Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-5382

Crash with complex multi-subquery query + derived_merge=ON

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 5.3.12, 5.5.34, 10.0.6
    • Fix Version/s: 5.5.35, 10.0.7, 5.3.13
    • Component/s: None
    • Labels:
      None

      Description

      (Thanks to shad0w1e on Freenode #mysql for finding this bug. I reduced it to a minimal test case and figured out the affected versions.)

      The following will crash MariaDB. MySQL is not similarly affected:

      DROP TABLE IF EXISTS `t1`;
      CREATE TABLE `t1` (
        `a` INT DEFAULT NULL
      );
       
      DROP TABLE IF EXISTS `t2`;
      CREATE TABLE `t2` (
        `b` INT DEFAULT NULL
      );
       
      # No crash:
      SET SESSION optimizer_switch='derived_merge=OFF';
       
      SELECT c1
      FROM (
        SELECT (
          SELECT 1
          FROM t1
          WHERE t1.a <= t2.b
          UNION ALL
          SELECT 1
          FROM t1
          WHERE t1.a <= t2.b
          ORDER BY a DESC
        ) AS c1
        FROM t2
      ) t3;
       
      # Crash:
      SET SESSION optimizer_switch='derived_merge=ON';
       
      SELECT c1
      FROM (
        SELECT (
          SELECT 1
          FROM t1
          WHERE t1.a <= t2.b
          UNION ALL
          SELECT 1
          FROM t1
          WHERE t1.a <= t2.b
          ORDER BY a DESC
        ) AS c1
        FROM t2
      ) t3;

        Attachments

          Activity

            People

            • Assignee:
              igor Igor Babaev
              Reporter:
              jeremycole Jeremy Cole
            • Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: