSECT *get_best_covering_ror_intersect(PARAM *param,
                                                      sizeof(ROR_SCAN_INFO*)*
                                                      best_num)))
     DBUG_RETURN(NULL);
-  memcpy(trp->first_scan, ror_scan_mark, best_num*sizeof(ROR_SCAN_INFO*));
+  memcpy(trp->first_scan, tree->ror_scans, best_num*sizeof(ROR_SCAN_INFO*));
   trp->last_scan=  trp->first_scan + best_num;
   trp->is_covering= TRUE;
   trp->read_cost= total_cost;