Bug #20110 server crash when querying the information schema about a view with a function
Submitted: 28 May 2006 8:59 Modified: 5 Jul 2006 18:28
Reporter: Giuseppe Maxia Email Updates:
Status: Can't repeat Impact on me:
None 
Category:MySQL Server: Information schema Severity:S1 (Critical)
Version:5.0.21,5.0.23-bk,5.1.12-bk OS:Linux (Linux,Windows)
Assigned to: Igor Babaev CPU Architecture:Any

[28 May 2006 8:59] Giuseppe Maxia
Description:
You have a view that calls a function in its WHERE clause, and that function contains DML commands.
In this situation, if you query the information_schema TWICE about your tables, it will crash

The query, from a stored procedure, was 
 select count(*) into exec_result from information_schema.tables where table_schema=database()

+------------+
| version()  |
+------------+
| 5.0.21-max |
+------------+
1 row in set (0.04 sec)

gmdesk [localhost] {gmax} (test) > call tbug();
+-------------+
| exec_result |
+-------------+
| 3           |
+-------------+
1 row in set (0.03 sec)

Query OK, 0 rows affected (0.03 sec)

gmdesk [localhost] {gmax} (test) > call tbug();
ERROR 2013 (HY000): Lost connection to MySQL server during query

and the resulting stack trace is the following:
0x818e082 handle_segfault + 426
0x89f420 (?)
(nil)
0x8283a1a exec_core__13sp_instr_stmtP3THDPUi + 26
0x82837d6 reset_lex_and_exec_core__13sp_lex_keeperP3THDPUibP8sp_instr + 234
0x82838fd execute__13sp_instr_stmtP3THDPUi + 141
0x8281493 execute__7sp_headP3THD + 855
0x828207d execute_procedure__7sp_headP3THDPt4List1Z4Item + 733
0x81a4533 mysql_execute_command__FP3THD + 18863
0x81a6c38 mysql_parse__FP3THDPcUi + 288
0x819e646 dispatch_command__F19enum_server_commandP3THDPcUi + 1894
0x819ded3 do_command__FP3THD + 195
0x819d414 handle_one_connection + 764
0xd46b80 (?)
0xbc8dee (?)

How to repeat:
create database if not exists test;
use test;

set global log_bin_trust_function_creators=1;

drop table if exists t1;
create table t1 ( id int not null primary key);

drop table if exists log_table;
create table log_table (ts timestamp, t text);

delimiter //

drop function if exists f1 //
create function f1()
returns int
begin
    insert into log_table values (null, 'inside f1' ) ;
    return 1;
end//

drop procedure if exists tbug //
create procedure tbug ( )
begin
    declare exec_result text;
    select count(*) into exec_result from information_schema.tables where table_schema=database() ;
    select exec_result;
end//

delimiter ;

create or replace view v1 as select id from t1 where f1();
select version();
call tbug();
call tbug();
[28 May 2006 18:24] MySQL Verification Team
verified on 5.1.12-bk and 5.0.23-bk on linux (fc4).
verified on 5.0.23-bk on windows too.

check_table_access(THD * thd=0x014896e0, unsigned long want_access=0x00000001, st_table_list * tables=0x00000000, int no_errors=0x00000000)
mysql_execute_command(THD * thd=0x014896e0)  
sp_instr_stmt::exec_core(THD * thd=0x014896e0, unsigned int * nextp=0x044de394) 
sp_lex_keeper::reset_lex_and_exec_core(THD * thd=0x014896e0, unsigned int * nextp=0x044de394, int open_tables=0x00000000, sp_instr * instr=0x03246068)
sp_instr_stmt::execute(THD * thd=0x014896e0, unsigned int * nextp=0x044de394) 
sp_head::execute(THD * thd=0x014896e0)
sp_head::execute_procedure(THD * thd=0x014896e0, List<Item> * args=0x01489c24)  
mysql_execute_command(THD * thd=0x014896e0)  
mysql_parse(THD * thd=0x014896e0, char * inBuf=0x0322a238, unsigned int length=0x0000000b) 
dispatch_command(enum_server_command command=COM_QUERY, THD * thd=0x014896e0, char * packet=0x03222169, unsigned int packet_length=0x0000000c) 
do_command(THD * thd=0x014896e0)  
handle_one_connection(void * arg=0x014896e0)  
pthread_start(void * param=0x0148ffe0)  
_threadstart(void * ptd=0x031f91d8)
[30 May 2006 23:03] MySQL Verification Team
today's 5.0BK doesn't crash anymore. 5.1BK still crashed.
[5 Jul 2006 17:37] MySQL Verification Team
I was unable to repeat on 5.0/5.1 current BK source:

mysql> call tbug();
+-------------+
| exec_result |
+-------------+
| 18          | 
+-------------+
1 row in set (0.03 sec)

Query OK, 0 rows affected (0.03 sec)

mysql> call tbug();
+-------------+
| exec_result |
+-------------+
| 18          | 
+-------------+
1 row in set (0.03 sec)

Query OK, 0 rows affected (0.03 sec)

mysql> select version();
+-------------------+
| version()         |
+-------------------+
| 5.1.12-beta-debug | 
+-------------------+
1 row in set (0.01 sec)

mysql>
[5 Jul 2006 18:28] Giuseppe Maxia
I don't understand this change of status.
The bug is repeatable (and it was independently verified) in the versions for which I submitted it, namely 5.0.21, 5.0.22, 5.1.10, and 5.1.11.
Saying "cant' repeat" in a newer version means that the bug is fixed, doesn't it?
I can see that the system does not crash in the latest 5.1.12-bk, but I haven't seen any mention of a patch regarding this bug. Perhaps it was fixed as a side effect from a patch to some other bug. If that's the case, it should be mentioned here. 
Will you change its status accordingly? IMO, it should be either "Verified" or "Closed".

Thanks

Giuseppe