Skip to content

Commit 6dec033

Browse files
igorbabaevigorbabaev
committed
MDEV-25086 Stored Procedure Crashes Server
The cause of this bug is the same as of the bug MDEV-24454. This bug manifested itself at the second execution of the queries that contained a set function whose only argument was outer reference to a column of a mergeable view or derived table or CTE. The first execution of such query worked fine, but the second execution of the query caused a crash of the server because the aggregation select for the used set function was determined incorrectly at the name resolution phase of the second execution.
1 parent d6ee351 commit 6dec033

File tree

3 files changed

+243
-1
lines changed

3 files changed

+243
-1
lines changed

‎mysql-test/r/derived_view.result

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3456,4 +3456,134 @@ a
34563456
3
34573457
drop view v1;
34583458
drop table t1;
3459+
#
3460+
# MDEV-24454 Second execution of SELECT containing set function
3461+
# MDEV-25086: whose only argument is an outer reference to a column
3462+
# of mergeable view/derived/table/CTE
3463+
#
3464+
create table t1 (a int);
3465+
create table t2 (b int);
3466+
insert into t1 values (3), (1), (3);
3467+
insert into t2 values (70), (30), (70);
3468+
create view v1 as select * from t2;
3469+
prepare stmt from "
3470+
select (select sum(b) from t1 where a=1) as r from v1;
3471+
";
3472+
execute stmt;
3473+
r
3474+
170
3475+
execute stmt;
3476+
r
3477+
170
3478+
deallocate prepare stmt;
3479+
prepare stmt from "
3480+
select (select sum(b) from t1 where a=1) as r from (select * from t2) dt;
3481+
";
3482+
execute stmt;
3483+
r
3484+
170
3485+
execute stmt;
3486+
r
3487+
170
3488+
deallocate prepare stmt;
3489+
prepare stmt from "
3490+
with cte as (select * from t2)
3491+
select (select sum(b) from t1 where a=1) as r from cte;
3492+
";
3493+
execute stmt;
3494+
r
3495+
170
3496+
execute stmt;
3497+
r
3498+
170
3499+
deallocate prepare stmt;
3500+
prepare stmt from "
3501+
select (select sum(b) from t1 where a=1) as r
3502+
from (select * from v1 where b > 50) dt;
3503+
";
3504+
execute stmt;
3505+
r
3506+
140
3507+
execute stmt;
3508+
r
3509+
140
3510+
deallocate prepare stmt;
3511+
prepare stmt from "
3512+
select (select sum(b) from t1 where a=1) as r
3513+
from (select * from (select * from t2) dt1 where b > 50) dt;
3514+
";
3515+
execute stmt;
3516+
r
3517+
140
3518+
execute stmt;
3519+
r
3520+
140
3521+
deallocate prepare stmt;
3522+
prepare stmt from "
3523+
with cte as (select * from (select * from t2) dt1 where b > 50)
3524+
select (select sum(b) from t1 where a=1) as r from cte;
3525+
";
3526+
execute stmt;
3527+
r
3528+
140
3529+
execute stmt;
3530+
r
3531+
140
3532+
deallocate prepare stmt;
3533+
create procedure sp1()
3534+
begin
3535+
select (select sum(b) from t1 where a=1) as r from v1;
3536+
end |
3537+
call sp1();
3538+
r
3539+
170
3540+
call sp1();
3541+
r
3542+
170
3543+
drop procedure sp1;
3544+
create procedure sp1()
3545+
begin
3546+
select (select sum(b) from t1 where a=1) as r from (select * from t2) dt;
3547+
end |
3548+
call sp1();
3549+
r
3550+
170
3551+
call sp1();
3552+
r
3553+
170
3554+
drop procedure sp1;
3555+
create procedure sp1()
3556+
begin
3557+
with cte as (select * from t2)
3558+
select (select sum(b) from t1 where a=1) as r from cte;
3559+
end |
3560+
call sp1();
3561+
r
3562+
170
3563+
call sp1();
3564+
r
3565+
170
3566+
drop procedure sp1;
3567+
drop view v1;
3568+
drop table t1,t2;
3569+
CREATE TABLE t1(f0 INT);
3570+
INSERT INTO t1 VALUES (3);
3571+
CREATE VIEW v1 AS SELECT f0 AS f1 FROM t1;
3572+
CREATE VIEW v2 AS
3573+
SELECT
3574+
(SELECT GROUP_CONCAT(v1.f1 SEPARATOR ', ') FROM v1 n) AS f2,
3575+
GROUP_CONCAT('aa' SEPARATOR ', ') AS f3
3576+
FROM v1;
3577+
CREATE VIEW v3 AS SELECT * FROM v2;
3578+
CREATE PROCEDURE p1()
3579+
SELECT * FROM v3;
3580+
CALL p1();
3581+
f2 f3
3582+
3 aa
3583+
CALL p1();
3584+
f2 f3
3585+
3 aa
3586+
DROP PROCEDURE p1;
3587+
DROP VIEW v1,v2,v3;
3588+
DROP TABLE t1;
34593589
# End of 10.2 tests

‎mysql-test/t/derived_view.test

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2265,4 +2265,115 @@ select * from ((select a from t1 limit 2) order by a desc) dt;
22652265
drop view v1;
22662266
drop table t1;
22672267

2268+
--echo #
2269+
--echo # MDEV-24454 Second execution of SELECT containing set function
2270+
--echo # MDEV-25086: whose only argument is an outer reference to a column
2271+
--echo # of mergeable view/derived/table/CTE
2272+
--echo #
2273+
2274+
create table t1 (a int);
2275+
create table t2 (b int);
2276+
insert into t1 values (3), (1), (3);
2277+
insert into t2 values (70), (30), (70);
2278+
create view v1 as select * from t2;
2279+
2280+
prepare stmt from "
2281+
select (select sum(b) from t1 where a=1) as r from v1;
2282+
";
2283+
execute stmt;
2284+
execute stmt;
2285+
deallocate prepare stmt;
2286+
2287+
prepare stmt from "
2288+
select (select sum(b) from t1 where a=1) as r from (select * from t2) dt;
2289+
";
2290+
execute stmt;
2291+
execute stmt;
2292+
deallocate prepare stmt;
2293+
2294+
prepare stmt from "
2295+
with cte as (select * from t2)
2296+
select (select sum(b) from t1 where a=1) as r from cte;
2297+
";
2298+
execute stmt;
2299+
execute stmt;
2300+
deallocate prepare stmt;
2301+
2302+
prepare stmt from "
2303+
select (select sum(b) from t1 where a=1) as r
2304+
from (select * from v1 where b > 50) dt;
2305+
";
2306+
execute stmt;
2307+
execute stmt;
2308+
deallocate prepare stmt;
2309+
2310+
prepare stmt from "
2311+
select (select sum(b) from t1 where a=1) as r
2312+
from (select * from (select * from t2) dt1 where b > 50) dt;
2313+
";
2314+
execute stmt;
2315+
execute stmt;
2316+
deallocate prepare stmt;
2317+
2318+
prepare stmt from "
2319+
with cte as (select * from (select * from t2) dt1 where b > 50)
2320+
select (select sum(b) from t1 where a=1) as r from cte;
2321+
";
2322+
execute stmt;
2323+
execute stmt;
2324+
deallocate prepare stmt;
2325+
2326+
--delimiter |
2327+
create procedure sp1()
2328+
begin
2329+
select (select sum(b) from t1 where a=1) as r from v1;
2330+
end |
2331+
--delimiter ;
2332+
call sp1();
2333+
call sp1();
2334+
drop procedure sp1;
2335+
2336+
--delimiter |
2337+
create procedure sp1()
2338+
begin
2339+
select (select sum(b) from t1 where a=1) as r from (select * from t2) dt;
2340+
end |
2341+
--delimiter ;
2342+
call sp1();
2343+
call sp1();
2344+
drop procedure sp1;
2345+
2346+
--delimiter |
2347+
create procedure sp1()
2348+
begin
2349+
with cte as (select * from t2)
2350+
select (select sum(b) from t1 where a=1) as r from cte;
2351+
end |
2352+
--delimiter ;
2353+
call sp1();
2354+
call sp1();
2355+
drop procedure sp1;
2356+
2357+
drop view v1;
2358+
drop table t1,t2;
2359+
2360+
CREATE TABLE t1(f0 INT);
2361+
INSERT INTO t1 VALUES (3);
2362+
CREATE VIEW v1 AS SELECT f0 AS f1 FROM t1;
2363+
CREATE VIEW v2 AS
2364+
SELECT
2365+
(SELECT GROUP_CONCAT(v1.f1 SEPARATOR ', ') FROM v1 n) AS f2,
2366+
GROUP_CONCAT('aa' SEPARATOR ', ') AS f3
2367+
FROM v1;
2368+
CREATE VIEW v3 AS SELECT * FROM v2;
2369+
2370+
CREATE PROCEDURE p1()
2371+
SELECT * FROM v3;
2372+
CALL p1();
2373+
CALL p1();
2374+
2375+
DROP PROCEDURE p1;
2376+
DROP VIEW v1,v2,v3;
2377+
DROP TABLE t1;
2378+
22682379
--echo # End of 10.2 tests

‎sql/item.cc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5617,7 +5617,8 @@ bool Item_field::fix_fields(THD *thd, Item **reference)
56175617
goto mark_non_agg_field;
56185618
}
56195619

5620-
if (thd->lex->in_sum_func &&
5620+
if (!thd->lex->current_select->no_wrap_view_item &&
5621+
thd->lex->in_sum_func &&
56215622
thd->lex->in_sum_func->nest_level ==
56225623
select->nest_level)
56235624
set_if_bigger(thd->lex->in_sum_func->max_arg_level,

0 commit comments

Comments
 (0)