Details
-
Type:
Bug
-
Status: Closed (View Workflow)
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 5.3.12, 5.5.34, 10.0.6
-
Component/s: None
-
Labels:None
Description
(Thanks to shad0w1e on Freenode #mysql for finding this bug. I reduced it to a minimal test case and figured out the affected versions.)
The following will crash MariaDB. MySQL is not similarly affected:
DROP TABLE IF EXISTS `t1`;
|
CREATE TABLE `t1` (
|
`a` INT DEFAULT NULL
|
);
|
|
|
DROP TABLE IF EXISTS `t2`;
|
CREATE TABLE `t2` (
|
`b` INT DEFAULT NULL
|
);
|
|
|
# No crash:
|
SET SESSION optimizer_switch='derived_merge=OFF';
|
|
|
SELECT c1
|
FROM (
|
SELECT (
|
SELECT 1
|
FROM t1
|
WHERE t1.a <= t2.b
|
UNION ALL
|
SELECT 1
|
FROM t1
|
WHERE t1.a <= t2.b
|
ORDER BY a DESC
|
) AS c1
|
FROM t2
|
) t3;
|
|
|
# Crash:
|
SET SESSION optimizer_switch='derived_merge=ON';
|
|
|
SELECT c1
|
FROM (
|
SELECT (
|
SELECT 1
|
FROM t1
|
WHERE t1.a <= t2.b
|
UNION ALL
|
SELECT 1
|
FROM t1
|
WHERE t1.a <= t2.b
|
ORDER BY a DESC
|
) AS c1
|
FROM t2
|
) t3;
|