Merge 10.2 into 10.3

mysql-test/main/subselect4.result

@@ -2534,3 +2534,35 @@ x
 c1
 1
 drop table t1;
+#
+# MDEV-22498: SIGSEGV in Bitmap<64u>::merge on SELECT
+#
+set @save_sql_select_limit= @@sql_select_limit;
+SET sql_select_limit=0;
+CREATE TABLE t1(b INT, c INT);
+CREATE TABLE t2(a INT, b INT);
+INSERT INTO t1 VALUES (1,1),(2,2),(3,3);
+INSERT INTO t2 VALUES (1,1),(2,2),(3,3);
+EXPLAIN EXTENDED SELECT sum(a), t2.a, t2.b FROM t2 HAVING t2.a IN (SELECT t2.b FROM t1);
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
+1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Zero limit
+2	DEPENDENT SUBQUERY	t1	ALL	NULL	NULL	NULL	NULL	3	100.00	
+Warnings:
+Note	1276	Field or reference 'test.t2.b' of SELECT #2 was resolved in SELECT #1
+Note	1276	Field or reference 'test.t2.b' of SELECT #2 was resolved in SELECT #1
+Note	1003	/* select#1 */ select sum(`test`.`t2`.`a`) AS `sum(a)`,`test`.`t2`.`a` AS `a`,`test`.`t2`.`b` AS `b` from `test`.`t2` having <in_optimizer>(`test`.`t2`.`a`,<exists>(/* select#2 */ select `test`.`t2`.`b` from `test`.`t1` where <cache>(`test`.`t2`.`a`) = `test`.`t2`.`b`))
+SELECT sum(a), t2.a, t2.b FROM t2 HAVING t2.a IN (SELECT t2.b FROM t1);
+sum(a)	a	b
+SET @@sql_select_limit= @save_sql_select_limit;
+EXPLAIN EXTENDED SELECT sum(a), t2.a, t2.b FROM t2 HAVING t2.a IN (SELECT t2.b FROM t1);
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
+1	PRIMARY	t2	ALL	NULL	NULL	NULL	NULL	3	100.00	
+2	DEPENDENT SUBQUERY	t1	ALL	NULL	NULL	NULL	NULL	3	100.00	
+Warnings:
+Note	1276	Field or reference 'test.t2.b' of SELECT #2 was resolved in SELECT #1
+Note	1276	Field or reference 'test.t2.b' of SELECT #2 was resolved in SELECT #1
+Note	1003	/* select#1 */ select sum(`test`.`t2`.`a`) AS `sum(a)`,`test`.`t2`.`a` AS `a`,`test`.`t2`.`b` AS `b` from `test`.`t2` having <expr_cache><`test`.`t2`.`a`,`test`.`t2`.`b`>(<in_optimizer>(`test`.`t2`.`a`,<exists>(/* select#2 */ select `test`.`t2`.`b` from `test`.`t1` where <cache>(`test`.`t2`.`a`) = `test`.`t2`.`b`)))
+SELECT sum(a), t2.a, t2.b FROM t2 HAVING t2.a IN (SELECT t2.b FROM t1);
+sum(a)	a	b
+6	1	1
+DROP TABLE t1,t2;

mysql-test/main/subselect4.test

@@ -2077,3 +2077,27 @@ insert into t1 values(2,1),(1,2);
 select (select c1 from t1 group by c1,c2 order by c1 limit 1) as x;
 (select c1 from t1 group by c1,c2 order by c1 limit 1);
 drop table t1;
+
+--echo #
+--echo # MDEV-22498: SIGSEGV in Bitmap<64u>::merge on SELECT
+--echo #
+
+set @save_sql_select_limit= @@sql_select_limit;
+SET sql_select_limit=0;
+
+CREATE TABLE t1(b INT, c INT);
+CREATE TABLE t2(a INT, b INT);
+INSERT INTO t1 VALUES (1,1),(2,2),(3,3);
+INSERT INTO t2 VALUES (1,1),(2,2),(3,3);
+
+let $query=
+SELECT sum(a), t2.a, t2.b FROM t2 HAVING t2.a IN (SELECT t2.b FROM t1);
+
+eval EXPLAIN EXTENDED $query;
+eval $query;
+
+SET @@sql_select_limit= @save_sql_select_limit;
+
+eval EXPLAIN EXTENDED $query;
+eval $query;
+DROP TABLE t1,t2;

mysql-test/suite/innodb/t/xa_recovery_debug.test

@@ -4,6 +4,10 @@
 # Embedded server does not support restarting
 --source include/not_embedded.inc
 
+--disable_query_log
+FLUSH TABLES;
+--enable_query_log
+
 --echo #
 --echo # Bug#20872655 XA ROLLBACK IS NOT CRASH-SAFE
 --echo #

sql/item_subselect.cc

@@ -2159,10 +2159,13 @@ Item_in_subselect::create_single_in_to_exists_cond(JOIN *join,
   }
   else
   {
+    /*
+      No need to use real_item for the item, as the ref items that are possible
+      in the subquery either belong to views or to the parent select.
+      For such case we need to refer to the reference and not to the original
+      item.
+    */
     Item *item= (Item*) select_lex->item_list.head();
-    if (item->type() != REF_ITEM ||
-        ((Item_ref*)item)->ref_type() != Item_ref::VIEW_REF)
-      item= item->real_item();
 
     if (select_lex->table_list.elements)
     {

storage/innobase/sync/sync0rw.cc

@@ -2,7 +2,7 @@
 
 Copyright (c) 1995, 2016, Oracle and/or its affiliates. All Rights Reserved.
 Copyright (c) 2008, Google Inc.
-Copyright (c) 2017, 2019, MariaDB Corporation.
+Copyright (c) 2017, 2020, MariaDB Corporation.
 
 Portions of this file contain modifications contributed and copyrighted by
 Google, Inc. Those modifications are gratefully acknowledged and are described
@@ -292,10 +292,13 @@ rw_lock_s_lock_spin(
 
 	ut_ad(rw_lock_validate(lock));
 
+	rw_lock_stats.rw_s_spin_wait_count.inc();
+
 lock_loop:
 
 	/* Spin waiting for the writer field to become free */
 	HMT_low();
+	ulint j = i;
 	while (i < srv_n_spin_wait_rounds &&
 	       my_atomic_load32_explicit(&lock->lock_word,
 					 MY_MEMORY_ORDER_RELAXED) <= 0) {
@@ -308,7 +311,7 @@ rw_lock_s_lock_spin(
 		os_thread_yield();
 	}
 
-	++spin_count;
+	spin_count += lint(i - j);
 
 	/* We try once again to obtain the lock */
 	if (rw_lock_s_lock_low(lock, pass, file_name, line)) {
@@ -428,7 +431,7 @@ rw_lock_x_lock_wait_func(
 		}
 
 		/* If there is still a reader, then go to sleep.*/
-		++n_spins;
+		n_spins += i;
 
 		sync_cell_t*	cell;
 
@@ -662,6 +665,12 @@ rw_lock_x_lock_func(
 	ut_ad(rw_lock_validate(lock));
 	ut_ad(!rw_lock_own(lock, RW_LOCK_S));
 
+	if (rw_lock_x_lock_low(lock, pass, file_name, line)) {
+		/* Locking succeeded */
+		return;
+	}
+	rw_lock_stats.rw_x_spin_wait_count.inc();
+
 lock_loop:
 
 	if (rw_lock_x_lock_low(lock, pass, file_name, line)) {
@@ -681,6 +690,7 @@ rw_lock_x_lock_func(
 
 		/* Spin waiting for the lock_word to become free */
 		HMT_low();
+		ulint j = i;
 		while (i < srv_n_spin_wait_rounds
 		       && my_atomic_load32_explicit(&lock->lock_word, MY_MEMORY_ORDER_RELAXED) <= X_LOCK_HALF_DECR) {
 			ut_delay(srv_spin_wait_delay);
@@ -688,7 +698,7 @@ rw_lock_x_lock_func(
 		}
 
 		HMT_medium();
-		spin_count += lint(i);
+		spin_count += lint(i - j);
 
 		if (i >= srv_n_spin_wait_rounds) {
 
@@ -756,11 +766,17 @@ rw_lock_sx_lock_func(
 	sync_array_t*	sync_arr;
 	lint		spin_count = 0;
 	int64_t		count_os_wait = 0;
-	lint		spin_wait_count = 0;
 
 	ut_ad(rw_lock_validate(lock));
 	ut_ad(!rw_lock_own(lock, RW_LOCK_S));
 
+	if (rw_lock_sx_lock_low(lock, pass, file_name, line)) {
+		/* Locking succeeded */
+		return;
+	}
+
+	rw_lock_stats.rw_sx_spin_wait_count.inc();
+
 lock_loop:
 
 	if (rw_lock_sx_lock_low(lock, pass, file_name, line)) {
@@ -772,23 +788,21 @@ rw_lock_sx_lock_func(
 		}
 
 		rw_lock_stats.rw_sx_spin_round_count.add(spin_count);
-		rw_lock_stats.rw_sx_spin_wait_count.add(spin_wait_count);
 
 		/* Locking succeeded */
 		return;
 
 	} else {
 
-		++spin_wait_count;
-
 		/* Spin waiting for the lock_word to become free */
+		ulint j = i;
 		while (i < srv_n_spin_wait_rounds
 		       && my_atomic_load32_explicit(&lock->lock_word, MY_MEMORY_ORDER_RELAXED) <= X_LOCK_HALF_DECR) {
 			ut_delay(srv_spin_wait_delay);
 			i++;
 		}
 
-		spin_count += lint(i);
+		spin_count += lint(i - j);
 
 		if (i >= srv_n_spin_wait_rounds) {
 
@@ -820,7 +834,6 @@ rw_lock_sx_lock_func(
 		}
 
 		rw_lock_stats.rw_sx_spin_round_count.add(spin_count);
-		rw_lock_stats.rw_sx_spin_wait_count.add(spin_wait_count);
 
 		/* Locking succeeded */
 		return;