Fixed bug #28598.

mysqld crashed when a long-running explain query was killed from
another connection.

When the current thread caught a kill signal executing the function
best_extension_by_limited_search it just silently returned to  
the calling function greedy_search without initializing elements of
the join->best_positions array.
However, the greedy_search function ignored thd->killed status
after a calls to the best_extension_by_limited_search function, and
after several calls the greedy_search function used an uninitialized
data from the join->best_positions[idx] to search position in the
join->best_ref array. 
That search failed, and greedy_search tried to call swap_variables
function with NULL argument - that caused a crash.


sql/sql_select.cc:
  Fixed bug #28598.
  choose_plan(), greedy_search(), best_extension_by_limited_search()
  and find_best() functions have been changed to return TRUE in case
  of fatal error.
mysql-test/t/kill.test:
  Updated test case for bug #28598.
mysql-test/r/kill.result:
  Updated test case for bug #28598.

2 files changed, 55 insertions, 0 deletions

diff --git a/mysql-test/r/kill.result b/mysql-test/r/kill.result
index 4bc04c6de3c..a4966d9d5ec 100644
--- a/mysql-test/r/kill.result
+++ b/mysql-test/r/kill.result
@@ -123,3 +123,5 @@ release_lock("lock27563")
 drop table t1, t2;
 drop function bug27563;
 drop procedure proc27563;
+PREPARE stmt FROM 'EXPLAIN SELECT * FROM t1,t2,t3,t4,t5,t6,t7,t8,t9,t10,t11,t12,t13,t14,t15,t16,t17,t18,t19,t20,t21,t22,t23,t24,t25,t26,t27,t28,t29,t30,t31,t32,t33,t34,t35,t36,t37,t38,t39,t40 WHERE a1=a2 AND a2=a3 AND a3=a4 AND a4=a5 AND a5=a6 AND a6=a7 AND a7=a8 AND a8=a9 AND a9=a10 AND a10=a11 AND a11=a12 AND a12=a13 AND a13=a14 AND a14=a15 AND a15=a16 AND a16=a17 AND a17=a18 AND a18=a19 AND a19=a20 AND a20=a21 AND a21=a22 AND a22=a23 AND a23=a24 AND a24=a25 AND a25=a26 AND a26=a27 AND a27=a28 AND a28=a29 AND a29=a30 AND a30=a31 AND a31=a32 AND a32=a33 AND a33=a34 AND a34=a35 AND a35=a36 AND a36=a37 AND a37=a38 AND a38=a39 AND a39=a40  ';
+EXECUTE stmt;
diff --git a/mysql-test/t/kill.test b/mysql-test/t/kill.test
index 83194e214fb..5f6bae00254 100644
--- a/mysql-test/t/kill.test
+++ b/mysql-test/t/kill.test
@@ -249,3 +249,56 @@ select release_lock("lock27563");
 drop table t1, t2;
 drop function bug27563;
 drop procedure proc27563;
+
+#
+# Bug#28598: mysqld crash when killing a long-running explain query.
+#
+--disable_query_log
+connection con1;
+let $ID= `select connection_id()`;
+let $tab_count= 40;
+
+let $i= $tab_count;
+while ($i)
+{
+  eval CREATE TABLE t$i (a$i int, KEY(a$i));
+  eval INSERT INTO t$i VALUES (1),(2),(3),(4),(5),(6),(7);
+  dec $i ;
+}
+set session optimizer_search_depth=0;
+
+let $i=$tab_count;
+while ($i)
+{
+ let $a= a$i;
+ let $t= t$i;
+ dec $i;
+ if ($i)
+ {
+   let $comma=,;
+   let $from=$comma$t$from;
+   let $where=a$i=$a $and $where;
+ }
+ if (!$i) 
+ {
+   let $from=FROM $t$from;
+   let $where=WHERE $where;
+ }
+ let $and=AND;
+}
+
+--enable_query_log
+eval PREPARE stmt FROM 'EXPLAIN SELECT * $from $where';
+send EXECUTE stmt;
+--disable_query_log
+
+connection con2;
+real_sleep 2;
+eval kill query $ID;
+let $i= $tab_count;
+while ($i)
+{
+  eval DROP TABLE t$i;
+  dec $i ;
+}
+--enable_query_log