diff options
| author | Oleksandr Byelkin <sanja@mariadb.com> | 2022-11-14 19:09:06 +0100 |
|---|---|---|
| committer | Oleksandr Byelkin <sanja@mariadb.com> | 2022-11-14 19:09:06 +0100 |
| commit | 695f20f1b55949ae5e4870805cf0b056457ec932 (patch) | |
| tree | 9705fed9d5f37c9f8035f10cbd285a48d982895c | |
| parent | dc3782804277ec2c314f4aecc3610aa03220c6db (diff) | |
| download | mariadb-git-mariadb-10.10.2-release.tar.gz | |
MDEV-30007 SIGSEGV in st_select_lex_unit::is_derived_eliminated, runtime error: member access within null pointer of type 'struct TABLE' in st_select_lex_unit::is_derived_eliminated()mariadb-10.10.2-release
Take into account case of a degenerate subquery (like SELECT 1).
| -rw-r--r-- | mysql-test/main/table_elim.result | 20 | ||||
| -rw-r--r-- | mysql-test/main/table_elim.test | 17 | ||||
| -rw-r--r-- | sql/sql_lex.cc | 9 |
3 files changed, 45 insertions, 1 deletions
diff --git a/mysql-test/main/table_elim.result b/mysql-test/main/table_elim.result index 35098b10822..4da85c4a9ca 100644 --- a/mysql-test/main/table_elim.result +++ b/mysql-test/main/table_elim.result @@ -1003,3 +1003,23 @@ a1 a2 5 277 NULL 278 DROP TABLE t1, t2; +# +# MDEV-30007: SIGSEGV in st_select_lex_unit::is_derived_eliminated, +# runtime error: member access within null pointer of type +# 'struct TABLE' in st_select_lex_unit::is_derived_eliminated() +# +CREATE VIEW v AS SELECT 1 AS a; +SELECT ROUND ((SELECT 1 FROM v)) FROM v GROUP BY ROUND ((SELECT 1 FROM v)); +ROUND ((SELECT 1 FROM v)) +1 +EXPLAIN +SELECT ROUND ((SELECT 1 FROM v)) FROM v GROUP BY ROUND ((SELECT 1 FROM v)); +id select_type table type possible_keys key key_len ref rows Extra +1 PRIMARY <derived4> system NULL NULL NULL NULL 1 +4 DERIVED NULL NULL NULL NULL NULL NULL NULL No tables used +2 SUBQUERY <derived5> system NULL NULL NULL NULL 1 +5 DERIVED NULL NULL NULL NULL NULL NULL NULL No tables used +DROP VIEW v; +# +# End of 10.10 tests +# diff --git a/mysql-test/main/table_elim.test b/mysql-test/main/table_elim.test index 70f91eb3d97..d6bf925c2c0 100644 --- a/mysql-test/main/table_elim.test +++ b/mysql-test/main/table_elim.test @@ -783,4 +783,19 @@ SELECT t1.* FROM t1 LEFT JOIN GROUP BY t2.a1) dt ) dt2 ON dt2.a2 = t1.a2; -DROP TABLE t1, t2;
\ No newline at end of file +DROP TABLE t1, t2; + +--echo # +--echo # MDEV-30007: SIGSEGV in st_select_lex_unit::is_derived_eliminated, +--echo # runtime error: member access within null pointer of type +--echo # 'struct TABLE' in st_select_lex_unit::is_derived_eliminated() +--echo # +CREATE VIEW v AS SELECT 1 AS a; +SELECT ROUND ((SELECT 1 FROM v)) FROM v GROUP BY ROUND ((SELECT 1 FROM v)); +EXPLAIN +SELECT ROUND ((SELECT 1 FROM v)) FROM v GROUP BY ROUND ((SELECT 1 FROM v)); +DROP VIEW v; + +--echo # +--echo # End of 10.10 tests +--echo # diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc index 5e9d9a8eb17..a01b1547cf1 100644 --- a/sql/sql_lex.cc +++ b/sql/sql_lex.cc @@ -11924,9 +11924,18 @@ bool SELECT_LEX_UNIT::explainable() const false; } +/* + Determines whether the derived table was eliminated during + the call of eliminate_tables(JOIN *) made at the optimization stage + or completely optimized out (for such degenerate statements like + "SELECT 1", for example) +*/ + bool SELECT_LEX_UNIT::is_derived_eliminated() const { if (!derived) return false; + if (!derived->table) + return true; return derived->table->map & outer_select()->join->eliminated_tables; } |