[MDEV-18675] Server crashes in COND_EQUAL::copy Created: 2019-02-21 Updated: 2019-04-04 Resolved: 2019-04-04 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Optimizer |
| Affects Version/s: | 10.4 |
| Fix Version/s: | 10.4.4 |
| Type: | Bug | Priority: | Major |
| Reporter: | Alice Sherepa | Assignee: | Galina Shalygina (Inactive) |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Issue Links: |
|
||||||||||||||||
| Description |
|
Reproducible on 10.4 with MyIsam/Innodb
|
| Comments |
| Comment by Galina Shalygina (Inactive) [ 2019-03-14 ] | ||
|
This bug appears because copy() method is called for the empty object (empty COND_EQUAL). Consider conds from the example above:
It can be seen that the right part of the OR condition is always false. So after optimize_cond() work it will be deleted from conds. COND_EQUAL for conds is built in build_item_equal() method. For OR condition it remains empty. After build_item_equal() call remove_eq_conds() is called. It deletes always false right part of the OR condition of conds. So conds after optimize_cond() is looking as:
COND_EQUAL for conds should contain conds itself but it remains empty. COND_EQUAL should be set after remove_eq_conds(). Now COND_EQUAL is set only for the similar case when only one part of OR condition remains and it is AND condition. Thу case of this bug when only one part of OR condition remains and it is multiple equality is missing. To fix it COND_EQUAL for this case should be set after remove_eq_conds() call. | ||
| Comment by Galina Shalygina (Inactive) [ 2019-04-04 ] | ||
|
Fixed in |