MySQL Bugs: #116754: Memory leak when migrate trigger during upgrade from 57 to 80

Bug #116754	Memory leak when migrate trigger during upgrade from 57 to 80
Submitted:	22 Nov 11:20	Modified:	25 Nov 10:46
Reporter:	Huaxiong Song (OCA)	Email Updates:
Status:	Verified	Impact on me:	None
Category:	MySQL Server: Data Dictionary	Severity:	S3 (Non-critical)
Version:	8.0	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
During upgrade from 5.7 to 8.0, memory leak can be found in `add_triggers_to_table`.

In function `add_triggers_to_table`, after call `d->parse_triggers(thd, &m_triggers, true)`, if error happen, it will return true directly. MySQL does not cleanup the trigger.

Code analysis:

Only when the trigger is created successfully, the related memory will be cleaned up.
```cpp
...
      // Cleanup for Trigger
      sp_head *sp = t->get_sp();
      sp_head *saved_sphead = thd->lex->sphead;
      thd->lex->sphead = sp;
      sp->m_parser_data.finish_parsing_sp_body(thd);
      thd->lex->sphead = saved_sphead;
      sp_head::destroy(sp);
...
```
However, there may be failures, in which case the server exits directly without cleaning up the memory, causing a memory leak.

How to repeat:
It is a code analysis, I think memory leak is obvious.

You can inject some failures to make `add_triggers_to_table` return true after `parse_triggers` is called.

Suggested fix:
Always clean up memory on exit

Hi Mr. Song,

Thank you for your bug report.

However, we do need a test case, so that we can check the memory leak.

Hence, a trigger, together with necessary table(s) would be necessary.

We would also need a description of how did you discover memory leak, whether it is Valgrind or AddressSanitizer or LeakSanitizer or similar. We do need some details of how have you built your binaries too.

Thanks a lot in advance.

I used debug packet to reproduce this problem:

1. Inject failed code here
```
diff --git a/sql/dd/upgrade_57/table.cc b/sql/dd/upgrade_57/table.cc
index bcba95ac771..a53290b4956 100644
--- a/sql/dd/upgrade_57/table.cc
+++ b/sql/dd/upgrade_57/table.cc
@@ -1217,6 +1217,8 @@ static bool add_triggers_to_table(THD *thd, TABLE *table,
 
       if (!t) break;
 
+      DBUG_EXECUTE_IF("error_happen_during_upgrade", return true; );
+
       Implicit_substatement_state_guard substatement_guard(thd);
 
       // Ordering of Triggers is taken care above, pass dummy arguments here.
```

2. Compile version 8.0.40 using debug + asan

3. Create trigger in MySQL 5.7
create database test;
use test;
CREATE TABLE t1(a int);
CREATE TRIGGER trigger1 BEFORE INSERT ON t1 FOR EACH ROW
SET @x = (SELECT "trigger");

4. Shutdown 5.7 and use 8.0.40 to startup with the data directory of 5.7, and debug variable should be set, like:
./runtime_output_directory/mysqld --defaults-file=/5744/etc/my.cnf --debug='+d, error_happen_during_upgrade'

You will find upgrade will failed, and memory leak can be report by ASAN.
```
=================================================================
==13714==ERROR: LeakSanitizer: detected memory leaks

Indirect leak of 6792 byte(s) in 3 object(s) allocated from:
    #0 0x7f082abc21ff in __interceptor_malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x5a5105b in redirecting_allocator /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/mysys/my_malloc.cc:280
    #2 0x5a514eb in my_raw_malloc<redirecting_allocator> /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/mysys/my_malloc.cc:323
    #3 0x5a51639 in my_internal_malloc<redirecting_allocator> /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/mysys/my_malloc.cc:373
    #4 0x5a51732 in my_malloc(unsigned int, unsigned long, int) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/mysys/my_malloc.cc:387
    #5 0x5a407ac in MEM_ROOT::AllocBlock(unsigned long, unsigned long) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/mysys/my_alloc.cc:90
    #6 0x5a40a1d in MEM_ROOT::AllocSlow(unsigned long) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/mysys/my_alloc.cc:123
    #7 0x30d6c7c in MEM_ROOT::Alloc(unsigned long) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/include/my_alloc.h:165
    #8 0x31b2b5c in st_lex_local::operator new(unsigned long, MEM_ROOT*, std::nothrow_t const&) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/sql_lex.h:4702
    #9 0x31a455d in sp_head::reset_lex(THD*) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/sp_head.cc:2947
    #10 0x37b5e99 in MYSQLparse(THD*, Parse_tree_root**) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/sql_yacc.yy:4930
    #11 0x322865a in THD::sql_parser() /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/sql_class.cc:3059
    #12 0x33af461 in parse_sql(THD*, Parser_state*, Object_creation_ctx*) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/sql_parse.cc:7135
    #13 0x36bfce8 in Trigger::parse(THD*, bool) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/trigger.cc:491
    #14 0x36ad11b in Table_trigger_dispatcher::parse_triggers(THD*, List<Trigger>*, bool) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/table_trigger_dispatcher.cc:460
    #15 0x59fc546 in add_triggers_to_table /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/dd/upgrade_57/table.cc:1130
    #16 0x5a03ed6 in migrate_table_to_dd /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/dd/upgrade_57/table.cc:1830
    #17 0x5a050c7 in dd::upgrade_57::migrate_all_frm_to_dd(THD*, char const*, bool) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/dd/upgrade_57/table.cc:1989
    #18 0x59ea914 in dd::upgrade_57::fill_dd_and_finalize(THD*) /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/dd/upgrade_57/upgrade.cc:1195
    #19 0x397ea86 in handle_bootstrap /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/sql/bootstrap.cc:328
    #20 0x6d95d0a in pfs_spawn_thread /home/songhuaxiong.shx/huaxiong.shx/code/mysql-server/storage/perfschema/pfs.cc:3050
    #21 0x7f082a904ea4 in start_thread /usr/src/debug/glibc-2.17-c758a686/nptl/pthread_create.c:307
...
```

I submitted fixes for bug#116750, bug#116751 and bug#116754 at https://bugs.mysql.com/bug.php?id=116750

Hi Mr. Song,

Thank you for your test case.

We were able to repeat it with 8.0.40.

We have got the ASAN report quite similar to yours.

This is now a verified bug.