Commit f28612ea authored by unknown's avatar unknown

Bug #34747: crash in debug assertion check after derived table

Was a double-free of the Unique member of Item_func_group_concat.
This was not causing a crash because the Unique is a descendent of
Sql_alloc.
Fixed to free the Unique only if it was allocated for the instance 
of Item_func_group_concat it was referenced from


mysql-test/r/func_gconcat.result:
  Bug #34747: test case
mysql-test/t/func_gconcat.test:
  Bug #34747: test case
sql/item_sum.cc:
  Bug #34747: free the Unique only if it was allocated
  for this instance of Item_func_group_concat
parent 87007702
...@@ -931,4 +931,19 @@ SELECT GROUP_CONCAT(DISTINCT b, a ORDER BY b) FROM t1; ...@@ -931,4 +931,19 @@ SELECT GROUP_CONCAT(DISTINCT b, a ORDER BY b) FROM t1;
GROUP_CONCAT(DISTINCT b, a ORDER BY b) GROUP_CONCAT(DISTINCT b, a ORDER BY b)
11,22,32 11,22,32
DROP TABLE t1, t2, t3; DROP TABLE t1, t2, t3;
CREATE TABLE t1(a INT);
INSERT INTO t1 VALUES (),();
SELECT s1.d1 FROM
(
SELECT
t1.a as d1,
GROUP_CONCAT(DISTINCT t1.a) AS d2
FROM
t1 AS t1,
t1 AS t2
GROUP BY 1
) AS s1;
d1
NULL
DROP TABLE t1;
End of 5.0 tests End of 5.0 tests
...@@ -640,4 +640,21 @@ SELECT GROUP_CONCAT(DISTINCT b, a ORDER BY b) FROM t1; ...@@ -640,4 +640,21 @@ SELECT GROUP_CONCAT(DISTINCT b, a ORDER BY b) FROM t1;
DROP TABLE t1, t2, t3; DROP TABLE t1, t2, t3;
#
# Bug #34747: crash in debug assertion check after derived table
#
CREATE TABLE t1(a INT);
INSERT INTO t1 VALUES (),();
SELECT s1.d1 FROM
(
SELECT
t1.a as d1,
GROUP_CONCAT(DISTINCT t1.a) AS d2
FROM
t1 AS t1,
t1 AS t2
GROUP BY 1
) AS s1;
DROP TABLE t1;
--echo End of 5.0 tests --echo End of 5.0 tests
...@@ -3460,6 +3460,6 @@ void Item_func_group_concat::print(String *str) ...@@ -3460,6 +3460,6 @@ void Item_func_group_concat::print(String *str)
Item_func_group_concat::~Item_func_group_concat() Item_func_group_concat::~Item_func_group_concat()
{ {
if (unique_filter) if (!original && unique_filter)
delete unique_filter; delete unique_filter;
} }
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment