database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-08 11:22:35 +03:00
Code Activity

Bug#48157: crash in Item_field::used_tables

Browse Source 
MySQL handles the join syntax "JOIN ... USING( field1,
... )" and natural joins by building the same parse tree as
a corresponding join with an "ON t1.field1 = t2.field1 ..."
expression would produce. This parse tree was not cleaned up
properly in the following scenario. If a thread tries to
lock some tables and finds that the tables were dropped and
re-created while waiting for the lock, it cleans up column
references in the statement by means a per-statement free
list. But if the statement was part of a stored procedure,
column references on the stored procedure's free list weren't
cleaned up and thus contained pointers to freed objects.

Fixed by adding a call to clean up the current prepared
statement's free list.


mysql-test/r/sp_sync.result:
  Bug#48157: Test case
mysql-test/t/sp_sync.test:
  Bug#48157: Test result
sql/item.h:
  Bug#48157: Commented field.
sql/sql_parse.cc:
  Bug#48157: Commented function.
sql/sql_update.cc:
  Bug#48157: fix
This commit is contained in:
Martin Hansson
2010-01-12 15:16:26 +01:00
parent 3c9322e73f
commit c8b5804f29
5 changed files with 94 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
mysql-test/r/sp_sync.result Normal file
View File

@@ -0,0 +1,23 @@
Tests of syncronization of stored procedure execution.
#
# Bug#48157: crash in Item_field::used_tables
#
CREATE TABLE t1 AS SELECT 1 AS a, 1 AS b;
CREATE TABLE t2 AS SELECT 1 AS a, 1 AS b;
CREATE PROCEDURE p1()
BEGIN
UPDATE t1 JOIN t2 USING( a, b ) SET t1.b = 1, t2.b = 1;
END|
LOCK TABLES t1 WRITE, t2 WRITE;
SET DEBUG_SYNC = 'multi_update_reopen_tables SIGNAL parked WAIT_FOR go';
CALL p1();
DROP TABLE t1, t2;
SET DEBUG_SYNC = 'now WAIT_FOR parked';
CREATE TABLE t1 AS SELECT 1 AS a, 1 AS b;
CREATE TABLE t2 AS SELECT 1 AS a, 1 AS b;
SET DEBUG_SYNC = 'now SIGNAL go';
# Without the DEBUG_SYNC supplied in the same patch as this test in the
# code, this test statement will hang.
DROP TABLE t1, t2;
DROP PROCEDURE p1;
SET DEBUG_SYNC = 'RESET';