Bug #5373 Handler

Description:
Using "HANDLER tbl_name READ index_name NEXT" without "HANDLER tbl_name READ index_name = (value1,value2,...)" crash the service.

How to repeat:
-- Ok --
HANDLER tbl_name OPEN [ AS alias ]
HANDLER tbl_name READ index_name = (value1,value2,...)
HANDLER tbl_name READ index_name NEXT
HANDLER tbl_name CLOSE

-- Crash the service ---
HANDLER tbl_name OPEN [ AS alias ]
//HANDLER tbl_name READ index_name = (value1,value2,...) // <-- without this line
HANDLER tbl_name READ index_name NEXT // <-- here crash the service
HANDLER tbl_name CLOSE

Suggested fix:
I believe that it would have to return an error.

Verified with the latest BK 4.0 tree.

create table innhandler(id int primary key,
first_name varchar(10),
last_name varchar(10),
index(first_name,last_name))engine=innodb;

insert into innhandler values
(1,'aaa','bbb');

HANDLER innhandler OPEN as a;
HANDLER a READ first_name NEXT;

(gdb) bt
#0  que_fork_get_first_thr (fork=0x0) at ../../innobase/que/../include/que0que.ic:32
#1  0x0823e15c in row_search_for_mysql (buf=0x8a2e558 "ü\001", mode=0, prebuilt=0x41196a68, match_mode=0,
    direction=1) at row0sel.c:2988
#2  0x08168994 in ha_innobase::general_fetch (this=0x8a2e470, buf=0x8a2e558 "ü\001", direction=1, match_mode=0)
    at ha_innodb.cc:2940
#3  0x08168a55 in ha_innobase::index_next (this=0x8a2e470, buf=0x8a2e558 "ü\001") at ha_innodb.cc:2976
#4  0x080bad6a in mysql_ha_read (thd=0x8a232e0, tables=0x8a33c98, mode=RNEXT, keyname=0x8a33ce8 "first_name",
    key_expr=0x8a33d08, ha_rkey_mode=HA_READ_KEY_EXACT, cond=0x0, select_limit=1, offset_limit=0)
    at sql_handler.cc:277
#5  0x08106f0f in mysql_execute_command () at sql_parse.cc:2535
#6  0x08107d0c in mysql_parse (thd=0x8a232e0, inBuf=0x8a33c48 "HANDLER a READ first_name NEXT", length=30)
    at sql_parse.cc:3001
#7  0x0810320c in dispatch_command (command=COM_QUERY, thd=0x8a232e0, packet=0x8a2fbe9 "", packet_length=31)
    at sql_parse.cc:1083
#8  0x08102c6f in do_command (thd=0x8a232e0) at sql_parse.cc:953
#9  0x0810234e in handle_one_connection (arg=0x8a232e0) at sql_parse.cc:737
#10 0x4016314b in pthread_start_thread () from /lib/libpthread.so.0
#11 0x401631df in pthread_start_thread_event () from /lib/libpthread.so.0
#12 0x402df50a in clone () from /lib/libc.so.6

Hi!

Is the command sequence correct for HANDLER at all?

Regards,
Heikki

obviously the command sequence is incorrect, but don't must crash the service

Heikki, I would prefer to have it fixed in the InnoDB (or rather in ha_innodb.cc).

FIxing it in the HANDLER command it rather easy in 4.1, but I would rather not to backport these changes to 4.0. Fixing in ha_innodb requires less code changes in the stable branch.

Monty wanted this as P1 since it can crash the Server

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/internals/25731

Fixed in 4.1.13, 5.0.7

Noted in 4.1.13, 5.0.7 changelogs.