MySQL Bugs: #32115: Bad use of Name_resolution_context from current LEX in partitioning

Bug #32115	Bad use of Name_resolution_context from current LEX in partitioning
Submitted:	5 Nov 2007 14:59	Modified:	7 Mar 2010 18:50
Reporter:	Ingo Strüwing	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: Partitions	Severity:	S2 (Serious)
Version:	5.5.0	OS:	Any
Assigned to:	Mattias Jonsson	CPU Architecture:	Any

Description:
Detected during analyze of Bug#31210 - INSERT DELAYED crashes server when used on partitioned table.

Two places in which code responsible for opening partitioned tables
accesses to current statement's LEX in such way that it causes problems
are mysql_unpack_partition() and fix_fields_part_func() (there are other
places in which we access LEX::sql_command but this is probably OK as
this member is always initialized).

In case of mysql_unpack_partition() we even already use proxy LEX object
for parsing of PARTITION clause from .FRM file, but for some reason
(probably legacy from older version of code) we perfer to borrow
Name_resolution_context from original LEX instead of using one which
is native to proxy LEX. IMO it is safe to use Name_resolution_context
from proxy LEX here since later we will replace all references to it 
by applying Item::change_context_processor to item tree anyway.

In case of fix_fields_part_func() we temporarily use
Name_resolution_context from the current statement's LEX to perform
field name resolutions. But since before doing this we replace all
relevant members in the context with our own values we can probably
as well use any other Name_resolution_context/LEX (i.e. proxy LEX).

One possible concern here is dangling references from Item trees
representing partitioning functions to these proxy LEX objects 
(e.g. Item_field is based on Item_ident which contains reference
to Name_resolution_context).

But this concern is relevant for both of these approaches. In the
first approach (as well as current code) these Item trees, life-time
of which is determined by the life-time of TABLE object, reference
Name_resolution_context from the statement which opened this table
first (or required creation of additional TABLE object, to be exact),
life-time of which is different.

Actually I think that these dangling references do not affect usage
of those Item trees in any way since we don't use these references
to context from Item_field::val_() methods (right?). For additional
safety/to catch bugs earlier we can in set these references to 0
in debug builds (using the same change_context_processor).

This fix is meant to go into 6.0, while the quck fix for #31210
shall go into 5.1.

How to repeat:
Temporarily remove the fix for Bug#31210 - INSERT DELAYED crashes server when used on partitioned table. Then do:

CREATE TABLE t1 ( a INT ) ENGINE = MyISAM PARTITION BY HASH(a) PARTITIONS 4;
INSERT DELAYED INTO t1 VALUES (1);
ERROR 2013 (HY000): Lost connection to MySQL server during query

Since it was agreed that in 6.0 we do not have a dependency between LEX and open_tables, I'm removing this assert from 6.0:
=== modified file 'sql/sql_base.cc'
--- sql/sql_base.cc	2008-11-18 19:41:51 +0000
+++ sql/sql_base.cc	2008-11-27 15:31:04 +0000
@@ -2347,9 +2347,6 @@ bool open_table(THD *thd, TABLE_LIST *ta
   TABLE_SHARE *share;
   DBUG_ENTER("open_table");
 
-  /* Parsing of partitioning information from .frm needs thd->lex set up. */
-  DBUG_ASSERT(thd->lex->is_lex_started);
-
   *action= OT_NO_ACTION;
 
   /* an open table operation needs a lot of the stack space */

In other words, this bug *must* be fixed in 6.0, otherwise we'll get regressions.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/60079

2755 Konstantin Osipov	2008-11-27
      Bug#32115 will remove the pre-requisite to initialize LEX to open tables.
      This dependency was added in 5.1 and was supposed to be removed in 6.0.
      Remove asserts and initialization of LEX in places where we don't deal
      with partitioned tables.

Pushed into 6.0.9-alpha  (revid:kostja@sun.com-20081127163609-6da53ewn1h3r1k7h) (version source revid:kostja@sun.com-20081127163609-6da53ewn1h3r1k7h) (pib:5)

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/79533

3477 Mikael Ronstrom	2009-07-29
      Bug#32115, made use of local lex object to avoid side effects of opening partitioned tables
      modified:
        sql/sql_partition.cc

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/79536

3478 Mikael Ronstrom	2009-07-29
      Bug#32115, added an extra test in debug builds to ensure no dangling pointers to the old lex object is still around
      modified:
        sql/sql_partition.cc

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/79552

3479 Mikael Ronstrom	2009-07-29
      Bug#32115, Removed an assert that was no longer needed
      modified:
        sql/table.cc

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/80156

3480 Mikael Ronstrom	2009-08-05
      Bug#32115, fixed review comments
      modified:
        sql/sql_partition.cc

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/80340

3481 Mikael Ronstrom	2009-08-07
      Bug#32115, remove now obsolete lex_start calls
      modified:
        libmysqld/lib_sql.cc
        sql/event_data_objects.cc
        sql/ha_ndbcluster.cc
        sql/ha_ndbcluster_binlog.cc
        sql/slave.cc
        sql/sql_insert.cc
        sql/sql_partition.cc

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/80581

3526 Mattias Jonsson	2009-08-11 [merge]
      merge of bug#32115

Checked for crashes as in both bug#31210 and bug#40281 before pushing into mysql-pe

Pushed into 5.4.4-alpha (revid:alik@sun.com-20090914155317-m1g9wodmndzdj4l1) (version source revid:alik@sun.com-20090914155317-m1g9wodmndzdj4l1) (merge vers: 5.4.4-alpha) (pib:11)

Documented bugfix in the 5.4.4 changelog as follows:

        Portions of the partitioning code were refactored in response to
        potential regression issues uncovered while working on the fix
        for Bug #31210.
      
Closed.

The fix for this bug has been documented for 5.4.4,
but the code changed is not present in mysql-next-mr (5.5.0).

In particular, DBUG_ASSERT(thd->lex->is_lex_started) is still present,
and the various lex_start() calls that were removed with patches attached to this
bug report are still present in the code.

Changing the bug status to verified.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/91001

2956 Mattias Jonsson	2009-11-20
      Bug#32115: Bad use of Name_resolution_context from current LEX in partitioning
      
      port from mysql-next (5.4) to mysql-next-mr-bugfixing (5.5/5.6?)
      
      2755 Konstantin Osipov	2008-11-27
      Bug#32115 will remove the pre-requisite to initialize LEX to open tables.
      This dependency was added in 5.1 and was supposed to be removed in 6.0.
      Remove asserts and initialization of LEX in places where we don't deal
      with partitioned tables.
     @ sql/sp_head.cc
        Fix a typo.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/91007

2957 Mattias Jonsson	2009-11-20
      Bug#32115: Bad use of Name_resolution_context from current LEX in partitioning
      
      port from mysql-next (5.4?) to mysql-next-mr-bugfixes (5.5/5.6?)
      
      3477 Mikael Ronstrom	2009-07-29
      Bug#32115, made use of local lex object to avoid side effects of opening partitioned
      tables
      
      3478 Mikael Ronstrom	2009-07-29
      Bug#32115, added an extra test in debug builds to ensure no dangling pointers to the
      old lex object is still around
      
      3479 Mikael Ronstrom	2009-07-29
      Bug#32115, Removed an assert that was no longer needed
      
      3480 Mikael Ronstrom	2009-08-05
      Bug#32115, fixed review comments
      
      3481 Mikael Ronstrom	2009-08-07
      Bug#32115, remove now obsolete lex_start calls

pushed to mysql-next-mr-bugfixing

Pushed into 6.0.14-alpha (revid:alik@sun.com-20091211055901-yp18b3c7xuhl87rf) (version source revid:alik@sun.com-20091211055401-43rjwq7gjed6ds83) (merge vers: 6.0.14-alpha) (pib:13)

Pushed into 5.6.0-beta (revid:alik@sun.com-20091211055628-ltr7fero363uev7r) (version source revid:alik@sun.com-20091211055453-717czhtezc74u8db) (merge vers: 5.6.0-beta) (pib:13)

Also noted in the 5.6.0 and 6.0.14 changelogs.

Was this ever pushed to 5.5?

No, I have not pushed this to mysql-trunk and I just verified that the patch is not there (5.5.0-beta according to configure.in).

Hi! Thanks for confirming (my skills with bzr are not the greatest).

Looks like it *should* go into 5.5 (P2/S2/D1/W1), but I'm closing for now to get it off my dashboard.

It should get automatically set back to Documenting whenever it gets pushed to another tree; I'll add the appropriate changelog entry when that happens.

Pushed into 5.5.3-m3 (revid:alik@sun.com-20100306103849-hha31z2enhh7jwt3) (version source revid:vvaintroub@mysql.com-20091211201717-03qf8ckwiw0np80p) (merge vers: 5.6.0-beta) (pib:16)

Moved 5.6.0 changelog entry to 5.5.3.