LP:819716 - Crash in JOIN::optimize with variables and nested derived tables in maria-5.3

Not repeatable with maria-5.2. Does not require any tables to run.

test case:

SELECT * FROM ( SELECT * FROM ( SELECT @b ) AS a1 ) AS a2;

explain:

id select_type table type possible_keys key key_len ref rows Extra
1 PRIMARY <derived2> ALL NULL NULL NULL NULL 2
2 DERIVED <derived3> ALL NULL NULL NULL NULL 2
3 DERIVED NULL NULL NULL NULL NULL NULL NULL No tables used

backtrace:

#2 0x0000000000691b54 in handle_segfault (sig=11) at mysqld.cc:2805
#3 <signal handler called>
#4 0x000000000074b5b9 in JOIN::optimize (this=0x0) at sql_select.cc:868
#5 0x00000000008a0b63 in mysql_derived_optimize (thd=0xe8ea108, lex=0xe8ec510, derived=0xe995e60) at sql_derived.cc:755
#6 0x00000000008a1a74 in mysql_handle_single_derived (lex=0xe8ec510, derived=0xe995e60, phases=4) at sql_derived.cc:174
#7 0x000000000070e4c5 in TABLE_LIST::handle_derived (this=0xe995e60, lex=0xe8ec510, phases=4) at table.cc:5766
#8 0x000000000057a833 in st_select_lex::handle_derived (this=0xe970388, lex=0xe8ec510, phases=4) at sql_lex.cc:3159
#9 0x000000000074b681 in JOIN::optimize (this=0xe9a4e10) at sql_select.cc:878
#10 0x00000000008a0b63 in mysql_derived_optimize (thd=0xe8ea108, lex=0xe8ec510, derived=0xe996678) at sql_derived.cc:755
#11 0x00000000008a1a74 in mysql_handle_single_derived (lex=0xe8ec510, derived=0xe996678, phases=4) at sql_derived.cc:174
#12 0x000000000070e4c5 in TABLE_LIST::handle_derived (this=0xe996678, lex=0xe8ec510, phases=4) at table.cc:5766
#13 0x000000000057a833 in st_select_lex::handle_derived (this=0xe8eca98, lex=0xe8ec510, phases=4) at sql_lex.cc:3159
#14 0x000000000074b681 in JOIN::optimize (this=0xe997a10) at sql_select.cc:878
#15 0x000000000074feb7 in mysql_select (thd=0xe8ea108, rref_pointer_array=0xe8ecce8, tables=0xe996678, wild_num=1, fields=..., conds=0x0, og_num=0,
order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xe971b90, unit=0xe8ec5b0, select_lex=0xe8eca98)
at sql_select.cc:2877
#16 0x0000000000756376 in handle_select (thd=0xe8ea108, lex=0xe8ec510, result=0xe971b90, setup_tables_done_option=0) at sql_select.cc:283
#17 0x00000000006a3046 in execute_sqlcom_select (thd=0xe8ea108, all_tables=0xe996678) at sql_parse.cc:5087
#18 0x00000000006a4d24 in mysql_execute_command (thd=0xe8ea108) at sql_parse.cc:2231
#19 0x00000000006adabd in mysql_parse (thd=0xe8ea108, rawbuf=0xe96fd40 "SELECT * FROM ( SELECT * FROM ( SELECT @b ) AS a1 ) AS a2", length=57,
found_semicolon=0x4201bf08) at sql_parse.cc:6088
#20 0x00000000006ae955 in dispatch_command (command=COM_QUERY, thd=0xe8ea108, packet=0xe9669c9 "SELECT * FROM ( SELECT * FROM ( SELECT @b ) AS a1 ) AS a2",
packet_length=57) at sql_parse.cc:1208
#21 0x00000000006aff63 in do_command (thd=0xe8ea108) at sql_parse.cc:906
#22 0x000000000069a903 in handle_one_connection (arg=0xe8ea108) at sql_connect.cc:1178
#23 0x00000033b600673d in start_thread () from /lib64/libpthread.so.0
#24 0x00000033b58d40cd in clone () from /lib64/libc.so.6

bzr version-info
revision-id: <email address hidden>
date: 2011-08-01 11:05:30 +0200
build-date: 2011-08-02 12:44:39 +0300
revno: 3138
branch-nick: maria-5.3