SET STATEMENT ... FOR <statement> crashes server if <statement> needs to re-open a temp table and fails
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
| Percona Server moved to https://jira.percona.com/projects/PS |
Fix Released
|
High
|
Laurynas Biveinis | |
| 5.1 |
Won't Fix
|
Undecided
|
Unassigned | |
| 5.5 |
New
|
Undecided
|
Unassigned | |
| 5.6 |
Fix Released
|
High
|
Laurynas Biveinis |
Bug Description
** Testcase
DROP DATABASE test;CREATE DATABASE test;USE test;
CREATE TEMPORARY TABLE t1(c1 CHAR (1));
handler t1 open as a1;
INSERT INTO t1 VALUES(_utf16le 0x00D800D8);
SET STATEMENT max_join_
*** GDB
+bt
#0 0x00007f94be5df771 in pthread_kill () from /lib64/
#1 0x00000000006772cd in handle_fatal_signal (sig=11) at /mnt/workspace/
#2 <signal handler called>
#3 get_thread_
#4 0x00000000005a8889 in inline_
#5 net_after_
#6 0x000000000066c7fb in net_read_
#7 net_read_packet (net=0x7f942df2
#8 0x000000000066d5b4 in my_net_read (net=0x7f942df2
#9 0x0000000000700742 in do_command (thd=0x7f942df2
#10 0x00000000006cc392 in do_handle_
#11 0x00000000006cc480 in handle_
#12 0x0000000000afd6b3 in pfs_spawn_thread (arg=0x7f942df4
#13 0x00007f94be5dadf3 in start_thread () from /lib64/
#14 0x00007f94bd2a41ad in clone () from /lib64/libc.so.6
Related branches
- Laurynas Biveinis (community): Approve on 2015-02-04
-
Diff: 150 lines (+82/-6)3 files modifiedmysql-test/r/percona_statement_set.result (+29/-2)
mysql-test/t/percona_statement_set.test (+48/-2)
sql/sql_parse.cc (+5/-2)
Ramesh Sivaraman (rameshvs02) wrote : | #2 |
Tested with SESSION command and it is not crashing.
Testcase:
DROP DATABASE test;CREATE DATABASE test;USE test;
CREATE TEMPORARY TABLE t1(c1 CHAR (1));
handler t1 open as a1;
INSERT INTO t1 VALUES(_utf16le 0x00D800D8);
SET SESSION max_join_
SELECT * FROM t1;
tags: | added: set-statement |
summary: |
handle_fatal_signal (sig=11) in get_thread_statement_locker_v1 | - perfschema/pfs.cc:4491 + perfschema/pfs.cc:4491on a SET STATEMENT max_join_size query |
The cause is thd->variables becoming a dangling pointer:
int
mysql_execute_
{
...
struct system_variables *per_query_
...
if (thd->tx_read_only &&
(
{
my_
goto error;
}
...
if (lex->set_statement && !lex->var_
per_
...
error:
...
if (lex->set_statement && !lex->var_
...
free_
thd->variables= *per_query_
my_
...
}
This bug is a sibling of bug 1387951 and bug 1418049. These three bugs represent three different error paths in mysql_execute_
summary: |
- handle_fatal_signal (sig=11) in get_thread_statement_locker_v1 | - perfschema/pfs.cc:4491on a SET STATEMENT max_join_size query + SET STATEMENT ... FOR <statement> crashes server if <statement> needs to + re-open a temp table and fails |
Shahriyar Rzayev (rzayev-sehriyar) wrote : | #4 |
Percona now uses JIRA for bug reports so this bug report is migrated to: https:/
What happens if you replace SET STATEMENT ... SELECT with session SET ... ; SELECT ? If it crashes, does the upstream crash too then?