Skip to content

MDEV-38295, MDEV-38272 Sig11 in LEX::resolve_references_to_cte at sql/sql_cte.cc, mem leak - #4486

Merged
mariadb-RexJohnston merged 2 commits into
mainfrom
bb-12.2-MDEV-38295
Feb 1, 2026
Merged

MDEV-38295, MDEV-38272 Sig11 in LEX::resolve_references_to_cte at sql/sql_cte.cc, mem leak#4486
mariadb-RexJohnston merged 2 commits into
mainfrom
bb-12.2-MDEV-38295

Conversation

@mariadb-RexJohnston

Copy link
Copy Markdown
Member
  • The Jira issue number for this PR is: MDEV-38295, MDEV-38272

Description

Bugs fixes related to testing MDEV-37220 Allow UPDATE/DELETE to read from a CTE

Release Notes

N/A

How can this PR be tested?

mtr main.cte_update_delete

If the changes are not amenable to automated testing, please explain why not and carefully describe how to test manually.

Basing the PR against the correct MariaDB version

  • This is a new feature or a refactoring, and the PR is based against the main branch.
  • This is a bug fix, and the PR is based against the earliest maintained branch in which the bug can be reproduced.

PR quality check

  • I checked the CODING_STANDARDS.md file and my PR conforms to this where appropriate.
  • For any trivial modifications to the PR, I am ok with the reviewer making the changes themselves.

@mariadb-RexJohnston

Copy link
Copy Markdown
Member Author

Hi @sanja-byelkin you've already reviewed the previous commit in this tree. I've squashed the 2 bugfixes together, maybe i should squash the already reviewed fix too?

@spetrunia
spetrunia force-pushed the bb-12.2-MDEV-38295 branch 2 times, most recently from 5fd31b1 to 1ef4d6b Compare January 30, 2026 16:09
@mariadb-RexJohnston

mariadb-RexJohnston commented Jan 30, 2026

Copy link
Copy Markdown
Member Author

We still have a memory leak executing
prepare s from 'with recursive cte as (select a from t1 union select a from cte where a < 2)
delete from cte where a = (select a from cte)';

st_select_lex::cleanup() is not called for select #2, so the underlying join structure isn't freed up.

We are missing a call in Sql_cmd_dml::prepare()

free_underlaid_joins(thd, unit->first_select());

before cleanup is called on the unit.

@mariadb-RexJohnston

mariadb-RexJohnston commented Feb 1, 2026

Copy link
Copy Markdown
Member Author

…ause

CTE's are read only i.e It cannot have their columns updated in updates
set clause. Attempting to do so , should throw error
ERROR 1288 (HY000): The target table cte of the UPDATE is not updatable

with cte as (select * from t1 where c < 5)
  update cte set cte.a =(select a from cte);
Here, conversion from a single table to a multi table update bypasses
the normal check by setting the TABLE_LIST object representing cte
to be merge derived.  This is incorrect, so we prohibit this conversion
in TABLE_LIST::init_derived.

Approved by: Sanja Byelkin (sanja@mariadb.com)
Lex::save_list contents remain from a previous query that has invalid
syntax and isn't reset when processing a new query.
We initialize this structure along with it's peer in LEX::start.

MDEV-38295 Recursive CTE usage leaks memory when not used in a top level select

During st_select_lex::cleanup() we assume that leaf tables and any
associated recursive table references can only be present when a join
structure is present.  After MDEV-37220 this is no longer true.
We shift our cleanup routine out of the test for a join.

We add Multidelete_prelocking_strategy::handle_end() in the same manner
as Multiupdate_prelocking_strategy::handle_end() (but with minimal
processing as yet) to populate these leaf_tables in the outermost
select when it is a delete statement.

We add in a call to free_underlaid_joins() to the error processing section
of Sql_cmd_dml::execute to free up temporary tables that were allocated
in prepare, but not freed up when execute is bypassed because an error
occured during prepare.

Sergei Petrunia: Better comments for MDEV-38272, MDEV-38272

Approved by: Sergei Petrunia (sergey@mariadb.com)
@mariadb-RexJohnston
mariadb-RexJohnston merged commit 549628d into main Feb 1, 2026
17 of 19 checks passed
@mariadb-RexJohnston
mariadb-RexJohnston deleted the bb-12.2-MDEV-38295 branch February 1, 2026 19:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

2 participants