drop table if exists `h`; create table `h` (`id` int,`data` int) engine=innodb; select 1 from `h` group by elt(1,1,`h`.`data`,1,1, ( select 1 from `h` `b` inner join ( select sum(distinct(select 1)) as id from `h` left join `h` `c` on 1 group by `c`.`id`,`c`.`data` order by `h`.`id` ) as `d` on 1 ) ) ; Version: '5.5.8-valgrind-max-debug' socket: '/tmp/mysql.sock' port: 3306 Source distribution ==3985== Thread 17: ==3985== Invalid read of size 8 ==3985== at 0x76CB6F: Item_field::print(String*, enum_query_type) (item.cc:6040) ==3985== by 0x5E6B66: st_select_lex::print_order(String*, st_order*, enum_query_type) (sql_lex.cc:2181) ==3985== by 0x64725A: st_select_lex::print(THD*, String*, enum_query_type) (sql_select.cc:17260) ==3985== by 0x5E69EF: st_select_lex_unit::print(String*, enum_query_type) (sql_lex.cc:2150) ==3985== by 0x646B48: TABLE_LIST::print(THD*, String*, enum_query_type) (sql_select.cc:17104) ==3985== by 0x646780: print_join(THD*, String*, List*, enum_query_type) (sql_select.cc:17022) ==3985== by 0x646A03: TABLE_LIST::print(THD*, String*, enum_query_type) (sql_select.cc:17081) ==3985== by 0x6466CF: print_join(THD*, String*, List*, enum_query_type) (sql_select.cc:17007) ==3985== by 0x64712E: st_select_lex::print(THD*, String*, enum_query_type) (sql_select.cc:17232) ==3985== by 0x7D488D: subselect_single_select_engine::print(String*, enum_query_type) (item_subselect.cc:2473) ==3985== by 0x7CE7A5: Item_subselect::print(String*, enum_query_type) (item_subselect.cc:344) ==3985== by 0x7A1272: Item_func::print_args(String*, unsigned int, enum_query_type) (item_func.cc:421) ==3985== by 0x7A11DC: Item_func::print(String*, enum_query_type) (item_func.cc:410) ==3985== by 0x642428: change_to_use_tmp_fields(THD*, Item**, List&, List&, unsigned int, List&) (sql_select.cc:15698) ==3985== by 0x61F7A3: JOIN::exec() (sql_select.cc:1987) ==3985== by 0x621699: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2568) ==3985== by 0x619877: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:296) ==3985== by 0x5F6528: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:4469) ==3985== by 0x5EF161: mysql_execute_command(THD*) (sql_parse.cc:2065) ==3985== by 0x5F869E: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5512) ==3985== by 0x5ECA45: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1029) ==3985== by 0x5EC067: do_command(THD*) (sql_parse.cc:769) ==3985== by 0x6CB751: do_handle_one_connection(THD*) (sql_connect.cc:745) ==3985== by 0x6CB58B: handle_one_connection (sql_connect.cc:684) ==3985== by 0x30E1807760: start_thread (pthread_create.c:301) ==3985== by 0x1818B70F: ??? ==3985== Address 0xd797d08 is 40 bytes inside a block of size 144 free'd ==3985== at 0x4A04D72: free (vg_replace_malloc.c:325) ==3985== by 0xA86FD7: my_free (my_malloc.c:128) ==3985== by 0xA7CF01: free_root (my_alloc.c:365) ==3985== by 0x636F4E: free_tmp_table(THD*, TABLE*) (sql_select.cc:11139) ==3985== by 0x621225: JOIN::destroy() (sql_select.cc:2422) ==3985== by 0x686E4B: st_select_lex::cleanup() (sql_union.cc:801) ==3985== by 0x686A2B: st_select_lex_unit::cleanup() (sql_union.cc:667) ==3985== by 0x5D0E72: mysql_derived_filling(THD*, LEX*, TABLE_LIST*) (sql_derived.cc:311) ==3985== by 0x5D06E1: mysql_handle_derived(LEX*, bool (*)(THD*, LEX*, TABLE_LIST*)) (sql_derived.cc:60) ==3985== by 0x5A42E8: open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) (sql_base.cc:5381) ==3985== by 0x598051: open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) (sql_base.h:476) ==3985== by 0x5F62D3: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:4434) ==3985== by 0x5EF161: mysql_execute_command(THD*) (sql_parse.cc:2065) ==3985== by 0x5F869E: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5512) ==3985== by 0x5ECA45: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1029) ==3985== by 0x5EC067: do_command(THD*) (sql_parse.cc:769) ==3985== by 0x6CB751: do_handle_one_connection(THD*) (sql_connect.cc:745) ==3985== by 0x6CB58B: handle_one_connection (sql_connect.cc:684) ==3985== by 0x30E1807760: start_thread (pthread_create.c:301) ==3985== by 0x1818B70F: ??? ==3985== ==3985== ==3985== ---- Attach to debugger ? --- [Return/N/n/Y/y/C/c] ---- c ==3985== Invalid read of size 1 ==3985== at 0x76CB73: Item_field::print(String*, enum_query_type) (item.cc:6040) ==3985== by 0x5E6B66: st_select_lex::print_order(String*, st_order*, enum_query_type) (sql_lex.cc:2181) ==3985== by 0x64725A: st_select_lex::print(THD*, String*, enum_query_type) (sql_select.cc:17260) ==3985== by 0x5E69EF: st_select_lex_unit::print(String*, enum_query_type) (sql_lex.cc:2150) ==3985== by 0x646B48: TABLE_LIST::print(THD*, String*, enum_query_type) (sql_select.cc:17104) ==3985== by 0x646780: print_join(THD*, String*, List*, enum_query_type) (sql_select.cc:17022) ==3985== by 0x646A03: TABLE_LIST::print(THD*, String*, enum_query_type) (sql_select.cc:17081) ==3985== by 0x6466CF: print_join(THD*, String*, List*, enum_query_type) (sql_select.cc:17007) ==3985== by 0x64712E: st_select_lex::print(THD*, String*, enum_query_type) (sql_select.cc:17232) ==3985== by 0x7D488D: subselect_single_select_engine::print(String*, enum_query_type) (item_subselect.cc:2473) ==3985== by 0x7CE7A5: Item_subselect::print(String*, enum_query_type) (item_subselect.cc:344) ==3985== by 0x7A1272: Item_func::print_args(String*, unsigned int, enum_query_type) (item_func.cc:421) ==3985== by 0x7A11DC: Item_func::print(String*, enum_query_type) (item_func.cc:410) ==3985== by 0x642428: change_to_use_tmp_fields(THD*, Item**, List&, List&, unsigned int, List&) (sql_select.cc:15698) ==3985== by 0x61F7A3: JOIN::exec() (sql_select.cc:1987) ==3985== by 0x621699: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2568) ==3985== by 0x619877: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:296) ==3985== by 0x5F6528: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:4469) ==3985== by 0x5EF161: mysql_execute_command(THD*) (sql_parse.cc:2065) ==3985== by 0x5F869E: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5512) ==3985== by 0x5ECA45: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1029) ==3985== by 0x5EC067: do_command(THD*) (sql_parse.cc:769) ==3985== by 0x6CB751: do_handle_one_connection(THD*) (sql_connect.cc:745) ==3985== by 0x6CB58B: handle_one_connection (sql_connect.cc:684) ==3985== by 0x30E1807760: start_thread (pthread_create.c:301) ==3985== by 0x1818B70F: ??? ==3985== Address 0x13a4fa9d is 1,981 bytes inside a block of size 4,320 free'd ==3985== at 0x4A04D72: free (vg_replace_malloc.c:325) ==3985== by 0xA86FD7: my_free (my_malloc.c:128) ==3985== by 0xA7CF01: free_root (my_alloc.c:365) ==3985== by 0x636F4E: free_tmp_table(THD*, TABLE*) (sql_select.cc:11139) ==3985== by 0x621225: JOIN::destroy() (sql_select.cc:2422) ==3985== by 0x686E4B: st_select_lex::cleanup() (sql_union.cc:801) ==3985== by 0x686A2B: st_select_lex_unit::cleanup() (sql_union.cc:667) ==3985== by 0x5D0E72: mysql_derived_filling(THD*, LEX*, TABLE_LIST*) (sql_derived.cc:311) ==3985== by 0x5D06E1: mysql_handle_derived(LEX*, bool (*)(THD*, LEX*, TABLE_LIST*)) (sql_derived.cc:60) ==3985== by 0x5A42E8: open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) (sql_base.cc:5381) ==3985== by 0x598051: open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) (sql_base.h:476) ==3985== by 0x5F62D3: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:4434) ==3985== by 0x5EF161: mysql_execute_command(THD*) (sql_parse.cc:2065) ==3985== by 0x5F869E: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5512) ==3985== by 0x5ECA45: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1029) ==3985== by 0x5EC067: do_command(THD*) (sql_parse.cc:769) ==3985== by 0x6CB751: do_handle_one_connection(THD*) (sql_connect.cc:745) ==3985== by 0x6CB58B: handle_one_connection (sql_connect.cc:684) ==3985== by 0x30E1807760: start_thread (pthread_create.c:301) ==3985== by 0x1818B70F: ??? ==3985== ==3985== Invalid read of size 8 ==3985== at 0x76CB6F: Item_field::print(String*, enum_query_type) (item.cc:6040) ==3985== by 0x5E6B66: st_select_lex::print_order(String*, st_order*, enum_query_type) (sql_lex.cc:2181) ==3985== by 0x6473A4: st_select_lex::print(THD*, String*, enum_query_type) (sql_select.cc:17291) ==3985== by 0x5E69EF: st_select_lex_unit::print(String*, enum_query_type) (sql_lex.cc:2150) ==3985== by 0x646B48: TABLE_LIST::print(THD*, String*, enum_query_type) (sql_select.cc:17104) ==3985== by 0x646780: print_join(THD*, String*, List*, enum_query_type) (sql_select.cc:17022) ==3985== by 0x646A03: TABLE_LIST::print(THD*, String*, enum_query_type) (sql_select.cc:17081) ==3985== by 0x6466CF: print_join(THD*, String*, List*, enum_query_type) (sql_select.cc:17007) ==3985== by 0x64712E: st_select_lex::print(THD*, String*, enum_query_type) (sql_select.cc:17232) ==3985== by 0x7D488D: subselect_single_select_engine::print(String*, enum_query_type) (item_subselect.cc:2473) ==3985== by 0x7CE7A5: Item_subselect::print(String*, enum_query_type) (item_subselect.cc:344) ==3985== by 0x7A1272: Item_func::print_args(String*, unsigned int, enum_query_type) (item_func.cc:421) ==3985== by 0x7A11DC: Item_func::print(String*, enum_query_type) (item_func.cc:410) ==3985== by 0x642428: change_to_use_tmp_fields(THD*, Item**, List&, List&, unsigned int, List&) (sql_select.cc:15698) ==3985== by 0x61F7A3: JOIN::exec() (sql_select.cc:1987) ==3985== by 0x621699: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2568) ==3985== by 0x619877: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:296) ==3985== by 0x5F6528: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:4469) ==3985== by 0x5EF161: mysql_execute_command(THD*) (sql_parse.cc:2065) ==3985== by 0x5F869E: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5512) ==3985== by 0x5ECA45: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1029) ==3985== by 0x5EC067: do_command(THD*) (sql_parse.cc:769) ==3985== by 0x6CB751: do_handle_one_connection(THD*) (sql_connect.cc:745) ==3985== by 0x6CB58B: handle_one_connection (sql_connect.cc:684) ==3985== by 0x30E1807760: start_thread (pthread_create.c:301) ==3985== by 0x1818B70F: ??? ==3985== Address 0x13a504f8 is 40 bytes inside a block of size 144 free'd ==3985== at 0x4A04D72: free (vg_replace_malloc.c:325) ==3985== by 0xA86FD7: my_free (my_malloc.c:128) ==3985== by 0xA7CF01: free_root (my_alloc.c:365) ==3985== by 0x636F4E: free_tmp_table(THD*, TABLE*) (sql_select.cc:11139) ==3985== by 0x621225: JOIN::destroy() (sql_select.cc:2422) ==3985== by 0x686E4B: st_select_lex::cleanup() (sql_union.cc:801) ==3985== by 0x686A2B: st_select_lex_unit::cleanup() (sql_union.cc:667) ==3985== by 0x5D0E72: mysql_derived_filling(THD*, LEX*, TABLE_LIST*) (sql_derived.cc:311) ==3985== by 0x5D06E1: mysql_handle_derived(LEX*, bool (*)(THD*, LEX*, TABLE_LIST*)) (sql_derived.cc:60) ==3985== by 0x5A42E8: open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) (sql_base.cc:5381) ==3985== by 0x598051: open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) (sql_base.h:476) ==3985== by 0x5F62D3: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:4434) ==3985== by 0x5EF161: mysql_execute_command(THD*) (sql_parse.cc:2065) ==3985== by 0x5F869E: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5512) ==3985== by 0x5ECA45: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1029) ==3985== by 0x5EC067: do_command(THD*) (sql_parse.cc:769) ==3985== by 0x6CB751: do_handle_one_connection(THD*) (sql_connect.cc:745) ==3985== by 0x6CB58B: handle_one_connection (sql_connect.cc:684) ==3985== by 0x30E1807760: start_thread (pthread_create.c:301) ==3985== by 0x1818B70F: ??? ==3985== ==3985== Invalid read of size 1 ==3985== at 0x76CB73: Item_field::print(String*, enum_query_type) (item.cc:6040) ==3985== by 0x5E6B66: st_select_lex::print_order(String*, st_order*, enum_query_type) (sql_lex.cc:2181) ==3985== by 0x6473A4: st_select_lex::print(THD*, String*, enum_query_type) (sql_select.cc:17291) ==3985== by 0x5E69EF: st_select_lex_unit::print(String*, enum_query_type) (sql_lex.cc:2150) ==3985== by 0x646B48: TABLE_LIST::print(THD*, String*, enum_query_type) (sql_select.cc:17104) ==3985== by 0x646780: print_join(THD*, String*, List*, enum_query_type) (sql_select.cc:17022) ==3985== by 0x646A03: TABLE_LIST::print(THD*, String*, enum_query_type) (sql_select.cc:17081) ==3985== by 0x6466CF: print_join(THD*, String*, List*, enum_query_type) (sql_select.cc:17007) ==3985== by 0x64712E: st_select_lex::print(THD*, String*, enum_query_type) (sql_select.cc:17232) ==3985== by 0x7D488D: subselect_single_select_engine::print(String*, enum_query_type) (item_subselect.cc:2473) ==3985== by 0x7CE7A5: Item_subselect::print(String*, enum_query_type) (item_subselect.cc:344) ==3985== by 0x7A1272: Item_func::print_args(String*, unsigned int, enum_query_type) (item_func.cc:421) ==3985== by 0x7A11DC: Item_func::print(String*, enum_query_type) (item_func.cc:410) ==3985== by 0x642428: change_to_use_tmp_fields(THD*, Item**, List&, List&, unsigned int, List&) (sql_select.cc:15698) ==3985== by 0x61F7A3: JOIN::exec() (sql_select.cc:1987) ==3985== by 0x621699: mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:2568) ==3985== by 0x619877: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:296) ==3985== by 0x5F6528: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:4469) ==3985== by 0x5EF161: mysql_execute_command(THD*) (sql_parse.cc:2065) ==3985== by 0x5F869E: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5512) ==3985== by 0x5ECA45: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1029) ==3985== by 0x5EC067: do_command(THD*) (sql_parse.cc:769) ==3985== by 0x6CB751: do_handle_one_connection(THD*) (sql_connect.cc:745) ==3985== by 0x6CB58B: handle_one_connection (sql_connect.cc:684) ==3985== by 0x30E1807760: start_thread (pthread_create.c:301) ==3985== by 0x1818B70F: ??? ==3985== Address 0x13a4fa9d is 1,981 bytes inside a block of size 4,320 free'd ==3985== at 0x4A04D72: free (vg_replace_malloc.c:325) ==3985== by 0xA86FD7: my_free (my_malloc.c:128) ==3985== by 0xA7CF01: free_root (my_alloc.c:365) ==3985== by 0x636F4E: free_tmp_table(THD*, TABLE*) (sql_select.cc:11139) ==3985== by 0x621225: JOIN::destroy() (sql_select.cc:2422) ==3985== by 0x686E4B: st_select_lex::cleanup() (sql_union.cc:801) ==3985== by 0x686A2B: st_select_lex_unit::cleanup() (sql_union.cc:667) ==3985== by 0x5D0E72: mysql_derived_filling(THD*, LEX*, TABLE_LIST*) (sql_derived.cc:311) ==3985== by 0x5D06E1: mysql_handle_derived(LEX*, bool (*)(THD*, LEX*, TABLE_LIST*)) (sql_derived.cc:60) ==3985== by 0x5A42E8: open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) (sql_base.cc:5381) ==3985== by 0x598051: open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) (sql_base.h:476) ==3985== by 0x5F62D3: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:4434) ==3985== by 0x5EF161: mysql_execute_command(THD*) (sql_parse.cc:2065) ==3985== by 0x5F869E: mysql_parse(THD*, char*, unsigned int, Parser_state*) (sql_parse.cc:5512) ==3985== by 0x5ECA45: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1029) ==3985== by 0x5EC067: do_command(THD*) (sql_parse.cc:769) ==3985== by 0x6CB751: do_handle_one_connection(THD*) (sql_connect.cc:745) ==3985== by 0x6CB58B: handle_one_connection (sql_connect.cc:684) ==3985== by 0x30E1807760: start_thread (pthread_create.c:301) ==3985== by 0x1818B70F: ??? ==3985==