MySQL Bugs: #39255: Stored procedures: crash if function references nonexistent table

Bug #39255	Stored procedures: crash if function references nonexistent table
Submitted:	4 Sep 2008 20:54	Modified:	12 Nov 21:51
Reporter:	Peter Gulutzan
Status:	Closed
Category:	Server: SP	Severity:	S3 (Non-critical)
Version:	6.0.7-alpha-debug	OS:	Linux (SUSE 10 32-bit)
Assigned to:	Alexander Nozdrin	Target Version:	6.0-beta
Triage:	Triaged: D1 (Critical)

Description:
I create a function which selects from a nonexistent table.
I select from a MyISAM table, using the function.
Crash.

How to repeat:
mysql> DELIMITER //
mysql> DROP FUNCTION IF EXISTS f//
Query OK, 0 rows affected (0.01 sec)

mysql> DROP TABLE IF EXISTS t2//
Query OK, 0 rows affected (0.03 sec)

mysql> DROP TABLE IF EXISTS t3//
Query OK, 0 rows affected, 1 warning (0.00 sec)

mysql> CREATE FUNCTION f() RETURNS INT
    -> BEGIN
    ->   DECLARE v INT;
    ->   SELECT s1 INTO v FROM t3;
    ->   RETURN 1;
    ->   END//
Query OK, 0 rows affected (0.01 sec)

mysql> DELIMITER ;
mysql> CREATE TABLE t2 (s1 INT) engine=myisam;
Query OK, 0 rows affected (0.10 sec)

mysql> INSERT INTO t2 VALUES (1);
Query OK, 1 row affected (0.01 sec)

mysql> SELECT * FROM t2 WHERE s1 = f();
ERROR 2013 (HY000): Lost connection to MySQL server during query

Thank you for the report.

Verified as described:

Version: '6.0.7-alpha-debug-log'  socket:
'/users/ssmirnova/src/mysql-6.0/mysql-test/var/tmp/master.sock'  port: 9306  Source
distribution
mysqld: sql_class.cc:441: void Diagnostics_area::set_eof_status(THD*): Assertion `!
is_set()' failed.
/users/ssmirnova/src/mysql-6.0/sql/mysqld(my_print_stacktrace+0x26)[0x891b515]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(handle_segfault+0x2de)[0x82f14ca]
[0x2ce420]
/lib/libc.so.6(abort+0xf8)[0x316678]
/lib/libc.so.6(__assert_fail+0xfd)[0x30e269]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(_ZN16Diagnostics_area14set_eof_statusEP3THD+0x5c)[0x82d7a46]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(_Z6my_eofP3THD+0x1e)[0x821b338]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(_ZN11select_send8send_eofEv+0x64)[0x82da388]
/users/ssmirnova/src/mysql-6.0/sql/mysqld[0x837e32c]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(_ZN4JOIN4execEv+0x217e)[0x8396192]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(_Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x33c)[0x83965f4]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(_Z13handle_selectP3THDP6st_lexP13select_resultm+0x1ec)[0x8396912]
/users/ssmirnova/src/mysql-6.0/sql/mysqld[0x8301cbb]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(_Z21mysql_execute_commandP3THD+0x731)[0x830755d]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(_Z11mysql_parseP3THDPKcjPS2_+0x22b)[0x831090f]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x8d9)[0x8311373]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(_Z10do_commandP3THD+0x23a)[0x83126d0]
/users/ssmirnova/src/mysql-6.0/sql/mysqld(handle_one_connection+0x11d)[0x82fea1d]
/lib/libpthread.so.0[0x45fbd4]
/lib/libc.so.6(__clone+0x5e)[0x3b74fe]
080904 22:18:59 - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.

key_buffer_size=1048576
read_buffer_size=131072
max_used_connections=1
max_threads=151
thread_count=1
connection_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 60039 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

thd: 0xacb0e68
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0xb671d448 thread_stack 0x30000
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at 0xad0c518 = SELECT * FROM t2 WHERE s1 = f()
thd->thread_id=1
thd->killed=NOT_KILLED
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.
Writing a core file

cut and pastable testcase:

DELIMITER //
DROP FUNCTION IF EXISTS f//
DROP TABLE IF EXISTS t2//
DROP TABLE IF EXISTS t3//
CREATE FUNCTION f() RETURNS INT
BEGIN
   DECLARE v INT;
   SELECT s1 INTO v FROM t3;
   RETURN 1;
END//
DELIMITER ;
CREATE TABLE t2 (s1 INT) engine=myisam;
INSERT INTO t2 VALUES (1);
SELECT * FROM t2 WHERE s1 = f();

Not reproduced in 6.0.
A test case pushed into 6.0-runtime.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/56503

2729 Alexander Nozdrin	2008-10-16
      A patch for Bug#39255: Stored procedures: crash if function
      references nonexistent table.
      
      The problem is not reproduced in 6.0. Adding a test case.

Pushed into 6.0.

No changelog entry needed.

Pushed into 6.0.8-alpha  (revid:alik@mysql.com-20081016123930-kf3ruo3uakw1x1bj) (version
source revid:alik@mysql.com-20081016123930-kf3ruo3uakw1x1bj) (pib:5)

A test case was pushed into 5.5.0.

A change log entry should not be required.
Moving to Documenting just to follow the procedure.

Test case change. No changelog entry required.

Pushed into 6.0.14-alpha (revid:alik@sun.com-20091102151658-j9o4wgro47m5v84d) (version
source revid:alik@sun.com-20091023064702-2f8jdmny61bdl94u) (merge vers: 6.0.14-alpha)
(pib:13)

Pushed into 5.5.0-beta (revid:alik@sun.com-20091110093229-0bh5hix780cyeicl) (version
source revid:mikael@mysql.com-20091103113702-p61dlwc6ml6fxg18) (merge vers: 5.5.0-beta)
(pib:13)

Test case change. No changelog entry needed.