mirror of
https://github.com/MariaDB/server.git
synced 2025-08-30 06:11:35 +02:00
25464d7fd5
On handling SP statement `FOR IN lower_bound..func() DO` the instruction sp_instr_set is allocated on sp_head's memory root, whereas an instance of the class Item_func_sp pointed by the data member sp_instr_set::sp_result_field is allocated on runtime memory root. In result, on finishing the first execution of a stored routine the memory allocated for the instance of the class Item_func_sp is released whereas the pointer sp_instr_set::sp_result_field still references the deleted memory. Next time the same stored routine is run dereferencing deallocated memory results in abnormal server termination. To fix the issue, allocate an instance of the class Item_func_sp on sp_head memory root. Do this allocation only once, meaning the Item_func_sp::cleanup doesn't do deletion an instance of the class Item_func_sp and nullifying the data member sp_instr_set::sp_result_field.
59 lines
889 B
Text
59 lines
889 B
Text
CREATE TABLE t1 (i INT);
|
|
SET @a = 2;
|
|
CREATE TABLE IF NOT EXISTS t2 (i INT) ENGINE = MyISAM
|
|
AS SELECT * FROM t1;
|
|
CREATE TABLE IF NOT EXISTS t2 (i INT) ENGINE = MyISAM
|
|
AS SELECT * FROM t1;
|
|
Warnings:
|
|
Note 1050 Table 't2' already exists
|
|
DROP TABLE t2;
|
|
CREATE PROCEDURE sp()
|
|
BEGIN
|
|
REPEAT
|
|
CREATE TABLE IF NOT EXISTS t2 (i INT) ENGINE = MyISAM
|
|
AS SELECT * FROM t1;
|
|
SET @a = @a - 1;
|
|
UNTIL @a = 0
|
|
END REPEAT ;
|
|
END |
|
|
CALL sp();
|
|
Warnings:
|
|
Note 1050 Table 't2' already exists
|
|
DROP PROCEDURE sp;
|
|
DROP TABLE t1, t2;
|
|
#
|
|
# MDEV-26115: Crash when calling stored function in FOR loop argument
|
|
#
|
|
CREATE OR REPLACE FUNCTION cnt()
|
|
RETURNS INTEGER NO SQL
|
|
BEGIN
|
|
RETURN 3;
|
|
END;
|
|
$
|
|
CREATE OR REPLACE PROCEDURE p1()
|
|
NO SQL
|
|
BEGIN
|
|
DECLARE i INTEGER;
|
|
FOR i IN 1..cnt() DO
|
|
SELECT 1;
|
|
END FOR;
|
|
END;
|
|
$
|
|
CALL p1();
|
|
1
|
|
1
|
|
1
|
|
1
|
|
1
|
|
1
|
|
CALL p1();
|
|
1
|
|
1
|
|
1
|
|
1
|
|
1
|
|
1
|
|
# Clean up
|
|
DROP FUNCTION cnt;
|
|
DROP PROCEDURE p1;
|
|
# End of 10.6 tests
|