LP:830993 - Crash in end_read_record with derived table

Queries such as:

SELECT alias1 . `col_int_key` AS field1 FROM ( ( SELECT SQ1_alias1 . * FROM ( C AS SQ1_alias1 INNER JOIN ( C AS SQ1_alias2 INNER JOIN C AS SQ1_alias3 ON (SQ1_alias3 . `col_varchar_key` = SQ1_alias2 . `col_varchar_key` ) ) ON (SQ1_alias3 . `col_varchar_key` = SQ1_alias2 . `col_varchar_key` ) ) ) AS alias1 , CC AS alias2 ) WHERE ( EXISTS ( ( SELECT 7 FROM DUAL ) ) ) OR ( alias1 . `col_int_key` = alias1 . `pk` OR alias1 . `col_varchar_key` LIKE CONCAT( 'x' , '%') ) GROUP BY field1 HAVING field1 > 's' ORDER BY alias1 . `col_varchar_key` DESC , CONCAT ( alias2 . `col_varchar_nokey`, alias1 . `col_varchar_key` )

sporadically cause the following crash:

1. 2011-08-22T13:18:06 #3 <signal handler called>
2. 2011-08-22T13:18:06 #4 0x000000000080e828 in end_read_record (info=0x87da988) at records.cc:294
3. 2011-08-22T13:18:06 #5 0x0000000000735c7a in st_join_table::cleanup (this=0x87da8d8) at sql_select.cc:9586
4. 2011-08-22T13:18:06 #6 0x0000000000735d7b in JOIN::cleanup (this=0x85f2a40, full=true) at sql_select.cc:9858
5. 2011-08-22T13:18:06 #7 0x000000000073ecb6 in JOIN::destroy (this=0x85f2a40) at sql_select.cc:2740
6. 2011-08-22T13:18:06 #8 0x000000000089e350 in st_select_lex::cleanup (this=0x2aaac10c6388) at sql_union.cc:929
7. 2011-08-22T13:18:06 #9 0x0000000000750629 in mysql_select (thd=0x2aaac10c39f8, rref_pointer_array=0x2aaac10c65d8, tables=0x84346c0, wild_num=0, fields=..., conds=0x85b4fc0,
8. 2011-08-22T13:18:06 og_num=3, order=0x85b5650, group=0x85b51c0, having=0x85b5398, proc_param=0x0, select_options=2147764736, result=0x85b5b40, unit=0x2aaac10c5ea0,
9. 2011-08-22T13:18:06 select_lex=0x2aaac10c6388) at sql_select.cc:2923
10. 2011-08-22T13:18:06 #10 0x0000000000756972 in handle_select (thd=0x2aaac10c39f8, lex=0x2aaac10c5e00, result=0x85b5b40, setup_tables_done_option=0) at sql_select.cc:283
11. 2011-08-22T13:18:06 #11 0x00000000006a331e in execute_sqlcom_select (thd=0x2aaac10c39f8, all_tables=0x84346c0) at sql_parse.cc:5090
12. 2011-08-22T13:18:06 #12 0x00000000006a4ffc in mysql_execute_command (thd=0x2aaac10c39f8) at sql_parse.cc:2234
13. 2011-08-22T13:18:06 #13 0x00000000006add95 in mysql_parse (thd=0x2aaac10c39f8,
14. 2011-08-22T13:18:06 rawbuf=0x86d5fb0 "/* 6 */ SELECT alias1 . `col_int_key` AS field1 FROM ( ( SELECT SQ1_alias1 . * FROM ( C AS SQ1_alias1 INNER JOIN ( C AS SQ1_alias2 INNER JOIN C AS SQ1_alias3 ON (SQ1_alias3 . `col_varchar_key` = SQ1_alias2 . `col_varchar_key` ) ) ON (SQ1_alias3 . `col_varchar_key` = SQ1_alias2 . `col_varchar_key` ) ) ) AS alias1 , CC AS alias2 ) WHERE ( EXISTS ( ( SELECT 7 FROM DUAL ) ) ) OR ( alias1 . `col_int_key` = alias1 . `pk` OR alias1 . `col_varchar_key` LIKE CONCAT( 'x' , '%') ) GROUP BY field1 HAVING field1 > 's' ORDER BY alias1 . `col_varchar_key` DESC , CONCAT ( alias2 . `col_varchar_nokey`, alias1 . `col_varchar_key` )", length=635, found_semicolon=0x4ec09f08) at sql_parse.cc:6091
15. 2011-08-22T13:18:06 #14 0x00000000006aec65 in dispatch_command (command=COM_QUERY, thd=0x2aaac10c39f8,
16. 2011-08-22T13:18:06 packet=0x2aaac10c76c9 "/* 6 */ SELECT alias1 . `col_int_key` AS field1 FROM ( ( SELECT SQ1_alias1 . * FROM ( C AS SQ1_alias1 INNER JOIN ( C AS SQ1_alias2 INNER JOIN C AS SQ1_alias3 ON (SQ1_alias3 . `col_varchar_key` = SQ1_alias2 . `col_varchar_key` ) ) ON (SQ1_alias3 . `col_varchar_key` = SQ1_alias2 . `col_varchar_key` ) ) ) AS alias1 , CC AS alias2 ) WHERE ( EXISTS ( ( SELECT 7 FROM DUAL ) ) ) OR ( alias1 . `col_int_key` = alias1 . `pk` OR alias1 . `col_varchar_key` LIKE CONCAT( 'x' , '%') ) GROUP BY field1 HAVING field1 > 's' ORDER BY alias1 . `col_varchar_key` DESC , CONCAT ( alias2 . `col_varchar_nokey`, alias1 . `col_varchar_key` )", packet_length=635) at sql_parse.cc:1211
17. 2011-08-22T13:18:06 #15 0x00000000006b0273 in do_command (thd=0x2aaac10c39f8) at sql_parse.cc:906
18. 2011-08-22T13:18:06 #16 0x000000000069aba7 in handle_one_connection (arg=0x2aaac10c39f8) at sql_connect.cc:1186
19. 2011-08-22T13:18:06 #17 0x00000033b600673d in start_thread () from /lib64/libpthread.so.0
20. 2011-08-22T13:18:06 #18 0x00000033b58d40cd in clone () from /lib64/libc.so.6

The crash happens repeatably inside RQG but is difficult to reproduce outside of it, so concurrency or some other inter-query interaction may be present.