Skip to content

Commit 2e941fe

Browse files
montywimontywi
committed
Fixed crashing bug when using ONLY_FULL_GROUP_BY in a stored procedure/trigger that is repeatedly executed.
This is MDEV-7601, including it's sub tasks MDEV-7594, MDEV-7555, MDEV-7590, MDEV-7581, MDEV-7589 The problem was that select_lex->non_agg_fields was not properly reset for re-execution and this caused an overwrite of a random memory position. The fix was move non_agg_fields from select_lext to JOIN, which is properly reset.
1 parent d199a0f commit 2e941fe

File tree

10 files changed

+357
-10
lines changed

10 files changed

+357
-10
lines changed

‎mysql-test/r/sp-group.result

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
drop table if exists t1;
2+
Warnings:
3+
Note 1051 Unknown table 't1'
4+
drop view if exists view_t1;
5+
Warnings:
6+
Note 1051 Unknown table 'test.view_t1'
7+
SET sql_mode=ONLY_FULL_GROUP_BY;
8+
CREATE TABLE t1 (
9+
pk INT,
10+
f0 INT, f1 INT, f2 INT, f3 INT, f4 INT,
11+
f5 INT, f6 INT, f7 INT, f8 INT, f9 INT,
12+
PRIMARY KEY (pk)
13+
);
14+
CREATE VIEW view_t1 AS SELECT * FROM t1;
15+
CREATE PROCEDURE s1()
16+
SELECT * FROM (
17+
INFORMATION_SCHEMA.`INNODB_BUFFER_PAGE_LRU` AS table1
18+
LEFT JOIN test.view_t1 AS table2
19+
ON ( table2.`f6` = table1.FREE_PAGE_CLOCK)
20+
)
21+
ORDER BY table1.NUMBER_RECORDS
22+
LIMIT 0
23+
;
24+
CALL s1;
25+
POOL_ID LRU_POSITION SPACE PAGE_NUMBER PAGE_TYPE FLUSH_TYPE FIX_COUNT IS_HASHED NEWEST_MODIFICATION OLDEST_MODIFICATION ACCESS_TIME TABLE_NAME INDEX_NAME NUMBER_RECORDS DATA_SIZE COMPRESSED_SIZE COMPRESSED IO_FIX IS_OLD FREE_PAGE_CLOCK pk f0 f1 f2 f3 f4 f5 f6 f7 f8 f9
26+
CALL s1;
27+
POOL_ID LRU_POSITION SPACE PAGE_NUMBER PAGE_TYPE FLUSH_TYPE FIX_COUNT IS_HASHED NEWEST_MODIFICATION OLDEST_MODIFICATION ACCESS_TIME TABLE_NAME INDEX_NAME NUMBER_RECORDS DATA_SIZE COMPRESSED_SIZE COMPRESSED IO_FIX IS_OLD FREE_PAGE_CLOCK pk f0 f1 f2 f3 f4 f5 f6 f7 f8 f9
28+
drop table t1;
29+
drop view view_t1;
30+
drop procedure s1;
31+
CREATE TABLE A (
32+
pk INTEGER AUTO_INCREMENT,
33+
col_int_key INTEGER,
34+
col_varchar_key VARCHAR(1),
35+
PRIMARY KEY (pk)
36+
) ENGINE=MyISAM;
37+
CREATE VIEW view_A AS SELECT * FROM A;
38+
CREATE TABLE C (
39+
pk INTEGER AUTO_INCREMENT,
40+
col_int_nokey INTEGER,
41+
col_int_key INTEGER,
42+
col_date_key DATE,
43+
col_date_nokey DATE,
44+
col_time_key TIME,
45+
col_time_nokey TIME,
46+
col_datetime_key DATETIME,
47+
col_datetime_nokey DATETIME,
48+
col_varchar_key VARCHAR(1),
49+
col_varchar_nokey VARCHAR(1),
50+
PRIMARY KEY (pk)
51+
) ENGINE=MyISAM;
52+
CREATE VIEW view_C AS SELECT * FROM C;
53+
CREATE TABLE AA (
54+
pk INTEGER AUTO_INCREMENT,
55+
col_int_nokey INTEGER,
56+
col_int_key INTEGER,
57+
col_date_key DATE,
58+
col_date_nokey DATE,
59+
col_time_key TIME,
60+
col_time_nokey TIME,
61+
col_datetime_key DATETIME,
62+
col_datetime_nokey DATETIME,
63+
col_varchar_key VARCHAR(1),
64+
col_varchar_nokey VARCHAR(1),
65+
PRIMARY KEY (pk),
66+
KEY (col_varchar_key, col_int_key)
67+
) ENGINE=MyISAM;
68+
CREATE VIEW view_AA AS SELECT * FROM AA;
69+
CREATE TABLE BB (
70+
pk INTEGER AUTO_INCREMENT,
71+
col_int_key INTEGER,
72+
col_varchar_key VARCHAR(1),
73+
col_varchar_nokey VARCHAR(1),
74+
PRIMARY KEY (pk),
75+
KEY (col_varchar_key, col_int_key)
76+
) ENGINE=MyISAM;
77+
CREATE VIEW view_BB AS SELECT * FROM BB;
78+
CREATE TABLE DD (
79+
pk INTEGER AUTO_INCREMENT,
80+
col_int_key INTEGER,
81+
col_date_key DATE,
82+
col_time_key TIME,
83+
col_datetime_key DATETIME,
84+
col_varchar_key VARCHAR(1),
85+
PRIMARY KEY (pk),
86+
KEY (col_varchar_key, col_int_key)
87+
) ENGINE=MyISAM;
88+
CREATE VIEW view_DD AS SELECT * FROM DD;
89+
CREATE TRIGGER k BEFORE INSERT ON `DD` FOR EACH ROW INSERT INTO `view_BB` SELECT * FROM `view_A` LIMIT 0 ;
90+
CREATE TRIGGER r BEFORE INSERT ON `A` FOR EACH ROW INSERT INTO `view_AA` SELECT * FROM `view_C` LIMIT 0 ;
91+
ALTER TABLE `DD` DROP PRIMARY KEY;
92+
ERROR 42000: Incorrect table definition; there can be only one auto column and it must be defined as a key
93+
INSERT INTO `view_A` ( `pk` ) VALUES (NULL);
94+
INSERT INTO `DD` ( `pk` ) VALUES (NULL);
95+
INSERT INTO `A` ( `pk` ) VALUES (NULL);
96+
INSERT INTO `view_DD` ( `pk` ) VALUES (NULL);
97+
drop trigger r;
98+
drop trigger k;
99+
drop view view_A,view_AA,view_C,view_BB,view_DD;
100+
drop table A,C,AA,BB,DD;
101+
CREATE TABLE A (
102+
i INT,
103+
i1 INT,
104+
i2 INT,
105+
d1 DATE,
106+
d2 DATE,
107+
col_time_nokey1 TIME,
108+
col_time_nokey2 TIME,
109+
col_datetime_nokey1 DATETIME,
110+
col_datetime_nokey2 DATETIME,
111+
col_varchar_nokey1 VARCHAR(1),
112+
col_varchar_nokey2 VARCHAR(1)
113+
) ENGINE=MyISAM;
114+
CREATE VIEW view_A AS SELECT * FROM A;
115+
CREATE TABLE B (
116+
col_varchar_nokey VARCHAR(1)
117+
) ENGINE=MyISAM;
118+
CREATE TABLE AA (
119+
i INT,
120+
i1 INT,
121+
i2 INT,
122+
d1 DATE,
123+
d2 DATE,
124+
col_time_nokey1 TIME,
125+
col_time_nokey2 TIME,
126+
col_datetime_nokey1 DATETIME,
127+
col_datetime_nokey2 DATETIME,
128+
col_varchar_nokey1 VARCHAR(1),
129+
col_varchar_nokey2 VARCHAR(1)
130+
) ENGINE=MyISAM;
131+
CREATE VIEW view_AA AS SELECT * FROM AA;
132+
CREATE TABLE DD (
133+
i INT,
134+
i1 INT,
135+
i2 INT,
136+
d1 DATE,
137+
d2 DATE,
138+
col_time_nokey1 TIME,
139+
col_time_nokey2 TIME,
140+
col_datetime_nokey1 DATETIME,
141+
col_datetime_nokey2 DATETIME,
142+
col_varchar_nokey1 VARCHAR(1),
143+
col_varchar_nokey2 VARCHAR(1)
144+
) ENGINE=MyISAM;
145+
CREATE VIEW view_DD AS SELECT * FROM DD;
146+
CREATE TRIGGER tr1 BEFORE INSERT ON `AA` FOR EACH ROW INSERT INTO `view_A` SELECT * FROM `view_AA` LIMIT 0 ;
147+
CREATE TRIGGER tr2 BEFORE INSERT ON `B` FOR EACH ROW INSERT INTO `D` SELECT * FROM `A` LIMIT 0 ;
148+
INSERT INTO `view_AA` ( `i` ) VALUES (1);
149+
INSERT INTO `AA` ( `i` ) VALUES (2);
150+
DELETE FROM `B`;
151+
INSERT INTO `view_DD` ( `i` ) VALUES (1);
152+
INSERT INTO `view_AA` ( `i` ) VALUES (3);
153+
drop trigger tr1;
154+
drop trigger tr2;
155+
drop view view_A, view_AA,view_DD;
156+
drop table A,B,AA,DD;

‎mysql-test/t/sp-group.test

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
--source include/have_innodb.inc
2+
3+
drop table if exists t1;
4+
drop view if exists view_t1;
5+
6+
#
7+
# Test case for MDEV 7601, MDEV-7594 and MDEV-7555
8+
# Server crashes in functions related to stored procedures
9+
# Server crashes in different ways while executing concurrent
10+
# flow involving views and non-empty sql_mode with ONLY_FULL_GROUP_BY
11+
#
12+
13+
SET sql_mode=ONLY_FULL_GROUP_BY;
14+
15+
CREATE TABLE t1 (
16+
pk INT,
17+
f0 INT, f1 INT, f2 INT, f3 INT, f4 INT,
18+
f5 INT, f6 INT, f7 INT, f8 INT, f9 INT,
19+
PRIMARY KEY (pk)
20+
);
21+
22+
CREATE VIEW view_t1 AS SELECT * FROM t1;
23+
CREATE PROCEDURE s1()
24+
SELECT * FROM (
25+
INFORMATION_SCHEMA.`INNODB_BUFFER_PAGE_LRU` AS table1
26+
LEFT JOIN test.view_t1 AS table2
27+
ON ( table2.`f6` = table1.FREE_PAGE_CLOCK)
28+
)
29+
ORDER BY table1.NUMBER_RECORDS
30+
LIMIT 0
31+
;
32+
CALL s1;
33+
CALL s1;
34+
35+
drop table t1;
36+
drop view view_t1;
37+
drop procedure s1;
38+
39+
#
40+
# MDEV-7590
41+
# Server crashes in st_select_lex_unit::cleanup on executing a trigger
42+
#
43+
44+
CREATE TABLE A (
45+
pk INTEGER AUTO_INCREMENT,
46+
col_int_key INTEGER,
47+
col_varchar_key VARCHAR(1),
48+
PRIMARY KEY (pk)
49+
) ENGINE=MyISAM;
50+
CREATE VIEW view_A AS SELECT * FROM A;
51+
CREATE TABLE C (
52+
pk INTEGER AUTO_INCREMENT,
53+
col_int_nokey INTEGER,
54+
col_int_key INTEGER,
55+
col_date_key DATE,
56+
col_date_nokey DATE,
57+
col_time_key TIME,
58+
col_time_nokey TIME,
59+
col_datetime_key DATETIME,
60+
col_datetime_nokey DATETIME,
61+
col_varchar_key VARCHAR(1),
62+
col_varchar_nokey VARCHAR(1),
63+
PRIMARY KEY (pk)
64+
) ENGINE=MyISAM;
65+
CREATE VIEW view_C AS SELECT * FROM C;
66+
CREATE TABLE AA (
67+
pk INTEGER AUTO_INCREMENT,
68+
col_int_nokey INTEGER,
69+
col_int_key INTEGER,
70+
col_date_key DATE,
71+
col_date_nokey DATE,
72+
col_time_key TIME,
73+
col_time_nokey TIME,
74+
col_datetime_key DATETIME,
75+
col_datetime_nokey DATETIME,
76+
col_varchar_key VARCHAR(1),
77+
col_varchar_nokey VARCHAR(1),
78+
PRIMARY KEY (pk),
79+
KEY (col_varchar_key, col_int_key)
80+
) ENGINE=MyISAM;
81+
CREATE VIEW view_AA AS SELECT * FROM AA;
82+
CREATE TABLE BB (
83+
pk INTEGER AUTO_INCREMENT,
84+
col_int_key INTEGER,
85+
col_varchar_key VARCHAR(1),
86+
col_varchar_nokey VARCHAR(1),
87+
PRIMARY KEY (pk),
88+
KEY (col_varchar_key, col_int_key)
89+
) ENGINE=MyISAM;
90+
CREATE VIEW view_BB AS SELECT * FROM BB;
91+
CREATE TABLE DD (
92+
pk INTEGER AUTO_INCREMENT,
93+
col_int_key INTEGER,
94+
col_date_key DATE,
95+
col_time_key TIME,
96+
col_datetime_key DATETIME,
97+
col_varchar_key VARCHAR(1),
98+
PRIMARY KEY (pk),
99+
KEY (col_varchar_key, col_int_key)
100+
) ENGINE=MyISAM;
101+
CREATE VIEW view_DD AS SELECT * FROM DD;
102+
CREATE TRIGGER k BEFORE INSERT ON `DD` FOR EACH ROW INSERT INTO `view_BB` SELECT * FROM `view_A` LIMIT 0 ;
103+
CREATE TRIGGER r BEFORE INSERT ON `A` FOR EACH ROW INSERT INTO `view_AA` SELECT * FROM `view_C` LIMIT 0 ;
104+
--error ER_WRONG_AUTO_KEY
105+
ALTER TABLE `DD` DROP PRIMARY KEY;
106+
INSERT INTO `view_A` ( `pk` ) VALUES (NULL);
107+
--error 0,ER_WRONG_VALUE_COUNT_ON_ROW
108+
INSERT INTO `DD` ( `pk` ) VALUES (NULL);
109+
INSERT INTO `A` ( `pk` ) VALUES (NULL);
110+
--error 0,ER_WRONG_VALUE_COUNT_ON_ROW
111+
INSERT INTO `view_DD` ( `pk` ) VALUES (NULL);
112+
113+
drop trigger r;
114+
drop trigger k;
115+
drop view view_A,view_AA,view_C,view_BB,view_DD;
116+
drop table A,C,AA,BB,DD;
117+
118+
#
119+
# MDEV-7581
120+
# Server crashes in st_select_lex_unit::cleanup after a sequence of statements
121+
#
122+
123+
CREATE TABLE A (
124+
i INT,
125+
i1 INT,
126+
i2 INT,
127+
d1 DATE,
128+
d2 DATE,
129+
col_time_nokey1 TIME,
130+
col_time_nokey2 TIME,
131+
col_datetime_nokey1 DATETIME,
132+
col_datetime_nokey2 DATETIME,
133+
col_varchar_nokey1 VARCHAR(1),
134+
col_varchar_nokey2 VARCHAR(1)
135+
) ENGINE=MyISAM;
136+
137+
CREATE VIEW view_A AS SELECT * FROM A;
138+
139+
CREATE TABLE B (
140+
col_varchar_nokey VARCHAR(1)
141+
) ENGINE=MyISAM;
142+
143+
CREATE TABLE AA (
144+
i INT,
145+
i1 INT,
146+
i2 INT,
147+
d1 DATE,
148+
d2 DATE,
149+
col_time_nokey1 TIME,
150+
col_time_nokey2 TIME,
151+
col_datetime_nokey1 DATETIME,
152+
col_datetime_nokey2 DATETIME,
153+
col_varchar_nokey1 VARCHAR(1),
154+
col_varchar_nokey2 VARCHAR(1)
155+
) ENGINE=MyISAM;
156+
157+
CREATE VIEW view_AA AS SELECT * FROM AA;
158+
159+
CREATE TABLE DD (
160+
i INT,
161+
i1 INT,
162+
i2 INT,
163+
d1 DATE,
164+
d2 DATE,
165+
col_time_nokey1 TIME,
166+
col_time_nokey2 TIME,
167+
col_datetime_nokey1 DATETIME,
168+
col_datetime_nokey2 DATETIME,
169+
col_varchar_nokey1 VARCHAR(1),
170+
col_varchar_nokey2 VARCHAR(1)
171+
) ENGINE=MyISAM;
172+
173+
CREATE VIEW view_DD AS SELECT * FROM DD;
174+
175+
CREATE TRIGGER tr1 BEFORE INSERT ON `AA` FOR EACH ROW INSERT INTO `view_A` SELECT * FROM `view_AA` LIMIT 0 ;
176+
CREATE TRIGGER tr2 BEFORE INSERT ON `B` FOR EACH ROW INSERT INTO `D` SELECT * FROM `A` LIMIT 0 ;
177+
178+
INSERT INTO `view_AA` ( `i` ) VALUES (1);
179+
INSERT INTO `AA` ( `i` ) VALUES (2);
180+
DELETE FROM `B`;
181+
INSERT INTO `view_DD` ( `i` ) VALUES (1);
182+
INSERT INTO `view_AA` ( `i` ) VALUES (3);
183+
184+
drop trigger tr1;
185+
drop trigger tr2;
186+
drop view view_A, view_AA,view_DD;
187+
drop table A,B,AA,DD;

‎sql/item.cc

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4883,7 +4883,7 @@ Item_field::fix_outer_field(THD *thd, Field **from_field, Item **reference)
48834883
non aggregated fields of the outer select.
48844884
*/
48854885
marker= select->cur_pos_in_select_list;
4886-
select->non_agg_fields.push_back(this);
4886+
select->join->non_agg_fields.push_back(this);
48874887
}
48884888
if (*from_field != view_ref_found)
48894889
{
@@ -5299,9 +5299,10 @@ bool Item_field::fix_fields(THD *thd, Item **reference)
52995299
fixed= 1;
53005300
if (thd->variables.sql_mode & MODE_ONLY_FULL_GROUP_BY &&
53015301
!outer_fixed && !thd->lex->in_sum_func &&
5302-
thd->lex->current_select->cur_pos_in_select_list != UNDEF_POS)
5302+
thd->lex->current_select->cur_pos_in_select_list != UNDEF_POS &&
5303+
thd->lex->current_select->join)
53035304
{
5304-
thd->lex->current_select->non_agg_fields.push_back(this);
5305+
thd->lex->current_select->join->non_agg_fields.push_back(this);
53055306
marker= thd->lex->current_select->cur_pos_in_select_list;
53065307
}
53075308
mark_non_agg_field:

‎sql/item.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -631,7 +631,7 @@ class Item {
631631
*/
632632
uint name_length; /* Length of name */
633633
uint decimals;
634-
int8 marker;
634+
int marker;
635635
bool maybe_null; /* If item may be null */
636636
bool in_rollup; /* If used in GROUP BY list
637637
of a query with ROLLUP */

‎sql/sql_lex.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1917,14 +1917,14 @@ void st_select_lex::init_select()
19171917
with_sum_func= 0;
19181918
is_correlated= 0;
19191919
cur_pos_in_select_list= UNDEF_POS;
1920-
non_agg_fields.empty();
19211920
cond_value= having_value= Item::COND_UNDEF;
19221921
inner_refs_list.empty();
19231922
insert_tables= 0;
19241923
merged_into= 0;
19251924
m_non_agg_field_used= false;
19261925
m_agg_func_used= false;
19271926
name_visibility_map= 0;
1927+
join= 0;
19281928
}
19291929

19301930
/*

0 commit comments

Comments
 (0)