• Igor Babaev's avatar
    MDEV-17177 Crash in Item_func_in::cleanup() for SELECT executed via · 2bde0655
    Igor Babaev authored
               prepared statement
    
    The method Item_func_in::build_clone() that builds a clone item for an
    Item_func_in item first calls a generic method Item_func::build_item()
    that builds the the clones for the arguments of the Item_func_in item
    to be cloned, creates a copy of the Item_func_in object and attaches the
    clones for the arguments to this copy. Then the method Item_func_in::build_clone()
    makes the copy fully independent on the copied object in order to
    guarantee a proper destruction of the clone. The fact is the copy of the
    Item_func_in object is registered as any other item object and should be
    destructed as any other item object.
    If the method Item_func::build_item fails to build a clone of an argument
    then it returns 0. In this case no copy of the Item_func_in object should
    be created. Otherwise the finalizing actions for this copy would not be
    performed and the copy would remain in a state that would prevent its
    proper destruction.
    
    The code of Item_func_in::build_clone() before this patch created the copy
    of the Item_func_in object before cloning the argument items. If this
    cloning failed the server crashed when trying to destruct the copy item.
    
    The code of Item_row::build_clone() was changed similarly to the code of
    Item_func::build_clone though this code could not cause any problems.
    2bde0655
item.cc 296 KB