3951 Tor Didriksen 2012-02-23
WL#6158 post-push fix: correct size specifier for shift constant.
modified:
unittest/gunit/join_tab_sort-t.cc
3950 Norvald H. Ryeng 2012-02-23
Bug#13571700 TINYBLOB NOT NULL, CRASH IN PROTOCOL::NET_STORE_DATA
Problem: Crash or wrong result for NOT NULL columns if the query
contains an impossible WHERE clause.
If a query contains an impossible WHERE clause, JOIN::optimize()
recognizes that this query will not produce any rows (except maybe a
NULL row) and exits early, without constructing join_tab.
JOIN::exec() recognizes the optimizer's decision and calls
return_zero_rows() to construct the NULL row. To construct this row,
it first calls mark_as_null_row() on the tables and then reads the
fields. However, the tables are found by following pointers from
join_tab, which is a null pointer because of the impossible WHERE
clause. The result is that the tables' null_row are not set, which
again leads to Field::is_null() returning false and an attempt to read
the field's value. The value is undefined, so the result may be an
arbitrary value (e.g., in the case of an INT) or a crash if it is an
undefined pointer, as in the case of TINYBLOB.
This bug is a regression introduced by
revid:jorgen.loland@stripped.
Fix: Revert to accessing tables through join->select_lex->leaf_tables
instead of join->join_tab.
@ mysql-test/include/select.inc
Add test case for bug #13571700.
@ mysql-test/r/select_all.result
Add test case for bug #13571700.
@ mysql-test/r/select_all_bka.result
Add test case for bug #13571700.
@ mysql-test/r/select_all_bka_nixbnl.result
Add test case for bug #13571700.
@ mysql-test/r/select_icp_mrr.result
Add test case for bug #13571700.
@ mysql-test/r/select_icp_mrr_bka.result
Add test case for bug #13571700.
@ mysql-test/r/select_icp_mrr_bka_nixbnl.result
Add test case for bug #13571700.
@ mysql-test/r/select_none.result
Add test case for bug #13571700.
@ mysql-test/r/select_none_bka.result
Add test case for bug #13571700.
@ mysql-test/r/select_none_bka_nixbnl.result
Add test case for bug #13571700.
@ sql/sql_executor.cc
Access tables through join->select_lex->leaf_tables.
modified:
mysql-test/include/select.inc
mysql-test/r/select_all.result
mysql-test/r/select_all_bka.result
mysql-test/r/select_all_bka_nixbnl.result
mysql-test/r/select_icp_mrr.result
mysql-test/r/select_icp_mrr_bka.result
mysql-test/r/select_icp_mrr_bka_nixbnl.result
mysql-test/r/select_none.result
mysql-test/r/select_none_bka.result
mysql-test/r/select_none_bka_nixbnl.result
sql/sql_executor.cc
=== modified file 'unittest/gunit/join_tab_sort-t.cc'
--- a/unittest/gunit/join_tab_sort-t.cc 2012-02-23 11:22:34 +0000
+++ b/unittest/gunit/join_tab_sort-t.cc 2012-02-23 13:54:03 +0000
@@ -55,19 +55,28 @@ protected:
Server_initializer initializer;
};
+
class MOCK_JOIN_TAB : public JOIN_TAB
{
public:
MOCK_JOIN_TAB(uint recs, uint table_no) : JOIN_TAB()
{
found_records= recs;
- m_table.map= 1UL<<table_no;
+ m_table.map= 1ULL << table_no;
this->table= &m_table;
}
TABLE m_table;
};
+std::ostream &operator<<(std::ostream &s, const MOCK_JOIN_TAB &jt)
+{
+ return s << "{"
+ << jt.found_records << ", "
+ << jt.m_table.map
+ << "}";
+}
+
TEST_F(JTSortTest, SimpleSortTest)
{
@@ -135,14 +144,16 @@ TEST_F(JTSortTest, SortDependsTest)
{
arr[i]= new MOCK_JOIN_TAB(i, i);
for (int j= i+1; j < num_tables; j++)
- arr[i]->dependent|= 1UL << j;
+ arr[i]->dependent|= 1ULL << j;
}
// MERGE SORT
std::random_shuffle(arr, arr + num_tables);
merge_sort(arr, arr + num_tables, Join_tab_compare_default());
for (int i= 1; i < num_tables; i++)
- EXPECT_TRUE(arr[i]->found_records < arr[i-1]->found_records);
+ EXPECT_TRUE(arr[i]->found_records < arr[i-1]->found_records)
+ << "i: " << *(arr[i]) << " "
+ << "i-1: " << *(arr[i-1]);
// INSERT SORT
std::random_shuffle(arr, arr + num_tables);
@@ -171,7 +182,7 @@ TEST_F(JTSortTest, SortKeyDependsTest)
{
arr[i]= new MOCK_JOIN_TAB(i, i);
for (int j= i+1; j < num_tables; j++)
- arr[i]->key_dependent|= 1UL << j;
+ arr[i]->key_dependent|= 1ULL << j;
}
// MERGE SORT
No bundle (reason: useless for push emails).
| Thread |
|---|
| • bzr push into mysql-trunk branch (tor.didriksen:3950 to 3951) WL#6158 | Tor Didriksen | 24 Feb |