Home - Waterfall Grid T-Grid Console Builders Recent Builds Buildslaves Changesources - JSON API - About

Console View


Categories: connectors experimental galera main
Legend:   Passed Failed Warnings Failed Again Running Exception Offline No data

connectors experimental galera main
Raghunandan Bhat
MDEV-36763: Assertion failed in `Type_handler_json_common::json_type_handler_from_generic`

Problem:
  Queries returning JSON from hybrid functions (`NULLIF`, `IF`, `NVL2`)
  crash. This is a regression from MDEV-36716, which added early calls
  to `Item_hybrid_func_fix_attributes()` inside
  - `Item_func_nullif::fix_length_and_dec()` and
  - `Item_func_case_abbreviation2::cache_type_info()`
  to block `ROW` arguments.

  Standard hybrid functions populate their `m_type_handler` by calling
  `aggregate_for_result()` prior to fixing attributes. However, since
  `NULLIF` and `IF` deduce their return type from a single argument,
  they optimize away the `aggregate_for_result()` step.

  This caused `Item_hybrid_func_fix_attributes()` to execute while
  `m_type_handler` was still in its uninitialized default state,
  triggering a debug assertion failure in the JSON handler.

Fix:
  Explicitly set the type handler from the source argument before
  calling `Item_hybrid_func_fix_attributes()`.
ParadoxV5
MDEV-38600: Annotate the binlogging of recreating MEMORY tables

The data in MEMORY tables is temporary and is lost when the server
restarts. Thus, it is well-intentioned to record TRUNCATE statements
to the binary log when these tables are rediscovered empty. However,
as entries with no explicit user query associated (especially the lack
of SHUTDOWN on crashes), those unaware of this mechanism can find them
unexpected, not to mention their significance downstream in replication.

This commit adds a comment to these automatically generated
TRUNCATE entries to briefly self-describe their source and purpose.
As a part of the generated query, this comment is visible together
with the TRUNCATE itself in SHOW BINLOG EVENTS and `mariadb-binlog`,
while maintaining seamlessness in replication.

There are no other changes in behaviour or storage engine API.

Reviewed-by: Andrei Elkin <[email protected]>
Raghunandan Bhat
MDEV-36763: Assertion failed in `Type_handler_json_common::json_type_handler_from_generic`

Problem:
  Queries with hybrid functions like `NULLIF`, `IF` and `NVL2` crashes
  because of early calls to `Item_hybrid_func_fix_attributes` added by
  the patch MDEV-36716 inside
  - `Item_func_nullif::fix_length_and_dec`
  - `Item_func_case_abbreviation2::cache_type_info()`
  to properly block `ROW` type arguments.

  Hybrid functions correctly populate `m_type_handler` member by calling
  `aggregate_for_result` prior to calling fix attributes. Since the
  return types of `NULLIF`, `IF`, etc are determined by single argument,
  `aggregate_for_result` result was not called.

  When `Item_hybrid_func_fix_attributes` was called without populating
  `m_type_handler` explicitly, a debug assert in JSON handler failed.

Fix:
  Ensure type handler is set before calling fix attribute function.
Sergei Golubchik
cleanup: remove galera test certificates from mtr

use server certs instead. galera CA didn't have a key saved in std_data,
so they could not be regenerated when needed.
Rucha Deodhar
MDEV-39212: JSON_MERGE_PATCH depth crash

Analysis:
The crash happens because we run out of stack space

Fix:
Add a stack overflow check.
Yuchen Pei
MDEV-39361 Assign Name resolution context in subst_vcol_if_compatible to the new vcol Item_field

Add a context field to vcol_info, and assign value in a Item_field
constructor as well as during substitution.
luckyxhq
Improve CONTRIBUTING.md formatting and consistency

Fix formatting inconsistencies in CONTRIBUTING.md:
- Standardize header underlines to use 3 dashes consistently
- Remove double spaces before links
- Add missing space after period on line 22
- Update http://mariadb.meetup.com/ to https:// for security

These changes improve document readability and follow markdown
best practices.
Aleksey Midenkov
MDEV-39063 Server crashes at Item_func_lastval and Item_func_setval with CTE alias

Pure aliases are not handled properly by Item_func_lastval::val_int()
and Item_func_setval::val_int().

This is followup fix for MDEV-33985 where it missed similar cases for
LASTVAL() and SETVAL().

add_table_to_list() does not create MDL request for pure aliases,
i.e. when there is no table_list->db set or TL_OPTION_ALIAS was
set. When the expression is not inside CTE the case with empty db is
handled by:

  else if (!lex->with_cte_resolution && lex->copy_db_to(&db))
    DBUG_RETURN(0);

So, table_list gets current database name and the query is failed with
ER_NO_SUCH_TABLE error.

The fix adds the case of is_pure_alias() check for val_int() methods
and fails it with ER_NOT_SEQUENCE2 error.

Note: semantics for TL_OPTION_ALIAS cannot be based on empty db, only
parser can set TL_OPTION_ALIAS as resolve_references_to_cte() relies
on TL_OPTION_ALIAS after copy_db_to().
Raghunandan Bhat
MDEV-36763: Assertion failed in `Type_handler_json_common::json_type_handler_from_generic`

Problem:
  Queries returning JSON from hybrid functions (`NULLIF`, `IF`, `NVL2`)
  crash. This is a regression from MDEV-36716, which added early calls
  to `Item_hybrid_func_fix_attributes()` inside
  - `Item_func_nullif::fix_length_and_dec()` and
  - `Item_func_case_abbreviation2::cache_type_info()`
  to block `ROW` arguments.

  Standard hybrid functions populate their `m_type_handler` by calling
  `aggregate_for_result()` prior to fixing attributes. However, since
  `NULLIF` and `IF` deduce their return type from a single argument,
  they optimize away the `aggregate_for_result()` step.

  This caused `Item_hybrid_func_fix_attributes()` to execute while
  `m_type_handler` was still in its uninitialized default state,
  triggering a debug assertion failure in the JSON handler.

Fix:
  Explicitly set the type handler from the source argument before
  calling `Item_hybrid_func_fix_attributes()`.
Alexey Botchkov
MDEV-15479 Empty string is erroneously allowed as a GEOMETRY column value.

Empty string disallowed.
Raghunandan Bhat
MDEV-36763: Assertion failed in `Type_handler_json_common::json_type_handler_from_generic`

Problem:
  Queries returning JSON from hybrid functions (`NULLIF`, `IF`, `NVL2`)
  crash. This is a regression from MDEV-36716, which added early calls
  to `Item_hybrid_func_fix_attributes()` inside
  - `Item_func_nullif::fix_length_and_dec()` and
  - `Item_func_case_abbreviation2::cache_type_info()`
  to block `ROW` arguments.

  Standard hybrid functions populate their `m_type_handler` by calling
  `aggregate_for_result()` prior to fixing attributes. However, since
  `NULLIF` and `IF` deduce their return type from a single argument,
  they optimize away the `aggregate_for_result()` step.

  This caused `Item_hybrid_func_fix_attributes()` to execute while
  `m_type_handler` was still in its uninitialized default state,
  triggering a debug assertion failure in the JSON handler.

Fix:
  Explicitly set the type handler from the source argument before
  calling `Item_hybrid_func_fix_attributes()`.
Dave Gosselin
MDEV-32290: Server crashes in sub_select_cache

A query inside UNION marked uncacheable could crash during a
subsequent execution on an assertion in sub_select_cache (like when a
derived table is materialized again inside a recursive CTE) or in
join_read_first because the cleanup at the end of one execution freed
state the next execution relies on.

The cleanup decision in JOIN::join_free looked only at an individual
SELECT_LEX's uncacheable flag.  That flag does not propagate down from
the enclosing unit to sibling branches, so a UNION "branch" would be
cleaned up as if it were the only query even when the containing UNION
is certain to run it again.  Change the cleanup check to Consider the
unit's uncacheable flag (and not only the SELECT_LEX's) to keep
preserve state required on subsequent executions.
ParadoxV5
MDEV-38600: Warn when recreating MEMORY tables on read-only slaves

The data in MEMORY tables is temporary and is lost when the server
restarts. Thus, when these tables are rediscovered empty,
it’s well-intentioned to record TRUNCATE statements to
the binary log, complete with an increment to the `@@gtid_binlog_pos`.
However, those unaware of this mechanism may not expect this increment
and its sign of replication divergence, namely in `@@gtid_strict_mode`.

This commit adds a binary log warning
when such a table is found `implicit_emptied`.

Since general uses of memory tables may already expect this effect,
to avoid unnecessary verbosity, this warning only emits from
`@@read_only` servers with CHANGE MASTER configured. `@@read_only`
indicates that the server should not receive changes; for a slave,
it means it only expects replication to binlog changes with GTID.

Reviewed-by: Brandon Nesterenko <[email protected]>
Brandon Nesterenko
MDEV-38830: SIGSEGV and UBSAN null-pointer-use in TABLE::evaluate_update_default_function on UPDATE

MDEV-38716 (fa36b269f13) fixes were incomplete. It still allowed a
table's default_fields to be left un-restored after an ALTER table
finished its copy_data_between_fields().

This patch actually matches the original conception of MDEV-38716. It
was later changed after finding a test failure in maria.alter, where I
thought the patch broke that test. But actually, maria.alter itself
relies on somewhat broken/inconsistent server behavior.

It is the MDEV-19055 extension of the test which broke. To summarize the
broken part of the test, first, it creates a temporary table t2, adds a
new column of type DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP, and adds
a constraint check on that new type:

CREATE TEMPORARY TABLE t2 (a TIME) ENGINE=Aria;
ALTER TABLE t2 ADD b DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP;
ALTER TABLE t2 ADD CHECK (b = 4);

The next part results in inconsistent behavior:

INSERT IGNORE INTO t2 () VALUES (),(),(),();

Prior to this patch, this would create 4 new rows, each with a zeroed
out timestamp for `b`. This is due to a the default_field not resetting
after the ALTER TABLE, thus the DEFAULT CURRENT_TIMESTAMP clause is lost
after the ALTER TABLE ADD CHECK.

With this patch, because the default_field is restored after the ALTER,
there is no affect of the INSERT IGNORE INTO t2. I.e., t2 is empty after
this insert.

This change in results further changes how an ALTER TABLE behaves later
in the test:

SET SQL_MODE= 'STRICT_ALL_TABLES';
SELECT count(a),sum(a) FROM t2;
--error ER_TRUNCATED_WRONG_VALUE
ALTER TABLE t2 CHANGE IF EXISTS d c INT;

Without this patch, there are rows in t2, and so this ALTER TABLE
results in an error. With this patch, t2 is empty, and therefore there
is no data that was truncated to warn about. It is generally bad test
practice to have a table with no rows, as it has historically masked
other bugs. So we add back a couple rows into the table to ensure it
hits additional logic. However, because the bug has been fixed, invalid
rows are not able to be inserted into the table and thereby the
ER_TRUNCATED_WRONG_VALUE error is still not thrown. So that error is
removed.

Reviewed-by: Monty <[email protected]>
Signed-off-by: Brandon Nesterenko <[email protected]>
Rucha Deodhar
MDEV-33843: Server crashes by stack-overflow with UPDATEXML

Analysis:
The stack size if insufficient and there is no stack overrun check.

Fix:
Add stack overrun check.
Raghunandan Bhat
MDEV-36763: Assertion failed in `Type_handler_json_common::json_type_handler_from_generic`

Problem:
  Queries returning JSON from hybrid functions (`NULLIF`, `IF`, `NVL2`)
  crash. This is a regression from MDEV-36716, which added early calls
  to `Item_hybrid_func_fix_attributes()` inside
  - `Item_func_nullif::fix_length_and_dec()` and
  - `Item_func_case_abbreviation2::cache_type_info()`
  to block `ROW` arguments.

  Standard hybrid functions populate their `m_type_handler` by calling
  `aggregate_for_result()` prior to fixing attributes. However, since
  `NULLIF` and `IF` deduce their return type from a single argument,
  they optimize away the `aggregate_for_result()` step.

  This caused `Item_hybrid_func_fix_attributes()` to execute while
  `m_type_handler` was still in its uninitialized default state,
  triggering a debug assertion failure in the JSON handler.

Fix:
  Explicitly set the type handler from the source argument before
  calling `Item_hybrid_func_fix_attributes()`.
Alexey Botchkov
MDEV-39210 ExtractValue/UpdateXML crash.

test and a comment fixed.
Yuchen Pei
MDEV-39361 Assign Name resolution context in subst_vcol_if_compatible to the new vcol Item_field

The pushdown from HAVING into WHERE optimization cleans up and refixes
every condition to be pushed.

The virtual column (vcol) index substitution optimization replaces
vcol expressions in GROUP BY (and WHERE and ORDER BY) with vcol
fields.

The refixing requires the correct name resolution context to find the
vcol fields.

The commit 0316c6e4f21dee02f5adfbe5c62471ee75ca20bb assigns context
from the select_lex that the GROUP BY belongs to, but that may not
work when there are derived table subqueries.

In this commit we assign the correct context by adding a context field
to vcol_info, and assigning value to it in a Item_field constructor as
well as during substitution, and using this context for the newly
constructed vcol Item_field in the substitution.

Alternative considered:

1. Assign the context when constructing vcol_info, in
unpack_vcol_info_from_frm. This does not work because the
current_context() in parsing is not the correct context, not to
mention that unpack_vcol_info_from_frm is not always called from a
SELECT statement.

2. Get the correct context for vcol_info after its construction and
before the substitution. Debugger with watch -a vcol_info shows that
there are no common functions accessing vcol_info before the
substitution.
Sergei Petrunia
MDEV-39368: Refuse to run with --replay-server and --parallel
Sergei Golubchik
MDEV-39413 wsrep unsafe handling of parameters

introduce safe() wrapper for parameters that can later be interpolated
into command line.
Use as

- var="foo$BAR"
+ var="foo$(safe BAR)"

A parameter is safe, if it contains no spaces, single quotes or backticks
ParadoxV5
MDEV-38600: Warn when recreating MEMORY tables on read-only slaves

The data in MEMORY tables is temporary and is lost when the server
restarts. Thus, when these tables are rediscovered empty,
it’s well-intentioned to record TRUNCATE statements to
the binary log, complete with an increment to the `@@gtid_binlog_pos`.
However, those unaware of this mechanism may not expect this increment
and its sign of replication divergence, namely in `@@gtid_strict_mode`.

This commit adds a binary log warning
when such a table is found `implicit_emptied`.

Since general uses of memory tables may already expect this effect,
to avoid unnecessary verbosity, this warning only emits from
`@@read_only` servers with CHANGE MASTER configured. `@@read_only`
indicates that the server should not receive changes; for a slave,
it means it only expects replication to binlog changes with GTID.

Reviewed-by: Brandon Nesterenko <[email protected]>
Marko Mäkelä
fixup! 8f402eb43a0c8b7997b3830016c84e3fc1f8b7ed
Alexey Botchkov
MDEV-38767 XML datatype to be reported as format in extended metadata in protocol.

add respective Send_field metadata for UDT.
ChandanaRamakrishna
MDEV-35462 Remove obsolete compiler version checks from RocksDB CMakeLists.txt

Removed outdated compiler version checks in storage/rocksdb/CMakeLists.txt:
- GCC < 4.8 and < 5.0 checks
- Clang < 3.3 checks
- CMake < 3.0 fallback logic
- Manual -std=c++11 flag handling

Replaced with modern CMAKE_CXX_STANDARD configuration.
Dave Gosselin
MDEV-32290: Server crashes in sub_select_cache

A query inside UNION marked uncacheable could crash during a
subsequent execution on an assertion in sub_select_cache (like when a
derived table is materialized again inside a recursive CTE) or in
join_read_first because the cleanup at the end of one execution freed
state the next execution relies on.

The cleanup decision in JOIN::join_free looked only at an individual
SELECT_LEX's uncacheable flag.  That flag does not propagate down from
the enclosing unit to sibling branches, so a UNION "branch" would be
cleaned up as if it were the only query even when the containing UNION
is certain to run it again.  Change the cleanup check to Consider the
unit's uncacheable flag (and not only the SELECT_LEX's) to keep
preserve state required on subsequent executions.
Rucha Deodhar
MDEV-39179: Incorrect NULL handling in UPDATE ... RETURNING result

Analysis:
OLD_VALUE() swapped only field->ptr, leaving null_ptr pointing to the
current record. This caused incorrect NULL results.

Fix:
Store null_ptr_old for record[1] and swap it together with ptr to
preserve correct NULL semantics.
Raghunandan Bhat
MDEV-36763: Assertion failed in `Type_handler_json_common::json_type_handler_from_generic`

Problem:
  Queries returning JSON from hybrid functions (`NULLIF`, `IF`, `NVL2`)
  crash. This is a regression from MDEV-36716, which added early calls
  to `Item_hybrid_func_fix_attributes()` inside
  - `Item_func_nullif::fix_length_and_dec()` and
  - `Item_func_case_abbreviation2::cache_type_info()`
  to block `ROW` arguments.

  Standard hybrid functions populate their `m_type_handler` by calling
  `aggregate_for_result()` prior to fixing attributes. However, since
  `NULLIF` and `IF` deduce their return type from a single argument,
  they optimize away the `aggregate_for_result()` step.

  This caused `Item_hybrid_func_fix_attributes()` to execute while
  `m_type_handler` was still in its uninitialized default state,
  triggering a debug assertion failure in the JSON handler.

Fix:
  Explicitly set the type handler from the source argument before
  calling `Item_hybrid_func_fix_attributes()`.
Fariha Shaikh
MDEV-38213 Remove leftover CXX11_FLAGS reference in build_rocksdb.cmake

MDEV-38855 removed the C++11 compiler checks from CMakeLists.txt but
left a ${CXX11_FLAGS} reference in the SSE4.2 compile check. Remove
it, as the C++ standard is now inherited from the parent project.

All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the
BSD-new license. I am contributing on behalf of my employer Amazon
Web Services, Inc.
ParadoxV5
MDEV-38600: Warn when recreating MEMORY tables on read-only slaves

The data in MEMORY tables is temporary and is lost when the server
restarts. Thus, when these tables are rediscovered empty,
it’s well-intentioned to record TRUNCATE statements to
the binary log, complete with an increment to the `@@gtid_binlog_pos`.
However, those unaware of this mechanism may not expect this increment
and its sign of replication divergence, namely in `@@gtid_strict_mode`.

This commit adds a binary log warning
when such a table is found `implicit_emptied`.

Since general uses of memory tables may already expect this effect,
to avoid unnecessary verbosity, this warning only emits from
`@@read_only` servers with CHANGE MASTER configured. `@@read_only`
indicates that the server should not receive changes; for a slave,
it means it only expects replication to binlog changes with GTID.

Reviewed-by: Brandon Nesterenko <[email protected]>
Sergei Petrunia
MDEV-37732: TPROC-H, Query 21 is much slower in 11.4 than in 10.11

The problem was in Duplicate_weedout_picker::check_qep(). It computes
updated record_count - the number of record combinations left after the
strategy removes the subquery's duplicates. The logic was incorrect.
Consider EXAMPLE-1:

  select * from t1 where t1.col1 in (select col2 from t2 where corr_cond)

  and the join order of
    t2, full scan rows=1M
    t1, ref access on t1.col1=t2.col2, rows=10

Here, it would compute updated record_count=10, based on #rows in t1's
access method. This number is much smaller than real estimate.

Rewrote the computation logic to use two approaches:

== 1. Use Subquery Fanout ==
Compute "Subquery Fanout" - how many (duplicate) matches the subquery
will generate for a record combination of outer tables. (Like everywhere
else in the code, we assume that any value has a match). For example, for

  ... IN (SELECT o_customer FROM orders WHERE ...)

the Subquery Fanout is average number of orders per one customer.
Then, after Duplicate Elimination is applied, we will have:
  updated_record_count = record_count / subquery_fanout.

Applying this to EXAMPLE-1, one gets:
  if (n_distinct(t2.col2) is known) then
    subquery_fanout= #rows(t2) / n_distinct(t2.col2);
  else
    subquery_fanout= 1.0;
  updated_record_count= 1M * 10 / subquery_fanout;

== 2. Collect fanout of outer tables in the join prefix ==

Done as follows:
  outer_fanout=1.0;
  for each table T in join prefix {
    if (T is not from subquery) {
      // This table's fanout will not be removed
      if (access to T doesn't depend on subquery tables)
        outer_fanout *= T->records_out;
      else
        outer_fanout *= T->table->stat_records() *
                        T->table->cond_selectivity;
    }
  }
  updated_record_count= outer_fanout;

The formula "stat_records()*cond_selectivity" estimates the fanout
that table T would have if it used an "independent" access method.

When we apply this to the join order of EXAMPLE-1:
  t2, full scan rows=1M  -- subquery table, ignore
  t1, ref access on t1.col1=t2.col2, rows=10 -- outer table, but the
access depends on the subquery table, so use
  t1->stat_records() * t1->cond_selectivity.

== Putting it together ==
Both approaches can give poor estimates in different cases, so we pick
the one providing smaller estimate.

The fix is controlled by @@new_mode='FIX_SEMIJOIN_DUPS_WEEDOUT_CHECK'
and is OFF by default in this patch.
jmestwa-coder
Document invariant ensuring passwd stays within packet bounds

Document that the packet buffer is null-terminated by the network layer,
ensuring strend(user) remains within bounds and passwd stays within
the packet.
Alexey Botchkov
MDEV-15479 Empty string is erroneously allowed as a GEOMETRY column value.

Empty string disallowed.
bsrikanth-mariadb
MDEV-39347: Referred databases are not present in the context

Currently, only create/use DDLs for the database that is in the
current thread is stored in the context.
However, we do store CREATE DDL statements of other database tables
in the context, if they are referred by the query.
So, while replaying the context, if the other database is not present
in the system, then we get an error.

== SOLUTION ==
Store CREATE DATABASE DDLs of the databases to the context, if any of those database tables are referred by the original query.
Sergei Petrunia
MDEV-39368: Make mysql-test-run check if replay server is alive

and restart it if needed.
ParadoxV5
MDEV-38600: Warn when recreating MEMORY tables on read-only slaves

The data in MEMORY tables is temporary and is lost when the server
restarts. Thus, when these tables are rediscovered empty,
it’s well-intentioned to record TRUNCATE statements to
the binary log, complete with an increment to the `@@gtid_binlog_pos`.
However, those unaware of this mechanism may not expect this increment
and its sign of replication divergence, namely in `@@gtid_strict_mode`.

This commit adds a binary log warning
when such a table is found `implicit_emptied`.

Since general uses of memory tables may already expect this effect,
to avoid unnecessary verbosity, this warning only emits from
`@@read_only` servers with CHANGE MASTER configured. `@@read_only`
indicates that the server should not receive changes; for a slave,
it means it only expects replication to binlog changes with GTID.

Reviewed-by: Brandon Nesterenko <[email protected]>
Sergei Golubchik
MDEV-39408 mbstream insufficient path validation

reject paths that could not have been written by mariadb-backup
bsrikanth-mariadb
MDEV-39414: cleanup optimizer context tests and docs

1. included file_stat_records in the schema, and dbug_print_read_stats()
2. Removed "optimizer_trace=ON" from the tests, as it has no impact on the
tests.
3. Added a test to check the presence of file_stat_records, and produce an error if not present.
Aleksey Midenkov
MDEV-36362 MariaDB crashes when parsing fuzzer generated PARTITION

Function calls in INTERVAL expression of DDL have little
sense. SETVAL() fails because sequences require opened tables and
vers_set_interval() is called at earlier stage.

The fix throws ER_SUBQUERIES_NOT_SUPPORTED for sequence functions
SETVAL(), NEXTVAL(), LASTVAL() when the context does not allow
subselect (determined by clause_that_disallows_subselect).
Sergei Petrunia
MDEV-37732: TPROC-H, Query 21 is much slower in 11.4 than in 10.11

The problem was in Duplicate_weedout_picker::check_qep(). It computes
"outer fanout" - number of record combinations left after the strategy
removes the subquery's duplicates. The logic was incorrect. For example:

  select * from t1 where t1.col1 in (select col2 from t2 where corr_cond)

  and the join order of
    t2, full scan rows=1M
    t1, ref access on t1.col1=t2.col2, rows=10

(call this EXAMPLE-1) it would conclude that the number of record
combinations after Duplicate Weedout (call this "outer_fanout") is 10,
based on t1.access_method_rows=10.

Rewrote the computation logic to use two approaches:

1. Pre-compute subquery's output cardinality, then check how many
  duplicate rows are expected in its output. This gives "subquery
  fanout" which we can use as expected number of duplicates.
  For example, for
    ... IN (SELECT o_customer FROM orders WHERE ...)
  the subquery fanout is average number of orders per one customer.
  In EXAMPLE-1, outer_fanout= (1M * 10) / subquery_fanout,
    subquery_fanout=#rows(t2) / n_distinct(t2.col2)
  When n_distinct is not known, subquery_fanout=1.

2. Given a join prefix of inner and outer tables, compute outer tables'
  fanout by ignoring all inner tables.
  If access to an outer table depends on an inner table, use outer
  table's "found records".
  For example, for
    select * from small_table WHERE col IN (SELECT * FROM big_table)
  and a join order of
    big_table, small_table
  we will use the number of matching records in the small_table
  (small_table->stat_records() * small_table->cond_selectivity as an
  estimate of how many matches there can be.
  In EXAMPLE-1: outer_fanout = #records(t1).

Both approaches can give poor estimates in different cases, so we pick
the best one.

The fix is controlled by @@new_mode='FIX_SEMIJOIN_DUPS_WEEDOUT_CHECK'
and is OFF by default in this patch.