Fixed bug #30396.

The bug caused memory corruption for some queries with top OR level
in the WHERE condition if they contained equality predicates and 
other sargable predicates in disjunctive parts of the condition.

The corruption happened because the upper bound of the memory
allocated for KEY_FIELD and SARGABLE_PARAM internal structures
containing info about potential lookup keys was calculated incorrectly
in some cases. In particular it was calculated incorrectly when the
WHERE condition was an OR formula with disjuncts being AND formulas
including equalities and other sargable predicates.


mysql-test/r/select.result:
  Added a test case for bug #30396.
mysql-test/t/select.test:
  Added a test case for bug #30396.
sql/item_cmpfunc.h:
  Removed max_members from the COND_EQUAL class as not useful anymore.
sql/sql_base.cc:
  Added the max_equal_elems field to the st_select_lex structure.
sql/sql_lex.cc:
  Added the max_equal_elems field to the st_select_lex structure.
sql/sql_lex.h:
  Added the max_equal_elems field to the st_select_lex structure.
  The field contains the maximal number of elements in multiple equalities
  built for the query conditions.
sql/sql_select.cc:
  Fixed bug #30396.
  The bug caused memory corruption for some queries with top OR level
  in the WHERE condition if they contained equality predicates and 
  other sargable predicates in disjunctive parts of the condition.
  
  The corruption happened because the upper bound of the memory
  allocated for KEY_FIELD and SARGABLE_PARAM internal structures
  containing info about potential lookup keys was calculated incorrectly
  in some cases. In particular it was calculated incorrectly when the
  WHERE condition was an OR formula with disjuncts being AND formulas
  including equalities and other sargable predicates.
   
  The max_equal_elems field to the st_select_lex structure is used now
  to calculate the above mentioned upper bound. The field contains the
  maximal number of elements in multiple equalities built for the query
  conditions.

1 files changed, 0 insertions, 1 deletions

diff --git a/sql/item_cmpfunc.h b/sql/item_cmpfunc.h
index 9afc0507817..7b6eaef08ec 100644
--- a/sql/item_cmpfunc.h
+++ b/sql/item_cmpfunc.h
@@ -1506,7 +1506,6 @@ public:
                                      the current and level           */
   COND_EQUAL()
   { 
-    max_members= 0;
     upper_levels= 0;
   }
 };