Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
fffe55f39cef...
fffe55f39cef9e077112f5e9abde3d8dd11ba492
Khaled Riyad
MDEV-40377 Change Server source code to point to new docs (12.3 part)

Replace the remaining Knowledge Base links with their MariaDB
Documentation equivalents, including the 838 URLs in the help tables.
Only URLs change in fill_help_tables.sql.

Merging upward: fill_help_tables.sql conflicts at 10.11->11.4 and
11.8->12.3. At those two merges keep the target branch's version,
since 11.4, 11.8 and 12.3 each carry their own URL fix. From 12.3 to
13.1 and 13.1 to main it merges cleanly; take the incoming change.
.github/pull_request_template.md is deleted in 12.3; keep the deletion.
f21444cd039e...
f21444cd039ebb07c5442082c1906b0e37ba7cbd
Sergei Golubchik
Merge branch '11.4' into 11.8
ef9134ac4933...
ef9134ac4933c30a3af9851050a0c5df5487c308
Dave Gosselin
CSV:  Keep the data file length when a lock wait fails

Keep the data file length in the share of a CSV table when a statement
fails to get its table lock.

After FLUSH TABLES t1, while another connection holds LOCK TABLES t1
READ LOCAL, UPDATE t1 SET v=v+10 fails with a lock wait timeout, and
the next SELECT * FROM t1 returns no rows.  The UPDATE opens a new
handler, whose own length is 0 until thr_lock grants the lock.  The
unlock after the failed wait stores that length in the share.

A handler now uses the length in the share from external_lock() until
thr_lock grants the lock, and an unlock without that grant leaves the
length in the share as it was.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
ecda07c65644...
ecda07c6564488ba0c807dcbdcfa3bea4b486ed9
Dave Gosselin
MDEV-41211 Remove unused index_read_idx() from both Federated engines

ha_federated::index_read_idx() and ha_federatedx::index_read_idx()
have no callers and do not override a handler method.  Remove them,
and remove the sentence in the comment on each index_read() that says
index_read() calls it.  Comments that describe index_read_idx() now
name index_read() or index_read_idx_map(), whichever does that read.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
e4efa64adacd...
e4efa64adacd5e540f59893395e9cc45698d87b4
Dave Gosselin
MDEV-41251:  Give a copied comparison its own comparator

A copy of a comparison operator or of NULLIF now sets up its own
Arg_comparator over the arguments of the copy, with the comparison type
of the original.  With t1.b holding NULL, 1, 2 and 5, a join to a split
materialized table on dt.a <=> (t1.b = 1) lost the row (NULL, NULL, 15)
that the same query without splitting returns.  The same query with the
row comparison (t1.b, t1.b) = (1, 1) crashed the server.

The copy of t1.b = 1 gives the key for reading the split table, but its
comparator still pointed at the original item.  It set null_value of
the original, so for a NULL t1.b the copy returned 0 instead of NULL.
The copy of a row comparison had no comparators for its elements, and
comparing the rows read through a null pointer.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
e457d7f51f77...
e457d7f51f773351abbe48f8c22687c5ac7c7817
Dave Gosselin
MDEV-41216:  ha_tina (CSV) deletes wrong records

Refuse a DELETE or UPDATE that changes rows of a CSV table through two
aliases.

In DELETE a1, a3 FROM t1 AS a1 JOIN t1 AS a3 WHERE a1.v=2 AND a3.v=1,
each alias saves the file offsets of its rows during the join and
deletes them in a later pass.  The end of the first pass rewrites the
data file without its deleted rows, so the offsets saved by the second
alias point at other rows.  The statement deletes the wrong rows or
marks the table as crashed, and an UPDATE through two aliases fails the
same way.

When two targets of a DELETE or UPDATE are the same CSV table,
including through a view, the statement fails with ER_NOT_SUPPORTED_YET
when it is prepared, and the message names both aliases.  For UPDATE
the check sits next to the existing one for a clustered primary key or
partition key updated through two aliases.

A multi-table UPDATE also fails with ER_NOT_SUPPORTED_YET when the
CHECK OPTION of an updated view reads an alias of a CSV table that the
statement changes through another alias.  The CHECK OPTION reads the
rows of that alias again by the positions saved during the join.  Any
other statement where one alias changes rows and the other only reads
them runs as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
d22d9e74773c...
d22d9e74773c6c6e797884df2fafb5c08e1be421
Brad Smith
MDEV-41221: memcpy() source and target overlap in dict_table_rename_in_cache()

In dict_table_rename_in_cache(), sql_id = foreign->sql_id() points into
the existing foreign->id string. When the new id is not longer than the old
one (always the case when renaming from "#sql-alter-..." back to the real
table name), the buffer is reused in place, so the final
snprintf(id, fklen, "%s\377%s", table->name.m_name, sql_id)
reads sql_id from the buffer it is writing to (sql_id == id + 50 in gdb).
That is undefined behavior. Most libcs happen to copy forward and get away
with it, but OpenBSD's memcpy detects the overlap and calls abort().

The fix computes the lengths explicitly, memmove()s the sql_id tail to its
final position first, then memcpy()s the table name prefix and writes the
\377 separator. The decision to reuse the old buffer or allocate a new one
is unchanged.

Co-authored-by: Claude Opus 5.5 <[email protected]>
cd2b2ef88117...
cd2b2ef88117b3bc5c2133c1d4e780a1a9a9e97b
Dave Gosselin
CSV:  Share the data file length among handlers of one lock

Under LOCK TABLES t1 WRITE, t1 AS a1 WRITE, rows added or changed
through t1 were missing when read through a1, and after UNLOCK TABLES
a row could stay hidden from every later query.  Each handler kept its
own copy of the data file length, taken when the table was locked, and
the last handler to unlock wrote its copy back to the share.

The CSV engine now registers a copy_status callback, as MyISAM does.
When one lock call holds a table more than once, all handlers of that
table use the length of the first handler, so a write through any of
them is seen by the others.  Only the first handler stores that length
in the share, because the others can unlock after it is closed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
c634c41f9567...
c634c41f9567070343670a963df4a7f63c91b8b1
Yuchen Pei
MDEV-40978 Restrict INTERVAL of range interval partitioning to partition-function-safe constant expressions

INTERVAL is evaluated at parse time, when placeholders and stored
procedure variables have no value yet.

We reuse the `check_partition_func_processor` to check for this. It
also bans user and system variables as well as functions lik RAND(),
but nonetheless slightly stricter than strictly needed - for example,
`CONCAT('1','.','30') HOUR_MINUTE` is no longer allowed.
c31b345e639d...
c31b345e639d9b25442f06a64de5198f70f62fee
Dave Gosselin
MDEV-41251:  Copy items for a stated purpose

Replaces Item::deep_copy() with Item::copy_for(), which takes a
Copy_context naming why the copy is made.  The purposes are a pushdown
into another select, a rewrite within the same select, a copy for
another thread, and a copy that outlives the statement.  Each purpose
decides how an Item_cache is copied, and every caller now names its
purpose.  With t0 holding (1,3), (2,2) and (3,7), the IN subquery over
a split materialized table in the test returned only (1,3), but the
same query without splitting returns (1,3) and (2,2).

The equality pushed into the split table held a copy of the cache of
the IN predicate.  Item_in_optimizer stores a new value into its own
cache for each outer row, yet nothing stored into the copy, so the copy
kept the value of the first row.  A pushdown copy now holds the
original cache.  It still copies an outer column, because an Item_field
reads the record of its table and a copy reads the same value, while a
cache keeps its value in the item itself.  The other pushdowns never
receive an outer reference, and they either replace a cache with a
literal or skip it when cleaning the pushed condition.  The walk that
marks the fields of the pushed equality as dependent no longer enters
caches, because it would otherwise mark the left operand of IN in the
outer select.  A rewrite copy is refused when the tree holds a cache,
and the casefold rewrite is then skipped.  That rewrite cleans its copy
and fixes it again, which would clear a shared cache.  No cache reaches
it today, because it runs before the optimizer caches constant
expressions.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
b6398296aeee...
b6398296aeeeb253bdb3d1dd1620d2bb03836bf7
Khaled Riyad
MDEV-38861 heap-use-after-free in Prepared_statement::execute()

DROP PROCEDURE and CREATE OR REPLACE PROCEDURE executed from inside the
routine itself removed it from the SP cache. sp_head::destroy() then freed
the memory root that the running sp_head, its LEX and its instructions
live in, and the caller kept using them.

Skip the removal while the routine is being executed. sp_cache_invalidate()
above has already bumped the cache version, so the stale entry is removed by
the next lookup, after IS_INVOKED has been cleared.
b51d2f12bc27...
b51d2f12bc27a29897caf8cb982077683fe47fcd
Dave Gosselin
MDEV-41211 Federated multi-table DELETE keeps a const table row

A multi-table DELETE on a FEDERATED or FederatedX table went wrong
when a primary key lookup made the target a const table.  The
optimizer reads a const table's row through index_read_idx_map(),
whose default implementation ends the index scan and frees the result
set.  The server asks for the row's position later, during execution,
so the saved position was empty.  FederatedX skipped the row and
FEDERATED crashed in rnd_pos().

Both engines now override index_read_idx_map() so that the lookup
leaves its result set open, as index_read() does.  position() then
records a valid position, and the result set is freed at the end of
the statement.  FEDERATED's reset() now also clears stored_result,
which otherwise pointed at a freed result set and was freed again
when the table was closed.

Tests include a multitable UPDATE with a const target, which crashed
both engines before the fix.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
b2bc6c2f7045...
b2bc6c2f7045ad0371934f944e4f23fcd744a062
Sergei Golubchik
Merge branch '11.8' into 12.3
b03be66c0d07...
b03be66c0d0799379a087e33677ec0c562ab4ec0
Dave Gosselin
CSV:  Read rows written under LOCK TABLES in CHECK and REPAIR

Make CHECK TABLE and REPAIR TABLE on a CSV table read the rows written
while the table is locked.

Under LOCK TABLES t1 WRITE, INSERT INTO t1 VALUES (4) followed by
CHECK TABLE t1 reports the table as corrupt, and the next statement
fails because the table is marked as crashed.  check() and repair() set
the data file length from the share, which keeps the length from the
time of the lock until UNLOCK TABLES stores the new one.  The scan stops
before the inserted row, and the row count does not match.

CHECK now scans to the end of the data file, because the row count
includes every row written so far.  Under LOCK TABLES t1 READ LOCAL,
the count also includes the rows that another connection inserted after
the lock, which the length of the locked handler misses.  The handler
keeps its own length for the statements that follow under the same
lock.  REPAIR scans to the end of the data file too, so that it removes
the bad rows that CHECK reports, such as a row that another program
appended to the file under LOCK TABLES t1 WRITE.

An INSERT now writes and counts its row under share->mutex, and CHECK
reads the row count and the file length under the same mutex, so that
the two agree when another connection inserts a row during CHECK
TABLE.  The constructor sets curr_lock_type to F_UNLCK, so that it has
a value before the first call to external_lock().

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
adc979f54ddb...
adc979f54ddbaf6a2a51a536aefc5e9cbefb328f
Sergei Golubchik
Merge branch '11.8' into 12.3
91b30e2cc15a...
91b30e2cc15a0ae3f3a2ad3276885cf645bdf617
Alexander Barkov
MDEV-41265 SELECT/ UPDATE RETURNING INTO a single row-field fails with ER_WRONG_NUMBER_OF_COLUMNS_IN_SELECT, even though the column count matches

my_var_sp_row_field::check_assignability() and
my_var_sp_row_field_by_name::check_assignability() had an inverted
condition. They returned true (error) when the select list had exactly
one element, and false (OK) otherwise.

A field of a ROW variable (r0.a) is a scalar target, so it accepts
exactly one column. The check must fail when the number of select list
elements is not 1:

  SELECT a INTO r0.a FROM t1;    # was wrongly rejected, now works
  SELECT a,b INTO r0.a FROM t1;  # was wrongly accepted, now fails with
                                  # ER_WRONG_NUMBER_OF_COLUMNS_IN_SELECT

Fix: change 'select_list.elements == 1' to 'select_list.elements != 1'
in both classes.

Tests added to select_into_row.test for fields of:
- an explicit ROW variable
- a ROW TYPE OF table variable
- a ROW TYPE OF cursor variable
Each covers the one-column (OK) and two-column (error) cases.

The bug was introduced in two steps:
- a91b78049a8 MDEV-36705 added my_var_sp_row_field with the inverted
  condition.
- add63991988 MDEV-40790 copied it into the new class
  my_var_sp_row_field_by_name.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
8dddd70215a6...
8dddd70215a68e26117178f730751a2e141ab9f8
drrtuy
MDEV-40957 MTR  tests to cover DML statements in a replicated setup.
7a942c268b93...
7a942c268b939dd5f221bb1ccbc81fcd0d05b1df
Yuchen Pei
MDEV-41064 Use my_safe_alloca for unescaped json server option string

This fixes segv when the option string is longer than thread stack
7a18746354a8...
7a18746354a847d8cff7487fcbfda4965358fe06
Sergei Golubchik
Merge remote-tracking branch 'github/12.3' into bb-12.3-serg
78fe5219d370...
78fe5219d3705eedd87de85c6a15afd06cbaacd9
Sergei Golubchik
Merge branch '11.8' into 12.3
6ea788237d04...
6ea788237d04388a5c976403c90a7202fee0ad2b
Yuchen Pei
MDEV-40978 Restrict INTERVAL of range interval partitioning to partition-function-safe constant expressions

INTERVAL is evaluated at parse time, when placeholders and stored
procedure variables have no value yet.

We reuse the `check_partition_func_processor` to check for this. It is
slightly stricter than strictly needed - for example,
`CONCAT('1','.','30') HOUR_MINUTE` is no longer allowed.
69d1ca979535...
69d1ca979535ba612b47b68998a0fb1dd45a9ea7
Dave Gosselin
CSV:  Keep the row when an UPDATE fails to write its new version

When an UPDATE on a CSV table failed to write the new version of a row
to the temporary file, the old version had already been marked for
removal.  The end of the scan still rewrote the data file, so the row
was lost and CHECK TABLE reported the table as corrupt.  A write that
failed partway also left part of the row in the temporary file, which
then joined the next row written after it.

Undo the removal mark when the write fails, so the old row stays in the
table.  Move the write position of the temporary file back to its last
good length, where the next write replaces the part of the failed row.
The end of the scan cuts the temporary file to the length of the rows
written, which removes any part that no later write replaced.  If the
write position cannot be moved back, the end of the scan leaves the
data file unchanged, and the rows updated before the failed one keep
their old values.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
572e56c878e1...
572e56c878e172c802148ac5291b13ca079ae3d2
Yuchen Pei
MDEV-41064 Use my_safe_alloca for unescaped json server option string

This fixes segv when the option string is longer than thread stack
4f224eca94f7...
4f224eca94f74f82fda951a67888119cedad5240
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

Fix: RANGE_SEQ_ENTRY stack[MAX_REF_PARTS+1];

The above change exposed an issue with key length calculation on
MS Windows.  Calling make_prev_keypart_map(32) caused the resultant
bitmap to be calculated as (1UL << 32) - 1.  Using the MSVC compiler
this resulted in an empty key length calculation during
handler::index_read_map, causing an assertion in ha_innobase::index_read().

As we only need 32 bits to represent our key map, we change the type thus
-typedef ulong key_part_map;
+typedef uint32 key_part_map;

We correct make_keypart_map() and make_prev_keypart_map() to call our
overflow safe my_set_bits().  We also correct bka_range_seq_next()
and bkah_range_seq_next() to use make_prev_keypart_map().

We also add some DBUG_ASSERTS in key_part_map processing elsewhere,
exposing some issues in our BNLH implementation.  We cap the number of
keyuse parts here, altering the explain output of 2 of our tests.

Numerous places needed bit shift operations altered to use
make*keymap_part and various format strings needed to be corrected.
4452249518da...
4452249518da921ac0250cbf59b95b8a944a86f2
mariadb-PranavTiwari
Added type casting
3f0b82d2ba43...
3f0b82d2ba43d4c063f55a44248e75e44b8d6dca
Jan Lindström
MDEV-40038 tp_foreach() crashes on a dying transaction participant

Bug: tp_foreach() found an engine in hton2plugin[] and passed the
result of plugin_lock() to plugin_hton() without a check. While
reap_plugins() deinitializes an uninstalled engine (PLUGIN_IS_DYING),
the slot stays set until the end of ha_finalize_handlerton(), and
plugin_lock() returns NULL. The server crashed in plugin_hton(), for
example in RESET MASTER through ha_commit_checkpoint_request().

This is a regression from aed5928207a, which changed plugin_foreach()
to tp_foreach() and lost the PLUGIN_IS_READY state mask.

Fix: add plugin_lock_ready(), which locks only a PLUGIN_IS_READY plugin
and reports under LOCK_plugin whether a failed lock was for a READY
plugin (out of memory in debug builds). tp_foreach() skips a plugin that
is not READY and returns an error for a READY plugin that cannot be
locked. An uninstalled but busy engine (PLUGIN_IS_DELETED) is not
visited, as with plugin_foreach() before.

The test uses a DEBUG_SYNC point in ha_finalize_handlerton() to run
RESET MASTER while an engine is deinitialized.

Assisted-by: https://mariadb.org/governance/governance-ai-policy/
3ee413a5374b...
3ee413a5374bf8339e5f124f0ada55b1935fc5af
Dave Gosselin
MDEV-41216:  Tests for CSV DELETE and UPDATE through two aliases

Add tests where two aliases of the same CSV table change rows in one
DELETE or UPDATE, in a plain statement, under LOCK TABLES and in a
stored function.  These statements must fail with ER_NOT_SUPPORTED_YET
and leave the table unchanged, so the tests fail until the server
refuses them.  Statements where one alias changes rows while the other
only reads them still succeed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
38bc5b954b88...
38bc5b954b88bc8004bc1d3a10894250cbcde807
drrtuy
MDEV-40957 replication from InnoDB into DuckDB works using FULL mode only.
34e3dc803852...
34e3dc803852a36d41c471af9048563c73070772
drrtuy
MDEV-40957 DuckDB engine now returns maximum cost for unimplemented index handler operations effectively disabling them.
335eca6b25e6...
335eca6b25e6db3a12ae6bd6913414866c7e35b4
Dave Gosselin
CSV:  Remove the partial row that a failed INSERT leaves

Cut the data file of a CSV table back to its length before the write
when an INSERT fails to write its row.

When the write of row 2 stops after its first byte, INSERT INTO t1
VALUES (2) fails, but that byte stays at the end of the data file.  The
next INSERT INTO t1 VALUES (3) appends its row after it.  Once the
table is opened again, SELECT * FROM t1 returns the rows 1 and 23, and
CHECK TABLE reports the table as OK.

If the cut fails too, the table is marked as crashed.  A new debug
injection point writes the first byte of a row and then fails as if
the disk were full, and the new test uses it.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
250ee9121fc1...
250ee9121fc18863086ac785914f181862acbb87
drrtuy
MDEV-40957 read-free DML on the slave for DuckDB.
2340857fa1e8...
2340857fa1e803202783c33ae379a7484bbf038f
Khaled Riyad
MDEV-40377 Change Server source code to point to new docs (11.4 part)

Replace the remaining Knowledge Base links with their MariaDB
Documentation equivalents, including the 838 URLs in the help tables.
Only URLs change in fill_help_tables.sql.

Merging upward: fill_help_tables.sql conflicts at 10.11->11.4 and
11.8->12.3. At those two merges keep the target branch's version,
since 11.4, 11.8 and 12.3 each carry their own URL fix. From 12.3 to
13.1 and 13.1 to main it merges cleanly; take the incoming change.
.github/pull_request_template.md is deleted in 12.3; keep the deletion.
1d5573936d5b...
1d5573936d5b1268c3b3947ed0480298427837a4
Dave Gosselin
MDEV-41146:  Check rand() in WHERE when top level base tables are const

A WHERE conjunct that calls rand() but doesn't refer to a column, such
as rand() < 0, is checked on the last non-const top level base table
in the join order.  When every top level base table was const and the
join order ended with materialized semi-joins, the conjunct was never
checked.  Such a query gave wrong results.  In that scenario the join
returns at most one row, so the conjunct is now checked once before
the join starts, together with the conditions on columns of an outer
query.

A join of only const tables already checks it this way, and both cases
now collect it with the same code.  The decision uses the same search
for the last top level base table that places the conjunct in every
other case.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
1ca6a438535f...
1ca6a438535fef8a643c414e2782b3987e0fc78e
Dave Gosselin
CSV:  Test a failed write during UPDATE

Add two debug injection points to the CSV engine.  One writes the first
byte of the new version of a row and the other writes all of it, and
both then fail as if the disk were full.  The new test uses the first
to check that UPDATE keeps the old rows and that the table is not
marked as corrupt afterwards.  A second case fails on the second row
and checks that the first row keeps its new version, which covers
moving the write position of the temporary file back.  A third case
fails on a new version that is longer than the rest of the table, and
checks that no part of it reaches the data file, which covers the cut
of the temporary file at the end of the scan.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
19719d64f025...
19719d64f0252bd2e0950457c46fdea90b1cfcbc
ParadoxV5
MDEV-38849 slave_connections_needed_for_purge prevents independent machine from purging binary logs

`@@slave_connections_needed_for_purge`’s default of `1` ensures binary
log availability on replication masters, but is not a sensible default
suitable for all scenarios, especially for long-term slave servers and
standalone (not in a replication setup) servers.
The outcome was that standalone server users were confused why automatic
binlog purging does not work.

This commit changes this default to `0`, which is suitable for both
standalone and (when backed by prompt failure recovery)
replication setups.
`0` also more closely matches the behaviour before MDEV-31404,
which added this variable, out of the box.

This commit also adds a one-time replication warning when registering a
slave, but `@@slave_connections_needed_for_purge` is left unchanged.
Rather than enforcing a defence with an unsensible default, this
reminder will bring awareness of the risk of automatic binlog purging.

This commit also cleans up Galera and MTR workarounds to the
introduction of the `@@slave_connections_needed_for_purge=1` default.
189298bd2a36...
189298bd2a36d1e14c076339404563ec04bd315c
drrtuy
MDEV-40957 mixed-mode replication UPDATE/DELETE for DuckDB.
17cc6b376784...
17cc6b376784df4fdbab2514a29311bf4367e81c
Khaled Riyad
MDEV-40377 Change Server source code to point to new docs (11.8 part)

Replace the remaining Knowledge Base links with their MariaDB
Documentation equivalents, including the 838 URLs in the help tables.
Only URLs change in fill_help_tables.sql.

Merging upward: fill_help_tables.sql conflicts at 10.11->11.4 and
11.8->12.3. At those two merges keep the target branch's version,
since 11.4, 11.8 and 12.3 each carry their own URL fix. From 12.3 to
13.1 and 13.1 to main it merges cleanly; take the incoming change.
.github/pull_request_template.md is deleted in 12.3; keep the deletion.
15174ecd8efe...
15174ecd8efe4a2cc95cb00c8fc6b01e8a54b484
drrtuy
MDEV-40957 various fixes for mixed DML path that suffered from uninit bitmaps and wrong SQL statements that failed in DuckDB.
14362356d14b...
14362356d14b80242d60dceb9b34f988bbcc9945
Yuchen Pei
MDEV-41064 Use my_safe_alloca for unescaped json server option string

This fixes segv when the option string is longer than thread stack
068bc4717414...
068bc47174143809b1a33fc18226c7f1627abb29
Rex Johnston
MDEV-41179 MAX_KEY_PARTS ranges in select causing SEGV

When a select containing 32 ranges is made on a table containing a
compound key with 32 parts, the range optimizer can run off the end
of a stack variable, invalidly overwriting subsequent stack variables.

In the struct st_sel_arg_range_seq, we have an array
  RANGE_SEQ_ENTRY stack[MAX_REF_PARTS];

MAX_REF_PARTS is 32.

check_quick_select
  / sel_arg_range_seq_init
    initialises stack[0] as NOT a key part
  / sel_arg_range_seq_next
    iterates through the key parts, adding key part n to stack[n+1]

key part #32 gets referenced by step_down_to(), setting seq->i off the
end of the array.

Fix: RANGE_SEQ_ENTRY stack[MAX_REF_PARTS+1];

The above change exposed an issue with key length calculation on
MS Windows.  Calling make_prev_keypart_map(32) caused the resultant
bitmap to be calculated as (1UL << 32) - 1.  Using the MSVC compiler
this resulted in an empty key length calculation during
handler::index_read_map, causing an assertion in ha_innobase::index_read().

As we only need 32 bits to represent our key map, we change the type thus
-typedef ulong key_part_map;
+typedef uint32 key_part_map;

We correct make_keypart_map() and make_prev_keypart_map() to call our
overflow safe my_set_bits().  We also correct bka_range_seq_next()
and bkah_range_seq_next() to use make_prev_keypart_map().

We also add some DBUG_ASSERTS in key_part_map processing elsewhere,
exposing some issues in our BNLH implementation.  We cap the number of
keyuse parts here, altering the explain output of 2 of our tests.

Numerous places needed bit shift operations altered to use
make*keymap_part and various format strings needed to be corrected.
BuildBot (0.8.9) working for the MariaDB project.
Page built: Thu 08 Oct 2026 04:09:09 (UTC)