Skip to content

Commit 7b6899b

Browse files
author
Nisha Gopalakrishnan
committed
BUG#19897405: CRASH WHILE ACCESSING VIEWS IN STORED ROUTINE
AND TABLES ARE FLUSHED Analysis -------- The server crashes while accessing view columns in the stored procedure after DDL/FLUSH TABLE operation is performed on the tables used by the SQL statements in the stored procedure. Scenario 1: a) SP is executed--> The view fields are resolved/fixed. b) Trigger reparse--> Query arena state is not reset and remains as 'STMT_EXECUTED'. c) SP is executed--> The view fields are resolved/fixed using the execution mem_root. d) SP is executed--> Server crashes while trying to access the resolved view columns allocated on the execution mem_root which was freed after execution(c). Scenario 2: a) SP is executed--> The view fields are resolved/fixed. b) Trigger reparse--> Query arena state is reset with the fix introduced in the earlier patch for scenario 1. c) SP is executed--> DDL execution fails--> View fields are not resolved/fixed--> But query arena state is set as 'STMT_EXECUTED'. d) SP is executed--> The view fields are resolved/fixed using the execution mem_root. e) SP is executed--> Server crashes while trying to access the resolved view columns allocated on the execution mem_root which was freed after execution(d). The DDL/FLUSH TABLE operation on the tables used by the SQL statement of the stored procedure triggers a re-parse of the query. The state of the statement arena was set to 'STMT_EXECUTED'. Also when the DDL fails, beyond the open table stage during execution, the state of the statement arena was set to 'STMT_EXECUTED'. This state of the query arena caused the runtime arena to be used for the allocation of item representing the view column instead of persistent arena. The runtime arena and the mem_root associated with it is not persistent and is deallocated at the end of the query execution. Hence the subsequent execution of the stored procedure, accesses invalid(freed) memory causing the server to crash. Fix: --- The condition which checks the state of the query arena for the allocation of the item representing the view column in an appropriate mem_root is removed. Since there is already a condition to determine whether the statement is a prepared statement or stored routine statement for switching to a persistent mem_root. Thus, when the item representing the view column is created, it will be allocated on the persistent memroot which will be accessible for the subsequent calls to the stored procedure. Note: This is a follow up patch.
1 parent a0882a2 commit 7b6899b

File tree

1 file changed

+1
-4
lines changed

1 file changed

+1
-4
lines changed

sql/sql_base.cc

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6553,10 +6553,7 @@ find_field_in_view(THD *thd, TABLE_LIST *table_list,
65536553
Use own arena for Prepared Statements or data will be freed after
65546554
PREPARE.
65556555
*/
6556-
Prepared_stmt_arena_holder ps_arena_holder(
6557-
thd,
6558-
register_tree_change &&
6559-
thd->stmt_arena->is_stmt_prepare_or_first_stmt_execute());
6556+
Prepared_stmt_arena_holder ps_arena_holder(thd, register_tree_change);
65606557

65616558
/*
65626559
create_item() may, or may not create a new Item, depending on

0 commit comments

Comments
 (0)