Skip to content

MDEV-32401 expression cache lead to crash if table of wrong type created and the cache switched off - #5492

Open
forkfun wants to merge 1 commit into
10.6from
bb-10.6-MDEV-32401
Open

MDEV-32401 expression cache lead to crash if table of wrong type created and the cache switched off#5492
forkfun wants to merge 1 commit into
10.6from
bb-10.6-MDEV-32401

Conversation

@forkfun

@forkfun forkfun commented Aug 5, 2026

Copy link
Copy Markdown
Contributor
  1. take into account TMP_TABLE_ALL_COLUMNS when
    we are modifying agg_item->result_field
  2. remove unused now "bool materialized_subquery;"

(cherry picked from commit 3d0ea3d)

…ted and the cache switched off

1) take into account TMP_TABLE_ALL_COLUMNS when
   we are modifying agg_item->result_field
2) remove unused now "bool materialized_subquery;"

(cherry picked from commit 3d0ea3d)
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes MDEV-32401 by preventing unsafe Item_sum::result_field rewrites when creating “all columns” temporary tables (e.g., expression cache / non-aggregation temp tables), removes the now-unused temp-table materialization flag, and adds a regression test to cover the crash scenario.

Changes:

  • Gate Item_sum::result_field updates on TMP_TABLE_ALL_COLUMNS/not_all_columns during tmp table field creation.
  • Remove TMP_TABLE_PARAM::materialized_subquery and its remaining assignment.
  • Add mysql-test coverage reproducing the expression-cache crash scenario.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
sql/sql_select.cc Changes when Item_sum::result_field gets updated during tmp table creation.
sql/sql_priv.h Documents semantics of TMP_TABLE_ALL_COLUMNS.
sql/sql_class.h Removes TMP_TABLE_PARAM::materialized_subquery member and constructor init.
sql/sql_class.cc Removes materialized_subquery initialization.
sql/item_subselect.cc Removes setting of the removed materialized_subquery flag.
mysql-test/main/subselect_cache.test Adds regression test queries for MDEV-32401.
mysql-test/main/subselect_cache.result Updates expected output for the new regression test.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread sql/sql_select.cc
Comment on lines +20315 to +20319
if (not_all_columns)
{
DBUG_ASSERT(!agg_item->result_field);
agg_item->result_field= new_field;
}
Comment thread sql/sql_priv.h
Comment on lines +126 to +133
/*
Include all colums in temporary table, i.e. do not ignore aggregate and
constants, i.e. the temporary table created for other purposes than
aggregation.

As a side effect it also require do not modify result_field of the
Items by which the temporary table created
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

5 participants