MDEV-40414 Server crash in Charset::charset upon JSON operations

[grooverdan]

JSON_EQUALS didn't check that ::val_str() of its arguments where not-null before attempting to test their equality.

JSON_OVERLAPS also ensure that ::val_json() isn't null.

[gemini-code-assist]

Code Review

This pull request addresses a server crash (MDEV-40414) during JSON operations by adding null checks in Item_func_json_equals::val_bool() and Item_func_json_overlaps::val_bool(), along with corresponding test cases. The reviewer suggests refactoring these null checks to utilize args[i]->null_value instead of explicitly checking for nullptr on the returned pointer, which aligns with the project's idiomatic practices and simplifies the code.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

According to the project's general rules, when calling val_str() (or val_json()) on an Item, if the returned pointer is NULL, args[i]->null_value is guaranteed to be true. Therefore, we can directly check args[i]->null_value instead of performing an explicit null check on the returned pointer, making the code cleaner and more idiomatic.

  String *a= args[0]->val_json(&a_tmp);
  if ((null_value= args[0]->null_value))
    return 1;
  String *b= args[1]->val_json(&b_tmp);
  if ((null_value= args[1]->null_value))
    return 1;

References

1. When calling val_str() on an Item, if the returned pointer is NULL, args[i]->null_value is guaranteed to be true. Therefore, checking args[i]->null_value first in a logical OR expression safely guards against dereferencing the returned pointer, making an explicit null check on the pointer redundant.

[gemini-code-assist]

According to the project's general rules, checking args[i]->null_value first in a logical OR (||) expression safely guards against dereferencing the returned pointer, making an explicit null check on the pointer redundant in the common case. We should check args[0]->null_value first to optimize the common path and adhere to the general rules.

  if ((null_value= args[0]->null_value || (js == nullptr)))
    return 0;

References

1. When calling val_str() on an Item, if the returned pointer is NULL, args[i]->null_value is guaranteed to be true. Therefore, checking args[i]->null_value first in a logical OR expression safely guards against dereferencing the returned pointer, making an explicit null check on the pointer redundant.