MDEV-14828 Server crashes in JOIN::prepare / setup_fields on 2nd exec…

…ution of PS [fixes #437]
MariaDB · Jan 2, 2018 · b8b5d8d · b8b5d8d
1 parent 8efca72
commit b8b5d8d
Show file tree

Hide file tree

Showing 4 changed files with 23 additions and 4 deletions.
diff --git a/mysql-test/suite/versioning/r/create.result b/mysql-test/suite/versioning/r/create.result
@@ -399,5 +399,17 @@ t3	CREATE TABLE `t3` (
   `en` SYS_DATATYPE GENERATED ALWAYS AS ROW END INVISIBLE,
   PERIOD FOR SYSTEM_TIME (`st`, `en`)
 ) ENGINE=DEFAULT_ENGINE DEFAULT CHARSET=latin1 WITH SYSTEM VERSIONING
+# MDEV-14828 Server crashes in JOIN::prepare / setup_fields on 2nd execution of PS [#437]
+create or replace table t1 (x int) with system versioning;
+prepare bad from 'create or replace table t2 with system versioning as select * from t1';
+execute bad;
+execute bad;
+execute bad;
+execute bad;
+execute bad;
+execute bad;
+execute bad;
+execute bad;
+# bad is good.
 drop database test;
 create database test;
diff --git a/mysql-test/suite/versioning/t/create.test b/mysql-test/suite/versioning/t/create.test
@@ -361,5 +361,11 @@ as select x30, y, sys_trx_start, sys_trx_end, st, en from t1, t2;
 --replace_result $default_engine DEFAULT_ENGINE $sys_datatype SYS_DATATYPE $sys_datatype_null SYS_DATATYPE $sys_datatype_not_null SYS_DATATYPE $sys_datatype_default_null SYS_DATATYPE
 show create table t3;
 
+--echo # MDEV-14828 Server crashes in JOIN::prepare / setup_fields on 2nd execution of PS [#437]
+create or replace table t1 (x int) with system versioning;
+prepare bad from 'create or replace table t2 with system versioning as select * from t1';
+execute bad; execute bad; execute bad; execute bad; execute bad; execute bad; execute bad; execute bad;
+--echo # bad is good.
+
 drop database test;
 create database test;
diff --git a/sql/handler.cc b/sql/handler.cc
@@ -7093,9 +7093,9 @@ bool Table_scope_and_contents_source_st::vers_fix_system_fields(
     DBUG_ASSERT(items);
     while (added--)
     {
-      items->push_back(
-        new (thd->mem_root) Item_default_value(thd, thd->lex->current_context()),
-        thd->mem_root);
+      Item_default_value *item= new (thd->mem_root)
+        Item_default_value(thd, thd->lex->current_context());
+      items->push_back(item, thd->mem_root);
     }
   }
 

diff --git a/sql/sql_insert.cc b/sql/sql_insert.cc
@@ -4318,8 +4318,9 @@ TABLE *select_create::create_table_from_items(THD *thd,
 
 
 int
-select_create::prepare(List<Item> &values, SELECT_LEX_UNIT *u)
+select_create::prepare(List<Item> &_values, SELECT_LEX_UNIT *u)
 {
+  List<Item> values(_values, thd->mem_root);
   MYSQL_LOCK *extra_lock= NULL;
   DBUG_ENTER("select_create::prepare");