Fixed bug #28598.

mysqld crashed when a long-running explain query was killed from
another connection.

When the current thread caught a kill signal executing the function
best_extension_by_limited_search it just silently returned to  
the calling function greedy_search without initializing elements of
the join->best_positions array.
However, the greedy_search function ignored thd->killed status
after a calls to the best_extension_by_limited_search function, and
after several calls the greedy_search function used an uninitialized
data from the join->best_positions[idx] to search position in the
join->best_ref array. 
That search failed, and greedy_search tried to call swap_variables
function with NULL argument - that caused a crash.


sql/sql_select.cc:
  Fixed bug #28598.
  choose_plan(), greedy_search(), best_extension_by_limited_search()
  and find_best() functions have been changed to return TRUE in case
  of fatal error.
mysql-test/t/kill.test:
  Updated test case for bug #28598.
mysql-test/r/kill.result:
  Updated test case for bug #28598.

1 files changed, 2 insertions, 0 deletions

diff --git a/mysql-test/r/kill.result b/mysql-test/r/kill.result
index 4bc04c6de3c..a4966d9d5ec 100644
--- a/mysql-test/r/kill.result
+++ b/mysql-test/r/kill.result
@@ -123,3 +123,5 @@ release_lock("lock27563")
 drop table t1, t2;
 drop function bug27563;
 drop procedure proc27563;
+PREPARE stmt FROM 'EXPLAIN SELECT * FROM t1,t2,t3,t4,t5,t6,t7,t8,t9,t10,t11,t12,t13,t14,t15,t16,t17,t18,t19,t20,t21,t22,t23,t24,t25,t26,t27,t28,t29,t30,t31,t32,t33,t34,t35,t36,t37,t38,t39,t40 WHERE a1=a2 AND a2=a3 AND a3=a4 AND a4=a5 AND a5=a6 AND a6=a7 AND a7=a8 AND a8=a9 AND a9=a10 AND a10=a11 AND a11=a12 AND a12=a13 AND a13=a14 AND a14=a15 AND a15=a16 AND a16=a17 AND a17=a18 AND a18=a19 AND a19=a20 AND a20=a21 AND a21=a22 AND a22=a23 AND a23=a24 AND a24=a25 AND a25=a26 AND a26=a27 AND a27=a28 AND a28=a29 AND a29=a30 AND a30=a31 AND a31=a32 AND a32=a33 AND a33=a34 AND a34=a35 AND a35=a36 AND a36=a37 AND a37=a38 AND a38=a39 AND a39=a40  ';
+EXECUTE stmt;