Commit 6a5b47a4 authored by unknown's avatar unknown

Bug#51980 mysqld service crashes with a simple COUNT(DISTINCT) query over a view

Problem: Segmentation fault in add_group_and_distinct_keys() when accessing
field of what is assumed to be an Item_field object.

Cause: In case of views, the item added to list by is_indexed_agg_distinct() 
was not of type Item_field, but Item_ref.

Resolution:  Add the real Item_field object, the one referred to by 
Item_ref object, to the list, instead.

mysql-test/r/count_distinct.result:
  Results for test case for Bug#51980.
mysql-test/t/count_distinct.test:
  Test case for Bug#51980.
  Table needs to contain at least two rows to avoid const table optimization.
sql/sql_select.cc:
  Make sure it is the actual Item_field object that is pushed to the out_args
  list of is_indexed_agg_distinct(), and not Item_ref objects.
parent 1b9adec7
No related merge requests found
...@@ -86,3 +86,11 @@ select count(distinct if(f1,3,f2)) from t1; ...@@ -86,3 +86,11 @@ select count(distinct if(f1,3,f2)) from t1;
count(distinct if(f1,3,f2)) count(distinct if(f1,3,f2))
2 2
drop table t1; drop table t1;
create table t1 (i int);
insert into t1 values (0), (1);
create view v1 as select * from t1;
select count(distinct i) from v1;
count(distinct i)
2
drop table t1;
drop view v1;
...@@ -96,3 +96,14 @@ insert into t1 values (0,1),(1,2); ...@@ -96,3 +96,14 @@ insert into t1 values (0,1),(1,2);
select count(distinct if(f1,3,f2)) from t1; select count(distinct if(f1,3,f2)) from t1;
drop table t1; drop table t1;
#
# Bug #51980 "mysqld service crashes with a simple COUNT(DISTINCT) query
# over a view"
#
create table t1 (i int);
insert into t1 values (0), (1);
create view v1 as select * from t1;
select count(distinct i) from v1;
drop table t1;
drop view v1;
...@@ -4157,7 +4157,7 @@ is_indexed_agg_distinct(JOIN *join, List<Item_field> *out_args) ...@@ -4157,7 +4157,7 @@ is_indexed_agg_distinct(JOIN *join, List<Item_field> *out_args)
optimization is applicable optimization is applicable
*/ */
if (out_args) if (out_args)
out_args->push_back((Item_field *) expr); out_args->push_back((Item_field *) expr->real_item());
result= true; result= true;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment