Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
f30e0dd2a7f9...
f30e0dd2a7f92d2b347e425012f03f7b413a43a9
Daniel Black
MDEV-41200 ANY_VALUE not marked BINLOG_STMT_UNSAFE_SYSTEM_FUNCTION

Without this marking the slave may differ from the master.
f28ef527a5c6...
f28ef527a5c685d181b0f60dcc713ca31c3bef7d
Rex Johnston
MDEV-41228 Test deep clones of Item_cache items

Deep clones of items are created in very few places, so most of the Item
clone code has no test coverage at all, although Parallel Query relies on it
heavily. One of the places where deep clones are created is the generation
of the key parts for a lookup into a split materialized table, in
TABLE::add_splitting_info_for_key_field().

An Item_cache reaches that place through the IN->EXISTS transformation.
Item_in_optimizer::fix_left() wraps the left expression of the predicate in
an Item_cache, and the equality injected into the subquery refers to it, so
the key field value being cloned is an Item_direct_ref over that cache. Two
more things are needed for the clone to happen: the grouping field the
equality matches has to be the first component of some index of the
underlying table, otherwise it is not among spl_opt_info->spl_fields and the
function returns before cloning, and the subquery must not be converted to a
semi-join. The latter is achieved by the shape of the query, a UNION in the
subquery, rather than by turning optimizer switches off, so that the plan is
the one a user gets with a default optimizer_switch.

We add Item::check_deep_copy(), which validates a clone against its original in
a debug build. It walks both item trees and reports, as notes, whether they
have the same shape with the same Item class at every node, and whether the
clone shares an Item object with the original. Sharing is what distinguishes
a shallow copy from a deep one: an item that is shallow by design, Item_field
for instance, still produces a separate object and only shares a Field, which
is not an Item.

Call it from TABLE::add_splitting_info_for_key_field() under the
"split_materialized_clones" debug flag, which additionally makes the
optimizer use a clone as the value of the generated key part. The clone then
has to work both in the condition pushed into the materialized table and as
the value looked up in the filled table. Note that the clone built for the
pushed condition cannot be reused for this, as it has already been made
dependent on the select that specifies the materialized table.

With the check in place, the clone of the cache turned out not to be a deep
one: every Item_cache_* class implemented deep_copy() as a plain shallow
copy. That is wrong beyond sharing the example item. A cache is filled by the
store()/cache_value() calls of the item that owns it, Item_in_optimizer here,
and nobody does that for a clone, so a clone that inherited the cached value
of the original kept returning that value for the rest of the query.

Implement Item_cache::deep_copy() once for all cache classes instead. The
clone is given an empty cache, so that it computes the value itself out of
the item the value is read from, and a copy of that item. The exception is an
example containing an aggregate or a window function: those are not clonable
yet, as a copy of one shares the per-execution data of the original and both
would free it, so such an example is shared and the check reports the clone
as not fully deep. Item_cache_row is not clonable at all now, as a copy of it
shared the values[] array of element caches with the original.

The test uses a single row in the outer table, because the answer to the same
query with more rows is wrong for an unrelated reason, MDEV-41251: a split
materialized table in a dependently executed subquery is never refilled when
the outer row changes.

We run our mtr test using the above like this
mtr --mysqld=--debug-dbug=+d,split_materialized_clones --suite=main \
  --parallel=auto
or similar.

Items of type Item_cache, the main Item class of interest in this commit,
are usually created by the type handler, through the call
Item::get_cache.  So another approach here is deep copy our Item_cache
here.

Deep copies of Item_caches can be tested using mtr like this
mtr --mysqld=--debug-dbug=+d,item_cache_clones --suite=main --parallel=auto
or similar.

Note that they can be combined, so anything Item_cache items used for
split materialized key generation will be a deep clone of a deep clone.

Another DBUG flag is "check_deep_copy".  This is used to check how many
items are deep cloned by producing a warning message.
e887bf2aa41d...
e887bf2aa41d8183659c945dadd39da0af1f4310
Jan Lindström
MDEV-37269 : kill_galera.inc does not wait for the killed process to exit

There were two compatible copies of kill_galera.inc and which one a test got
depended on its suite, so tests outside the galera suite still used the copy
with the non-portable "kill -9". Neither waited for the process to exit: both
ended in wait_until_disconnected.inc, which only says the server stopped
serving the connection, while the process can hold its pid file, ports and
data directory for a while after that. Tests that restart the node or read
its grastate right away worked around it with a --sleep.

Keep one copy, under include, and wait for the process with a kill(0) probe.
mysqld does not remove its pid file when killed by a signal, so
wait_until_no_pidfile.inc cannot be used here, but my_safe_process is in
waitpid() on it and reaps it as soon as it exits. Drop the seven --sleeps
that only waited for the process, and the six wait_until_disconnected.inc
calls the include already does.

Waiting for the rest of the cluster to notice is a separate thing which the
include cannot do for the caller, so the tests polling wsrep_cluster_size or
wsrep_cluster_status on a surviving node keep doing that.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
e366cea0bd48...
e366cea0bd485e3d48f09013588730bc62ba0fbb
Jaeheon Shim
Implement ANY_VALUE as a 'real' aggregate function through subclassing Item_sum_min_max
df627b530a5f...
df627b530a5f3fb682513f4362bde68933a1ffbb
Yuchen Pei
MDEV-XXXXX HANDLER READ NEXT/PREV after a key read on a partitioned table

HANDLER t1 READ idx = (key) followed by HANDLER t1 READ idx NEXT or
PREV must continue through the whole index, as without partitioning.
On a partitioned table this failed in several ways:

- When the key determines the partition, partition_scan_set_up()
  limited the scan to that partition (see get_partition_set()), and
  used an unordered scan. NEXT stopped at the end of the partition.
- index_prev() always uses the ordered scan. After an unordered scan
  m_top_entry is NO_CURRENT_PART_ID, so PREV returned nothing, even
  within the partition.
- After an ordered scan where no partition had the key, NEXT returned
  nothing, because handle_ordered_next() checks m_top_entry before
  looking at the partitions that returned HA_ERR_KEY_NOT_FOUND.
- After an ordered scan for HA_READ_KEY_EXACT, the queue is set up for
  reading forward, and handle_ordered_prev() does not consider the
  partitions that did not have the key.
- The key buffer of HANDLER is allocated for each statement, but
  m_start_key.key pointed to it in later statements.

For HANDLER, which ha_partition now detects through
init_table_handle_for_HANDLER():

- Do not limit the partitions by the key, and always use the ordered
  scan, also when there is only one partition.
- Copy the key into the key buffer of the priority queue.
- After an HA_READ_KEY_EXACT read, on the first index_prev(), or on the
  first index_next() when no partition had the key, read all partitions
  again with HA_READ_BEFORE_KEY or HA_READ_AFTER_KEY, setting up the
  queue for the direction of the scan.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
daa1ed5c98aa...
daa1ed5c98aaf71039e5946414dc45ffaf446c11
Jaeheon Shim
Add charset/collation/coercibility tests
d81f6549d0d4...
d81f6549d0d4a610aa9ed69b1d512ac3bd741711
Jan Lindström
MDEV-37269 : galera.mysql-wsrep#198 test failure

The test polled INFORMATION_SCHEMA.PROCESSLIST for one of three thread states
to know that its two TOI DDLs were parked. None of them is reliable:
"acquiring total order isolation" is overwritten by THD_STAGE_INFO() two lines
after it is set and never reaches the process list, and while waiting for a
metadata lock the state alternates once per second between "Waiting for table
metadata lock" and the stage restored when the wait is left, which for a
statement that already holds total order isolation is "Waiting for TOI DDL"
and was not accepted. Both DDLs are in that state here, and the wait that
requires the two to match at the same poll is the one that timed out.

Use the mdl_acquire_lock_wait and wsrep_before_toi_begin debug sync points
instead. The test needs a debug build from now on.

On timeout wait_condition_with_debug_and_kill.inc killed the node but did not
abort the test, which then ran UNLOCK TABLES against the dead server and
failed with an unrelated error that hid the timeout. Abort after the kill.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
cf74df9e8a85...
cf74df9e8a851bb45888c35ba305bb93f0d4cc1c
Jaeheon Shim
Add prefix and suffix to any_value.test
ce5bb4775796...
ce5bb4775796b40953b6109e0ea4323d601875df
Vladislav Vaintroub
MDEV-28746 follow-up: missed relative paths overflowing MAX_PATH

my_win_sopen() only checked the length of the raw path it was given, but
the server opens table files via paths relative to its data directory,
so a short relative path can still overflow MAX_PATH once
resolved against a long enough datadir. That case was misreported as
ER_BAD_DB_ERROR instead of ER_CANT_CREATE_TABLE/ENAMETOOLONG.

Resolve the path via GetFullPathName() before deciding whether the path
was too long, factored into resolved_path_too_long(). A failed resolve
is only treated as too-long when GetLastError() is
ERROR_FILENAME_EXCED_RANGE, so unrelated resolution failures keep
mapping to the original CreateFile error.

Also fix the global errtable mapping of ERROR_FILENAME_EXCED_RANGE: it
was mapped to ENOENT, so any Win32 call that got that error code
directly (not via ERROR_PATH_NOT_FOUND) was misreported the same way.

Assisted-by: Claude:claude-sonnet-5
c74386c77546...
c74386c77546c069e5028156c236a4c167573e86
Jaeheon Shim
Modify any_value test case to include null rows and empty table
c3813bab9b53...
c3813bab9b537987f848b8d2dcfa87b6825fcfbd
Daniel Black
MDEV-39932 - remove test cases here. Already merged on rebase.
c1066e65e6b6...
c1066e65e6b6490e7fc366a7e6435829e768e549
Rex Johnston
MDEV-41202 ONLY_FULL_GROUP_BY silently bypassed for outer-correlated fields inside aggregate

Item field->marker left unset when pushing items into the
relevant JOIN::non_agg_fields List.  field->marker is left
stale at MARKER_UNDEF_POS (0) rather than correctly set to
JOIN::select->cur_pos_in_select_list.
Any select list item not at position 0 is incorrectly evaluated
in setup_group(), where MODE_ONLY_FULL_GROUP_BY is processed.
bef0b1230511...
bef0b123051102de81d76d42027e224a7fca8543
Yuchen Pei
MDEV-39923 tmp

tmp fix while waiting for the MDEV-39923 fix done
b92f63111288...
b92f631112880ea275165070b5c8ae5c75c71bdf
Jaeheon Shim
Modify existing group_by test to allow referencing outer field in correlated subquery as long as it is aggregated
aa0d3cdb405c...
aa0d3cdb405cd3859e6df99d8330bc25286be9c6
Jaeheon Shim
Recalculate digst hashes in perfschema tests
a589cb629a7a...
a589cb629a7a76a0b3df116855e2ba0f82c146ae
Jaeheon Shim
Update any_value tests involving window functions to use tables where the any_value column is functionally dependent on the partition by column. This is necessary as the iteration order when computing any_value on a window function is not guaranteed across executions.
a4ae3f23fdcb...
a4ae3f23fdcbe1e7f8878dc481f08a1c14af3407
bsrikanth-mariadb
MDEV-36986: Support tracing array of primitive types

Json_writer had two separate code paths: add_unquoted_str() for
numbers/bool/null, and add_escaped_str() which added the surrounding
quotes itself for strings. Single_line_formatting_helper, which
buffers consecutive array/object elements to decide if they fit on
one line, assumed only strings could ever be buffered and always
wrapped the flushed values in quotes. As a result, arrays of numbers
(e.g. "depends_on_map_bits", "rec_per_key") were incorrectly rendered
with their elements quoted as strings.

Unify both paths into add_escaped_quoted_str(): the caller now hands
over bytes that are already in their final on-the-wire form. String
escaping (json_escape_to_string) writes its own surrounding quotes,
while numbers/bool/null are passed through unquoted, so the one-line
helper just concatenates the buffered payloads on flush instead of
adding quotes itself. A DBUG_ASSERT in add_escaped_quoted_str() now
checks that every payload is already a quoted string or a bare
number/bool/null token, so a caller that violates the contract trips
an assertion in debug builds instead of silently producing invalid
JSON.

Also:
- Fix Json_writer_array::add(ulonglong)/(size_t), which went through
  add_ll() with a cast to longlong and corrupted large unsigned
  values (e.g. ULLONG_MAX); route them through add_ull() instead.
- Fix mysql-test/include/opt_context_schema.inc: "subquery_runs" was
  nested inside the preceding object instead of being a sibling
  member, and "rec_per_key" items are now declared as "number" to
  match the corrected output.
- Update recorded .result files for opt_trace, opt_context_*, and
  subselect_mat_analyze_json to reflect numbers/booleans no longer
  being quoted inside JSON arrays.
- Extend unittest/sql/my_json_writer-t.cc with coverage for arrays
  of primitives: plain integers, mixed types, sizes, multi-line
  arrays, values flushed before a nested object, strings that were
  already escaped by the one-line buffer, and invalid utf8mb4 input
  through add_str().
- Rewrite the "multi-line array of integers" test to actually
  overflow the one-line buffer (9 seven-digit numbers instead of 7),
  since the previous version fit on one line and never exercised the
  element-per-line flush path it claimed to test.
- Drop the now-redundant single-argument add_escaped_quoted_str()
  overload; all call sites already know their length.
- Update json_escape_to_string()'s doc comments (my_json_writer.h,
  sql_json_lib.h) to state that it quotes its output, not just
  escapes it.
99c95dbcdfee...
99c95dbcdfee10dcded8fefe13ef098b8fcc0b98
Marko Mäkelä
fixup! 33ec54440d8b0ebd6fb4a2286c1167b851b1cdce
87e62ca17270...
87e62ca17270e163a6d41b3fc8d6f4d440f1bb88
bsrikanth-mariadb
MDEV-40837 Fix crash recording opt context with NULL character_set_results

Unlike character_set_client or collation_connection,
character_set_results can be set to NULL. When recording context for
a query in opt_context_store_replay.cc,
character_set_results->cs_name was accessed without first checking
whether character_set_results itself was NULL, causing a crash.

Fix Optimizer_context_recorder::dump_sql_script() to check
character_set_results for NULL before accessing cs_name, writing
"SET character_set_results=NULL;" to the replay script in that case
so replay reproduces the recorded session instead of silently
defaulting to the script's SET NAMES charset.

Added a test for the same, in opt_context_store_stats.test, that
also checks the recorded script contains the NULL SET statement.
86b74043bdd7...
86b74043bdd7164e835db73a618be4bf558fccbf
Jaeheon Shim
MDEV-41138 Ensure ANY_VALUE not fully reserved
852d80192866...
852d801928662002d754a2df3578e24256b6f88c
Jaeheon Shim
Implement copy_or_same
7ed731f8ccaa...
7ed731f8ccaa5ea599fa83234d30d46014559a67
GoldenEmperor1177
MDEV-40453 Keep overflow edge case tests in place

What was wrong:
The former wrapping cases in the "Overflow edge cases" section of
mysqltest_expression_evaluation.test had been moved to the end of the
file, so the section no longer showed them.

How it is fixed:
Put the five cases back in their original places in that section. They
now die, so each is followed by an expected-error check that runs a
nested mysqltest instance. The duplicates at the end of the file are
removed.

How it is tested:
main.mysqltest_expression_evaluation, main.mysqltest and
main.mysqltest_string_functions pass, also with --ps-protocol and with
a UBSAN-built mariadb-test client. This changes only the test files.
7c2c062051c7...
7c2c062051c703652efe14830816c991706f48e0
Jaeheon Shim
Add additional test cases to any_value
715a937e98cc...
715a937e98cce4673204f8d82ea461ee76af3565
Jaeheon Shim
Modify Item_field::fix_fields and Item_field::fix_outer_field to push to non_agg_fields only if BOTH in_sum_func and in_any_value are false
6f78e802c10d...
6f78e802c10d56562cab78e7c2d02ea0f95b8e73
Hemant Dangi
MDEV-41230: shipped wsrep_notify.sh reparses credentials through eval

Issue: wsrep_notify.sh builds the mysql client invocation as text with
values wrapped in '...', then re-parses it via eval. A configured
password (or SSL path) containing a single quote breaks out of that
quoting, splitting into extra arguments; the unquoted SSL_PARAM splice
also let ssl_* values undergo pathname (glob) expansion before eval
ever ran.

Solution: escape embedded single quotes before interpolating USER,
PSWD, HOST and the ssl_* values into the eval'd string, and quote the
SSL_PARAM splice so it isn't glob/word-split before eval runs. Applied
identically to the std_data test copies, and added a galera regression
test reproducing the reported password-splitting.
6ea5b372a7f0...
6ea5b372a7f0706e01af07ce1a52466d0eb3f40d
Jaeheon Shim
Allow in_any_value to bypass set_non_agg_field_used in fix_fields
601d757ab78d...
601d757ab78dfef4f9fe9a0adfc39f7498c9f16b
Jaeheon Shim
Track ANY_VALUE nesting context in fix_fields
46f5260565b0...
46f5260565b0cb4006ac3d70dc1313b8b396fadc
mariadb-PranavTiwari
Add file change.
3cdcd64fb042...
3cdcd64fb042f4a31e82613ef2835c37fcafcc3d
6eanut
MDEV-41271 Add RISC-V Zvbc accelerated CRC-32C implementation

Extend the RISC-V CRC-32C path with a Zvbc vector implementation:

  - mysys/CMakeLists.txt: detect Zvbc + RVV intrinsics under
    -march=rv64gc_zbb_zvbc; when available rebuild the new
    crc32c_riscv_zvbc.cc with that march (optional, Zbc unaffected);
  - mysys/crc32/crc32c_riscv_zvbc.cc (new): K-lane vector core --
    4 lanes x 128-bit folding, vlseg2e64 de-interleaved 64B loads,
    vclmul_vx broadcast constants, single-element vector CLMUL for
    the Barrett merge (no scalar Zbc instruction anywhere), bit-exact
    with the Zbc core (same fold constants k1..k4 and Barrett math);
  - adaptive VLEN: one e64m1 vector pair at VLEN>=256, two pairs at
    VLEN=128, so 128-bit cores execute the vector path at full width;
  - mysys/crc32/crc32c_riscv.cc + crc32c.cc: runtime dispatch via
    riscv_hwprobe -- Zbc is preferred when present (existing
    deployments keep the optimized scalar core); the Zvbc vector
    path accelerates cores that implement Zvbc but not scalar Zbc.

Correctness: RFC 3720 + random/chained/boundary inputs bit-identical
to slicing-by-4; official unittest/mysys/crc32-t.c 36/36.

Performance on Spacemit X100 (k3, VLEN=256, gcc 14.3.0), vs inherited
slicing-by-4 crc32c_slow (official slow path, same my_crc32c entry):

    len      slow (MB/s)  PR-B2 Zvbc (MB/s)  vs slow
    128 B        289            1147              4.0x
    256 B        296            2105              7.1x
    1 KiB        297            5466            18.5x
    4 KiB        297            9116            30.7x
    64 KiB      296          11398            38.7x

Dispatch prefers the scalar Zbc path when Zbc is available, so
existing Zbc deployments see no behavior change or regression;
the vector path is selected on cores without scalar Zbc.
No behavior change on non-riscv64 builds or toolchains without
Zvbc (optional compile check).

Review revisions requested on PR #5746 (dr-m):

  - mysys/crc32/crc32c_riscv.cc: assemble the ZBC/ZVBC extension bits
    without a branch at both sites, dropping the redundant intermediate
    variable; replace `(void) hwprobe;` with `std::ignore = hwprobe;` and
    include <tuple>.  <tuple> introduces no static constructor, so the
    ifunc resolver's load-time constraint is unaffected.
  - mysys/crc32/crc32c.cc: expand the comment above the Zbc preference
    with the structural reason -- the vector core deliberately reuses the
    scalar fold to stay bit-exact, so its vl is capped at 4 and a wider
    VLEN buys nothing; scalar Zbc is preferred because the two are level
    on large input and the scalar path is clearly ahead on small input.
    Comment-only.

Assisted-by: YuanSheng:DeepSeek-V4-Flash
Co-authored-by: Xiaofei Gong <[email protected]>
Signed-off-by: Jiakai Xu <[email protected]>
3870414b8eaa...
3870414b8eaa46022e208881516b20a4b349dc40
bsrikanth-mariadb
MDEV-36986: Support tracing array of primitive types

Json_writer had two separate code paths: add_unquoted_str() for
numbers/bool/null, and add_escaped_str() which added the surrounding
quotes itself for strings. Single_line_formatting_helper, which
buffers consecutive array/object elements to decide if they fit on
one line, assumed only strings could ever be buffered and always
wrapped the flushed values in quotes. As a result, arrays of numbers
(e.g. "depends_on_map_bits", "rec_per_key") were incorrectly rendered
with their elements quoted as strings.

Unify both paths into add_escaped_quoted_str(): the caller now hands
over bytes that are already in their final on-the-wire form. String
escaping (json_escape_to_string) writes its own surrounding quotes,
while numbers/bool/null are passed through unquoted, so the one-line
helper just concatenates the buffered payloads on flush instead of
adding quotes itself. A DBUG_ASSERT in add_escaped_quoted_str() now
checks that every payload is already a quoted string or a bare
number/bool/null token, so a caller that violates the contract trips
an assertion in debug builds instead of silently producing invalid
JSON.

Also:
- Fix Json_writer_array::add(ulonglong)/(size_t), which went through
  add_ll() with a cast to longlong and corrupted large unsigned
  values (e.g. ULLONG_MAX); route them through add_ull() instead.
- Fix mysql-test/include/opt_context_schema.inc: "subquery_runs" was
  nested inside the preceding object instead of being a sibling
  member, and "rec_per_key" items are now declared as "number" to
  match the corrected output.
- Update recorded .result files for opt_trace, opt_context_*, and
  subselect_mat_analyze_json to reflect numbers/booleans no longer
  being quoted inside JSON arrays.
- Extend unittest/sql/my_json_writer-t.cc with coverage for arrays
  of primitives: plain integers, mixed types, sizes, multi-line
  arrays, values flushed before a nested object, strings that were
  already escaped by the one-line buffer, and invalid utf8mb4 input
  through add_str().
- Rewrite the "multi-line array of integers" test to actually
  overflow the one-line buffer (9 seven-digit numbers instead of 7),
  since the previous version fit on one line and never exercised the
  element-per-line flush path it claimed to test.
- Drop the now-redundant single-argument add_escaped_quoted_str()
  overload; all call sites already know their length.
- Update json_escape_to_string()'s doc comments (my_json_writer.h,
  sql_json_lib.h) to state that it quotes its output, not just
  escapes it.
371e52e6a860...
371e52e6a8605c262ea5a7c363064eed8b2bdb4f
Jaeheon Shim
Add additional any_value tests
- Tests without ONLY_FULL_GROUP_BY
- More NULL tests
- Window function tests
365d2d1f3e61...
365d2d1f3e616c0c89c14bd9a4a420834ae35c28
chiri
crc32c_x86: drop the AVX512DQ requirement
33f22199d882...
33f22199d882fb359a923f68e093fd04f36d4fdb
Jaeheon Shim
Add additional test cases to verify edge cases
31a572a1285c...
31a572a1285cbc9e140b85ecc178dc05047b6853
bsrikanth-mariadb
MDEV-41252: partial join cost Assertion failure in recompute_join_cost_with_limit()

recompute_join_cost_with_limit() computes the cost of the first table's
partial join as best_read*fraction - pos->read_time*fraction. When the
two costs are nearly equal and large (e.g. with a huge
optimizer_scan_setup_cost, or when fraction is close to 1), the two
products are rounded independently. The difference can then be a small
negative number whose magnitude exceeds the absolute DBL_EPSILON
tolerance used by the debug assertion, even though it is only a
floating-point rounding artifact.

Fix: scale the assertion tolerance with the magnitude of the operands
(DBL_EPSILON * pos->read_time * fraction). Negative values are still
clamped to 0.0 as before.

Add test cases to optimizer_crash.test, one with a very large
optimizer_scan_setup_cost and optimizer_join_limit_pref_ratio=1, and one
with a large LIMIT on a 30000-row table.
27d9f427b99c...
27d9f427b99ce0c2754412075b889c4e801b34e4
Jaeheon Shim
Undo COALESCE implementation of ANY_VALUE
22ff9c9edc8a...
22ff9c9edc8a8b6282841bc61d2ec5dfeff8e61d
GoldenEmperor1177
MDEV-40453 Reject overflowing mysqltest expressions

What was wrong:
The mysqltest expression evaluator did signed arithmetic without
checking that the result fits in long long. Boundary expressions
triggered undefined behavior or returned mathematically wrong wrapped
values, e.g. -9223372036854775808 / -1 gave -9223372036854775808, and
unsigned 18446744073709551615 + 1 gave 0.

How it is fixed:
Check unary minus, +, -, *, / and abs() before evaluating and die() with
an "Evaluation error: ... overflow" message when the result is not
representable in 64 bits. Unsigned +, - and * are checked the same way;
an unsigned difference that is negative but fits in long long is
returned as a signed value. A negative signed operand mixed with an
unsigned one is rejected instead of being silently converted. Valid
boundary results are kept: -9223372036854775808 % -1 = 0 and
-4611686018427387904 * 2 = -9223372036854775808. Unary minus on an
unsigned value still wraps, as conv(-~0, ...) in
main.mysqltest_string_functions relies on it.

How it is tested:
main.mysqltest_expression_evaluation: the former wrapping cases now
expect an error, and signed and unsigned overflow cases were added.
main.mysqltest, main.mysqltest_string_functions and the other tests
using $() pass, also with --ps-protocol.
1e197e7e769e...
1e197e7e769ef7d0ea8d0cbe29e9a06a2c919a92
Jaeheon Shim
Fix a minor indexing error in sql_yacc.yy, add ANY_VALUE_FUNC to is_aggr_sum_func()
179e48170e10...
179e48170e10860eac69e5f671da0bdf47ebc280
Jaeheon Shim
Create Item_func_any_value and Create_func_any_value
146a480eed0d...
146a480eed0d38174039c7a3402f7120c3ab3dba
Yuchen Pei
MDEV-XXXXX fixup: read the partition id at the right offset

handle_ordered_index_scan_key_not_found() updated m_top_entry from the
start of the queue element, where the blob storage pointer is, instead
of from ORDERED_PART_NUM_OFFSET, where return_top_record() and
init_record_priority_queue() keep the partition id. m_top_entry could
then differ from the partition at the top of the queue, and
handle_ordered_next() returned the current top row again instead of
reading the next row, e.g. HANDLER t1 READ a = (15) followed by
HANDLER t1 READ a NEXT returned 15 twice.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
BuildBot (0.8.9) working for the MariaDB project.
Page built: Thu 01 Oct 2026 10:31:47 (UTC)