Oleksandr Byelkin added a comment - 2020-03-17 09:23 It is problem of condition pushdown, Item IN copy delete array and then original IN item trys to delete it.

Oleksandr Byelkin added a comment - 2020-03-17 16:02 More precise the problem is that IN tries to make copy for pushdown, it make copy of IN but fail it for arguments so the copy of IN done as it was done by get_item_copy and then did not setup as it should. And so it has original Array and tries to delete it first in the copy then in the original Item.

Oleksandr Byelkin added a comment - 2020-03-17 18:12 This patch fix this bug problem but I have to check if there are more problem like this. diff --git a/sql/item.cc b/sql/item.cc index 4f8433c28c0..a1c8ef01b90 100644 --- a/sql/item.cc +++ b/sql/item.cc @@ -2446,7 +2446,8 @@ Item* Item_ref::build_clone(THD *thd, MEM_ROOT *mem_root) Item_ref *copy= (Item_ref *) get_copy(thd, mem_root); if (!copy) return 0; - copy->ref= + DBUG_ASSERT(thd->is_runtime(mem_root)); + copy->ref= (Item**) alloc_root(mem_root, sizeof(Item*)); if (!copy->ref) return 0; diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc index a28daf36f05..4572beeca62 100644 --- a/sql/item_cmpfunc.cc +++ b/sql/item_cmpfunc.cc @@ -4199,6 +4199,7 @@ bool Item_func_in::create_array(THD *thd) } if (!array || thd->is_fatal_error) // OOM return true; + has_own_array= TRUE; uint j=0; for (uint i=1 ; i < arg_count ; i++) { @@ -4294,6 +4295,7 @@ bool Item_func_in::fix_length_and_dec() array= new (thd->mem_root) in_row(thd, arg_count-1, 0); if (!array) return TRUE; + has_own_array= TRUE; cmp= &((in_row*)array)->tmp; } else @@ -4471,12 +4473,24 @@ longlong Item_func_in::val_int() } +Item *Item_func_in::get_copy(THD *thd, MEM_ROOT *mem_root) +{ + Item_func_in *clone= (Item_func_in *) + get_item_copy<Item_func_in>(thd, mem_root, this); + if (clone) + { + clone->has_own_array= FALSE; + bzero(&clone->cmp_items, sizeof(cmp_items)); + } + return clone; +} + + Item *Item_func_in::build_clone(THD *thd, MEM_ROOT *mem_root) { Item_func_in *clone= (Item_func_in *) Item_func::build_clone(thd, mem_root); if (clone) { - bzero(&clone->cmp_items, sizeof(cmp_items)); clone->fix_length_and_dec(); } return clone; diff --git a/sql/item_cmpfunc.h b/sql/item_cmpfunc.h index 613fb75bcd6..f0fee0163c2 100644 --- a/sql/item_cmpfunc.h +++ b/sql/item_cmpfunc.h @@ -1652,12 +1652,13 @@ class Item_func_in :public Item_func_opt_neg and can be used safely as comparisons for key conditions */ bool arg_types_compatible; + bool has_own_array; Item_result left_cmp_type; cmp_item *cmp_items[6]; /* One cmp_item for each result type */ Item_func_in(THD *thd, List<Item> &list): Item_func_opt_neg(thd, list), array(0), have_null(0), - arg_types_compatible(FALSE) + arg_types_compatible(FALSE), has_own_array(TRUE) { bzero(&cmp_items, sizeof(cmp_items)); allowed_arg_cols= 0; // Fetch this value from first argument @@ -1671,7 +1672,8 @@ class Item_func_in :public Item_func_opt_neg uint i; DBUG_ENTER("Item_func_in::cleanup"); Item_int_func::cleanup(); - delete array; + if (has_own_array) + delete array; array= 0; for (i= 0; i <= (uint)TIME_RESULT; i++) { @@ -1708,8 +1710,7 @@ class Item_func_in :public Item_func_opt_neg bool eval_not_null_tables(void *opt_arg); void fix_after_pullout(st_select_lex *new_parent, Item **ref, bool merge); bool count_sargable_conds(void *arg); - Item *get_copy(THD *thd, MEM_ROOT *mem_root) - { return get_item_copy<Item_func_in>(thd, mem_root, this); } + Item *get_copy(THD *thd, MEM_ROOT *mem_root); Item *build_clone(THD *thd, MEM_ROOT *mem_root); }; diff --git a/sql/sql_class.h b/sql/sql_class.h index b35f9a93238..fa0285bf9ba 100644 --- a/sql/sql_class.h +++ b/sql/sql_class.h @@ -4515,6 +4515,7 @@ class THD :public Statement, current_linfo= 0; mysql_mutex_unlock(&LOCK_thread_count); } + bool is_runtime (MEM_ROOT *root) { return root == & main_mem_root; } }; inline void add_to_active_threads(THD *thd) diff --git a/sql/table.cc b/sql/table.cc index d6d86d96016..5252ca46dde 100644 --- a/sql/table.cc +++ b/sql/table.cc @@ -8432,6 +8432,7 @@ Item* TABLE_LIST::build_pushable_cond_for_table(THD *thd, Item *cond) { bool cond_and= false; Item_cond *new_cond; + DBUG_ASSERT(thd->is_runtime(thd->mem_root)); if (((Item_cond*) cond)->functype() == Item_func::COND_AND_FUNC) { cond_and= true;

Oleksandr Byelkin added a comment - 2020-03-20 09:54 OK to push, but please first use stage tree for testing on buildbot (or if you did use ":" after MDEV in comment to make it easy by our robot to attach the commit to MDEV (also possible that our robot which attach the commits is not working again)

Igor Babaev (Inactive) added a comment - 2020-03-24 03:41 A fix for this bug was pushed into 10.2.