MDEV-31180: MyISAMMRG Crash on UPDATE of an updateable VIEW

Attach the children of a MERGE table once per statement, and keep the
value of pos_in_table_list for a MERGE table on subsequent executions
of a prepared statement.

Author: DaveGosselin-MariaDB

mysql-test/suite/merge/merge.result

@@ -4001,6 +4001,43 @@ SET SQL_SAFE_UPDATES=1;
 UPDATE t1 STRAIGHT_JOIN t2 SET a = 89 WHERE 9 IN (SELECT c FROM t3 WHERE c IN (SELECT MAX(d) FROM t4));
 ERROR HY000: You are using safe update mode and you tried to update a table without a WHERE that uses a KEY column
 DROP TABLE t1, t2, t3, t4;
+SET SQL_SAFE_UPDATES=DEFAULT;
 #
 # End of 10.11 tests
 #
+#
+# MDEV-31180: MyISAMMRG Crash on UPDATE of an updateable VIEW
+#
+CREATE TABLE t (f INT) ENGINE=MyISAM;
+INSERT INTO t VALUES (1),(2);
+CREATE TABLE tm (f INT) ENGINE=MERGE UNION (t) INSERT_METHOD=FIRST;
+CREATE VIEW v AS SELECT f FROM tm;
+UPDATE v SET f = 3;
+SELECT * FROM v;
+f
+3
+3
+SELECT * FROM tm;
+f
+3
+3
+DROP VIEW v;
+DROP TABLE tm, t;
+CREATE TABLE t (f INT) ENGINE=MyISAM;
+INSERT INTO t VALUES (1),(2);
+CREATE TABLE tm (f INT) ENGINE=MERGE UNION (t) INSERT_METHOD=FIRST;
+CREATE VIEW v AS SELECT f FROM tm;
+PREPARE s FROM 'UPDATE v SET f = 3';
+EXECUTE s;
+EXECUTE s;
+SELECT * FROM v;
+f
+3
+3
+SELECT * FROM tm;
+f
+3
+3
+DROP VIEW v;
+DROP TABLE tm, t;
+# End of 11.4 tests

mysql-test/suite/merge/merge.test

@@ -2945,7 +2945,38 @@ SET SQL_SAFE_UPDATES=1;
 UPDATE t1 STRAIGHT_JOIN t2 SET a = 89 WHERE 9 IN (SELECT c FROM t3 WHERE c IN (SELECT MAX(d) FROM t4));
 
 DROP TABLE t1, t2, t3, t4;
+SET SQL_SAFE_UPDATES=DEFAULT;
 
 --echo #
 --echo # End of 10.11 tests
 --echo #
+
+--echo #
+--echo # MDEV-31180: MyISAMMRG Crash on UPDATE of an updateable VIEW
+--echo #
+# Simple UPDATE through a VIEW with the MERGE engine.
+CREATE TABLE t (f INT) ENGINE=MyISAM;
+INSERT INTO t VALUES (1),(2);
+CREATE TABLE tm (f INT) ENGINE=MERGE UNION (t) INSERT_METHOD=FIRST;
+CREATE VIEW v AS SELECT f FROM tm;
+UPDATE v SET f = 3;  # crashed here
+SELECT * FROM v;
+SELECT * FROM tm;
+DROP VIEW v;
+DROP TABLE tm, t;
+
+# Prepared statement UPDATE through a VIEW with the MERGE engine, multiple
+# executions.
+CREATE TABLE t (f INT) ENGINE=MyISAM;
+INSERT INTO t VALUES (1),(2);
+CREATE TABLE tm (f INT) ENGINE=MERGE UNION (t) INSERT_METHOD=FIRST;
+CREATE VIEW v AS SELECT f FROM tm;
+PREPARE s FROM 'UPDATE v SET f = 3';
+EXECUTE s;    # no problem
+EXECUTE s;    # Asserted on pos_in_table_list->next_global == children_l, ha_myisammrg.cc:864
+SELECT * FROM v;
+SELECT * FROM tm;
+DROP VIEW v;
+DROP TABLE tm, t;
+
+--echo # End of 11.4 tests

sql/sql_base.cc

@@ -4897,10 +4897,10 @@ bool open_tables(THD *thd, const DDL_options_st &options,
   }
 
   /*
-    After successful open of all tables, including MERGE parents and
-    children, attach the children to their parents. At end of statement,
-    the children are detached. Attaching and detaching are always done,
-    even under LOCK TABLES.
+    After successfully opening the tables, including MERGE parents and
+    children, attach the children to their parents (unless they are already
+    attached).  At the end of statement, the children are detached.  Attaching
+    and detaching are always attempted, even under LOCK TABLES.
 
     We also convert all TL_WRITE_DEFAULT and TL_READ_DEFAULT locks to
     appropriate "real" lock types to be used for locking and to be passed
@@ -4916,7 +4916,8 @@ bool open_tables(THD *thd, const DDL_options_st &options,
     if (!tbl)
       continue;
 
-    if (tbl->file->ha_table_flags() & HA_CAN_MULTISTEP_MERGE)
+    if (tbl->file->ha_table_flags() & HA_CAN_MULTISTEP_MERGE &&
+        !tbl->file->extra(HA_EXTRA_IS_ATTACHED_CHILDREN))
     {
       /* MERGE tables need to access parent and child TABLE_LISTs. */
       if (tbl->file->extra(HA_EXTRA_ATTACH_CHILDREN))
@@ -8545,10 +8546,24 @@ bool setup_tables(THD *thd, Name_resolution_context *context,
       }
       else
       {
-        table_list->table->tablenr= table_list->tablenr_exec;
-        table_list->table->map= table_list->map_exec;
-        table_list->table->maybe_null= table_list->maybe_null_exec;
-        table_list->table->pos_in_table_list= table_list;
+        TABLE *tbl= table_list->table;
+        tbl->tablenr= table_list->tablenr_exec;
+        tbl->map= table_list->map_exec;
+        tbl->maybe_null= table_list->maybe_null_exec;
+        /*
+          If this is a MyISAM MERGE table then don't overwrite
+          pos_in_table_list on subsequent execution of a prepared statement
+          where that statement references a MyISAM MERGE table.  On the first
+          execution, the pos_in_table_list is set to a value from 'leaves'.
+          But on subsequent executions, that value was blindly overwritten from
+          'leaf_tables_exec'.  Most of the time that's safe, but not for the
+          MyISAM MERGE.  The MyISAM MERGE engine relies on this value being
+          stable between executions so that it can find the children spliced in
+          behind the parent (the merged children).
+        */
+        if (!(tbl->file->ha_table_flags() & HA_CAN_MULTISTEP_MERGE) ||
+            !tbl->pos_in_table_list)
+          tbl->pos_in_table_list= table_list;
         if (table_list->process_index_hints(table_list->table))
           DBUG_RETURN(1);
       }