MDEV-29624 Fix memory leak on pushdown of derived tablebb-10.11-MDEV-29624

Deallocation of TABLE_LIST::dt_handler and TABLE_LIST::pushdown_derived
was performed in multiple places if code. This not only made the code
more difficult to maintain but also lead to memory leaks when
dt_handler and pushdown_derived were allocated but actual pushdown
of the derived table did not take place due to the whole embedding
unit pushdown.
This commit puts deallocation of TABLE_LIST::dt_handler and
TABLE_LIST::pushdown_derived to the single point - JOIN::cleanup().

4 files changed, 13 insertions, 23 deletions

diff --git a/sql/derived_handler.cc b/sql/derived_handler.cc
index f48b95cbf76..2a88629925b 100644
--- a/sql/derived_handler.cc
+++ b/sql/derived_handler.cc
@@ -44,12 +44,6 @@ Pushdown_derived::Pushdown_derived(TABLE_LIST *tbl, derived_handler *h)
 }
 
 
-Pushdown_derived::~Pushdown_derived()
-{
-  delete handler;
-}
-
-
 int Pushdown_derived::execute()
 {
   int err;
diff --git a/sql/sql_derived.cc b/sql/sql_derived.cc
index 35cdfc840e8..e180dae00f1 100644
--- a/sql/sql_derived.cc
+++ b/sql/sql_derived.cc
@@ -1000,11 +1000,7 @@ bool mysql_derived_optimize(THD *thd, LEX *lex, TABLE_LIST *derived)
     /* Create an object for execution of the query specifying the table */
     if (!(derived->pushdown_derived=
             new (thd->mem_root) Pushdown_derived(derived, derived->dt_handler)))
-    {
-      delete derived->dt_handler;
-      derived->dt_handler= NULL;
       DBUG_RETURN(TRUE);
-    }
   }
 
   lex->current_select= first_select;
@@ -1229,7 +1225,6 @@ bool mysql_derived_fill(THD *thd, LEX *lex, TABLE_LIST *derived)
     /* Execute the query that specifies the derived table by a foreign engine */
     res= derived->pushdown_derived->execute();
     unit->executed= true;
-    delete derived->pushdown_derived;
       DBUG_RETURN(res);
   }
 
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 47237d94d87..7013cb2301c 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -69,6 +69,7 @@
 #include "my_json_writer.h"
 #include "opt_trace.h"
 #include "create_tmp_table.h"
+#include "derived_handler.h"
 
 /*
   A key part number that means we're using a fulltext scan.
@@ -14382,6 +14383,7 @@ void JOIN_TAB::cleanup()
     delete filesort->select;
   delete filesort;
   filesort= NULL;
+
   /* Skip non-existing derived tables/views result tables */
   if (table &&
       (table->s->tmp_table != INTERNAL_TMP_TABLE || table->is_created()))
@@ -14882,11 +14884,11 @@ void JOIN::cleanup(bool full)
     delete pushdown_query;
     pushdown_query= 0;
 
-    if (!join_tab)
+    List_iterator<TABLE_LIST> li(*join_list);
+    TABLE_LIST *table_ref;
+    while ((table_ref= li++))
     {
-      List_iterator<TABLE_LIST> li(*join_list);
-      TABLE_LIST *table_ref;
-      while ((table_ref= li++))
+      if (!join_tab)
       {
         if (table_ref->table &&
             table_ref->jtbm_subselect &&
@@ -14896,6 +14898,13 @@ void JOIN::cleanup(bool full)
           table_ref->table= NULL;
         }
       }
+      if (table_ref->pushdown_derived)
+      {
+        delete table_ref->pushdown_derived;
+        table_ref->pushdown_derived= NULL;
+      }
+      delete table_ref->dt_handler;
+      table_ref->dt_handler= NULL;
     }
   }
   /* Restore ref array to original state */
@@ -28516,12 +28525,6 @@ bool mysql_explain_union(THD *thd, SELECT_LEX_UNIT *unit, select_result *result)
                       result, unit, first);
   }
 
-  if (unit->derived && unit->derived->pushdown_derived)
-  {
-    delete unit->derived->pushdown_derived;
-    unit->derived->pushdown_derived= NULL;
-  }
-
   DBUG_RETURN(res || thd->is_error());
 }
 
diff --git a/sql/sql_select.h b/sql/sql_select.h
index 9174d5f7d93..9eb368c6088 100644
--- a/sql/sql_select.h
+++ b/sql/sql_select.h
@@ -2488,8 +2488,6 @@ public:
 
   Pushdown_derived(TABLE_LIST *tbl, derived_handler *h);
 
-  ~Pushdown_derived();
-
   int execute(); 
 };