Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.0(EOL), 10.1(EOL), 10.2(EOL)
-
None
Description
DROP FUNCTION IF EXISTS f1;
|
CREATE FUNCTION f1() RETURNS INT RETURN 1;
|
CREATE OR REPLACE TABLE t1 SELECT f1() AS a;
|
crashes the server with this stack trace:
#0 0x00000000005e7e77 in wait_while_table_is_used (thd=0x7fff9a6b0070,
|
table=0x0, function=HA_EXTRA_NOT_USED)
|
at /home/bar/maria-git/server-10.0/sql/sql_base.cc:1835
|
#1 0x00000000006f0e5c in mysql_rm_table_no_locks (thd=0x7fff9a6b0070,
|
tables=0x7ffff7f7ba70, if_exists=false, drop_temporary=false,
|
drop_view=false, dont_log_query=true, dont_free_locks=true)
|
at /home/bar/maria-git/server-10.0/sql/sql_table.cc:2469
|
#2 0x00000000006f7126 in create_table_impl (thd=0x7fff9a6b0070,
|
orig_db=0x7fff918d3770 "test", orig_table_name=0x7fff918d3158 "t1",
|
db=0x7fff918d3770 "test", table_name=0x7fff918d3158 "t1",
|
path=0x7ffff7f7c520 "./test/t1", create_info=0x7ffff7f7dc50,
|
alter_info=0x7ffff7f7dbc0, create_table_mode=1, is_trans=0x0,
|
key_info=0x7ffff7f7c728, key_count=0x7ffff7f7c724, frm=0x7ffff7f7c510)
|
at /home/bar/maria-git/server-10.0/sql/sql_table.cc:4738
|
#3 0x00000000006f7a26 in mysql_create_table_no_lock (thd=0x7fff9a6b0070,
|
db=0x7fff918d3770 "test", table_name=0x7fff918d3158 "t1",
|
create_info=0x7ffff7f7dc50, alter_info=0x7ffff7f7dbc0, is_trans=0x0,
|
create_table_mode=1)
|
at /home/bar/maria-git/server-10.0/sql/sql_table.cc:4941
|
#4 0x00000000006338ec in create_table_from_items (thd=0x7fff9a6b0070,
|
create_info=0x7ffff7f7dc50, create_table=0x7fff918d3190,
|
alter_info=0x7ffff7f7dbc0, items=0x7fff9a6b41e8, lock=0x7ffff7f7d898,
|
hooks=0x7ffff7f7d850)
|
at /home/bar/maria-git/server-10.0/sql/sql_insert.cc:3955
|
#5 0x0000000000633f7b in select_create::prepare (this=0x7fff918d4e10,
|
values=..., u=0x7fff9a6b39e0)
|
at /home/bar/maria-git/server-10.0/sql/sql_insert.cc:4128
|
#6 0x000000000067ead0 in JOIN::prepare (this=0x7fff919b6088,
|
rref_pointer_array=0x7fff9a6b4348, tables_init=0x0, wild_num=0, conds_init=
|
0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0,
|
having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7fff9a6b40d0,
|
unit_arg=0x7fff9a6b39e0)
|
at /home/bar/maria-git/server-10.0/sql/sql_select.cc:967
|
....
|
If I rewrite the script as follows:
DROP FUNCTION IF EXISTS f1;
|
CREATE FUNCTION f1() RETURNS INT RETURN 1;
|
DROP TABLE IF EXISTS t1;
|
CREATE OR REPLACE TABLE t1 SELECT f1() AS a;
|
it does not crash.
Attachments
Issue Links
- relates to
-
-
- Closed
-
Activity
So, the full test case is actually this:
CREATE TABLE t1 (i INT);
|
DROP FUNCTION IF EXISTS f1;
|
CREATE FUNCTION f1() RETURNS INT RETURN 1;
|
CREATE OR REPLACE TABLE t1 SELECT f1() AS a;
|
(the table should already exist).
Fixed in the scope of
MDEV-10824(or at least disappeared from 10.0 tree after this bugfix).commit a3c980b381ead0ea13df8314258c7a8d11fe5cd1Author: Sergey VojtovichDate: Mon Oct 24 15:26:11 2016 +0400MDEV-10824 - Crash in CREATE OR REPLACE TABLE t1 AS SELECT spfunc()Code flow hit incorrect branch while closing table instances before removal.This branch expects thread to hold open table instance, whereas CREATE ORREPLACE doesn't actually hold open table instance.Before CREATE OR REPLACE TABLE it was impossible to hit this condition inLTM_PRELOCKED mode, thus the problem didn't expose itself during DROP TABLEor DROP DATABASE.Fixed by adjusting condition to take into account LTM_PRELOCKED mode, which canbe set during CREATE OR REPLACE TABLE.