Skip to content
  • Roy Lyseng's avatar
    d049cc15
    Bug#21606400: Segfault in Item_ident::fix_after_pullout with semijoin · d049cc15
    Roy Lyseng authored
    The problem here occurs when a subquery's query block is removed
    during transformation of an IN subquery or a scalar subquery, and
    semi-join is not applicable, and Item::remove_dependence_processor()
    is used to modify items below the subquery to be removed.
    
    One such item is an Item_direct_ref which is added in the
    transformation of an IN subquery, see e.g
    Item_in_subselect::single_value_transformer(). The Item_direct_ref
    may be created with a dependent_from field pointing to the subquery
    to be removed. In this case, dependent_from most be moved to the outer query block, but remove_dependence_processor() fails to handle this situation.
    
    Luckily, Item_ident::fix_after_pullout() does exactly this, when first
    making sure that the name resolution contexts of the eliminated query
    block are merged with its parent.
    
    The code snippet that merges name resolution contexts is made into a
    new member function of SELECT_LEX, named merge_contexts().
    
    Item::remove_dependence_processor() was also deleted.
    d049cc15
    Bug#21606400: Segfault in Item_ident::fix_after_pullout with semijoin
    Roy Lyseng authored
    The problem here occurs when a subquery's query block is removed
    during transformation of an IN subquery or a scalar subquery, and
    semi-join is not applicable, and Item::remove_dependence_processor()
    is used to modify items below the subquery to be removed.
    
    One such item is an Item_direct_ref which is added in the
    transformation of an IN subquery, see e.g
    Item_in_subselect::single_value_transformer(). The Item_direct_ref
    may be created with a dependent_from field pointing to the subquery
    to be removed. In this case, dependent_from most be moved to the outer query block, but remove_dependence_processor() fails to handle this situation.
    
    Luckily, Item_ident::fix_after_pullout() does exactly this, when first
    making sure that the name resolution contexts of the eliminated query
    block are merged with its parent.
    
    The code snippet that merges name resolution contexts is made into a
    new member function of SELECT_LEX, named merge_contexts().
    
    Item::remove_dependence_processor() was also deleted.
Loading