MySQL Bugs: #245: Crash with UNION with subselect in ORDER BY

Bug #245	Crash with UNION with subselect in ORDER BY
Submitted:	7 Apr 2003 23:43	Modified:	17 May 2003 8:01
Reporter:	jocelyn fournier (Silver Quality Contributor)	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server	Severity:	S1 (Critical)
Version:	4.1	OS:	Any (all)
Assigned to:	Michael Widenius	CPU Architecture:	Any

Description:
(SELECT 1) UNION (SELECT 2) ORDER BY (SELECT a) crashes.

Stack trace :

0x80af681 handle_segfault + 481
0x82aef58 pthread_sighandler + 176
0x80d76df find_item_in_list(Item*, List<Item>&, unsigned*, find_item_error_report_type) + 95
0x804d096 Item_field::fix_fields(THD*, st_table_list*, Item**) + 182
0x80d7a10 setup_fields(THD*, Item**, st_table_list*, List<Item>&, bool, List<Item>*, bool) + 96
0x80dca22 JOIN::prepare(Item***, st_table_list*, unsigned, Item*, unsigned, st_order*, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*, bool) + 242
0x8090587 subselect_single_select_engine::prepare() + 199
0x808e72a Item_subselect::fix_fields(THD*, st_table_list*, Item**) + 170
0x80e5d6a find_order_in_list(THD*, Item**, st_table_list*, st_order*, List<Item>&, List<Item>&) + 138
0x80dcac9 JOIN::prepare(Item***, st_table_list*, unsigned, Item*, unsigned, st_order*, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*, bool) + 409
0x80df771 _Z12mysql_selectP3THDPPP4ItemP13st_table_listjR4ListIS1_ES2_jP8st_orderSB_S2_SB_mP13select_resultP18st_select_lex_unitP13st_sel + 497
0x8154dc3 st_select_lex_unit::exec() + 675
0x8153f8f mysql_union(THD*, st_lex*, select_result*, st_select_lex_unit*, bool) + 79
0x80dc771 handle_select(THD*, st_lex*, select_result*) + 113
0x80bde44 mysql_execute_command(THD*) + 644
0x80c2e18 mysql_parse(THD*, char*, unsigned) + 232
0x80bc9d3 dispatch_command(enum_server_command, THD*, char*, unsigned) + 867
0x80bc625 do_command(THD*) + 133
0x80bbeb9 handle_one_connection + 857
0x82ac97a pthread_start_thread + 218
0x82e0eca thread_start + 4

How to repeat:
(SELECT 1) UNION (SELECT 2) ORDER BY (SELECT a)

Thank you for your bug report.

It was a bug and this is a fix:

==== sql/item.cc 1.67 vs edited =====
*** /tmp/item.cc-1.67-19771     Fri Mar 28 16:58:44 2003
--- edited/sql/item.cc  Tue Apr  8 15:42:38 2003
***************
*** 701,709 ****
                                         (last= sl)->get_table_list(), &where,
                                         0)) != not_found_field)
            break;
!         if ((refer= find_item_in_list(this, sl->item_list, &counter,
!                                      REPORT_EXCEPT_NOT_FOUND)) !=
!            (Item **)not_found_item)
            break;
          if (sl->master_unit()->first_select()->linkage ==
              DERIVED_TABLE_TYPE)
--- 701,710 ----
                                         (last= sl)->get_table_list(), &where,
                                         0)) != not_found_field)
            break;
!         if (sl->item_list.elements &&
!             ((refer= find_item_in_list(this, sl->item_list, &counter, 
!                                        REPORT_EXCEPT_NOT_FOUND)) != 
!              (Item **)not_found_item))
            break;
          if (sl->master_unit()->first_select()->linkage ==
              DERIVED_TABLE_TYPE)

I reopened this bug as I strongly suspect that he fix was wrong.
I have reverted the fix in 4.1 and we don't seam to have any problems in 4.1 even after this.  (I hope this is becasue some other patch fixed this problem)

Please test in 4.1.1 if you can get any queries like this to fail!

Hi,

I'm unable to compile the latest bk tree to check if the bug is still here :

mysqld.cc: In function `my_bool get_one_option(int, const my_option*, char*)':
mysqld.cc:5056: error: `isam_skip' undeclared (first use this function)
mysqld.cc:5056: error: (Each undeclared identifier is reported only once for 
   each function it appears in.)
mysqld.cc:5057: error: `isam_innodb' undeclared (first use this function)

Regards,
  Jocelyn

Hi,

After applying changeset 1.1531 the compilation problem is gone.
I can also confirm the bug is fixed :)

Jocelyn