Bug #32115 Bad use of Name_resolution_context from current LEX in partitioning
Submitted: 5 Nov 2007 15:59 Modified: 23 Nov 12:18
Reporter: Ingo Strüwing
Status: Patch queued
Category:Server: Partition Severity:S2 (Serious)
Version:5.5.0 OS:Any
Assigned to: Mattias Jonsson Target Version:5.4+
Triage: Triaged: D1 (Critical)

[5 Nov 2007 15:59] Ingo Strüwing 
Description:
Detected during analyze of Bug#31210 - INSERT DELAYED crashes server when used on
partitioned table.

Two places in which code responsible for opening partitioned tables
accesses to current statement's LEX in such way that it causes problems
are mysql_unpack_partition() and fix_fields_part_func() (there are other
places in which we access LEX::sql_command but this is probably OK as
this member is always initialized).

In case of mysql_unpack_partition() we even already use proxy LEX object
for parsing of PARTITION clause from .FRM file, but for some reason
(probably legacy from older version of code) we perfer to borrow
Name_resolution_context from original LEX instead of using one which
is native to proxy LEX. IMO it is safe to use Name_resolution_context
from proxy LEX here since later we will replace all references to it 
by applying Item::change_context_processor to item tree anyway.

In case of fix_fields_part_func() we temporarily use
Name_resolution_context from the current statement's LEX to perform
field name resolutions. But since before doing this we replace all
relevant members in the context with our own values we can probably
as well use any other Name_resolution_context/LEX (i.e. proxy LEX).

One possible concern here is dangling references from Item trees
representing partitioning functions to these proxy LEX objects 
(e.g. Item_field is based on Item_ident which contains reference
to Name_resolution_context).

But this concern is relevant for both of these approaches. In the
first approach (as well as current code) these Item trees, life-time
of which is determined by the life-time of TABLE object, reference
Name_resolution_context from the statement which opened this table
first (or required creation of additional TABLE object, to be exact),
life-time of which is different.

Actually I think that these dangling references do not affect usage
of those Item trees in any way since we don't use these references
to context from Item_field::val_() methods (right?). For additional
safety/to catch bugs earlier we can in set these references to 0
in debug builds (using the same change_context_processor).

This fix is meant to go into 6.0, while the quck fix for #31210
shall go into 5.1.

How to repeat:
Temporarily remove the fix for Bug#31210 - INSERT DELAYED crashes server when used on
partitioned table. Then do:

CREATE TABLE t1 ( a INT ) ENGINE = MyISAM PARTITION BY HASH(a) PARTITIONS 4;
INSERT DELAYED INTO t1 VALUES (1);
ERROR 2013 (HY000): Lost connection to MySQL server during query
[27 Nov 2008 16:41] Konstantin Osipov 
Since it was agreed that in 6.0 we do not have a dependency between LEX and open_tables,
I'm removing this assert from 6.0:
=== modified file 'sql/sql_base.cc'
--- sql/sql_base.cc	2008-11-18 19:41:51 +0000
+++ sql/sql_base.cc	2008-11-27 15:31:04 +0000
@@ -2347,9 +2347,6 @@ bool open_table(THD *thd, TABLE_LIST *ta
   TABLE_SHARE *share;
   DBUG_ENTER("open_table");
 
-  /* Parsing of partitioning information from .frm needs thd->lex set up. */
-  DBUG_ASSERT(thd->lex->is_lex_started);
-
   *action= OT_NO_ACTION;
 
   /* an open table operation needs a lot of the stack space */

In other words, this bug *must* be fixed in 6.0, otherwise we'll get regressions.
[27 Nov 2008 17:37] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/60079

2755 Konstantin Osipov	2008-11-27
      Bug#32115 will remove the pre-requisite to initialize LEX to open tables.
      This dependency was added in 5.1 and was supposed to be removed in 6.0.
      Remove asserts and initialization of LEX in places where we don't deal
      with partitioned tables.
[8 Dec 2008 22:38] Bugs System 
Pushed into 6.0.9-alpha  (revid:kostja@sun.com-20081127163609-6da53ewn1h3r1k7h) (version
source revid:kostja@sun.com-20081127163609-6da53ewn1h3r1k7h) (pib:5)
[29 Jul 16:02] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/79533

3477 Mikael Ronstrom	2009-07-29
      Bug#32115, made use of local lex object to avoid side effects of opening
partitioned tables
      modified:
        sql/sql_partition.cc
[29 Jul 16:56] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/79536

3478 Mikael Ronstrom	2009-07-29
      Bug#32115, added an extra test in debug builds to ensure no dangling pointers to
the old lex object is still around
      modified:
        sql/sql_partition.cc
[29 Jul 20:01] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/79552

3479 Mikael Ronstrom	2009-07-29
      Bug#32115, Removed an assert that was no longer needed
      modified:
        sql/table.cc
[5 Aug 14:53] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/80156

3480 Mikael Ronstrom	2009-08-05
      Bug#32115, fixed review comments
      modified:
        sql/sql_partition.cc
[7 Aug 11:43] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/80340

3481 Mikael Ronstrom	2009-08-07
      Bug#32115, remove now obsolete lex_start calls
      modified:
        libmysqld/lib_sql.cc
        sql/event_data_objects.cc
        sql/ha_ndbcluster.cc
        sql/ha_ndbcluster_binlog.cc
        sql/slave.cc
        sql/sql_insert.cc
        sql/sql_partition.cc
[11 Aug 15:04] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/80581

3526 Mattias Jonsson	2009-08-11 [merge]
      merge of bug#32115
[13 Aug 0:17] Mattias Jonsson 
Checked for crashes as in both bug#31210 and bug#40281 before pushing into mysql-pe
[14 Sep 18:05] Bugs System 
Pushed into 5.4.4-alpha (revid:alik@sun.com-20090914155317-m1g9wodmndzdj4l1) (version
source revid:alik@sun.com-20090914155317-m1g9wodmndzdj4l1) (merge vers: 5.4.4-alpha)
(pib:11)
[15 Sep 11:13] Jon Stephens 
Documented bugfix in the 5.4.4 changelog as follows:

        Portions of the partitioning code were refactored in response to
        potential regression issues uncovered while working on the fix
        for Bug #31210.
      
Closed.
[6 Nov 23:41] Marc Alff 
The fix for this bug has been documented for 5.4.4,
but the code changed is not present in mysql-next-mr (5.5.0).

In particular, DBUG_ASSERT(thd->lex->is_lex_started) is still present,
and the various lex_start() calls that were removed with patches attached to this
bug report are still present in the code.

Changing the bug status to verified.
[20 Nov 0:16] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/91001

2956 Mattias Jonsson	2009-11-20
      Bug#32115: Bad use of Name_resolution_context from current LEX in partitioning
      
      port from mysql-next (5.4) to mysql-next-mr-bugfixing (5.5/5.6?)
      
      2755 Konstantin Osipov	2008-11-27
      Bug#32115 will remove the pre-requisite to initialize LEX to open tables.
      This dependency was added in 5.1 and was supposed to be removed in 6.0.
      Remove asserts and initialization of LEX in places where we don't deal
      with partitioned tables.
     @ sql/sp_head.cc
        Fix a typo.
[20 Nov 1:21] Bugs System 
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/91007

2957 Mattias Jonsson	2009-11-20
      Bug#32115: Bad use of Name_resolution_context from current LEX in partitioning
      
      port from mysql-next (5.4?) to mysql-next-mr-bugfixes (5.5/5.6?)
      
      3477 Mikael Ronstrom	2009-07-29
      Bug#32115, made use of local lex object to avoid side effects of opening
partitioned
      tables
      
      3478 Mikael Ronstrom	2009-07-29
      Bug#32115, added an extra test in debug builds to ensure no dangling pointers to
the
      old lex object is still around
      
      3479 Mikael Ronstrom	2009-07-29
      Bug#32115, Removed an assert that was no longer needed
      
      3480 Mikael Ronstrom	2009-08-05
      Bug#32115, fixed review comments
      
      3481 Mikael Ronstrom	2009-08-07
      Bug#32115, remove now obsolete lex_start calls
[23 Nov 12:18] Mattias Jonsson 
pushed to mysql-next-mr-bugfixing