Bug #11722 InnoDB crash with prepared statement and committed transaction
Submitted: 4 Jul 2005 13:03 Modified: 4 Jul 2005 14:27
Reporter: Georg Richter Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server Severity:S1 (Critical)
Version:5.0.9-beta OS:Linux (Linux)
Assigned to: CPU Architecture:Any

[4 Jul 2005 13:03] Georg Richter
Description:
When committing an open transaction after mysql_stmt_execute (cursor) server crashes.

Output from gdb:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1442732976 (LWP 935)]
0x08337009 in trx_free (trx=0x42278068) at trx0trx.c:286
286             ut_a(trx->conc_state == TRX_NOT_STARTED);
Current language:  auto; currently c
(gdb) bt
#0  0x08337009 in trx_free (trx=0x42278068) at trx0trx.c:286
#1  0x083375e7 in trx_free_for_mysql (trx=0x42278068) at trx0trx.c:342
#2  0x0826fcff in innobase_close_connection (thd=0x8c40a20) at ha_innodb.cc:2121
#3  0x08260f9b in ha_close_connection (thd=0x8c40a20) at handler.cc:514
#4  0x0817a90e in ~THD (this=0x8c40a20) at sql_class.cc:405
#5  0x0818cb97 in end_thread (thd=0x8c40a20, put_in_cache=true) at mysqld.cc:1504
#6  0x081a29d8 in handle_one_connection (arg=0x8c40a20) at sql_parse.cc:1150
#7  0x400569dd in start_thread () from /lib/tls/libpthread.so.0
#8  0x40180ffa in clone () from /lib/tls/libc.so.6
(gdb)

How to repeat:

#include <stdio.h>
#include <mysql.h>

int main () {
	MYSQL *mysql;
	MYSQL_STMT *stmt;

	char *stmtstr = "SELECT a FROM t4";
	ulong cursortype = CURSOR_TYPE_READ_ONLY;

	mysql = mysql_init(NULL);
	mysql_real_connect(mysql, "localhost", "root", "", "test", 0, NULL, 0);

	mysql_query(mysql, "DROP TABLE IF EXISTS t3");
	mysql_query(mysql, "DROP TABLE IF EXISTS t4");
	mysql_query(mysql, "CREATE TABLE t3 (a int) engine=InnoDB");
	mysql_query(mysql, "CREATE TABLE t4 (a int) engine=InnoDB");

	mysql_query(mysql, "BEGIN");
	mysql_query(mysql, "INSERT INTO t3 VALUES (1),(2),(3)");
	mysql_query(mysql, "COMMIT");

	mysql_query(mysql, "BEGIN");
	mysql_query(mysql, "INSERT INTO t4 VALUES (1),(2),(3)");

	stmt = mysql_stmt_init(mysql);
	mysql_stmt_prepare(stmt, stmtstr, strlen(stmtstr));
	
	mysql_stmt_execute(stmt);

	mysql_query(mysql, "COMMIT");

	while (!mysql_stmt_fetch(stmt))
		printf("*\n");

	mysql_stmt_close(stmt);
	mysql_close(mysql);
}
[4 Jul 2005 13:14] Marko Mäkelä
This can't be repeated from the mysql client. I'm trying to link the program against the client library (never done that before).
[4 Jul 2005 13:32] Marko Mäkelä
I couldn't repeat this with a few days old version
(ChangeSet@1.1973.1.35, 2005-06-29 16:41:49+02:00, msvensson@neptunus).
[4 Jul 2005 14:19] Georg Richter
Bug was fixed on Friday already by Heikki (fix for #3300.)
[4 Jul 2005 14:27] Heikki Tuuri
Georg,

the bug fix of bug #3300 concerned optimization of locking if innodb_locks_unsafe_for_binlog is set. I do not see how it could fix this crash.

There are several crash bugs with prepared statements:

http://bugs.mysql.com/search.php?search_for=prepared&limit=90&order_by=id&direction=DESC&c...

and it may be some of the fixes has been pushed in the past few days.

I am closing this bug report now.

Regards,

Heikki