From: Jorgen Loland
Date: May 18 2011 11:25am
Subject: bzr commit into mysql-trunk branch (jorgen.loland:3308) Bug#12430646
List-Archive: http://lists.mysql.com/commits/137646
X-Bug: 12430646
Message-Id: <20110518112530.D067E10A3@atum21.norway.sun.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============5832505400701394483=="

--===============5832505400701394483==
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

#At file:///export/home/jl208045/mysql/wl4800/mysql-next-mr-opt-backporting-wl4800-12430646/ based on revid:jorgen.loland@stripped

 3308 Jorgen Loland	2011-05-18
      BUG#12430646 - SEL_ARG::LEFT AND RIGHT POINTERS INCORRECTLY USED.
                     CRASHES OPTIMIZER TRACING
      
      SEL_ARGs are the building blocks of range conditions. Multiple
      conditions are stored as SEL_ARGs in a RedBlack tree, in which 
      left and right points to children SEL_ARGs. 
      
      When a SEL_ARG does not have a left or right child, left/right 
      normally points to null_element. This is, however, not the case
      with a special SEL_ARG of type MAYBE_KEY. For this type, the
      left and right pointers are required to be NULL pointers. This 
      is inconsistent, but many functions rely on this fact 
      (e.g. eq_tree(), SEL_ARG::first()). 
      
      Two bugs are fixed by this changeset: 
       1) One of the SEL_ARG constructors did not initialize
          prev, next, left and right pointers.
       2) and_all_keys() sets left and right pointers to 
          &null_element for SEL_ARG::MAYBE_KEY even though it is 
          explicitly stated that these shall be NULL.
     @ mysql-test/r/optimizer_trace_bugs.result
        New regression test result file for statements that failed with 
        optimizer tracing enabled.
        Added test for BUG#12430646
     @ mysql-test/t/optimizer_trace_bugs.test
        New regression test file for statements that failed with 
        optimizer tracing enabled.
        Added test for BUG#12430646
     @ sql/opt_range.cc
        * One of the SEL_ARG constructors did not initialize prev,
          next, left and right pointers.
        * and_all_keys() sets left and right pointers to &null_element
          for SEL_ARG::MAYBE_KEY even though it is explicitly stated
          that these shall be NULL.

    added:
      mysql-test/r/optimizer_trace_bugs.result
      mysql-test/t/optimizer_trace_bugs.test
    modified:
      sql/opt_range.cc
=== added file 'mysql-test/r/optimizer_trace_bugs.result'
--- a/mysql-test/r/optimizer_trace_bugs.result	1970-01-01 00:00:00 +0000
+++ b/mysql-test/r/optimizer_trace_bugs.result	2011-05-18 11:25:27 +0000
@@ -0,0 +1,33 @@
+SET optimizer_trace="enabled=on,end_marker=on,one_line=off";
+#
+# BUG#12430646 - SEL_ARG::LEFT AND RIGHT POINTERS INCORRECTLY 
+#                USED. CRASHES OPTIMIZER TRACING
+#
+CREATE TABLE t1 (
+a INT,
+b CHAR(2),
+c INT,
+d INT,
+KEY (c),
+KEY (d,a,b(2)),
+KEY (b(1))
+);
+INSERT INTO t1 VALUES (NULL, 'a', 1, 2), (NULL, 'a', 1, 2),
+(1,    'a', 1, 2), (1,    'a', 1, 2);
+CREATE TABLE t2 (
+a INT,
+c INT,
+e INT,
+KEY (e)
+);
+INSERT INTO t2 VALUES (1, 1, NULL), (1, 1, NULL);
+SELECT 1
+FROM t1, t2
+WHERE t1.d <> '1' AND t1.b > '1'
+AND t1.a = t2.a AND t1.c = t2.c;
+1
+1
+1
+1
+1
+DROP TABLE t1, t2;

=== added file 'mysql-test/t/optimizer_trace_bugs.test'
--- a/mysql-test/t/optimizer_trace_bugs.test	1970-01-01 00:00:00 +0000
+++ b/mysql-test/t/optimizer_trace_bugs.test	2011-05-18 11:25:27 +0000
@@ -0,0 +1,38 @@
+# Regressiontest for statements that failed with optimizer tracing enabled.
+
+--source include/have_optimizer_trace.inc
+SET optimizer_trace="enabled=on,end_marker=on,one_line=off";
+
+--echo #
+--echo # BUG#12430646 - SEL_ARG::LEFT AND RIGHT POINTERS INCORRECTLY 
+--echo #                USED. CRASHES OPTIMIZER TRACING
+--echo #
+
+CREATE TABLE t1 (
+  a INT,
+  b CHAR(2),
+  c INT,
+  d INT,
+  KEY (c),
+  KEY (d,a,b(2)),
+  KEY (b(1))
+);
+
+INSERT INTO t1 VALUES (NULL, 'a', 1, 2), (NULL, 'a', 1, 2),
+                      (1,    'a', 1, 2), (1,    'a', 1, 2);
+
+CREATE TABLE t2 (
+  a INT,
+  c INT,
+  e INT,
+  KEY (e)
+);
+
+INSERT INTO t2 VALUES (1, 1, NULL), (1, 1, NULL);
+
+SELECT 1
+FROM t1, t2
+WHERE t1.d <> '1' AND t1.b > '1'
+AND t1.a = t2.a AND t1.c = t2.c;
+
+DROP TABLE t1, t2;

=== modified file 'sql/opt_range.cc'
--- a/sql/opt_range.cc	2011-05-18 10:37:05 +0000
+++ b/sql/opt_range.cc	2011-05-18 11:25:27 +0000
@@ -376,7 +376,9 @@ public:
   uchar *min_value,*max_value;			// Pointer to range
 
   /*
-    eq_tree() requires that left == right == 0 if the type is MAYBE_KEY.
+    eq_tree(), first(), last() etc require that left == right == NULL
+    if the type is MAYBE_KEY. Todo: fix this so SEL_ARGs without R-B
+    children are handled consistently. See related WL#5894.
    */
   SEL_ARG *left,*right;   /* R-B tree children */
   SEL_ARG *next,*prev;    /* Links for bi-directional interval list */
@@ -396,10 +398,17 @@ public:
   SEL_ARG(Field *,const uchar *, const uchar *);
   SEL_ARG(Field *field, uint8 part, uchar *min_value, uchar *max_value,
 	  uint8 min_flag, uint8 max_flag, uint8 maybe_flag);
+  /*
+    Used to construct MAYBE_KEY and IMPOSSIBLE SEL_ARGs. left and
+    right is NULL, so this ctor must not be used to create other
+    SEL_ARG types. See todo for left/right pointers.
+  */
   SEL_ARG(enum Type type_arg)
-    :min_flag(0),elements(1),use_count(1),left(0),right(0),next_key_part(0),
-    color(BLACK), type(type_arg)
-  {}
+    :min_flag(0),elements(1),use_count(1),left(NULL),right(NULL),
+     next_key_part(0), color(BLACK), type(type_arg)
+  {
+    DBUG_ASSERT(type_arg == MAYBE_KEY || type_arg == IMPOSSIBLE);
+  }
   inline bool is_same(SEL_ARG *arg)
   {
     if (type != arg->type || part != arg->part)
@@ -1797,6 +1806,9 @@ QUICK_RANGE::QUICK_RANGE()
 
 SEL_ARG::SEL_ARG(SEL_ARG &arg) :Sql_alloc()
 {
+  DBUG_ASSERT(arg.type != MAYBE_KEY);  // Would need left=right=NULL
+  left=right= &null_element;
+  prev=next= NULL;
   type=arg.type;
   min_flag=arg.min_flag;
   max_flag=arg.max_flag;
@@ -1815,7 +1827,7 @@ inline void SEL_ARG::make_root()
 {
   left=right= &null_element;
   color=BLACK;
-  next=prev=0;
+  next=prev= NULL;
   use_count=0; elements=1;
 }
 
@@ -1823,8 +1835,8 @@ SEL_ARG::SEL_ARG(Field *f,const uchar *m
                  const uchar *max_value_arg)
   :min_flag(0), max_flag(0), maybe_flag(0), maybe_null(f->real_maybe_null()),
    elements(1), use_count(1), field(f), min_value((uchar*) min_value_arg),
-   max_value((uchar*) max_value_arg), next(0),prev(0),
-   next_key_part(0),color(BLACK),type(KEY_RANGE)
+   max_value((uchar*) max_value_arg), next(NULL), prev(NULL),
+   next_key_part(0), color(BLACK), type(KEY_RANGE)
 {
   left=right= &null_element;
 }
@@ -1835,7 +1847,7 @@ SEL_ARG::SEL_ARG(Field *field_,uint8 par
   :min_flag(min_flag_),max_flag(max_flag_),maybe_flag(maybe_flag_),
    part(part_),maybe_null(field_->real_maybe_null()), elements(1),use_count(1),
    field(field_), min_value(min_value_), max_value(max_value_),
-   next(0),prev(0),next_key_part(0),color(BLACK),type(KEY_RANGE)
+   next(NULL), prev(NULL), next_key_part(0), color(BLACK), type(KEY_RANGE)
 {
   left=right= &null_element;
 }
@@ -6972,7 +6984,9 @@ and_all_keys(RANGE_OPT_PARAM *param, SEL
   }
   if (key1->type == SEL_ARG::MAYBE_KEY)
   {
-    key1->right= key1->left= &null_element;
+    // See todo for left/right pointers
+    DBUG_ASSERT(!key1->left);
+    DBUG_ASSERT(!key1->right);
     key1->next= key1->prev= 0;
   }
   for (next=key1->first(); next ; next=next->next)


--===============5832505400701394483==
MIME-Version: 1.0
Content-Type: text/bzr-bundle; charset="us-ascii";
	name="bzr/jorgen.loland@stripped"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

# Bazaar merge directive format 2 (Bazaar 0.90)
# revision_id: jorgen.loland@stripped\
#   2df6qg7h9ymrj17c
# target_branch: file:///export/home/jl208045/mysql/wl4800/mysql-next-\
#   mr-opt-backporting-wl4800-12430646/
# testament_sha1: 631fdf5d2e97e85ae5f850943b21909216071853
# timestamp: 2011-05-18 13:25:30 +0200
# source_branch: file:///export/home/jl208045/mysql/wl4800/mysql-next-\
#   mr-opt-backporting-wl4800/
# base_revision_id: jorgen.loland@stripped\
#   k3hpovzfwciqpkbs
# 
# Begin bundle
IyBCYXphYXIgcmV2aXNpb24gYnVuZGxlIHY0CiMKQlpoOTFBWSZTWcfhPSYABZ7/gGAcEAB59///
f//fsL////5gDC3fC7t717nXZSUKp6z3t0K+9bQ6t7gByHtZqqa2EkkIyZET8iaMnqntBCeUYIyP
1E9Q8ptTyJpphGm1BJImRiGiaaamian6KaejUyaAMTTIAAAMQGpppT2hKejJD1HqADQAwCNGgMgy
GgMgEpolMynqFNP1IeTanqg002o9QwgADQADQABtRQSephlMjJkaZAMmgAA00A0AAAEiRGgQNCYj
ETZJhNEzUTIaAyDZCAMioAZmV6ZiRkZHzdwj5MVbet+A7c/e05gjvle/ghj9PCjjR1zQ8Kkxb1NZ
0nmBuAlD5gtJIaS44l6Z6nA80ARuwxFuxgai0lNbGw81NTZOlUHdX2PcK4sdhkbKcZ3G7xx6o8qc
J1RIzVVU1XutqkoSRpOPH2fZvcvjJlBArsQaS2jFtYlMY2GF6Pm5BYGna3B+8YMzATu1JntW/cxN
i/v94vsOHRXdpygt8ibbiDg98TupQCkgoOIK8ZkomRcy1vkvuMx95lPkZ13FhgazEbhnVdu9n59D
MREEGQJhtZqFvSrEaAk5BIt/JGoulWJYh37+Sslixi9WWXlZx+BjSnlwXzeLsNwrEvDM8gqeeVCV
B8ueHa55mciA3I1qmNOsCahA1uVTjohpVjG1ew8NSpBHJ/CItzUeTyZ0PcSjLIgvWkyUtdWzwqEY
MyaN1g/F95uxx5EoX3p6XwtbQjh+/qH4djrph3YaBYlZZhpylFV2HyPiQesTLBkzAJHHIPKLBT0h
HQszcxXmn683FCbMNIsXRN9FD/uiyUlDH2GPIcXvaDfJjdpb4VHLHy03UrRA5JWOdmGZmsoxPZW2
AwgONAhCDeNF2yJxBr7Y8uPLMbEcJ0WoT/omsCqAmnxX6jLrklhdpt4UQQPzXVuiB3doES22RdNf
gp2SdlMxPOZZzJ9np8J69Vwamxta4IbG1kDGEDd8CAB8yDTneDdeiqikwthrDAfqCQjBYo9/QbVn
cVkL0iXYI+PtWR1eZcPIDZtv8wO1J+Pb5LBel9KHKkvP9GpSOqJHKLmZZWy19PHMdIwZqBEEoNaS
oFnfzOv2MKUzQtfE6MUQ8v12gup8WeUqvINYQ4Lp2grU4ENy6XJeV1oPBF9RhWEcRNKxRqSatkTl
yXYZTmDBtYjKnfGeZWd4V4gmCmGwyqAJfTkXk1cF4I/duO70vroCGI3qjrpBH5kZzSJW8ONt2Hcy
j4UYnH1ZYkbhMXLwYmL8j1CHacpA9hDKQ1W0boJnW/OuCaTTaazUeXM9dSn0BWsF0+A22xaVMNGc
EelND6iDNu4dVC02mhdpBaUF03jOEOy6FGPERV3PcluKWG4RpKt6147mUKZC2VxbW+b1rrYRyU5l
DC8KG8kOg3ccXWFl2+0jQeVMjVxv8obLh2yomrgUniYEEc2eyhtc228ZhZDSNxrvN9BZGvK5ZnKJ
qEYDrb169loaXFdmB04PBErBH57S8xKM9VwtGITvrqNlOPbetJhq2lPr0TM5WpD4lZqr99z2vTai
Zhi+0UxQKOH5WrDqmb7zeoL9eF6GFzsOtb88sikI7McGTNF0JElQJX2nO489pCpXKy8WBz2m/His
XYFTRMe7i9ECkBFevurYoWl3IRJPloztLX53weAc5aO6WFFo6DuFjgm6ODJYRBlA6BpMyTRgpjAk
y4SBodOHKcUVI1LCETzom1DvKpM9oR07qZ6VR8osXcUQ1sYzVmejSZEYB4nhrupQitEKKOAqruFS
58JHz7mvgMxdU4R1ntB1frPucd0TCWg3th8FvhjGFQVUmTORNZPRUPkU4yFJdAuhWV/QhUwwPnge
gA5MH0DqSqEcqdCSbys3hb8fYZZDUjjCt0Fg36bkgqFjEmBNrJuZq1gw0jPYOA0QQvioTEH5rYUU
gPyCScfegPGlQxWNVeiSGE41Twej0n+lFmmLFirUVq8IBfgmG9bqlKpttvgl1GtZGkGKRiWrOJG4
MqmAX5R1jDFDarQNMaSI8HgMYMYNFRYH4rEJrQpEFw1iQsFgTsWgsVQwtVYBWvyOJaqJExhWms61
Ew3sUMNobA8onDBIgry9UDnV44JgoiuByzVycExX7A2IJiRP/hmgKxt1l4DaVyTNqkAWEoAtq2rQ
F9K84zK6MxAnSUKbvIUdF9w1hLSaDUEpMMH5A7yJFLKP66Or7Dhs2c120WiYA7MnDABPowR8BHCl
GiM7kplsLjwKieBZkr0GBgGUkhOzXE0aEF4fTWSU/ttnQTxvmwop7KyD2cS7jgTlycowalPuKfVp
rh6x4uIe6e0KE9OIZbJRZQrQ+QdXH1UDaSULmZlw5nxXaaTdmMzRymhc8mSh8TXqd1Ge/BFy/EKy
BvK0lZRZUlu2Smw25FFMlUoJSwtIKrJi78CoUkEth9ykq923getZO0wM44eREXZHejCrZMokySSb
C/YV209DTIydwjSeIZsCb2qFhNVsr4IeDhSWju+oHfY/S5dbDdduR2YYxxGTid+ryS4ERhkQ0lPJ
0SU+Y7TCOfAqO9UKyvacDjKRpWQ5LgTN3Bw7Rb7RGGIrxSNsDhtqdoX1LPFTCvMRjUqCeLQ4pq5V
VWHemgkySN7cUgBWJIuCKtQ17xdDjDidGHMZYResCGZt5viTNwpa4me1oCGLN9ym61mDzzkIXLpr
VQHZ4vyuNGYMioIhwrczIFJSPdIX6iWjeIrS0JW5Vkfgdq58Tw3wPaImcTszh2HtV4YGQN3xVD3/
MmoTa5XHQclNIq0ADj1B1FYZoI8I3NfARMVSk0mARyNABy1eeVVJG3p4rkOGuAiOQjTBMUfKBa/6
Qu6tfykmyAapeGfAA3iVSzUg1fUvCN5s5nWbGA7O+YUALNrNyS6lQQaV39cHWLMacuTFW0OYH0M5
8LesCibsDE0F2LGN0ajpFYQcEbTMXGq4xLFJQ0LoQu3OHYewGo08NawNgP1hfefecUeti8F42cU9
PZqNSM4bagnsmvVIX1btYB1V9fj0tbWLOkmsgxZGvoRaepg37veci9HQqHE4IuqDhmn3klmrFsau
3WnZrjF67ZJKuVRyce2pqQGwajdTgDCdtoRCXX7YiFLFBVFt42WpkQiEkwhwitStZohBAmgJlRH2
kyRW2FP6wv+1JUSqg21IxyWgXmDSoBKAhpjF+RRyV3bjr8wfY+TXqHLbXPrXVWe7GrMGwoIsX8LU
lxSDQUoECkcjwkpId50+bXnbvO2CVXY7uzs0qKkTmGY/QIg/vgDanHIRKsmIRYuddtLercn8lMHO
eLZS1ZMjgmUA8AiN7r0c/oMFMR3ccUtOhEbOa8sVJAqlxZG2hT6galKmlOJAusJxh3mq9kl6JpLI
AUQj340RouC99FJWKgeJWggzJ+8zi1+uYVo81nwAHmxrN0Qm15fDqNgjesC5XhvZefXHdEgMLgXJ
zyKZcPDEI7Pp9sB4w5i4lhGyxVjIrt7Sc7RVqulspTCymbv6wzW5WcVx+TjhPcQu5uCeTNBNoWLr
yWbFpLxLpallmyexgkVYz2HItQ85QUsympR28rH4yuhLfOpavNljqWFbrsqsqAiuBc8MFKPfLnM9
5x2e9t90U2YJcy8ultJYudIsTlLBEChKlJNZZwmbKAYJvv2FCPWpilrC1SBamgl4TnI17TOARLa7
a4MlyCrMkySexCmmOCEpp0SMKdLGHEmr2SzDiFI35VlJF5PRSsTHk8MFWPLPzld3awkmdA1YMwT/
as/zyF42BBevBZwnlXuZ1/JNcF04QyH4JB6Fx3Whq9zQR2L6xHeSHm9FKAK4lJFPwFP7Zf4u5Ipw
oSGPwnpM


--===============5832505400701394483==--