• Dmitry Shulga's avatar
    MDEV-23182: Server crashes in Item::fix_fields_if_needed /... · a65d01a4
    Dmitry Shulga authored
    MDEV-23182: Server crashes in Item::fix_fields_if_needed / table_value_constr::prepare upon 2nd execution of PS
    
    Repeating execution of a query containing the clause IN with string literals
    in environment where the server variable in_predicate_conversion_threshold
    is set results in server abnormal termination in case the query is run
    as a Prepared Statement and conversion of charsets for string values in the
    query are required.
    
    The reason for server abnormal termination is that instances of the class
    Item_string created on transforming the IN clause into subquery were created
    on runtime memory root that is deallocated on finishing execution of Prepared
    statement. On the other hand, references to Items placed on deallocated memory
    root still exist in objects of the class table_value_constr. Subsequent running
    of the same prepared statement leads to dereferencing of pointers to already
    deallocated memory that could lead to undefined behaviour.
    
    To fix the issue the values being pushed into a values list for TVC are created
    by cloning their original items. This way the cloned items are allocate on
    the PS memroot and as consequences no dangling pointer does more exist.
    a65d01a4
table_value_constr.test 30.9 KB