[MDEV-9496] Crash in CREATE OR REPLACE TABLE t1 AS SELECT stored_function() Created: 2016-01-30  Updated: 2018-07-18  Resolved: 2018-07-18

Status: Closed
Project: MariaDB Server
Component/s: Locking, Stored routines
Affects Version/s: 10.0, 10.1, 10.2
Fix Version/s: 10.0.28, 10.1.19, 10.2.4

Type: Bug Priority: Major
Reporter: Alexander Barkov Assignee: Unassigned
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-10824 Crash in CREATE OR REPLACE TABLE t1 A... Closed

 Description    

DROP FUNCTION IF EXISTS f1;
 
CREATE  FUNCTION f1() RETURNS INT RETURN 1;
 
CREATE OR REPLACE TABLE t1 SELECT f1() AS a;

crashes the server with this stack trace:

#0  0x00000000005e7e77 in wait_while_table_is_used (thd=0x7fff9a6b0070, 
    table=0x0, function=HA_EXTRA_NOT_USED)
 
    at /home/bar/maria-git/server-10.0/sql/sql_base.cc:1835
 
#1  0x00000000006f0e5c in mysql_rm_table_no_locks (thd=0x7fff9a6b0070, 
    tables=0x7ffff7f7ba70, if_exists=false, drop_temporary=false, 
    drop_view=false, dont_log_query=true, dont_free_locks=true)
 
    at /home/bar/maria-git/server-10.0/sql/sql_table.cc:2469
 
#2  0x00000000006f7126 in create_table_impl (thd=0x7fff9a6b0070, 
    orig_db=0x7fff918d3770 "test", orig_table_name=0x7fff918d3158 "t1", 
    db=0x7fff918d3770 "test", table_name=0x7fff918d3158 "t1", 
    path=0x7ffff7f7c520 "./test/t1", create_info=0x7ffff7f7dc50, 
    alter_info=0x7ffff7f7dbc0, create_table_mode=1, is_trans=0x0, 
    key_info=0x7ffff7f7c728, key_count=0x7ffff7f7c724, frm=0x7ffff7f7c510)
 
    at /home/bar/maria-git/server-10.0/sql/sql_table.cc:4738
 
#3  0x00000000006f7a26 in mysql_create_table_no_lock (thd=0x7fff9a6b0070, 
    db=0x7fff918d3770 "test", table_name=0x7fff918d3158 "t1", 
    create_info=0x7ffff7f7dc50, alter_info=0x7ffff7f7dbc0, is_trans=0x0, 
    create_table_mode=1)
 
    at /home/bar/maria-git/server-10.0/sql/sql_table.cc:4941
 
#4  0x00000000006338ec in create_table_from_items (thd=0x7fff9a6b0070, 
    create_info=0x7ffff7f7dc50, create_table=0x7fff918d3190, 
    alter_info=0x7ffff7f7dbc0, items=0x7fff9a6b41e8, lock=0x7ffff7f7d898, 
    hooks=0x7ffff7f7d850)
 
    at /home/bar/maria-git/server-10.0/sql/sql_insert.cc:3955
 
#5  0x0000000000633f7b in select_create::prepare (this=0x7fff918d4e10, 
    values=..., u=0x7fff9a6b39e0)
 
    at /home/bar/maria-git/server-10.0/sql/sql_insert.cc:4128
 
#6  0x000000000067ead0 in JOIN::prepare (this=0x7fff919b6088, 
    rref_pointer_array=0x7fff9a6b4348, tables_init=0x0, wild_num=0, conds_init=
 
    0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, 
    having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7fff9a6b40d0, 
    unit_arg=0x7fff9a6b39e0)
 
    at /home/bar/maria-git/server-10.0/sql/sql_select.cc:967
 
....

If I rewrite the script as follows:

DROP FUNCTION IF EXISTS f1;
 
CREATE  FUNCTION f1() RETURNS INT RETURN 1;
 
DROP TABLE IF EXISTS t1;
 
CREATE OR REPLACE TABLE t1 SELECT f1() AS a;

it does not crash.

 Comments   
Comment by Elena Stepanova [ 2016-02-01 ]

So, the full test case is actually this:

CREATE TABLE t1 (i INT);
 
DROP FUNCTION IF EXISTS f1;
 
CREATE  FUNCTION f1() RETURNS INT RETURN 1;
 
CREATE OR REPLACE TABLE t1 SELECT f1() AS a;

(the table should already exist).

Comment by Elena Stepanova [ 2018-07-18 ]

Fixed in the scope of MDEV-10824 (or at least disappeared from 10.0 tree after this bugfix).

commit a3c980b381ead0ea13df8314258c7a8d11fe5cd1
 
Author: Sergey Vojtovich
 
Date:   Mon Oct 24 15:26:11 2016 +0400
 
 
 
    MDEV-10824 - Crash in CREATE OR REPLACE TABLE t1 AS SELECT spfunc()
 
    
    Code flow hit incorrect branch while closing table instances before removal.
 
    This branch expects thread to hold open table instance, whereas CREATE OR
 
    REPLACE doesn't actually hold open table instance.
 
    
    Before CREATE OR REPLACE TABLE it was impossible to hit this condition in
 
    LTM_PRELOCKED mode, thus the problem didn't expose itself during DROP TABLE
 
    or DROP DATABASE.
 
    
    Fixed by adjusting condition to take into account LTM_PRELOCKED mode, which can
 
    be set during CREATE OR REPLACE TABLE.

Generated at Thu Feb 08 07:35:06 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.