[MDEV-15070] Crash when doing a CREATE VIEW inside a package routine - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Fixed
Affects Version/s: 10.3(EOL)
Fix Version/s: N/A
Component/s: Stored routines
Labels:
None

Description

I run this script in bb-10.2-compatibility:

SET sql_mode=ORACLE;

DELIMITER $$

CREATE OR REPLACE PACKAGE pkg2 AS

  PROCEDURE p00();

END;

$$

CREATE OR REPLACE PACKAGE BODY pkg2 AS

  PROCEDURE p01() AS

  BEGIN

    SELECT 'This is p01';

  END;

  PROCEDURE p00() AS

  BEGIN

    CREATE OR REPLACE VIEW v1 AS SELECT 1;

    CALL p01();

  END;

END;

$$

DELIMITER ;

CALL pkg2.p00;

It crashes with the following stack trace:

#0  0x0000555555b47ad8 in MDL_key::mdl_namespace (this=0x8f8f8f8f8f8f8faf)

    at /home/bar/maria-git/server.10.2-compatibility/sql/mdl.h:320

#1  0x0000555555b3a889 in open_and_process_routine (thd=0x7fff5c000a98,

    prelocking_ctx=0x7fff5c037d08, rt=0x8f8f8f8f8f8f8f8f,

    prelocking_strategy=0x7fffe0548ed8, has_prelocking_list=false,

    ot_ctx=0x7fffe0548dc0, need_prelocking=0x7fffe0548d60,

    routine_modifies_data=0x7fffe0548d61)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.cc:3121

#2  0x0000555555b3c598 in open_tables (thd=0x7fff5c000a98, options=...,

    start=0x7fffe0548e38, counter=0x7fffe0548e54, flags=0,

    prelocking_strategy=0x7fffe0548ed8)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.cc:4060

#3  0x0000555555b3dbab in open_and_lock_tables (thd=0x7fff5c000a98,

    options=..., tables=0x0, derived=true, flags=0,

    prelocking_strategy=0x7fffe0548ed8)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.cc:4745

#4  0x0000555555b00901 in open_and_lock_tables (thd=0x7fff5c000a98,

    tables=0x0, derived=true, flags=0)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.h:496

#5  0x0000555555bb7337 in Sql_cmd_call::execute (this=0x7fff5c0396b0,

    thd=0x7fff5c000a98)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:3124

#6  0x0000555555bc15e8 in mysql_execute_command (thd=0x7fff5c000a98)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:6254

#7  0x0000555555af7cd2 in sp_instr_stmt::exec_core (this=0x7fff5c039c10,

    thd=0x7fff5c000a98, nextp=0x7fffe0549bf4)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:3591

#8  0x0000555555af72cf in sp_lex_keeper::reset_lex_and_exec_core (

    this=0x7fff5c039c60, thd=0x7fff5c000a98, nextp=0x7fffe0549bf4,

    open_tables=false, instr=0x7fff5c039c10)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:3336

#9  0x0000555555af7983 in sp_instr_stmt::execute (this=0x7fff5c039c10,

    thd=0x7fff5c000a98, nextp=0x7fffe0549bf4)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:3507

#10 0x0000555555af1a09 in sp_head::execute (this=0x7fff5c031d00,

    thd=0x7fff5c000a98, merge_da_on_success=true)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:1390

#11 0x0000555555af423a in sp_head::execute_procedure (this=0x7fff5c031d00,

    thd=0x7fff5c000a98, args=0x7fff5c005588)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:2313

#12 0x0000555555bb6a54 in do_execute_sp (thd=0x7fff5c000a98, sp=0x7fff5c031d00)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:2929

#13 0x0000555555bb757a in Sql_cmd_call::execute (this=0x7fff5c028720,

    thd=0x7fff5c000a98)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:3169

#14 0x0000555555bc15e8 in mysql_execute_command (thd=0x7fff5c000a98)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:6254

#15 0x0000555555bc639d in mysql_parse (thd=0x7fff5c000a98,

    rawbuf=0x7fff5c0152e0 "CALL pkg2.p00", length=13,

    parser_state=0x7fffe054b230, is_com_multi=false, is_next_command=false)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:7974

#16 0x0000555555bb3c62 in dispatch_command (command=COM_QUERY,

    thd=0x7fff5c000a98, packet=0x7fff5c0081e9 "CALL pkg2.p00",

    packet_length=13, is_com_multi=false, is_next_command=false)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:1834

#17 0x0000555555bb25e1 in do_command (thd=0x7fff5c000a98)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:1382

#18 0x0000555555d07842 in do_handle_one_connection (connect=0x555558671b28)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_connect.cc:1335

#19 0x0000555555d075c2 in handle_one_connection (arg=0x555558671b28)

    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_connect.cc:1241

#20 0x00007ffff7bbe36d in start_thread () from /lib64/libpthread.so.0

#21 0x00007ffff62f9b9f in clone () from /lib64/libc.so.6

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

MDEV-15070.diff
12 kB
2018-01-26 12:37

Issue Links

is duplicated by

MDEV-14949 Crash signal 11 in prepared statement (stored procedures)

Closed

MDEV-14950 crash 11 in check, if sql command is allowed to write into logfiles

Closed

MDEV-15080 ASAN heap-use-after-free in Query_tables_list::set_query_tables_list / Sp_handler::sp_cache_package_routine or crash in MDL_key::mdl_namespace

Closed

relates to

MDEV-15028 Crash in open_tables() while calling stored procedure from the package

Closed

MDEV-15040 Crash in st_select_lex::cleanup() in stored procedure from the package

Closed

Activity

Ascending order - Click to sort in descending order

Alexander Barkov created issue - 2018-01-25 14:42

Alexander Barkov made changes - 2018-01-25 14:42

Field	Original Value	New Value
Fix Version/s		N/A [ 14700 ]
Fix Version/s	10.3 [ 22126 ]

Alexander Barkov made changes - 2018-01-25 15:00

Description

I run this script in bb-10.2-compatibility:

{code:sql}
SET sql_mode=ORACLE;
DELIMITER $$
CREATE OR REPLACE PACKAGE pkg2 AS
  PROCEDURE p00();
END;
$$
CREATE OR REPLACE PACKAGE BODY pkg2 AS
  PROCEDURE p01() AS
  BEGIN
    SELECT 'This is p01';
  END;
  PROCEDURE p00() AS
  BEGIN
    CREATE OR REPLACE VIEW v1 AS SELECT 1;
    CALL p01();
  END;
END;
$$
CALL pkg2.p00;
{code}
It crashes with the following stack trace:

{noformat}
#0 0x0000555555b47ad8 in MDL_key::mdl_namespace (this=0x8f8f8f8f8f8f8faf)
    at /home/bar/maria-git/server.10.2-compatibility/sql/mdl.h:320
#1 0x0000555555b3a889 in open_and_process_routine (thd=0x7fff5c000a98,
    prelocking_ctx=0x7fff5c037d08, rt=0x8f8f8f8f8f8f8f8f,
    prelocking_strategy=0x7fffe0548ed8, has_prelocking_list=false,
    ot_ctx=0x7fffe0548dc0, need_prelocking=0x7fffe0548d60,
    routine_modifies_data=0x7fffe0548d61)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.cc:3121
#2 0x0000555555b3c598 in open_tables (thd=0x7fff5c000a98, options=...,
    start=0x7fffe0548e38, counter=0x7fffe0548e54, flags=0,
    prelocking_strategy=0x7fffe0548ed8)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.cc:4060
#3 0x0000555555b3dbab in open_and_lock_tables (thd=0x7fff5c000a98,
    options=..., tables=0x0, derived=true, flags=0,
    prelocking_strategy=0x7fffe0548ed8)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.cc:4745
#4 0x0000555555b00901 in open_and_lock_tables (thd=0x7fff5c000a98,
    tables=0x0, derived=true, flags=0)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.h:496
#5 0x0000555555bb7337 in Sql_cmd_call::execute (this=0x7fff5c0396b0,
    thd=0x7fff5c000a98)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:3124
#6 0x0000555555bc15e8 in mysql_execute_command (thd=0x7fff5c000a98)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:6254
#7 0x0000555555af7cd2 in sp_instr_stmt::exec_core (this=0x7fff5c039c10,
    thd=0x7fff5c000a98, nextp=0x7fffe0549bf4)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:3591
#8 0x0000555555af72cf in sp_lex_keeper::reset_lex_and_exec_core (
    this=0x7fff5c039c60, thd=0x7fff5c000a98, nextp=0x7fffe0549bf4,
    open_tables=false, instr=0x7fff5c039c10)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:3336
#9 0x0000555555af7983 in sp_instr_stmt::execute (this=0x7fff5c039c10,
    thd=0x7fff5c000a98, nextp=0x7fffe0549bf4)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:3507
#10 0x0000555555af1a09 in sp_head::execute (this=0x7fff5c031d00,
    thd=0x7fff5c000a98, merge_da_on_success=true)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:1390
#11 0x0000555555af423a in sp_head::execute_procedure (this=0x7fff5c031d00,
    thd=0x7fff5c000a98, args=0x7fff5c005588)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:2313
#12 0x0000555555bb6a54 in do_execute_sp (thd=0x7fff5c000a98, sp=0x7fff5c031d00)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:2929
#13 0x0000555555bb757a in Sql_cmd_call::execute (this=0x7fff5c028720,
    thd=0x7fff5c000a98)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:3169
#14 0x0000555555bc15e8 in mysql_execute_command (thd=0x7fff5c000a98)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:6254
#15 0x0000555555bc639d in mysql_parse (thd=0x7fff5c000a98,
    rawbuf=0x7fff5c0152e0 "CALL pkg2.p00", length=13,
    parser_state=0x7fffe054b230, is_com_multi=false, is_next_command=false)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:7974
#16 0x0000555555bb3c62 in dispatch_command (command=COM_QUERY,
    thd=0x7fff5c000a98, packet=0x7fff5c0081e9 "CALL pkg2.p00",
    packet_length=13, is_com_multi=false, is_next_command=false)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:1834
#17 0x0000555555bb25e1 in do_command (thd=0x7fff5c000a98)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:1382
#18 0x0000555555d07842 in do_handle_one_connection (connect=0x555558671b28)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_connect.cc:1335
#19 0x0000555555d075c2 in handle_one_connection (arg=0x555558671b28)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_connect.cc:1241
#20 0x00007ffff7bbe36d in start_thread () from /lib64/libpthread.so.0
#21 0x00007ffff62f9b9f in clone () from /lib64/libc.so.6
{noformat}

I run this script in bb-10.2-compatibility:

{code:sql}
SET sql_mode=ORACLE;
DELIMITER $$
CREATE OR REPLACE PACKAGE pkg2 AS
  PROCEDURE p00();
END;
$$
CREATE OR REPLACE PACKAGE BODY pkg2 AS
  PROCEDURE p01() AS
  BEGIN
    SELECT 'This is p01';
  END;
  PROCEDURE p00() AS
  BEGIN
    CREATE OR REPLACE VIEW v1 AS SELECT 1;
    CALL p01();
  END;
END;
$$
DELIMITER ;
CALL pkg2.p00;
{code}
It crashes with the following stack trace:

{noformat}
#0 0x0000555555b47ad8 in MDL_key::mdl_namespace (this=0x8f8f8f8f8f8f8faf)
    at /home/bar/maria-git/server.10.2-compatibility/sql/mdl.h:320
#1 0x0000555555b3a889 in open_and_process_routine (thd=0x7fff5c000a98,
    prelocking_ctx=0x7fff5c037d08, rt=0x8f8f8f8f8f8f8f8f,
    prelocking_strategy=0x7fffe0548ed8, has_prelocking_list=false,
    ot_ctx=0x7fffe0548dc0, need_prelocking=0x7fffe0548d60,
    routine_modifies_data=0x7fffe0548d61)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.cc:3121
#2 0x0000555555b3c598 in open_tables (thd=0x7fff5c000a98, options=...,
    start=0x7fffe0548e38, counter=0x7fffe0548e54, flags=0,
    prelocking_strategy=0x7fffe0548ed8)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.cc:4060
#3 0x0000555555b3dbab in open_and_lock_tables (thd=0x7fff5c000a98,
    options=..., tables=0x0, derived=true, flags=0,
    prelocking_strategy=0x7fffe0548ed8)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.cc:4745
#4 0x0000555555b00901 in open_and_lock_tables (thd=0x7fff5c000a98,
    tables=0x0, derived=true, flags=0)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_base.h:496
#5 0x0000555555bb7337 in Sql_cmd_call::execute (this=0x7fff5c0396b0,
    thd=0x7fff5c000a98)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:3124
#6 0x0000555555bc15e8 in mysql_execute_command (thd=0x7fff5c000a98)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:6254
#7 0x0000555555af7cd2 in sp_instr_stmt::exec_core (this=0x7fff5c039c10,
    thd=0x7fff5c000a98, nextp=0x7fffe0549bf4)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:3591
#8 0x0000555555af72cf in sp_lex_keeper::reset_lex_and_exec_core (
    this=0x7fff5c039c60, thd=0x7fff5c000a98, nextp=0x7fffe0549bf4,
    open_tables=false, instr=0x7fff5c039c10)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:3336
#9 0x0000555555af7983 in sp_instr_stmt::execute (this=0x7fff5c039c10,
    thd=0x7fff5c000a98, nextp=0x7fffe0549bf4)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:3507
#10 0x0000555555af1a09 in sp_head::execute (this=0x7fff5c031d00,
    thd=0x7fff5c000a98, merge_da_on_success=true)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:1390
#11 0x0000555555af423a in sp_head::execute_procedure (this=0x7fff5c031d00,
    thd=0x7fff5c000a98, args=0x7fff5c005588)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sp_head.cc:2313
#12 0x0000555555bb6a54 in do_execute_sp (thd=0x7fff5c000a98, sp=0x7fff5c031d00)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:2929
#13 0x0000555555bb757a in Sql_cmd_call::execute (this=0x7fff5c028720,
    thd=0x7fff5c000a98)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:3169
#14 0x0000555555bc15e8 in mysql_execute_command (thd=0x7fff5c000a98)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:6254
#15 0x0000555555bc639d in mysql_parse (thd=0x7fff5c000a98,
    rawbuf=0x7fff5c0152e0 "CALL pkg2.p00", length=13,
    parser_state=0x7fffe054b230, is_com_multi=false, is_next_command=false)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:7974
#16 0x0000555555bb3c62 in dispatch_command (command=COM_QUERY,
    thd=0x7fff5c000a98, packet=0x7fff5c0081e9 "CALL pkg2.p00",
    packet_length=13, is_com_multi=false, is_next_command=false)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:1834
#17 0x0000555555bb25e1 in do_command (thd=0x7fff5c000a98)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_parse.cc:1382
#18 0x0000555555d07842 in do_handle_one_connection (connect=0x555558671b28)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_connect.cc:1335
#19 0x0000555555d075c2 in handle_one_connection (arg=0x555558671b28)
    at /home/bar/maria-git/server.10.2-compatibility/sql/sql_connect.cc:1241
#20 0x00007ffff7bbe36d in start_thread () from /lib64/libpthread.so.0
#21 0x00007ffff62f9b9f in clone () from /lib64/libc.so.6
{noformat}

Alexander Barkov made changes - 2018-01-26 10:25

issue.field.resolutiondate

2018-01-26 10:25:00.0

2018-01-26 10:25:00.338

Alexander Barkov made changes - 2018-01-26 10:25

Resolution		Fixed [ 1 ]
Status	Open [ 1 ]	Closed [ 6 ]

Alexander Barkov made changes - 2018-01-26 11:56

Link

This issue is duplicated by ~~MDEV-15080~~ [ ~~MDEV-15080~~ ]

Alexander Barkov made changes - 2018-01-26 12:37

Attachment

MDEV-15070.diff [ 45017 ]

Elena Stepanova made changes - 2018-01-27 11:30

Link

This issue is duplicated by ~~MDEV-14950~~ [ ~~MDEV-14950~~ ]

Elena Stepanova made changes - 2018-01-27 11:37

Link

This issue is duplicated by ~~MDEV-14949~~ [ ~~MDEV-14949~~ ]

Elena Stepanova made changes - 2018-01-27 11:52

Link

This issue relates to ~~MDEV-15040~~ [ ~~MDEV-15040~~ ]

Elena Stepanova made changes - 2018-01-27 11:55

Link

This issue relates to ~~MDEV-15028~~ [ ~~MDEV-15028~~ ]

Sergei Golubchik made changes - 2021-12-06 21:46

Workflow

MariaDB v3 [ 85137 ]

MariaDB v4 [ 153649 ]

People

Assignee:: Alexander Barkov

Reporter:: Alexander Barkov

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Dates

Created:: 2018-01-25 14:42

Updated:: 2018-08-31 15:51

Resolved:: 2018-01-26 10:25

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Attachments

Attachments

Issue Links

Activity

People

Dates

Git Integration