MDEV-31162 Crash for query using ROWNUM over multi-table view with ORDER BYbb-10.6-igor

This bug could cause a crash of the server when processing a query with
ROWNUM() if it used in its FROM list a reference to a mergeable view
defined as SELECT over more than one table that contained ORDER BY clause.
When a mergeable view with ORDER BY clause and without LIMIT clause is used
in the FROM list of a query that does not have ORDER BY clause the ORDER BY
clause of the view is moved to the query. The code that performed this
transformation forgot to delete the moved ORDER BY list from the view.
If a query contains ROWNUM() and uses a mergeable multi-table view with
ORDER BY then according to the current code of TABLE_LIST::init_derived()
the view has to be forcibly materialized. As the query and the view shared
the same items in its ORDER BY lists they could not be properly resolved
either in the query or in the view. This led to a crash of the server.

This patch has returned back the original signature of LEX::can_not_use_merged()
to comply with 10.4 code of the condition that checks whether a megeable
view has to be forcibly materialized.

Approved by Oleksandr Byelkin <sanja@mariadb.com>

4 files changed, 10 insertions, 9 deletions

diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index 743488ab808..dd3d182784c 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -4090,7 +4090,7 @@ bool LEX::can_use_merged()
     TRUE  - VIEWs with MERGE algorithms can be used
 */
 
-bool LEX::can_not_use_merged(bool no_update_or_delete)
+bool LEX::can_not_use_merged()
 {
   switch (sql_command) {
   case SQLCOM_CREATE_VIEW:
@@ -4103,10 +4103,6 @@ bool LEX::can_not_use_merged(bool no_update_or_delete)
   case SQLCOM_SHOW_FIELDS:
     return TRUE;
 
-  case SQLCOM_UPDATE_MULTI:
-  case SQLCOM_DELETE_MULTI:
-    return no_update_or_delete;
-
   default:
     return FALSE;
   }
diff --git a/sql/sql_lex.h b/sql/sql_lex.h
index 2076fdf21f4..d457e309014 100644
--- a/sql/sql_lex.h
+++ b/sql/sql_lex.h
@@ -3659,7 +3659,7 @@ public:
 
   bool can_be_merged();
   bool can_use_merged();
-  bool can_not_use_merged(bool no_update_or_delete);
+  bool can_not_use_merged();
   bool only_view_structure();
   bool need_correct_ident();
   uint8 get_effective_with_check(TABLE_LIST *view);
diff --git a/sql/sql_view.cc b/sql/sql_view.cc
index e3bfe37b172..a4da5c48b6d 100644
--- a/sql/sql_view.cc
+++ b/sql/sql_view.cc
@@ -1808,7 +1808,7 @@ bool mysql_make_view(THD *thd, TABLE_SHARE *share, TABLE_LIST *table,
     if (view_is_mergeable &&
         (table->select_lex->master_unit() != &old_lex->unit ||
          old_lex->can_use_merged()) &&
-        !old_lex->can_not_use_merged(0))
+        !old_lex->can_not_use_merged())
     {
       /* lex should contain at least one table */
       DBUG_ASSERT(view_main_select_tables != 0);
@@ -1841,8 +1841,11 @@ bool mysql_make_view(THD *thd, TABLE_SHARE *share, TABLE_LIST *table,
       */
       if (!table->select_lex->master_unit()->is_unit_op() &&
           table->select_lex->order_list.elements == 0)
+      {
         table->select_lex->order_list.
           push_back(&lex->first_select_lex()->order_list);
+        lex->first_select_lex()->order_list.empty();
+      }
       else
       {
         if (old_lex->sql_command == SQLCOM_SELECT &&
diff --git a/sql/table.cc b/sql/table.cc
index 1bc7b36775a..5bbecb88bb6 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -9551,8 +9551,10 @@ bool TABLE_LIST::init_derived(THD *thd, bool init_view)
          (!first_select->group_list.elements &&
           !first_select->order_list.elements)) &&
         (is_view() ||
-         (optimizer_flag(thd, OPTIMIZER_SWITCH_DERIVED_MERGE) &&
-          !thd->lex->can_not_use_merged(1))) &&
+         optimizer_flag(thd, OPTIMIZER_SWITCH_DERIVED_MERGE)) &&
+          !thd->lex->can_not_use_merged() &&
+        !((thd->lex->sql_command == SQLCOM_UPDATE_MULTI ||
+           thd->lex->sql_command == SQLCOM_DELETE_MULTI) && !is_view()) &&
         !is_recursive_with_table())
       set_merged_derived();
     else