MySQL Bugs: #3577: prepared statement, union, second execute crashes mysqld

Bug #3577	prepared statement, union, second execute crashes mysqld
Submitted:	27 Apr 2004 13:02	Modified:	4 May 2004 16:49
Reporter:	Matthias Leich	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server	Severity:	S1 (Critical)
Version:	4.1.2	OS:	Linux (Linux (SuSE 9.0 Prof./Intel))
Assigned to:	Oleksandr Byelkin	CPU Architecture:	Any

Description:
I have a prepared statement with a UNION. If I try to execute this statement several times, the second execution crashes all except one of my mysqld processes.

MySQL 4.1.2 compiled from source tree(last bk pull 27.04.2004) 

How to repeat:
Please use my attached C source file.

C source file for the recreation of the problem

Attachment: m0.c (text/plain), 4.23 KiB.

resolve_stack_dump, backtrace and server log

Attachment: m0.crash (application/octet-stream, text), 3.42 KiB.

Thank you for the bug report I got server's crash on Windows:

C:\servers\4.1.2\bin>bug
 Establishing a connection to the database ...
 OK
my_prepare: select col1 FROM test_table where col1=1  union distinct select col1 FROM test_table where col1=2      OK
my_execute:  OK
my_execute: ------> exception handler

CALL STACK:

get_lock_data(THD * 0x00e8b060, st_table * * 0x00e8c458, unsigned int 3, int 0, st_table * * 0x03e3f27c) line 406 + 22 bytes
mysql_lock_tables(THD * 0x00e8b060, st_table * * 0x00e8c458, unsigned int 3) line 93 + 23 bytes
lock_tables(THD * 0x00e8b060, st_table_list * 0x00e8c308, unsigned int 3) line 1708 + 17 bytes
open_and_lock_tables(THD * 0x00e8b060, st_table_list * 0x00e8c308) line 1665 + 41 bytes
mysql_execute_command(THD * 0x00e8b060) line 1917 + 13 bytes
mysql_stmt_execute(THD * 0x00e8b060, char * 0x00e8504a, unsigned int 10) line 1507 + 9 bytes
dispatch_command(enum_server_command COM_EXECUTE, THD * 0x00e8b060, char * 0x00e85041, unsigned int 10) line 1421 + 17 bytes
do_command(THD * 0x00e8b060) line 1266 + 49 bytes
handle_one_connection(void * 0x00e8b060) line 1016 + 9 bytes
pthread_start(void * 0x00e8af40) line 63 + 7 bytes
_threadstart(void * 0x00e83bc0) line 173 + 13 bytes

ChangeSet 
  1.1802 04/05/03 13:58:01 bell@sanja.is.com.ua +2 -0 
  return table list of fake_select in empty state to prevent using TABLE_LIST 
allocated on stack in next execution of PS (Bug #3577)

Thank you for bugreport. fix for this bug is pushed in our source repository 
and will be present in next server release.