Skip to content

Commit 807aa1c

Browse files
author
Sergey Glukhov
committed
Fixed following problems:
--Bug#52157 various crashes and assertions with multi-table update, stored function --Bug#54475 improper error handling causes cascading crashing failures in innodb/ndb --Bug#57703 create view cause Assertion failed: 0, file .\item_subselect.cc, line 846 --Bug#57352 valgrind warnings when creating view --Recently discovered problem when a nested materialized derived table is used before being populated and it leads to incorrect result We have several modes when we should disable subquery evaluation. The reasons for disabling are different. It could be uselessness of the evaluation as in case of 'CREATE VIEW' or 'PREPARE stmt', or we should disable subquery evaluation if tables are not locked yet as it happens in bug#54475, or too early evaluation of subqueries can lead to wrong result as it happened in Bug#19077. Main problem is that if subquery items are treated as const they are evaluated in ::fix_fields(), ::fix_length_and_dec() of the parental items as a lot of these methods have Item::val_...() calls inside. We have to make subqueries non-const to prevent unnecessary subquery evaluation. At the moment we have different methods for this. Here is a list of these modes: 1. PREPARE stmt; We use UNCACHEABLE_PREPARE flag. It is set during parsing in sql_parse.cc, mysql_new_select() for each SELECT_LEX object and cleared at the end of PREPARE in sql_prepare.cc, init_stmt_after_parse(). If this flag is set subquery becomes non-const and evaluation does not happen. 2. CREATE|ALTER VIEW, SHOW CREATE VIEW, I_S tables which process FRM files We use LEX::view_prepare_mode field. We set it before view preparation and check this flag in ::fix_fields(), ::fix_length_and_dec(). Some bugs are fixed using this approach, some are not(Bug#57352, Bug#57703). The problem here is that we have a lot of ::fix_fields(), ::fix_length_and_dec() where we use Item::val_...() calls for const items. 3. Derived tables with subquery = wrong result(Bug19077) The reason of this bug is too early subquery evaluation. It was fixed by adding Item::with_subselect field The check of this field in appropriate places prevents const item evaluation if the item have subquery. The fix for Bug19077 fixes only the problem with convert_constant_item() function and does not cover other places(::fix_fields(), ::fix_length_and_dec() again) where subqueries could be evaluated. Example: CREATE TABLE t1 (i INT, j BIGINT); INSERT INTO t1 VALUES (1, 2), (2, 2), (3, 2); SELECT * FROM (SELECT MIN(i) FROM t1 WHERE j = SUBSTRING('12', (SELECT * FROM (SELECT MIN(j) FROM t1) t2))) t3; DROP TABLE t1; 4. Derived tables with subquery where subquery is evaluated before table locking(Bug#54475, Bug#52157) Suggested solution is following: -Introduce new field LEX::context_analysis_only with the following possible flags: #define CONTEXT_ANALYSIS_ONLY_PREPARE 1 #define CONTEXT_ANALYSIS_ONLY_VIEW 2 #define CONTEXT_ANALYSIS_ONLY_DERIVED 4 -Set/clean these flags when we perform context analysis operation -Item_subselect::const_item() returns result depending on LEX::context_analysis_only. If context_analysis_only is set then we return FALSE that means that subquery is non-const. As all subquery types are wrapped by Item_subselect it allow as to make subquery non-const when it's necessary. --BZR-- revision-id: [email protected] property-branch-nick: mysql-5.1-bugteam property-file-info: ld7:file_id67:sp1f-derived.result-20020326130604-7h5qgv4t7i62th7ufm74tv3o2mtgqoqg7:message10:test case property-file-info: 4:path27:mysql-test/r/derived.resulted7:file_id72:sp1f-multi_update.result-20010611232825-7f2vetuxiyd3bu5lefd5a2ze43xed33y7:message10:test case property-file-info: 4:path32:mysql-test/r/multi_update.resulted7:file_id64:sp1f-view.result-20040715221517-nqk3l34grrhprjiitidhfjyjqlgh6a5v7:message10:test case property-file-info: 4:path24:mysql-test/r/view.resulted7:file_id54:innodb_multi_update.-20100505103911-y0w80g5puuxpduh3-27:message10:test case property-file-info: 4:path52:mysql-test/suite/innodb/r/innodb_multi_update.resulted7:file_id54:innodb_multi_update.-20100505103911-y0w80g5puuxpduh3-17:message10:test case property-file-info: 4:path50:mysql-test/suite/innodb/t/innodb_multi_update.tested7:file_id54:innodb_multi_update.-20100505104322-7gbmdbglxlf5azsf-27:message10:test case property-file-info: 4:path59:mysql-test/suite/innodb_plugin/r/innodb_multi_update.resulted7:file_id54:innodb_multi_update.-20100505104322-7gbmdbglxlf5azsf-17:message10:test case property-file-info: 4:path57:mysql-test/suite/innodb_plugin/t/innodb_multi_update.tested7:file_id65:sp1f-derived.test-20020326130604-mdjuldldv4iv2xqkrt4c4xbvxdwnljpw7:message10:test case property-file-info: 4:path25:mysql-test/t/derived.tested7:file_id70:sp1f-multi_update.test-20010611232825-wkkm3vvyawipiowjzwqmkqegx6wd6aiw7:message10:test case property-file-info: 4:path30:mysql-test/t/multi_update.tested7:file_id62:sp1f-view.test-20040715221517-2kxb7l4itrpl4mw266xe5gby4vftru3z7:message10:test case property-file-info: 4:path22:mysql-test/t/view.tested7:file_id60:sp1f-item.cc-19700101030959-u7hxqopwpfly4kf5ctlyk2dvrq4l3dhn7:message27:--removed unnecessary code property-file-info: 4:path11:sql/item.cced7:file_id68:sp1f-item_cmpfunc.cc-19700101030959-hrk7pi2n6qpwxauufnkizirsoucdcx2e7:message118:--removed unnecessary checks property-file-info: --THD::is_context_analysis_only() is replaced with LEX::is_ps_or_view_context_analysis() property-file-info: 4:path19:sql/item_cmpfunc.cced7:file_id65:sp1f-item_func.cc-19700101030959-3wmsx76yvc25sroqpfrx2n77kqdxxn3y7:message37:--refactored context analysis checks property-file-info: 4:path16:sql/item_func.cced7:file_id64:sp1f-item_row.cc-20021115183204-24uyecwm52gv5pn6jtszpqpfufhwmisq7:message29:--removed unnecessary checks property-file-info: 4:path15:sql/item_row.cced7:file_id70:sp1f-item_subselect.cc-20020512204640-qep43aqhsfrwkqmrobni6czc3fqj36oo7:message390:--removed unnecessary code property-file-info: --added DBUG_ASSERT into Item_subselect::exec() property-file-info: which asserts that subquery execution can not happen property-file-info: if LEX::context_analysis_only is set, i.e. at context property-file-info: analysis stage. property-file-info: --Item_subselect::const_item() property-file-info: Return FALSE if LEX::context_analysis_only is set. property-file-info: It prevents subquery evaluation in ::fix_fields & property-file-info: ::fix_length_and_dec at context analysis stage. property-file-info: 4:path21:sql/item_subselect.cced7:file_id69:sp1f-item_subselect.h-20020512204640-qdg77wil56cxyhtc2bjjdrppxq3wqgh37:message27:--removed unnecessary code property-file-info: 4:path20:sql/item_subselect.hed7:file_id65:sp1f-mysql_priv.h-19700101030959-4fl65tqpop5zfgxaxkqotu2fa2ree5ci7:message26:--Added new set of flags. property-file-info: 4:path16:sql/mysql_priv.hed7:file_id64:sp1f-sql_class.h-19700101030959-jnqnbrjyqsvgncsibnumsmg3lyi7pa5s7:message27:--removed unnecessary code property-file-info: 4:path15:sql/sql_class.hed7:file_id67:sp1f-sql_derived.cc-20020326130604-4qz6ovo2xa6w5eslbmcx76agmnyyvsfh7:message66:--added LEX::context_analysis_only analysis intialization/cleanup property-file-info: 4:path18:sql/sql_derived.cced7:file_id63:sp1f-sql_lex.cc-19700101030959-4pizwlu5rqkti27gcwsvxkawq6bc2kph7:message40:--init LEX::context_analysis_only field property-file-info: 4:path14:sql/sql_lex.cced7:file_id62:sp1f-sql_lex.h-19700101030959-sgldb2sooc7twtw5q7pgjx7qzqiaa3sn7:message39:--New LEX::context_analysis_only field property-file-info: 4:path13:sql/sql_lex.hed7:file_id65:sp1f-sql_parse.cc-19700101030959-ehcre3rwhv5l3mlxqhaxg36ujenxnrcd7:message27:--removed unnecessary code property-file-info: 4:path16:sql/sql_parse.cced7:file_id67:sp1f-sql_prepare.cc-20020612210720-gtqjjiu7vpmfxb5xct2qke7urmqcabli7:message93:--removed unnecessary code property-file-info: --added LEX::context_analysis_only analysis intialization/cleanup property-file-info: 4:path18:sql/sql_prepare.cced7:file_id66:sp1f-sql_select.cc-19700101030959-egb7whpkh76zzvikycs5nsnuviu4fdlb7:message37:--refactored context analysis checks property-file-info: 4:path17:sql/sql_select.cced7:file_id64:sp1f-sql_show.cc-19700101030959-umlljfnpplg452h7reeyqr4xnbmlkvfj7:message66:--added LEX::context_analysis_only analysis intialization/cleanup property-file-info: 4:path15:sql/sql_show.cced7:file_id64:sp1f-sql_view.cc-20040715221517-nw4p4mja6nzzlvwwhzfgfqb4umxqobe47:message66:--added LEX::context_analysis_only analysis intialization/cleanup property-file-info: 4:path15:sql/sql_view.ccee testament3-sha1: 8211d7e88fa5b69c3a5443eb362008f8452b0252
1 parent 98216f3 commit 807aa1c

26 files changed

Lines changed: 175 additions & 83 deletions

mysql-test/r/derived.result

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,4 +400,15 @@ SELECT 0 FROM
400400
(SELECT 0) t61;
401401
0
402402
0
403+
#
404+
# A nested materialized derived table is used before being populated.
405+
# (addon for bug#19077)
406+
#
407+
CREATE TABLE t1 (i INT, j BIGINT);
408+
INSERT INTO t1 VALUES (1, 2), (2, 2), (3, 2);
409+
SELECT * FROM (SELECT MIN(i) FROM t1
410+
WHERE j = SUBSTRING('12', (SELECT * FROM (SELECT MIN(j) FROM t1) t2))) t3;
411+
MIN(i)
412+
1
413+
DROP TABLE t1;
403414
# End of 5.0 tests

mysql-test/r/multi_update.result

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -659,4 +659,15 @@ Error 1242 Subquery returns more than 1 row
659659
Error 1242 Subquery returns more than 1 row
660660
DROP TABLE t1, t2, t3;
661661
SET SESSION sql_safe_updates = DEFAULT;
662+
#
663+
# Bug#52157 various crashes and assertions with multi-table update, stored function
664+
#
665+
CREATE FUNCTION f1 () RETURNS BLOB RETURN 1;
666+
CREATE TABLE t1 (f1 DATE);
667+
INSERT INTO t1 VALUES('2001-01-01');
668+
UPDATE (SELECT 1 FROM t1 WHERE f1 = (SELECT f1() FROM t1)) x, t1 SET f1 = 1;
669+
Warnings:
670+
Warning 1292 Truncated incorrect datetime value: '1'
671+
DROP FUNCTION f1;
672+
DROP TABLE t1;
662673
end of tests

mysql-test/r/view.result

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3884,6 +3884,19 @@ CREATE VIEW v1 AS SELECT 1 from t1
38843884
WHERE t1.b <=> (SELECT a FROM t1 WHERE a < SOME(SELECT '1'));
38853885
DROP VIEW v1;
38863886
DROP TABLE t1;
3887+
#
3888+
# Bug#57703 create view cause Assertion failed: 0, file .\item_subselect.cc, line 846
3889+
#
3890+
CREATE TABLE t1(a int);
3891+
CREATE VIEW v1 AS SELECT 1 FROM t1 GROUP BY
3892+
SUBSTRING(1 FROM (SELECT 3 FROM t1 WHERE a >= ANY(SELECT 1)));
3893+
DROP VIEW v1;
3894+
DROP TABLE t1;
3895+
#
3896+
# Bug#57352 valgrind warnings when creating view
3897+
#
3898+
CREATE VIEW v1 AS SELECT 1 IN (1 LIKE 2,0) AS f;
3899+
DROP VIEW v1;
38873900
# -----------------------------------------------------------------
38883901
# -- End of 5.1 tests.
38893902
# -----------------------------------------------------------------

mysql-test/suite/innodb/r/innodb_multi_update.result

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,3 +74,11 @@ a b
7474
4 14
7575
5 15
7676
drop table bug38999_1,bug38999_2;
77+
#
78+
# Bug#54475 improper error handling causes cascading crashing failures in innodb/ndb
79+
#
80+
CREATE TABLE t1(f1 INT) ENGINE=INNODB;
81+
INSERT INTO t1 VALUES(1);
82+
UPDATE (SELECT ((SELECT 1 FROM t1), 1) FROM t1 WHERE (SELECT 1 FROM t1)) x, (SELECT 1) AS d SET d.f1 = 1;
83+
ERROR 21000: Operand should contain 1 column(s)
84+
DROP TABLE t1;

mysql-test/suite/innodb/t/innodb_multi_update.test

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,14 @@ select * from bug38999_1;
2727
select * from bug38999_2;
2828

2929
drop table bug38999_1,bug38999_2;
30+
31+
32+
--echo #
33+
--echo # Bug#54475 improper error handling causes cascading crashing failures in innodb/ndb
34+
--echo #
35+
CREATE TABLE t1(f1 INT) ENGINE=INNODB;
36+
INSERT INTO t1 VALUES(1);
37+
--error ER_OPERAND_COLUMNS
38+
UPDATE (SELECT ((SELECT 1 FROM t1), 1) FROM t1 WHERE (SELECT 1 FROM t1)) x, (SELECT 1) AS d SET d.f1 = 1;
39+
DROP TABLE t1;
40+

mysql-test/suite/innodb_plugin/r/innodb_multi_update.result

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,3 +74,11 @@ a b
7474
4 14
7575
5 15
7676
drop table bug38999_1,bug38999_2;
77+
#
78+
# Bug#54475 improper error handling causes cascading crashing failures in innodb/ndb
79+
#
80+
CREATE TABLE t1(f1 INT) ENGINE=INNODB;
81+
INSERT INTO t1 VALUES(1);
82+
UPDATE (SELECT ((SELECT 1 FROM t1), 1) FROM t1 WHERE (SELECT 1 FROM t1)) x, (SELECT 1) AS d SET d.f1 = 1;
83+
ERROR 21000: Operand should contain 1 column(s)
84+
DROP TABLE t1;

mysql-test/suite/innodb_plugin/t/innodb_multi_update.test

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,14 @@ select * from bug38999_1;
2727
select * from bug38999_2;
2828

2929
drop table bug38999_1,bug38999_2;
30+
31+
32+
--echo #
33+
--echo # Bug#54475 improper error handling causes cascading crashing failures in innodb/ndb
34+
--echo #
35+
CREATE TABLE t1(f1 INT) ENGINE=INNODB;
36+
INSERT INTO t1 VALUES(1);
37+
--error ER_OPERAND_COLUMNS
38+
UPDATE (SELECT ((SELECT 1 FROM t1), 1) FROM t1 WHERE (SELECT 1 FROM t1)) x, (SELECT 1) AS d SET d.f1 = 1;
39+
DROP TABLE t1;
40+

mysql-test/t/derived.test

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,4 +301,15 @@ SELECT 0 FROM
301301
(SELECT 0) t56, (SELECT 0) t57, (SELECT 0) t58, (SELECT 0) t59, (SELECT 0) t60,
302302
(SELECT 0) t61; # 61 == MAX_TABLES
303303

304+
--echo #
305+
--echo # A nested materialized derived table is used before being populated.
306+
--echo # (addon for bug#19077)
307+
--echo #
308+
309+
CREATE TABLE t1 (i INT, j BIGINT);
310+
INSERT INTO t1 VALUES (1, 2), (2, 2), (3, 2);
311+
SELECT * FROM (SELECT MIN(i) FROM t1
312+
WHERE j = SUBSTRING('12', (SELECT * FROM (SELECT MIN(j) FROM t1) t2))) t3;
313+
DROP TABLE t1;
314+
304315
--echo # End of 5.0 tests

mysql-test/t/multi_update.test

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -673,4 +673,15 @@ SET t3.a = 0;
673673
DROP TABLE t1, t2, t3;
674674
SET SESSION sql_safe_updates = DEFAULT;
675675

676+
--echo #
677+
--echo # Bug#52157 various crashes and assertions with multi-table update, stored function
678+
--echo #
679+
680+
CREATE FUNCTION f1 () RETURNS BLOB RETURN 1;
681+
CREATE TABLE t1 (f1 DATE);
682+
INSERT INTO t1 VALUES('2001-01-01');
683+
UPDATE (SELECT 1 FROM t1 WHERE f1 = (SELECT f1() FROM t1)) x, t1 SET f1 = 1;
684+
DROP FUNCTION f1;
685+
DROP TABLE t1;
686+
676687
--echo end of tests

mysql-test/t/view.test

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3925,6 +3925,22 @@ WHERE t1.b <=> (SELECT a FROM t1 WHERE a < SOME(SELECT '1'));
39253925
DROP VIEW v1;
39263926
DROP TABLE t1;
39273927

3928+
--echo #
3929+
--echo # Bug#57703 create view cause Assertion failed: 0, file .\item_subselect.cc, line 846
3930+
--echo #
3931+
3932+
CREATE TABLE t1(a int);
3933+
CREATE VIEW v1 AS SELECT 1 FROM t1 GROUP BY
3934+
SUBSTRING(1 FROM (SELECT 3 FROM t1 WHERE a >= ANY(SELECT 1)));
3935+
DROP VIEW v1;
3936+
DROP TABLE t1;
3937+
3938+
--echo #
3939+
--echo # Bug#57352 valgrind warnings when creating view
3940+
--echo #
3941+
CREATE VIEW v1 AS SELECT 1 IN (1 LIKE 2,0) AS f;
3942+
DROP VIEW v1;
3943+
39283944
--echo # -----------------------------------------------------------------
39293945
--echo # -- End of 5.1 tests.
39303946
--echo # -----------------------------------------------------------------

0 commit comments

Comments
 (0)