Bug #47511 Segmentation fault during cleanup in sql_union (events_bugs.test)

Description:
The events_bugs test fails with a core dump in about 15-20% of the runs.

CURRENT_TEST: main.events_bugs

Server [mysqld.1 - pid: 5394, winpid: 5394, exit: 256] failed during test run

 - saving '/export/home/pb2/test/sb_6-756089-1253459744.48/mysql-6.0.14-alpha-linux-x86_64-test/mysql-test/var-n_mix/2/log/main.events_bugs/' to '/export/home/pb2/test/sb_6-756089-1253459744.48/mysql-6.0.14-alpha-linux-x86_64-test/mysql-test/var-n_mix/log/main.events_bugs/'
 - found 'core.5395' (0/5)

Trying 'dbx' to get a backtrace

Trying 'gdb' to get a backtrace
Guessing that core was generated by '/export/home/pb2/test/sb_6-756089-1253459744.48/mysql-6.0.14-alpha-linux-x86_64-test/libexec/mysqld'
Output from gdb follows. The first stack trace is from the failing thread.
The following stack traces are from all threads (so the failing one is
duplicated).
--------------------------
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/export/home/pb2/test/sb_6-756089-1253459744.48/mysql-6.0.14-alpha-linux-x86_64'.
Program terminated with signal 11, Segmentation fault.
#0 0x0000003c3da0b122 in pthread_kill () from /lib64/libpthread.so.0 #0 0x0000003c3da0b122 in pthread_kill () from /lib64/libpthread.so.0 #1 0x000000000062a6fe in handle_segfault (sig=11) at mysqld.cc:2755 #2 <signal handler called> #3 0x0000000000000000 in ?? () #4 0x000000000076f1bf in st_select_lex_unit::cleanup (this=0x2aaab400b1b8)
    at sql_union.cc:661
#5 0x0000000000795226 in Event_job_data::execute (this=0x40c09020,
    thd=0x2aaab40098f0, drop=false) at event_data_objects.cc:1517
#6 0x0000000000792d63 in Event_worker_thread::run (this=0x40c09127,
    thd=0x2aaab40098f0, event=0x2aaab4009740) at event_scheduler.cc:307
#7 0x0000000000792db8 in event_worker_thread (arg=<value optimized out>)
    at event_scheduler.cc:264
#8 0x0000003c3da062f7 in start_thread () from /lib64/libpthread.so.0 #9 0x0000003c3ced1b6d in clone () from /lib64/libc.so.6

How to repeat:
Run the main.events_bugs test 5-10 times

I get the same error sporadically in backup.backup_objects_depdendency.test and backup.backup_events.test as well.

Easy to reproduce in optimized mode. Here are some sample stack traces.

#0  0x00985424 in __kernel_vsyscall ()
#0  0x00985424 in __kernel_vsyscall ()
#1  0x00b0a1e8 in pthread_kill () from /lib/libpthread.so.0
#2  0x085f9e9c in my_write_core (sig=11) at stacktrace.c:309
#3  0x0825edba in handle_segfault (sig=11) at mysqld.cc:2755
#4  <signal handler called>
#5  0x082cf626 in JOIN::destroy (this=0xb7102668) at sql_select.cc:2931
#6  0x083d03ce in st_select_lex::cleanup () at sql_union.cc:803
#7  st_select_lex_unit::cleanup (this=0xb7102108) at sql_union.cc:679
#8  0x083f82fd in Event_job_data::execute (this=0xb744bf08, thd=0xb71011c0, drop=false) at event_data_objects.cc:1517
#9  0x083f76cd in Event_worker_thread::run (this=0xb744bfa7, thd=0xb71011c0, event=0xb7101158) at event_scheduler.cc:307
#10 0x083f773f in event_worker_thread (arg=0xb7101158) at event_scheduler.cc:264
#11 0x00b0551f in start_thread () from /lib/libpthread.so.0
#12 0x001f404e in clone () from /lib/libc.so.6

#0  0x00c6a424 in __kernel_vsyscall ()
#1  0x00b0a1e8 in pthread_kill () from /lib/libpthread.so.0
#2  0x085f9e9c in my_write_core (sig=11) at stacktrace.c:309
#3  0x0825edba in handle_segfault (sig=11) at mysqld.cc:2755
#4  <signal handler called>
#5  0x00000000 in ?? ()
#6  0x083d0214 in st_select_lex_unit::cleanup (this=0xa437940) at sql_union.cc:661
#7  0x083f82fd in Event_job_data::execute (this=0xb7462f08, thd=0xa4369f8, drop=false) at event_data_objects.cc:1517
#8  0x083f76cd in Event_worker_thread::run (this=0xb7462fa7, thd=0xa4369f8, event=0xa36c448) at event_scheduler.cc:307
#9  0x083f773f in event_worker_thread (arg=0xa36c448) at event_scheduler.cc:264
#10 0x00b0551f in start_thread () from /lib/libpthread.so.0
#11 0x00a3b04e in clone () from /lib/libc.so.6

#0  0x0094e424 in __kernel_vsyscall ()
#1  0x00b0a1e8 in pthread_kill () from /lib/libpthread.so.0
#2  0x085f9e2c in my_write_core (sig=11) at stacktrace.c:309
#3  0x0825ee2a in handle_segfault (sig=11) at mysqld.cc:2755
#4  <signal handler called>
#5  st_select_lex::cleanup () at sql_union.cc:800
#6  st_select_lex_unit::cleanup (this=0xb740a7c8) at sql_union.cc:669
#7  0x083f826d in Event_job_data::execute (this=0xb7559f08, thd=0xb7409880, drop=false) at event_data_objects.cc:1517
#8  0x083f763d in Event_worker_thread::run (this=0xb7559fa7, thd=0xb7409880, event=0x9618938) at event_scheduler.cc:307
#9  0x083f76af in event_worker_thread (arg=0x9618938) at event_scheduler.cc:264
#10 0x00b0551f in start_thread () from /lib/libpthread.so.0
#11 0x00a3b04e in clone () from /lib/libc.so.6

#0  0x0029b424 in __kernel_vsyscall ()
#1  0x00b0a1e8 in pthread_kill () from /lib/libpthread.so.0
#2  0x085fa08c in my_write_core (sig=11) at stacktrace.c:309
#3  0x0825eeea in handle_segfault (sig=11) at mysqld.cc:2755
#4  <signal handler called>
#5  st_select_lex_unit::cleanup (this=0x8fd38b0) at sql_union.cc:674
#6  0x083f84cd in Event_job_data::execute (this=0xb746cf08, thd=0x8fd2968, drop=false) at event_data_objects.cc:1517
#7  0x083f789d in Event_worker_thread::run (this=0xb746cfa7, thd=0x8fd2968, event=0x8fb6e88) at event_scheduler.cc:307
#8  0x083f790f in event_worker_thread (arg=0x8fb6e88) at event_scheduler.cc:264
#9  0x00b0551f in start_thread () from /lib/libpthread.so.0
#10 0x00a3b04e in clone () from /lib/libc.so.6

This bug is also an important contributor in keeping the pushbuild red.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/84389

2836 Tor Didriksen	2009-09-23
      Bug#47511 Segmentation fault during cleanup in sql_union (events_bugs.test)
      
      Segfaults were caused by calling cleanup() on objects which were not properly initialized.
     @ sql/sql_lex.h
        Ensure that fields used during shutdown() are always initialized by constructors.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/84445

2838 Tor Didriksen	2009-09-24
      Bug#47511 Segmentation fault during cleanup in sql_union (events_bugs.test)
      
      Segfaults were caused by calling cleanup() on objects which were not properly initialized.
     @ sql/sql_lex.h
        Ensure that fields used during cleanup() are always initialized by constructors.

Also warnings from valgrind from several tests:

backup.backup_objects_dependency         w4 [ retry-fail ]  Found warnings/errors in server log file!
        Test ended at 2009-09-24 00:09:37
mysqltest: Logging to ''.
mysqltest: Results saved in ''.
mysqltest: Connecting to server localhost:13470 (socket /export/home/pb2/test/sb_0-764111-1253742263.71/tmp/1xHSl6SqRv/4/mysqld.1.sock) as 'root', connection 'default', attempt 0 ...
mysqltest: ... Connected.
mysqltest: Start processing test commands from './include/check-warnings.test' ...
file_name	line
/export/home/pb2/test/sb_0-764111-1253742263.71/mysql-6.0.14-alpha-linux-x86_64-test/mysql-test/var-n_mix/4/log/mysqld.1.err	==6217==    at 0x8B5987: st_select_lex_unit::cleanup() (sql_union.cc:653)
/export/home/pb2/test/sb_0-764111-1253742263.71/mysql-6.0.14-alpha-linux-x86_64-test/mysql-test/var-n_mix/4/log/mysqld.1.err	==6217==    at 0x8B59C5: st_select_lex_unit::cleanup() (sql_union.cc:659)
/export/home/pb2/test/sb_0-764111-1253742263.71/mysql-6.0.14-alpha-linux-x86_64-test/mysql-test/var-n_mix/4/log/mysqld.1.err	==6217==    at 0x8B5A72: st_select_lex_unit::cleanup() (sql_union.cc:668)
/export/home/pb2/test/sb_0-764111-1253742263.71/mysql-6.0.14-alpha-linux-x86_64-test/mysql-test/var-n_mix/4/log/mysqld.1.err	==6217==    at 0x8B5A82: st_select_lex_unit::cleanup() (sql_union.cc:671)
^ Found warnings!!
mysqltest: ... Done processing test commands.
mysqltest: Test has succeeded!
ok

Pushed into 6.0.14-alpha (revid:alik@sun.com-20090929093622-1mooerbh12e97zux) (version source revid:alik@sun.com-20090927203924-087s36mrs0uxepwb) (merge vers: 6.0.14-alpha) (pib:11)

Due to backporting of features, this bug has re-appeared in
mysql-next-mr-bugfixing
The fix also needs to be backported.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/92030

2908 Tor Didriksen	2009-11-30
      backport of:
              ------------------------------------------------------------
              revno: 2617.81.1
              revision-id: tor.didriksen@sun.com-20090924061133-qo02zotz3yypmfpk
              parent: davi.arnaut@sun.com-20090923203724-tvz7x8dauzp686v7
              committer: Tor Didriksen <tor.didriksen@sun.com>
              branch nick: 6.0-codebase-bf-opt
              timestamp: Thu 2009-09-24 08:11:33 +0200
              message:
                Bug#47511 Segmentation fault during cleanup in sql_union (events_bugs.test)
                
     @ sql/sql_lex.h
        Ensure that fields used during cleanup() are always initialized by constructors.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/92212

3742 Tor Didriksen	2009-12-01 [merge]
      nullmerge of backport of Bug#47511

Backported and pushed to
bzr+ssh://bk-internal.mysql.com/bzrroot/server/mysql-next-mr-bugfixing/

Nullmerged to
bzr+ssh://bk-internal.mysql.com/bzrroot/server/mysql-6.0-codebase-bugfixing/

Pushed into 6.0.14-alpha (revid:alik@sun.com-20091211055901-yp18b3c7xuhl87rf) (version source revid:alik@sun.com-20091211055401-43rjwq7gjed6ds83) (merge vers: 6.0.14-alpha) (pib:13)

The parser failed to initialize some internal objects properly.
This could cause server crash in the cleanup phase after query execution.

Noted in 5.6.2, 6.0.14 changelogs.