mirror of
https://github.com/MariaDB/server.git
synced 2025-09-12 12:22:19 +02:00
25464d7fd5
On handling SP statement `FOR IN lower_bound..func() DO` the instruction sp_instr_set is allocated on sp_head's memory root, whereas an instance of the class Item_func_sp pointed by the data member sp_instr_set::sp_result_field is allocated on runtime memory root. In result, on finishing the first execution of a stored routine the memory allocated for the instance of the class Item_func_sp is released whereas the pointer sp_instr_set::sp_result_field still references the deleted memory. Next time the same stored routine is run dereferencing deallocated memory results in abnormal server termination. To fix the issue, allocate an instance of the class Item_func_sp on sp_head memory root. Do this allocation only once, meaning the Item_func_sp::cleanup doesn't do deletion an instance of the class Item_func_sp and nullifying the data member sp_instr_set::sp_result_field.
60 lines
1 KiB
Text
60 lines
1 KiB
Text
#
|
|
# MDEV-6610 Assertion `thd->is_error() || thd->killed' failed in mysql_execute_command on executing an SP with repeated CREATE TABLE .. SELECT
|
|
#
|
|
CREATE TABLE t1 (i INT);
|
|
SET @a = 2;
|
|
|
|
CREATE TABLE IF NOT EXISTS t2 (i INT) ENGINE = MyISAM
|
|
AS SELECT * FROM t1;
|
|
CREATE TABLE IF NOT EXISTS t2 (i INT) ENGINE = MyISAM
|
|
AS SELECT * FROM t1;
|
|
DROP TABLE t2;
|
|
|
|
--delimiter |
|
|
CREATE PROCEDURE sp()
|
|
BEGIN
|
|
REPEAT
|
|
CREATE TABLE IF NOT EXISTS t2 (i INT) ENGINE = MyISAM
|
|
AS SELECT * FROM t1;
|
|
SET @a = @a - 1;
|
|
UNTIL @a = 0
|
|
END REPEAT ;
|
|
END |
|
|
--delimiter ;
|
|
|
|
CALL sp();
|
|
|
|
DROP PROCEDURE sp;
|
|
DROP TABLE t1, t2;
|
|
|
|
--echo #
|
|
--echo # MDEV-26115: Crash when calling stored function in FOR loop argument
|
|
--echo #
|
|
--delimiter $
|
|
CREATE OR REPLACE FUNCTION cnt()
|
|
RETURNS INTEGER NO SQL
|
|
BEGIN
|
|
RETURN 3;
|
|
END;
|
|
$
|
|
|
|
CREATE OR REPLACE PROCEDURE p1()
|
|
NO SQL
|
|
BEGIN
|
|
DECLARE i INTEGER;
|
|
FOR i IN 1..cnt() DO
|
|
SELECT 1;
|
|
END FOR;
|
|
END;
|
|
$
|
|
|
|
--delimiter ;
|
|
|
|
CALL p1();
|
|
CALL p1();
|
|
|
|
--echo # Clean up
|
|
DROP FUNCTION cnt;
|
|
DROP PROCEDURE p1;
|
|
|
|
--echo # End of 10.6 tests
|