Re: Sporadic wrong results and valgrind failure in/below mm_* functions
Test case. This crashes and produces a valgrind warning only in maria-5.3-mwl128. maria-5.3 does not appear to be affected, however since EXPLAIN also crashes, it is not possible to determine if the two trees use the same query plan.

--source include/have_innodb.inc
CREATE TABLE t1 ( f3 int(11)) ;
CREATE TABLE t2 ( f1 int(11), f2 int(11), PRIMARY KEY (f1), KEY (f2)) ENGINE=InnoDB;
INSERT IGNORE INTO t2 VALUES (1,2);

CREATE OR REPLACE VIEW v1 AS SELECT * FROM t1;

SELECT *
FROM t2 AS alias1
JOIN t2 AS alias2 ON alias1.f2 = alias2.f1
JOIN v1 ON alias2.f1 = v1.f3
WHERE v1.f3 BETWEEN 2 AND 5 AND alias1.f2 IN ( 1 );

valgrind warning:

==19181== Invalid read of size 4
==19181== at 0x83AAA5A: get_full_func_mm_tree(RANGE_OPT_PARAM*, Item_func*, Item_field*, Item*, bool) (opt_range.cc:7111)
==19181== by 0x83AB23C: get_mm_tree(RANGE_OPT_PARAM*, Item*) (opt_range.cc:7216)
==19181== by 0x83AAC6A: get_mm_tree(RANGE_OPT_PARAM*, Item*) (opt_range.cc:7145)
==19181== by 0x83A2F72: SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool) (opt_range.cc:3025)
==19181== by 0x830ABDA: get_quick_record_count(THD*, SQL_SELECT*, st_table*, Bitmap<64u> const*, unsigned long long) (sql_select.cc:2746)
==19181== by 0x830C74C: make_join_statistics(JOIN*, TABLE_LIST*, Item*, st_dynamic_array*) (sql_select.cc:3203)
==19181== by 0x8304E98: JOIN::optimize() (sql_select.cc:954)
==19181== by 0x830A803: mysql_select(THD*, Item**, TABLE_LIST, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, u$
==19181== by 0x8303130: handle_select(THD*, st_lex*, select_result*, unsigned long) (sql_select.cc:282)
==19181== by 0x82A0C9B: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:5070)
==19181== by 0x8297CAA: mysql_execute_command(THD*) (sql_parse.cc:2234)
==19181== by 0x82A3233: mysql_parse(THD*, char*, unsigned int, char const**) (sql_parse.cc:6077)
==19181== by 0x8295942: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1210)
==19181== by 0x8294DEF: do_command(THD*) (sql_parse.cc:903)
==19181== by 0x8291ECD: handle_one_connection (sql_connect.cc:1154)
==19181== by 0x821918: start_thread (in /lib/libpthread-2.12.1.so)

Re: Sporadic wrong results and valgrind failure in/below mm_* functions
bzr version-info:

revision-id: igor@askmonty.org-20110129025430-221yzgrb7yap99jt
date: 2011-01-28 18:54:30 -0800
build-date: 2011-02-02 15:33:26 +0200
revno: 2897
branch-nick: maria-5.3-mwl128

Re: Sporadic wrong results and valgrind failure in/below mm_* functions
The bug cannot be reproduced with the reported test case for the main
5.3 tree because the backported fix for bug 59696 masks the
problem that causes the crash in the mentioned test case. It's not
clear weather this fix masks this problem in all possible cases.

Anyway the patch for bug 698882 introduced some inconsistent data
structures that could contain indirect references to deleted object.
It happened when two Item_equal objects were merged and the Item_field
list of the second object was joined to such list of the first object.
This operation required adjustment of the backward pointers in
Item fields from the joined list. However the adjustment was missing
and this caused crashes in the tree for mwl#128.

That's why I decided to apply the fix to 5.3 too.

Launchpad bug id: 702403