Bug#14789301: CRASHING SERVER BY STORED FUNCTION

Mattias Jonsson · Mattias Jonsson · commit a610da4ee694 · 2012-10-30T22:53:53.000+08:00
REFERENCING USER DEFINED VARIABLE IN QUERY

There are 2 steps resulting in the crash:
1) the stored procedure was executed during JOIN::prepare resulting
    in setting thd-&gt;user_var_events_alloc to NULL (due to LTM_NONE)
2) the next time the stored procedure was executed in the same statement
    it crashes due to thd-&gt;user_var_events_alloc was null. (it was not
   set to thd-&gt;mem_root since LTM_PRELOCKED).

The fix is to:
* avoid executing the stored program during prepare phase of
Item_func_isnull (update_used_tables).

Also updated a comment which got out of date after bug 14247298.
Also added test case copied from the duplicate bug:
BUG#11765560 - SEGFAULT ON SHOW TABLE STATUS (MYSQLDUMP) OF NESTED
VIEWS
which is a duplicate in 5.6 (other cause in 5.1/5.5), but with another crash.
In 5.1/5.5 this patch cannot be used since it lacks of with_stored_program,
and the problem is caching strategy for is_not_null/isnull and
DETERMINISTIC stored programs.
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
@@ -5160,7 +5160,7 @@ longlong Item_func_isnull::val_int()
     Handle optimization if the argument can't be null
     This has to be here because of the test in update_used_tables().
   */
-  if (!used_tables_cache && !with_subselect)
+  if (!used_tables_cache && !with_subselect && !with_stored_program)
     return cached_value;
   return args[0]->is_null() ? 1: 0;
 }
@@ -5169,7 +5169,7 @@ longlong Item_is_not_null_test::val_int()
 {
   DBUG_ASSERT(fixed == 1);
   DBUG_ENTER("Item_is_not_null_test::val_int");
-  if (!used_tables_cache && !with_subselect)
+  if (!used_tables_cache && !with_subselect && !with_stored_program)
   {
     owner->was_null|= (!cached_value);
     DBUG_PRINT("info", ("cached: %ld", (long) cached_value));
@@ -5201,7 +5201,8 @@ void Item_is_not_null_test::update_used_tables()
   with_subselect= args[0]->has_subquery();
   with_stored_program= args[0]->has_stored_program();
   used_tables_cache|= args[0]->used_tables();
-  if (used_tables_cache == initial_pseudo_tables && !with_subselect)
+  if (used_tables_cache == initial_pseudo_tables && !with_subselect &&
+      !with_stored_program)
     /* Remember if the value is always NULL or never NULL */
     cached_value= !args[0]->is_null();
 }
diff --git a/sql/item_cmpfunc.h b/sql/item_cmpfunc.h
@@ -1492,7 +1492,7 @@ class Item_func_isnull :public Item_bool_func
       with_stored_program= args[0]->has_stored_program();
 
       if ((const_item_cache= !(used_tables_cache= args[0]->used_tables()) &&
-          !with_subselect))
+           !with_subselect && !with_stored_program))
       {
 	/* Remember if the value is always NULL or never NULL */
 	cached_value= (longlong) args[0]->is_null();
diff --git a/sql/opt_range.cc b/sql/opt_range.cc
@@ -6131,6 +6131,8 @@ static SEL_TREE *get_mm_tree(RANGE_OPT_PARAM *param,Item *cond)
   /* 
     Here when simple cond 
     There are limits on what kinds of const items we can evaluate.
+    At this stage a subquery in 'cond' might not be fully transformed yet
+    (example: semijoin) thus cannot be evaluated.
   */
   if (cond->const_item() && !cond->is_expensive() && !cond->has_subquery())
   {

Original file line number	Diff line number	Diff line change
`@@ -1492,7 +1492,7 @@ class Item_func_isnull :public Item_bool_func`
`1492`	`1492`	`with_stored_program= args[0]->has_stored_program();`
`1493`	`1493`
`1494`	`1494`	`if ((const_item_cache= !(used_tables_cache= args[0]->used_tables()) &&`
`1495`		`- !with_subselect))`
	`1495`	`+ !with_subselect && !with_stored_program))`
`1496`	`1496`	`{`
`1497`	`1497`	`/* Remember if the value is always NULL or never NULL */`
`1498`	`1498`	`cached_value= (longlong) args[0]->is_null();`
Original file line number	Diff line number	Diff line change
`@@ -6131,6 +6131,8 @@ static SEL_TREE get_mm_tree(RANGE_OPT_PARAM param,Item *cond)`
`6131`	`6131`	`/*`
`6132`	`6132`	`Here when simple cond`
`6133`	`6133`	`There are limits on what kinds of const items we can evaluate.`
	`6134`	`+ At this stage a subquery in 'cond' might not be fully transformed yet`
	`6135`	`+ (example: semijoin) thus cannot be evaluated.`
`6134`	`6136`	`*/`
`6135`	`6137`	`if (cond->const_item() && !cond->is_expensive() && !cond->has_subquery())`
`6136`	`6138`	`{`