diff options
| author | Igor Babaev <igor@askmonty.org> | 2022-08-24 11:07:09 -0700 |
|---|---|---|
| committer | Igor Babaev <igor@askmonty.org> | 2022-08-25 09:53:23 -0700 |
| commit | 94e3f02db741e4a35f3aba22c258e20fe9617d75 (patch) | |
| tree | 9fa243214cf768db2cb958808007a22a520c362c /sql/item_subselect.cc | |
| parent | d1a80c42ee5b9c845ca72288d3bc58b47f5632a3 (diff) | |
| download | mariadb-git-94e3f02db741e4a35f3aba22c258e20fe9617d75.tar.gz | |
MDEV-29350 Crash when IN predicand is used in eliminated GROUP BY clause
This bug affected some queries with an IN/ALL/ANY predicand or an EXISTS
predicate whose subquery contained a GROUP BY clause that could be
eliminated. If this clause used a IN/ALL/ANY predicand whose left operand
was a single-value subquery then execution of the query caused a crash of
the server after invokation of remove_redundant_subquery_clauses().
The crash was caused by an attempt to exclude the unit for the single-value
subquery from the query tree for the second time by the function
Item_subselect::eliminate_subselect_processor().
This bug had been masked by the bug MDEV-28617 until a fix for the latter
that properly excluded units was pushed into 10.3.
Approved by Oleksandr Byelkin <sanja@mariadb.com>
Diffstat (limited to 'sql/item_subselect.cc')
| -rw-r--r-- | sql/item_subselect.cc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc index 2e33a71b8f9..ee36ee2fae9 100644 --- a/sql/item_subselect.cc +++ b/sql/item_subselect.cc @@ -379,7 +379,8 @@ bool Item_subselect::mark_as_eliminated_processor(void *arg) bool Item_subselect::eliminate_subselect_processor(void *arg) { unit->item= NULL; - unit->exclude(); + if (!unit->is_excluded()) + unit->exclude(); eliminated= TRUE; return FALSE; } |