Backported test case for bug #36981.

mysql-test/include/icp_tests.inc

+--echo #
+--echo # Bug#36981 - "innodb crash when selecting for update"
+--echo #
+
+#
+# Test 1: Test based on the reproduction test case for this bug.
+#         This query resulted in a crash in InnoDB due to
+#         InnoDB changing from using the index which the push condition
+#         where for to use the clustered index due to "SELECT ... FOR UPDATE".
+#
+
+CREATE TABLE t1 (
+  c1 CHAR(1),
+  c2 CHAR(10),
+  KEY (c1)
+);
+
+INSERT INTO t1 VALUES ('3', null);
+
+SELECT * FROM t1 WHERE c1='3' FOR UPDATE;
+
+DROP TABLE t1;
+
+#
+# Test 2: Extended test case to test that the correct rows are returned.
+#         This test is for ensuring that if InnoDB refuses to accept
+#         the pushed index condition it is still evaluated.
+#         
+
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (0),(1),(2),(3),(4),(5),(6),(7),(8),(9);
+
+CREATE TABLE t2 (a INT);
+INSERT INTO t2 SELECT A.a + 10*(B.a + 10*C.a) FROM t1 A, t1 B, t1 C;
+
+CREATE TABLE t3 (
+  c1 CHAR(10) NOT NULL,
+  c2 CHAR(10) NOT NULL,
+  c3 CHAR(200) NOT NULL,
+  KEY (c1)
+);
+
+INSERT INTO t3 
+  SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',1000+ t2.a,'=w'), 'filler'
+  FROM t2;
+
+INSERT INTO t3 
+  SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',2000+t2.a,'=w'), 'filler-1'
+  FROM t2;
+ 
+INSERT INTO t3
+  SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',3000+t2.a,'=w'), 'filler-2'
+  FROM t2;
+
+--sorted_result
+SELECT c1,c3 FROM t3 WHERE c1 >= 'c-1994=w' and c1 != 'c-1996=w' FOR UPDATE;
+
+DROP TABLE t1,t2,t3;
+
 --echo #
 --echo # Bug#42580 - Innodb's ORDER BY ..LIMIT returns no rows for
 --echo #             null-safe operator <=> NULL

mysql-test/r/innodb_icp.result

 set @save_storage_engine= @@storage_engine;
 set storage_engine=InnoDB;
 #
+# Bug#36981 - "innodb crash when selecting for update"
+#
+CREATE TABLE t1 (
+c1 CHAR(1),
+c2 CHAR(10),
+KEY (c1)
+);
+INSERT INTO t1 VALUES ('3', null);
+SELECT * FROM t1 WHERE c1='3' FOR UPDATE;
+c1	c2
+3	NULL
+DROP TABLE t1;
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (0),(1),(2),(3),(4),(5),(6),(7),(8),(9);
+CREATE TABLE t2 (a INT);
+INSERT INTO t2 SELECT A.a + 10*(B.a + 10*C.a) FROM t1 A, t1 B, t1 C;
+CREATE TABLE t3 (
+c1 CHAR(10) NOT NULL,
+c2 CHAR(10) NOT NULL,
+c3 CHAR(200) NOT NULL,
+KEY (c1)
+);
+INSERT INTO t3 
+SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',1000+ t2.a,'=w'), 'filler'
+  FROM t2;
+INSERT INTO t3 
+SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',2000+t2.a,'=w'), 'filler-1'
+  FROM t2;
+INSERT INTO t3
+SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',3000+t2.a,'=w'), 'filler-2'
+  FROM t2;
+SELECT c1,c3 FROM t3 WHERE c1 >= 'c-1994=w' and c1 != 'c-1996=w' FOR UPDATE;
+c1	c3
+c-1994=w	filler
+c-1994=w	filler-1
+c-1994=w	filler-2
+c-1995=w	filler
+c-1995=w	filler-1
+c-1995=w	filler-2
+c-1997=w	filler
+c-1997=w	filler-1
+c-1997=w	filler-2
+c-1998=w	filler
+c-1998=w	filler-1
+c-1998=w	filler-2
+c-1999=w	filler
+c-1999=w	filler-1
+c-1999=w	filler-2
+DROP TABLE t1,t2,t3;
+#
 # Bug#42580 - Innodb's ORDER BY ..LIMIT returns no rows for
 #             null-safe operator <=> NULL
 #

mysql-test/r/maria_icp.result

 set @save_storage_engine= @@storage_engine;
 set storage_engine=Maria;
 #
+# Bug#36981 - "innodb crash when selecting for update"
+#
+CREATE TABLE t1 (
+c1 CHAR(1),
+c2 CHAR(10),
+KEY (c1)
+);
+INSERT INTO t1 VALUES ('3', null);
+SELECT * FROM t1 WHERE c1='3' FOR UPDATE;
+c1	c2
+3	NULL
+DROP TABLE t1;
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (0),(1),(2),(3),(4),(5),(6),(7),(8),(9);
+CREATE TABLE t2 (a INT);
+INSERT INTO t2 SELECT A.a + 10*(B.a + 10*C.a) FROM t1 A, t1 B, t1 C;
+CREATE TABLE t3 (
+c1 CHAR(10) NOT NULL,
+c2 CHAR(10) NOT NULL,
+c3 CHAR(200) NOT NULL,
+KEY (c1)
+);
+INSERT INTO t3 
+SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',1000+ t2.a,'=w'), 'filler'
+  FROM t2;
+INSERT INTO t3 
+SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',2000+t2.a,'=w'), 'filler-1'
+  FROM t2;
+INSERT INTO t3
+SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',3000+t2.a,'=w'), 'filler-2'
+  FROM t2;
+SELECT c1,c3 FROM t3 WHERE c1 >= 'c-1994=w' and c1 != 'c-1996=w' FOR UPDATE;
+c1	c3
+c-1994=w	filler
+c-1994=w	filler-1
+c-1994=w	filler-2
+c-1995=w	filler
+c-1995=w	filler-1
+c-1995=w	filler-2
+c-1997=w	filler
+c-1997=w	filler-1
+c-1997=w	filler-2
+c-1998=w	filler
+c-1998=w	filler-1
+c-1998=w	filler-2
+c-1999=w	filler
+c-1999=w	filler-1
+c-1999=w	filler-2
+DROP TABLE t1,t2,t3;
+#
 # Bug#42580 - Innodb's ORDER BY ..LIMIT returns no rows for
 #             null-safe operator <=> NULL
 #

mysql-test/r/myisam_icp.result

 #
+# Bug#36981 - "innodb crash when selecting for update"
+#
+CREATE TABLE t1 (
+c1 CHAR(1),
+c2 CHAR(10),
+KEY (c1)
+);
+INSERT INTO t1 VALUES ('3', null);
+SELECT * FROM t1 WHERE c1='3' FOR UPDATE;
+c1	c2
+3	NULL
+DROP TABLE t1;
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (0),(1),(2),(3),(4),(5),(6),(7),(8),(9);
+CREATE TABLE t2 (a INT);
+INSERT INTO t2 SELECT A.a + 10*(B.a + 10*C.a) FROM t1 A, t1 B, t1 C;
+CREATE TABLE t3 (
+c1 CHAR(10) NOT NULL,
+c2 CHAR(10) NOT NULL,
+c3 CHAR(200) NOT NULL,
+KEY (c1)
+);
+INSERT INTO t3 
+SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',1000+ t2.a,'=w'), 'filler'
+  FROM t2;
+INSERT INTO t3 
+SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',2000+t2.a,'=w'), 'filler-1'
+  FROM t2;
+INSERT INTO t3
+SELECT CONCAT('c-',1000+t2.a,'=w'), CONCAT('c-',3000+t2.a,'=w'), 'filler-2'
+  FROM t2;
+SELECT c1,c3 FROM t3 WHERE c1 >= 'c-1994=w' and c1 != 'c-1996=w' FOR UPDATE;
+c1	c3
+c-1994=w	filler
+c-1994=w	filler-1
+c-1994=w	filler-2
+c-1995=w	filler
+c-1995=w	filler-1
+c-1995=w	filler-2
+c-1997=w	filler
+c-1997=w	filler-1
+c-1997=w	filler-2
+c-1998=w	filler
+c-1998=w	filler-1
+c-1998=w	filler-2
+c-1999=w	filler
+c-1999=w	filler-1
+c-1999=w	filler-2
+DROP TABLE t1,t2,t3;
+#
 # Bug#42580 - Innodb's ORDER BY ..LIMIT returns no rows for
 #             null-safe operator <=> NULL
 #

storage/xtradb/handler/ha_innodb.cc

@@ -12110,7 +12110,7 @@ C_MODE_END
 
 Item *ha_innobase::idx_cond_push(uint keyno_arg, Item* idx_cond_arg)
 {
-  if ((keyno_arg != primary_key) && (prebuilt->select_lock_type == LOCK_NONE))
+  if (keyno_arg != primary_key && prebuilt->select_lock_type != LOCK_X)
   {
     pushed_idx_cond_keyno= keyno_arg;
     pushed_idx_cond= idx_cond_arg;