Bug#32905044: CRASH AT CONDITION_PUSHDOWN::REPLACE_COLUMNS_IN_COND DURIN

              RQG CONCURRENCY RUNS

An earlier fix (Bug#32324234) made sure that a view reference needs to
be cloned before a condition is pushed down to the derived table.
To resolve the expression that was cloned, merged derived table's
context (query_block->first_context) was used. However, an Item_view_ref
object could also be created when a natural join column is created. For
this case, while resolving, we cannot be using the merged derived table's
context.
Also, query_block->first_context is updated when natural join is present
in the query. As a result, we can no more rely on first_context to give
the correct context for the merged derived table.

Solution:
While creating field translations for the table that is getting merged,
we capture the merged derived table's context. This context is then
saved to each of the Item_view_ref object created. We then use it
when view ref object is cloned.

Change-Id: Ia60c49bf7e8393f2cda5b3ff9be223178e0f7f4a

Author: Chaithra Gopalareddy

mysql-test/r/derived_condition_pushdown.result

@@ -1176,3 +1176,12 @@ FROM (SELECT MAX(f1) AS a1 FROM t) as dt1,
 WHERE dt1.a1 <= dt2.a2;
 a1	a2
 DROP TABLE t;
+#
+# Bug#32905044: CRASH AT CONDITION_PUSHDOWN::REPLACE_COLUMNS_IN_COND
+#	       DURIN RQG CONCURRENCY RUNS
+CREATE TABLE t(f1 INTEGER);
+CREATE ALGORITHM=temptable VIEW v AS SELECT f1 FROM t;
+SELECT f1 FROM (SELECT f1 FROM v) AS dt1 NATURAL JOIN v dt2 WHERE f1 > 5;
+f1
+DROP TABLE t;
+DROP VIEW v;

mysql-test/t/derived_condition_pushdown.test

@@ -699,3 +699,16 @@ SELECT a1, a2
  WHERE dt1.a1 <= dt2.a2;
 
 DROP TABLE t;
+
+--echo #
+--echo # Bug#32905044: CRASH AT CONDITION_PUSHDOWN::REPLACE_COLUMNS_IN_COND
+--echo #	       DURIN RQG CONCURRENCY RUNS
+
+CREATE TABLE t(f1 INTEGER);
+CREATE ALGORITHM=temptable VIEW v AS SELECT f1 FROM t;
+
+#Query should not crash
+SELECT f1 FROM (SELECT f1 FROM v) AS dt1 NATURAL JOIN v dt2 WHERE f1 > 5;
+
+DROP TABLE t;
+DROP VIEW v;

sql/item.cc

@@ -8313,9 +8313,9 @@ Item *Item_view_ref::replace_view_refs_with_clone(uchar *arg) {
   // Since the query block having dt2 is merged with the outer query
   // block, the context to resolve the field will be different than
   // the derived table context (dt1).
-  return dt->get_clone_for_derived_expr(
-      current_thd, *ref,
-      dt->derived_query_expression()->outer_query_block()->first_context);
+  Name_resolution_context *context_to_use =
+      m_merged_derived_context ? m_merged_derived_context : context;
+  return dt->get_clone_for_derived_expr(current_thd, *ref, context_to_use);
 }
 
 bool Item_default_value::itemize(Parse_context *pc, Item **res) {

sql/item.h

@@ -5699,10 +5699,11 @@ class Item_view_ref final : public Item_ref {
   Item_view_ref(Name_resolution_context *context_arg, Item **item,
                 const char *db_name_arg, const char *alias_name_arg,
                 const char *table_name_arg, const char *field_name_arg,
-                TABLE_LIST *tl)
+                TABLE_LIST *tl, Name_resolution_context *merged_derived_context)
       : Item_ref(context_arg, item, db_name_arg, alias_name_arg,
                  field_name_arg),
-        first_inner_table(nullptr) {
+        first_inner_table(nullptr),
+        m_merged_derived_context(merged_derived_context) {
     if (tl->is_view()) {
       m_orig_db_name = db_name_arg;
       m_orig_table_name = table_name_arg;
@@ -5806,6 +5807,11 @@ class Item_view_ref final : public Item_ref {
     then this field points to the first leaf table of the view, otherwise NULL.
   */
   TABLE_LIST *first_inner_table;
+  /**
+    Original Context of the underlying field in case of a merged derived
+    table.
+  */
+  Name_resolution_context *m_merged_derived_context;
 };
 
 /*

sql/sql_derived.cc

@@ -1154,6 +1154,7 @@ bool Condition_pushdown::replace_columns_in_cond(Item **cond, bool is_having) {
   if (view_ref) {
     (*cond) = (*cond)->transform(&Item::replace_view_refs_with_clone,
                                  pointer_cast<uchar *>(m_derived_table));
+    if (cond == nullptr) return true;
   }
   Item *new_cond =
       is_having ? (*cond)->transform(&Item::replace_with_derived_expr_ref,

sql/table.cc

@@ -157,7 +157,8 @@ LEX_CSTRING PARSE_GCOL_KEYWORD = {STRING_WITH_LEN("parse_gcol_expr")};
 
 static Item *create_view_field(THD *thd, TABLE_LIST *view, Item **field_ref,
                                const char *name,
-                               Name_resolution_context *context);
+                               Name_resolution_context *context,
+                               Name_resolution_context *merged_derived_context);
 static void open_table_error(THD *thd, TABLE_SHARE *share, int error,
                              int db_errno);
 
@@ -4578,6 +4579,10 @@ bool TABLE_LIST::create_field_translation(THD *thd) {
   field_translation = transl;
   field_translation_end = transl + field_count;
 
+  // We capture the context used to resolve the fields of the merged
+  // derived table. This context is used when the field needs to be cloned
+  // to facilitate condition pushdown (replace_view_refs_with_clone()).
+  m_merged_derived_context = &select->context;
   return false;
 }
 
@@ -5027,7 +5032,8 @@ Item *Natural_join_column::create_item(THD *thd) {
     assert(table_field == nullptr);
     Query_block *select = thd->lex->current_query_block();
     return create_view_field(thd, table_ref, &view_field->item,
-                             view_field->name, &select->context);
+                             view_field->name, &select->context,
+                             /*merged_derived_context=*/nullptr);
   }
   return table_field;
 }
@@ -5090,12 +5096,14 @@ const char *Field_iterator_view::name() { return ptr->name; }
 
 Item *Field_iterator_view::create_item(THD *thd) {
   Query_block *select = thd->lex->current_query_block();
-  return create_view_field(thd, view, &ptr->item, ptr->name, &select->context);
+  return create_view_field(thd, view, &ptr->item, ptr->name, &select->context,
+                           view->m_merged_derived_context);
 }
 
-static Item *create_view_field(THD *, TABLE_LIST *view, Item **field_ref,
-                               const char *name,
-                               Name_resolution_context *context) {
+static Item *create_view_field(
+    THD *, TABLE_LIST *view, Item **field_ref, const char *name,
+    Name_resolution_context *context,
+    Name_resolution_context *merged_derived_context) {
   DBUG_TRACE;
 
   Item *field = *field_ref;
@@ -5140,8 +5148,9 @@ static Item *create_view_field(THD *, TABLE_LIST *view, Item **field_ref,
           mistakes, such as forgetting to mark the use of a field in both
           read_set and write_set (may happen e.g in an UPDATE statement).
   */
-  Item *item = new Item_view_ref(context, field_ref, db_name, view->alias,
-                                 table_name, name, view);
+  Item *item =
+      new Item_view_ref(context, field_ref, db_name, view->alias, table_name,
+                        name, view, merged_derived_context);
   return item;
 }
 

sql/table.h

@@ -3521,6 +3521,12 @@ struct TABLE_LIST {
   ulonglong algorithm{0};
   ulonglong view_suid{0};   ///< view is suid (true by default)
   ulonglong with_check{0};  ///< WITH CHECK OPTION
+  /**
+    Context that is used to resolve a merged derived table's
+    fields. Needed when a field from a merged derived table
+    is cloned. Used during condition pushdown to derived tables.
+  */
+  Name_resolution_context *m_merged_derived_context{nullptr};
 
  private:
   /// The view algorithm that is actually used, if this is a view.