MySQL Bugs: #51357: crash when using handler commands on spatial indexes

Bug #51357	crash when using handler commands on spatial indexes
Submitted:	20 Feb 2010 20:47	Modified:	18 Jun 2010 1:54
Reporter:	Shane Bester (Platinum Quality Contributor)	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: GIS	Severity:	S1 (Critical)
Version:	4.1.25,5.0.90,5.1.45,5.5.1-m2,5.5.99-m3	OS:	Any
Assigned to:	Georgi Kodinov	CPU Architecture:	Any
Tags:	crash, handler, spatial

Description:
5.1.44 stack trace:

mysqld.exe!rtree_get_next()[rt_index.c:415]
mysqld.exe!mi_rnext()[mi_rnext.c:69]
mysqld.exe!ha_myisam::index_next()[ha_myisam.cc:1683]
mysqld.exe!mysql_ha_read()[sql_handler.cc:566]
mysqld.exe!mysql_execute_command()[sql_parse.cc:4055]
mysqld.exe!mysql_parse()[sql_parse.cc:5975]
mysqld.exe!dispatch_command()[sql_parse.cc:1235]
mysqld.exe!do_command()[sql_parse.cc:874]
mysqld.exe!handle_one_connection()[sql_connect.cc:1127]
mysqld.exe!pthread_start()[my_winthread.c:85]
mysqld.exe!_callthreadstart()[thread.c:295]
mysqld.exe!_threadstart()[thread.c:275]

How to repeat:
drop table if exists t1;
create table if not exists t1(a geometry not null,spatial index a(a));
handler `t1` open;
handler `t1` read `a` first;
handler `t1` read `a` next;

Thank you for the bug report. Verified just as described on Mac OS X.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/101598

3358 Georgi Kodinov	2010-02-26
      Bug #51357: crash when using handler commands on spatial indexes
      
      Spatial indexes were not checking for out-of-record condition in
      the handler next command when the previous command didn't found
      rows.
      
      Fixed by making the rtree index to check for end of rows condition
      before re-using the key from the previous search.

Ramil has found a new crashing scenario (even with my fix): 
CREATE TABLE t1(a GEOMETRY NOT NULL,SPATIAL INDEX a(a));
HANDLER t1 OPEN;
HANDLER t1 READ a FIRST;
INSERT INTO t1 VALUES (GeomFromText('Polygon((40 40,60 40,60 60,40 60,40 40))'));
HANDLER t1 READ a NEXT;
HANDLER t1 CLOSE;
DROP TABLE t1;

Looking into it now.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/102352

3358 Georgi Kodinov	2010-03-04
      Bug #51357: crash when using handler commands on spatial indexes
      
      Spatial indexes were not checking for out-of-record condition in
      the handler next command when the previous command didn't found
      rows.
      
      Fixed by making the rtree index to check for end of rows condition
      before re-using the key from the previous search.
      
      Fixed another crash if the tree has changed since the last search.
      Added a test case for the other error.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/102549

3373 Georgi Kodinov	2010-03-04
      Bug #51357: crash when using handler commands on spatial indexes
      
      Spatial indexes were not checking for out-of-record condition in
      the handler next command when the previous command didn't found
      rows.
      
      Fixed by making the rtree index to check for end of rows condition
      before re-using the key from the previous search.
      
      Fixed another crash if the tree has changed since the last search.
      Added a test case for the other error.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/102559

2849 Georgi Kodinov	2010-03-08
      Backport of the fix for bug #51357 to 5.0-bugteam.:
      
      Spatial indexes were not checking for out-of-record condition in
      the handler next command when the previous command didn't found
      rows.
      
      Fixed by making the rtree index to check for end of rows condition
      before re-using the key from the previous search.
      
      Fixed another crash if the tree has changed since the last search.
      Added a test case for the other error.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/102758

3380 Georgi Kodinov	2010-03-09
      Disable the second part of the test for bug #51357 until bug #51877 is fixed.

Pushed into 5.5.4-m3 (revid:alik@sun.com-20100326080914-2pz8ns984e0spu03) (version source revid:alexey.kopytov@sun.com-20100312095153-t4rtoqc7p96lmxvh) (merge vers: 5.5.3-m2) (pib:16)

Pushed into mysql-next-mr (revid:alik@sun.com-20100326081116-m3v4l34yhr43mtsv) (version source revid:alik@sun.com-20100325072612-4sds00ix8ajo1e84) (pib:16)

Pushed into 6.0.14-alpha (revid:alik@sun.com-20100326081944-qja07qklw1p2w7jb) (version source revid:alik@sun.com-20100325073410-4t4i9gu2u1pge7xb) (merge vers: 6.0.14-alpha) (pib:16)

Pushed into 5.0.91 (revid:joro@sun.com-20100406075152-flz4btqirl9hly31) (version source revid:joro@sun.com-20100308103957-byh54e6q91b5h4om) (merge vers: 5.0.91) (pib:16)

Pushed into 5.1.46 (revid:sergey.glukhov@sun.com-20100405111026-7kz1p8qlzglqgfmu) (version source revid:joro@sun.com-20100309170015-3ajklvjyjsby9a18) (merge vers: 5.1.45) (pib:16)

Noted in 5.0.91, 5.1.46, 5.5.5, 6.0.14 changelogs.

Use of HANDLER statements with tables that had spatial indexes caused
a server crash.

Pushed into 5.1.47-ndb-7.0.16 (revid:martin.skold@mysql.com-20100617114014-bva0dy24yyd67697) (version source revid:vasil.dimov@oracle.com-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

Pushed into 5.1.47-ndb-6.2.19 (revid:martin.skold@mysql.com-20100617115448-idrbic6gbki37h1c) (version source revid:martin.skold@mysql.com-20100609211156-tsac5qhw951miwtt) (merge vers: 5.1.46-ndb-6.2.19) (pib:16)

Pushed into 5.1.47-ndb-6.3.35 (revid:martin.skold@mysql.com-20100617114611-61aqbb52j752y116) (version source revid:vasil.dimov@oracle.com-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)