Skip to content

MDEV-35747: Wrong result from prepared TVC with parameter markers#5072

Open
DaveGosselin-MariaDB wants to merge 1 commit into
10.11from
10.11-MDEV-35747-with-as-ps
Open

MDEV-35747: Wrong result from prepared TVC with parameter markers#5072
DaveGosselin-MariaDB wants to merge 1 commit into
10.11from
10.11-MDEV-35747-with-as-ps

Conversation

@DaveGosselin-MariaDB
Copy link
Copy Markdown
Member

@DaveGosselin-MariaDB DaveGosselin-MariaDB commented May 13, 2026

The setup of column type information in table_value_constr::prepare() was wrapped in an "if (!holders)" guard so that it runs only once per prepared statement. However, the guard was too wide because it bound the allocation of item holders (which should happen only once) to the collection of type information (which should happen on each execution).

This leaves the TVC stuck with whatever placeholder type the parameter had at PREPARE time which likely won't match the type of the next substitution (because a type holder has no actual type at PREPARE time). Its type only becomes known when a value is bound at EXECUTE time. So both the TVC types and the corresponding Item_type_holder instance in the SELECT item list must be computed again on every EXECUTE.

This patch does just that, and separates the work done once per prepared statement from the work done on every execution as implied above.

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request fixes MDEV-35747, which caused prepared statements with Table Value Constructors (TVC) in CTEs to return incorrect results. The implementation reuses Type_holder buffers across executions and refreshes type metadata on each call. Review feedback identifies a critical bug where type_holders is assigned before full initialization, potentially leading to crashes on OOM. Additionally, the review suggests checking for other 'sticky' attributes that might cause metadata corruption and points out a redundant call to set_maybe_null.

Comment thread sql/sql_tvc.cc Outdated
Comment thread sql/sql_class.h
Comment thread sql/sql_tvc.cc
The setup of column type information in table_value_constr::prepare()
was wrapped in an "if (!holders)" guard so that it runs only once per
prepared statement.  However, the guard was too wide because it bound
the allocation of item holders (which should happen only once) to the
collection of type information (which should happen on each
execution).

This leaves the TVC stuck with whatever placeholder type the parameter
had at PREPARE time which may not match the type of the next
substitution.  A type holder has no actual type at PREPARE time.  Its
type only becomes known when a value is bound at EXECUTE time.  So
both the TVC types and the corresponding Item_type_holder instance in
the SELECT item list must be computed again on every EXECUTE.

This patch separates the work done once per prepared statement from
the work done on every execution as implied above.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

1 participant