BUG#24595581: NULL POINTER DEREFERENCE WHILE USING LONGTEXT

              FUNCTION IN SUBQUERY

ANALYSIS:
=========
Server runs into null pointer dereferencing when a
deterministic function returning longtext is used in a
subquery.

Item::const_item() is 'true' for all items having no table
reference bits set. So it is 'true' for subqueries and
deterministic functions that do not reference any tables.
However, we cannot always consider items to be constant
based on the referenced table bits. In this scenario, a
deterministic function is considered a const item. Hence the
resolver tries to evaluate the function in the preparation
phase. At this phase, the query tables are open but not
locked. After the evaluation, all the tables in the outer
query block are closed. Later during the execution phase,
when we try to lock the query tables, the TABLE object will
be unused, thus leading to a null pointer dereference.

FIX:
====
We are overriding the function 'fix_after_pullout' in the
'Item_func_sp' class where we are not considering
deterministic functions as const items based on their table
reference, thus preventing the resolver from evaluating
the function in the preparation phase.

Author: karthik-kamath

mysql-test/suite/opt_trace/r/general_no_prot_all.result

@@ -8233,15 +8233,15 @@ select * from t6 where d in (select f1() from t2 where s="c")	{
               "steps": [
                 {
                   "transformation": "equality_propagation",
-                  "resulting_condition": "(1 and multiple equal('c', `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "(1 and (`t6`.`d` = `f1`()) and multiple equal('c', `t2`.`s`))"
                 },
                 {
                   "transformation": "constant_propagation",
-                  "resulting_condition": "(1 and multiple equal('c', `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "(1 and (`t6`.`d` = `f1`()) and multiple equal('c', `t2`.`s`))"
                 },
                 {
                   "transformation": "trivial_condition_removal",
-                  "resulting_condition": "(multiple equal('c', `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "((`t6`.`d` = `f1`()) and multiple equal('c', `t2`.`s`))"
                 }
               ] /* steps */
             } /* condition_processing */
@@ -8305,13 +8305,13 @@ select * from t6 where d in (select f1() from t2 where s="c")	{
                     {
                       "rows_to_scan": 4,
                       "access_type": "scan",
-                      "resulting_rows": 1,
+                      "resulting_rows": 4,
                       "cost": 2.8068,
                       "chosen": true
                     }
                   ] /* considered_access_paths */
                 } /* best_access_path */,
-                "condition_filtering_pct": 100,
+                "condition_filtering_pct": 25,
                 "rows_for_plan": 1,
                 "cost_for_plan": 2.8068,
                 "semijoin_strategy_choice": [
@@ -8426,7 +8426,7 @@ select * from t6 where d in (select f1() from t2 where s="c")	{
           },
           {
             "attaching_conditions_to_tables": {
-              "original_condition": "((`t6`.`d` = `f1`()) and (`t2`.`s` = 'c'))",
+              "original_condition": "((`t2`.`s` = 'c') and (`t6`.`d` = `f1`()))",
               "attached_conditions_computation": [
               ] /* attached_conditions_computation */,
               "attached_conditions_summary": [
@@ -8436,7 +8436,7 @@ select * from t6 where d in (select f1() from t2 where s="c")	{
                 },
                 {
                   "table": "`t2`",
-                  "attached": "((`t6`.`d` = `f1`()) and (`t2`.`s` = 'c'))"
+                  "attached": "((`t2`.`s` = 'c') and (`t6`.`d` = `f1`()))"
                 }
               ] /* attached_conditions_summary */
             } /* attaching_conditions_to_tables */
@@ -9167,15 +9167,15 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
               "steps": [
                 {
                   "transformation": "equality_propagation",
-                  "resulting_condition": "(1 and multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "(1 and (`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 },
                 {
                   "transformation": "constant_propagation",
-                  "resulting_condition": "(1 and multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "(1 and (`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 },
                 {
                   "transformation": "trivial_condition_removal",
-                  "resulting_condition": "(multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "((`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 }
               ] /* steps */
             } /* condition_processing */
@@ -9239,13 +9239,13 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
                     {
                       "rows_to_scan": 4,
                       "access_type": "scan",
-                      "resulting_rows": 1,
+                      "resulting_rows": 4,
                       "cost": 2.8068,
                       "chosen": true
                     }
                   ] /* considered_access_paths */
                 } /* best_access_path */,
-                "condition_filtering_pct": 100,
+                "condition_filtering_pct": 25,
                 "rows_for_plan": 1,
                 "cost_for_plan": 2.8068,
                 "semijoin_strategy_choice": [
@@ -9360,7 +9360,7 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
           },
           {
             "attaching_conditions_to_tables": {
-              "original_condition": "((`t6`.`d` = `f1`()) and (`t2`.`s` = arg@0))",
+              "original_condition": "((`t2`.`s` = arg@0) and (`t6`.`d` = `f1`()))",
               "attached_conditions_computation": [
               ] /* attached_conditions_computation */,
               "attached_conditions_summary": [
@@ -9370,7 +9370,7 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
                 },
                 {
                   "table": "`t2`",
-                  "attached": "((`t6`.`d` = `f1`()) and (`t2`.`s` = arg@0))"
+                  "attached": "((`t2`.`s` = arg@0) and (`t6`.`d` = `f1`()))"
                 }
               ] /* attached_conditions_summary */
             } /* attaching_conditions_to_tables */
@@ -11083,15 +11083,15 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
               "steps": [
                 {
                   "transformation": "equality_propagation",
-                  "resulting_condition": "(1 and multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "(1 and (`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 },
                 {
                   "transformation": "constant_propagation",
-                  "resulting_condition": "(1 and multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "(1 and (`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 },
                 {
                   "transformation": "trivial_condition_removal",
-                  "resulting_condition": "(multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "((`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 }
               ] /* steps */
             } /* condition_processing */
@@ -11185,13 +11185,13 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
                     {
                       "rows_to_scan": 4,
                       "access_type": "scan",
-                      "resulting_rows": 1,
+                      "resulting_rows": 4,
                       "cost": 2.8068,
                       "chosen": true
                     }
                   ] /* considered_access_paths */
                 } /* best_access_path */,
-                "condition_filtering_pct": 100,
+                "condition_filtering_pct": 25,
                 "rows_for_plan": 1,
                 "cost_for_plan": 2.8068,
                 "semijoin_strategy_choice": [
@@ -11317,7 +11317,7 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
           },
           {
             "attaching_conditions_to_tables": {
-              "original_condition": "((`t6`.`d` = `f1`()) and (`t2`.`s` = arg@0))",
+              "original_condition": "((`t2`.`s` = arg@0) and (`t6`.`d` = `f1`()))",
               "attached_conditions_computation": [
               ] /* attached_conditions_computation */,
               "attached_conditions_summary": [
@@ -11327,7 +11327,7 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
                 },
                 {
                   "table": "`t2`",
-                  "attached": "((`t6`.`d` = `f1`()) and (`t2`.`s` = arg@0))"
+                  "attached": "((`t2`.`s` = arg@0) and (`t6`.`d` = `f1`()))"
                 }
               ] /* attached_conditions_summary */
             } /* attaching_conditions_to_tables */

mysql-test/suite/opt_trace/r/general_ps_prot_all.result

@@ -9025,15 +9025,15 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
               "steps": [
                 {
                   "transformation": "equality_propagation",
-                  "resulting_condition": "(1 and multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "(1 and (`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 },
                 {
                   "transformation": "constant_propagation",
-                  "resulting_condition": "(1 and multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "(1 and (`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 },
                 {
                   "transformation": "trivial_condition_removal",
-                  "resulting_condition": "(multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "((`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 }
               ] /* steps */
             } /* condition_processing */
@@ -9097,13 +9097,13 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
                     {
                       "rows_to_scan": 4,
                       "access_type": "scan",
-                      "resulting_rows": 1,
+                      "resulting_rows": 4,
                       "cost": 2.8068,
                       "chosen": true
                     }
                   ] /* considered_access_paths */
                 } /* best_access_path */,
-                "condition_filtering_pct": 100,
+                "condition_filtering_pct": 25,
                 "rows_for_plan": 1,
                 "cost_for_plan": 2.8068,
                 "semijoin_strategy_choice": [
@@ -9218,7 +9218,7 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
           },
           {
             "attaching_conditions_to_tables": {
-              "original_condition": "((`t6`.`d` = `f1`()) and (`t2`.`s` = arg@0))",
+              "original_condition": "((`t2`.`s` = arg@0) and (`t6`.`d` = `f1`()))",
               "attached_conditions_computation": [
               ] /* attached_conditions_computation */,
               "attached_conditions_summary": [
@@ -9228,7 +9228,7 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
                 },
                 {
                   "table": "`t2`",
-                  "attached": "((`t6`.`d` = `f1`()) and (`t2`.`s` = arg@0))"
+                  "attached": "((`t2`.`s` = arg@0) and (`t6`.`d` = `f1`()))"
                 }
               ] /* attached_conditions_summary */
             } /* attaching_conditions_to_tables */
@@ -10955,15 +10955,15 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
               "steps": [
                 {
                   "transformation": "equality_propagation",
-                  "resulting_condition": "(1 and multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "(1 and (`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 },
                 {
                   "transformation": "constant_propagation",
-                  "resulting_condition": "(1 and multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "(1 and (`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 },
                 {
                   "transformation": "trivial_condition_removal",
-                  "resulting_condition": "(multiple equal(arg@0, `t2`.`s`) and multiple equal(`f1`(), `t6`.`d`))"
+                  "resulting_condition": "((`t6`.`d` = `f1`()) and multiple equal(arg@0, `t2`.`s`))"
                 }
               ] /* steps */
             } /* condition_processing */
@@ -11057,13 +11057,13 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
                     {
                       "rows_to_scan": 4,
                       "access_type": "scan",
-                      "resulting_rows": 1,
+                      "resulting_rows": 4,
                       "cost": 2.8068,
                       "chosen": true
                     }
                   ] /* considered_access_paths */
                 } /* best_access_path */,
-                "condition_filtering_pct": 100,
+                "condition_filtering_pct": 25,
                 "rows_for_plan": 1,
                 "cost_for_plan": 2.8068,
                 "semijoin_strategy_choice": [
@@ -11189,7 +11189,7 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
           },
           {
             "attaching_conditions_to_tables": {
-              "original_condition": "((`t6`.`d` = `f1`()) and (`t2`.`s` = arg@0))",
+              "original_condition": "((`t2`.`s` = arg@0) and (`t6`.`d` = `f1`()))",
               "attached_conditions_computation": [
               ] /* attached_conditions_computation */,
               "attached_conditions_summary": [
@@ -11199,7 +11199,7 @@ select d into res from t6 where d in (select f1() from t2 where s=arg)	{
                 },
                 {
                   "table": "`t2`",
-                  "attached": "((`t6`.`d` = `f1`()) and (`t2`.`s` = arg@0))"
+                  "attached": "((`t2`.`s` = arg@0) and (`t6`.`d` = `f1`()))"
                 }
               ] /* attached_conditions_summary */
             } /* attaching_conditions_to_tables */

sql/item_func.cc

@@ -480,6 +480,24 @@ void Item_func::update_used_tables()
 }
 
 
+void Item_func_sp::fix_after_pullout(SELECT_LEX *parent_select,
+                                     SELECT_LEX *removed_select)
+{
+  Item_func::fix_after_pullout(parent_select, removed_select);
+
+  /*
+    Prevents function from being evaluated before it is locked.
+    @todo - make this dependent on READS SQL or MODIFIES SQL.
+            Due to a limitation in how functions are evaluated, we need to
+            ensure that we are in a prelocked mode even though the function
+            doesn't reference any tables.
+  */
+  used_tables_cache|= PARAM_TABLE_BIT;
+
+  const_item_cache= used_tables_cache == 0;
+}
+
+
 table_map Item_func::used_tables() const
 {
   return used_tables_cache;

sql/item_func.h

@@ -1,7 +1,7 @@
 #ifndef ITEM_FUNC_INCLUDED
 #define ITEM_FUNC_INCLUDED
 
-/* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -193,8 +193,8 @@ class Item_func :public Item_result_field
 
   bool fix_fields(THD *, Item **ref);
   bool fix_func_arg(THD *, Item **arg);
-  void fix_after_pullout(st_select_lex *parent_select,
-                         st_select_lex *removed_select);
+  virtual void fix_after_pullout(st_select_lex *parent_select,
+                                 st_select_lex *removed_select);
   table_map used_tables() const;
   /**
      Returns the pseudo tables depended upon in order to evaluate this
@@ -2718,6 +2718,9 @@ class Item_func_sp :public Item_func
   table_map get_initial_pseudo_tables() const;
   void update_used_tables();
 
+  virtual void fix_after_pullout(st_select_lex *parent_select,
+                                 st_select_lex *removed_select);
+
   void cleanup();
 
   const char *func_name() const;