Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40299

Opening a SYS_REFCURSOR over an EXPLAIN aborts the server

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      Server hangs when executing the test case below on the release build.

      SET sql_mode=ORACLE;
      DELIMITER $$;
      CREATE PROCEDURE p() AS
        c SYS_REFCURSOR;
      BEGIN
        OPEN c FOR 'EXPLAIN SELECT 1';
        CLOSE c;
      END;
      $$
      DELIMITER ;$$
      CALL p();
      

      Leads to

      CS 13.1.0 dcb8fdc739c30622928f4d17fdef54f6dfbd34e6 (Debug, Clang 18.1.3-11) Build 30/06/2026

      mariadbd: /test/13.1_dbg/sql/sql_error.cc:479: void Diagnostics_area::set_error_status(uint, const char *, const char *, const Sql_user_condition_identity &, const Sql_condition *): Assertion `! is_set() || m_can_overwrite_status' failed.
      

      CS 13.1.0 dcb8fdc739c30622928f4d17fdef54f6dfbd34e6 (Debug, Clang 18.1.3-11) Build 30/06/2026

      Core was generated by `/test/MD300626-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 927489)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x000072b36ac4527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x000072b36ac288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x000072b36ac2881b in __assert_fail_base (fmt=0x72b36add01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5cf6c46443e7 "! is_set() || m_can_overwrite_status", file=file@entry=0x5cf6c46441a6 "/test/13.1_dbg/sql/sql_error.cc", line=line@entry=479, function=function@entry=0x5cf6c464440c "void Diagnostics_area::set_error_status(uint, const char *, const char *, const Sql_user_condition_identity &, const Sql_condition *)") at ./assert/assert.c:96
      #6  0x000072b36ac3b517 in __assert_fail (assertion=0x5cf6c46443e7 "! is_set() || m_can_overwrite_status", file=0x5cf6c46441a6 "/test/13.1_dbg/sql/sql_error.cc", line=479, function=0x5cf6c464440c "void Diagnostics_area::set_error_status(uint, const char *, const char *, const Sql_user_condition_identity &, const Sql_condition *)") at ./assert/assert.c:105
      #7  0x00005cf6c34785be in Diagnostics_area::set_error_status (this=0x6ab254007158, sql_errno=1326, message=0x72b34477b2b0 "Cursor is not open", sqlstate=0x5cf6c46383eb "24000", ucid=@0x72b34477afc0: {m_user_condition_value = 0x0}, error_condition=0x0)at /test/13.1_dbg/sql/sql_error.cc:479
      #8  0x00005cf6c3441fb4 in THD::raise_condition (this=0x6ab254000d60, cond=0x72b34477afb0) at /test/13.1_dbg/sql/sql_class.cc:1202
      #9  0x00005cf6c3319e5a in THD::raise_condition (this=0x6ab254000d60, sql_errno=1326, sqlstate=0x5cf6c461e4c8 "", level=Sql_state_errno_level::WARN_LEVEL_ERROR, msg=0x72b34477b2b0 "Cursor is not open")at /test/13.1_dbg/sql/sql_class.h:5718
      #10 0x00005cf6c3307bdf in my_message_sql (error=1326, str=0x72b34477b2b0 "Cursor is not open", MyFlags=0)at /test/13.1_dbg/sql/mysqld.cc:3451
      #11 0x00005cf6c42f866b in my_error (nr=1326, MyFlags=0)at /test/13.1_dbg/mysys/my_error.c:121
      #12 0x00005cf6c33d15ca in Sp_rcontext_handler::get_open_cursor_or_error (thd=0x6ab254000d60, ref=@0x6ab254028200: {<sp_rcontext_addr> = {m_rcontext_handler = 0x5cf6c50e66b0 <sp_rcontext_handler_local>, m_offset = 0}, m_deref_rcontext_handler = 0x5cf6c50e66c0 <sp_rcontext_handler_statement>})at /test/13.1_dbg/sql/sp_rcontext.cc:48
      #13 0x00005cf6c37c5619 in sp_instr_cclose_by_ref::execute (this=0x6ab2540281c0, thd=0x6ab254000d60, nextp=0x72b34477b7c8)at /test/13.1_dbg/sql/sp_instr.cc:2768
      #14 0x00005cf6c33bdd6c in sp_head::execute (this=0x6ab254026820, thd=0x6ab254000d60, merge_da_on_success=true)at /test/13.1_dbg/sql/sp_head.cc:1332
      #15 0x00005cf6c33c076e in sp_head::execute_procedure (this=0x6ab254026820, thd=0x6ab254000d60, args=0x6ab254006280)at /test/13.1_dbg/sql/sp_head.cc:2369
      #16 0x00005cf6c34eb2e7 in do_execute_sp (thd=0x6ab254000d60, sp=0x6ab254026820)at /test/13.1_dbg/sql/sql_parse.cc:3084
      #17 0x00005cf6c34eae08 in Sql_cmd_call::execute (this=0x6ab25401a680, thd=0x6ab254000d60) at /test/13.1_dbg/sql/sql_parse.cc:3322
      #18 0x00005cf6c34f7238 in mysql_execute_command (thd=0x6ab254000d60, is_called_from_prepared_stmt=false) at /test/13.1_dbg/sql/sql_parse.cc:5905
      #19 0x00005cf6c34e63b4 in mysql_parse (thd=0x6ab254000d60, rawbuf=0x6ab25401a3e0 "CALL p()", length=8, parser_state=0x72b34477dab0)at /test/13.1_dbg/sql/sql_parse.cc:7945
      #20 0x00005cf6c34e36fd in dispatch_command (command=COM_QUERY, thd=0x6ab254000d60, packet=0x6ab25400b611 "", packet_length=8, blocking=true) at /test/13.1_dbg/sql/sql_parse.cc:1903
      #21 0x00005cf6c34e6f63 in do_command (thd=0x6ab254000d60, blocking=true)at /test/13.1_dbg/sql/sql_parse.cc:1437
      #22 0x00005cf6c36e56b9 in do_handle_one_connection (connect=0x5cf6ca14f710, put_in_cache=true) at /test/13.1_dbg/sql/sql_connect.cc:1510
      #23 0x00005cf6c36e545e in handle_one_connection (arg=0x5cf6ca121f10)at /test/13.1_dbg/sql/sql_connect.cc:1422
      #24 0x000072b36ac9caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #25 0x000072b36ad29c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Attachments

        Activity

          People

            bar Alexander Barkov
            ramesh Ramesh Sivaraman
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 0.5h
                0.5h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.