bk commit into 4.1 tree (evgen:1.2463) BUG#14482

[eugene]

Below is the list of changes that have just been committed into a local
4.1 repository of evgen. When evgen does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet
  1.2463 05/11/17 20:13:55 evgen@stripped +3 -0
  Fix bug #14482 Wrongly applied optimization in resolve_const_item() caused
  crash
  
  While applying optimization, resolve_const_item() changed Item_cache to
  Item_null. Later Item_cache's function was called for Item_null object, 
  which caused server crash.
  
  resolve_const_item() now applies optimization for items with 
  result_type == ROW_RESULT only to Item_rows.

  sql/item.cc
    1.229 05/11/17 20:09:44 evgen@stripped +4 -3
    Fix bug #14482 Wrongly applied optimization in resolve_const_item() caused
    crash
    
    resolve_const_item() now applies optimization for result_type == ROW_RESULT
    only to Item_rows.

  mysql-test/r/select.result
    1.71 05/11/17 20:09:34 evgen@stripped +8 -0
    Test case for bug #14482 Wrongly applied optimization in resolve_const_item() caused
crash

  mysql-test/t/select.test
    1.54 05/11/17 20:09:22 evgen@stripped +11 -0
    Test case for bug #14482 Wrongly applied optimization in resolve_const_item() caused
crash
    

# This is a BitKeeper patch.  What follows are the unified diffs for the
# set of deltas contained in the patch.  The rest of the patch, the part
# that BitKeeper cares about, is below these diffs.
# User:	evgen
# Host:	moonbone.local
# Root:	/work/14482-bug-4.1-mysql

--- 1.228/sql/item.cc	2005-10-25 20:01:39 +04:00
+++ 1.229/sql/item.cc	2005-11-17 20:09:44 +03:00
@@ -2863,7 +2863,7 @@
 void resolve_const_item(THD *thd, Item **ref, Item *comp_item)
 {
   Item *item= *ref;
-  Item *new_item;
+  Item *new_item= NULL;
   if (item->basic_const_item())
     return;                                     // Can't be better
   Item_result res_type=item_cmp_type(comp_item->result_type(),
@@ -2892,7 +2892,8 @@
     new_item= (null_value ? (Item*) new Item_null(name) :
                (Item*) new Item_int(name, result, length));
   }
-  else if (res_type == ROW_RESULT)
+  else if (res_type == ROW_RESULT && item->type() == Item::ROW_ITEM &&
+           comp_item->type() == Item::ROW_ITEM)
   {
     Item_row *item_row= (Item_row*) item;
     Item_row *comp_item_row= (Item_row*) comp_item;
@@ -2910,7 +2911,7 @@
     while (col-- > 0)
       resolve_const_item(thd, item_row->addr(col), comp_item_row->el(col));
   }
-  else
+  else if (res_type == REAL_RESULT)
   {						// It must REAL_RESULT
     double result=item->val();
     uint length=item->max_length,decimals=item->decimals;

--- 1.70/mysql-test/r/select.result	2005-10-27 18:35:50 +04:00
+++ 1.71/mysql-test/r/select.result	2005-11-17 20:09:34 +03:00
@@ -2706,3 +2706,11 @@
 count(f2) >0
 1
 drop table t1,t2;
+create table t1 (f1 int,f2 int);
+insert into t1 values(1,1);
+create table t2 (f3 int, f4 int, primary key(f3,f4));
+insert into t2 values(1,1);
+select * from t1 where f1 in (select f3 from t2 where (f3,f4)= (select f3,f4 from t2));
+f1	f2
+1	1
+drop table t1,t2;

--- 1.53/mysql-test/t/select.test	2005-10-27 17:44:26 +04:00
+++ 1.54/mysql-test/t/select.test	2005-11-17 20:09:22 +03:00
@@ -2237,4 +2237,15 @@
 insert into t2 values (1,1),(1,2);
 select distinct count(f2) >0 from t1 left join t2 on f1=f3 group by f1;
 drop table t1,t2;
+
+#
+# Bug #14482 Server crash when subselecting from the same table
+#
+create table t1 (f1 int,f2 int);
+insert into t1 values(1,1);
+create table t2 (f3 int, f4 int, primary key(f3,f4));
+insert into t2 values(1,1);
+select * from t1 where f1 in (select f3 from t2 where (f3,f4)= (select f3,f4 from t2)); 
+drop table t1,t2;
+
 # End of 4.1 tests