• Sergei Petrunia's avatar
    MDEV-28268: Server crashes in Expression_cache_tracker::fetch_current_stats · 8db9aa49
    Sergei Petrunia authored
    (cherry-pick into preview-10.9-MDEV-27021-explain tree)
    
    Expression_cache_tmptable object uses an Expression_cache_tracker object
    to report the statistics.
    
    In the common scenario, Expression_cache_tmptable destructor sets
    tracker->cache=NULL. The tracker object survives after the expression
    cache is deleted and one may call cache_tracker->fetch_current_stats()
    for it with no harm.
    
    However a degenerate cache with no parameters does not set
    tracker->cache=NULL in Expression_cache_tmptable destructor which
    results in an attempt to use freed data in the
    cache_tracker->fetch_current_stats() call.
    
    Fixed by setting tracker->cache to NULL and wrapping the assignment into
    a function.
    8db9aa49
sql_expression_cache.cc 9.37 KB