MDEV-22748 MariaDB crash on WITH RECURSIVE large query

This bug is the same as the bug MDEV-17024. The crashes caused by these
bugs were due to premature cleanups of the unit specifying recursive CTEs
that happened in some cases when there were several outer references the
same recursive CTE.
The problem of premature cleanups for recursive CTEs could be already
resolved by the correction in TABLE_LIST::set_as_with_table() introduced
in this patch. ALL other changes introduced by the patches for MDEV-17024
and MDEV-22748 guarantee that this clean-ups are performed as soon as
possible: when the select containing the last outer reference to a
recursive CTE is being cleaned up the specification of the recursive CTE
should be cleaned up as well.

3 files changed, 15 insertions, 5 deletions

diff --git a/sql/sql_cte.cc b/sql/sql_cte.cc
index d922a7a7551..fe8e0de71b4 100644
--- a/sql/sql_cte.cc
+++ b/sql/sql_cte.cc
@@ -1099,6 +1099,7 @@ bool TABLE_LIST::set_as_with_table(THD *thd, With_element *with_elem)
   {
     derived= with_elem->spec;
     if (derived != select_lex->master_unit() &&
+        !with_elem->is_recursive &&
         !is_with_table_recursive_reference())
     {
        derived->move_as_slave(select_lex);
diff --git a/sql/sql_derived.cc b/sql/sql_derived.cc
index 6785bf8e815..39499e6895f 100644
--- a/sql/sql_derived.cc
+++ b/sql/sql_derived.cc
@@ -1054,7 +1054,6 @@ bool mysql_derived_fill(THD *thd, LEX *lex, TABLE_LIST *derived)
   DBUG_ASSERT(derived->table && derived->table->is_created());
   select_union *derived_result= derived->derived_result;
   SELECT_LEX *save_current_select= lex->current_select;
-  bool derived_recursive_is_filled= false;
   
   if (derived_is_recursive)
   {
@@ -1067,7 +1066,6 @@ bool mysql_derived_fill(THD *thd, LEX *lex, TABLE_LIST *derived)
     {
       /* In this case all iteration are performed */
       res= derived->fill_recursive(thd);
-      derived_recursive_is_filled= true;
     }
   }
   else if (unit->is_union())
@@ -1123,9 +1121,7 @@ bool mysql_derived_fill(THD *thd, LEX *lex, TABLE_LIST *derived)
     }
   }
 
-  if (res || (!lex->describe &&
-              (!derived_is_recursive ||
-               derived_recursive_is_filled)))
+  if (res || (!lex->describe && !derived_is_recursive))
     unit->cleanup();
   lex->current_select= save_current_select;
 
diff --git a/sql/sql_union.cc b/sql/sql_union.cc
index 7e4d06b03f2..b2198eb2b31 100644
--- a/sql/sql_union.cc
+++ b/sql/sql_union.cc
@@ -1540,6 +1540,19 @@ bool st_select_lex::cleanup()
     delete join;
     join= 0;
   }
+  for (TABLE_LIST *tbl= get_table_list(); tbl; tbl= tbl->next_local)
+  {
+    if (tbl->is_recursive_with_table() &&
+        !tbl->is_with_table_recursive_reference())
+    {
+      /*
+        If query is killed before open_and_process_table() for tbl
+        is called then 'with' is already set, but 'derived' is not.
+      */
+      st_select_lex_unit *unit= tbl->with->spec;
+      error|= (bool) error | (uint) unit->cleanup();
+    }
+  }
   for (SELECT_LEX_UNIT *lex_unit= first_inner_unit(); lex_unit ;
        lex_unit= lex_unit->next_unit())
   {