diff options
| author | Sergei Petrunia <sergey@mariadb.com> | 2022-04-26 23:29:29 +0300 |
|---|---|---|
| committer | Sergei Petrunia <sergey@mariadb.com> | 2022-04-29 11:00:37 +0300 |
| commit | 8db9aa496c59e48238ed5718d683fb6bf2ae2445 (patch) | |
| tree | 66a006f61fa64dc5e1cb509d655fa90c11031a59 /mysql-test/main/subselect4.test | |
| parent | 3f68c2169e16814e8e268d0f9a9f29aee522453e (diff) | |
| download | mariadb-git-8db9aa496c59e48238ed5718d683fb6bf2ae2445.tar.gz | |
MDEV-28268: Server crashes in Expression_cache_tracker::fetch_current_stats
(cherry-pick into preview-10.9-MDEV-27021-explain tree)
Expression_cache_tmptable object uses an Expression_cache_tracker object
to report the statistics.
In the common scenario, Expression_cache_tmptable destructor sets
tracker->cache=NULL. The tracker object survives after the expression
cache is deleted and one may call cache_tracker->fetch_current_stats()
for it with no harm.
However a degenerate cache with no parameters does not set
tracker->cache=NULL in Expression_cache_tmptable destructor which
results in an attempt to use freed data in the
cache_tracker->fetch_current_stats() call.
Fixed by setting tracker->cache to NULL and wrapping the assignment into
a function.
Diffstat (limited to 'mysql-test/main/subselect4.test')
| -rw-r--r-- | mysql-test/main/subselect4.test | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/mysql-test/main/subselect4.test b/mysql-test/main/subselect4.test index cde9b4c25c3..95e73755226 100644 --- a/mysql-test/main/subselect4.test +++ b/mysql-test/main/subselect4.test @@ -2425,6 +2425,21 @@ set optimizer_switch=@tmp_os; drop table t1, t10, t11; +--echo # +--echo # MDEV-28268: Server crashes in Expression_cache_tracker::fetch_current_stats +--echo # +CREATE TABLE t1 (a INT, b INT); +INSERT INTO t1 VALUES (1,2),(3,4); + +--source include/analyze-format.inc +ANALYZE FORMAT=JSON +SELECT DISTINCT + (SELECT MIN(a) FROM t1 WHERE b <= ANY (SELECT a FROM t1)) AS f +FROM t1; + +# Cleanup +DROP TABLE t1; + --echo # End of 10.2 tests --echo # End of 10.3 tests @@ -2470,3 +2485,4 @@ select * from t1 where t1.a in (select t2.a from t2 order by t2.b); drop table t0, t1, t2; --echo # End of 10.4 tests + |