MySQL Bugs: #5240: Stored procedure crash if function has cursor declaration

Bug #5240	Stored procedure crash if function has cursor declaration
Submitted:	26 Aug 2004 21:47	Modified:	9 Feb 2005 13:17
Reporter:	Peter Gulutzan	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server	Severity:	S3 (Non-critical)
Version:	5.0.2-alpha-debug	OS:	Linux (SuSE 8.2)
Assigned to:	Per-Erik Martin	CPU Architecture:	Any

Description:
It should be impossible to access a table from within a function. I can get around that by 
opening a cursor. The result is a crash. 
 

How to repeat:
mysql> delimiter // 
mysql> create table t300 (s1 int)// 
Query OK, 0 rows affected (0.04 sec) 
 
mysql> insert into t300 values (1)// 
Query OK, 1 row affected (0.00 sec) 
 
mysql> create function f300 () returns int begin declare c cursor for select * from t300; open 
c; return 5; end;// 
Query OK, 0 rows affected (0.00 sec) 
 
mysql> select s1, f300() from t300// 
ERROR 2013 (HY000): Lost connection to MySQL server during query

(gdb) bt
#0  0xffffe410 in ?? ()
#1  0x410b322c in ?? ()
#2  0x00000006 in ?? ()
#3  0x4e3b3872 in abort () from /lib/tls/libc.so.6
#4  0x4e3ab718 in __assert_fail () from /lib/tls/libc.so.6
#5  0x081d07b8 in lock_tables(THD*, st_table_list*, unsigned) (thd=0x86bd8e0, tables=0x86f59c8, count=1) at sql_base.cc:1796
#6  0x081d06f0 in open_and_lock_tables(THD*, st_table_list*) (thd=0x86bd8e0, tables=0x86f59c8) at sql_base.cc:1763
#7  0x081a7a19 in mysql_execute_command(THD*) (thd=0x86bd8e0) at sql_parse.cc:2001
#8  0x082aec6f in sp_instr_stmt::exec_stmt(THD*, st_lex*) (this=0x86f5b00, thd=0x86bd8e0, lex=0x86f92b0) at sp_head.cc:1167
#9  0x082affcb in sp_instr_copen::execute(THD*, unsigned*) (this=0x86f5b00, thd=0x86bd8e0, nextp=0x0) at sp_head.cc:1595
#10 0x082aca51 in sp_head::execute(THD*) (this=0x86f5708, thd=0x86bd8e0) at sp_head.cc:464
#11 0x082ace8d in sp_head::execute_function(THD*, Item**, unsigned, Item**) (this=0x86f5708, thd=0x86bd8e0, argp=0x0, argcount=0, resp=0x0) at sp_head.cc:571
#12 0x0812cb4a in Item_func_sp::execute(Item**) (this=0x86ec168, itp=0x0) at item_func.cc:3299
#13 0x081356ef in Item_func_sp::val_int() (this=0x86ec168) at item_func.h:1131
#14 0x081142a2 in Item::send(Protocol*, String*) (this=0x86ec168, protocol=0x86be1ec, buffer=0x410b3ca0) at item.cc:1883
#15 0x08181f92 in select_send::send_data(List<Item>&) (this=0x86ec420, items=@0x86be1ec) at sql_class.cc:761
#16 0x081eb07d in end_send (join=0x86ec430, join_tab=0x86ed5ec, end_of_records=false) at sql_select.cc:8399
#17 0x081e953a in do_select (join=0x86ec430, fields=0x86ed5ec, table=0x0, procedure=0x0) at sql_select.cc:7465
#18 0x081dbec7 in JOIN::exec() (this=0x86ec430) at sql_select.cc:1550
#19 0x081dcbb4 in mysql_select(THD*, Item***, st_table_list*, unsigned, List<Item>&, Item*, unsigned, st_order*, st_order*, Item*, st_order*, unsigned long, select_result*, st_select_lex_unit*, st_select_lex*) (thd=0x86bd8e0, rref_pointer_array=0x86bdbac, tables=0x86ec230, wild_num=0, fields=@0x0, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=42224128, result=0x86ec420, unit=0x86bd920, select_lex=0x86bdaac) at sql_select.cc:1972
#20 0x081d8356 in handle_select(THD*, st_lex*, select_result*) (thd=0x86bd8e0, lex=0x86bd914, result=0x86ec420) at sql_select.cc:209
#21 0x081a7c6a in mysql_execute_command(THD*) (thd=0x86bd8e0) at sql_parse.cc:2039
#22 0x081ae33a in mysql_parse(THD*, char*, unsigned) (thd=0x86bd8e0, inBuf=0x86ec060 "select s1, f300() from t300", length=141285652) at sql_parse.cc:4432
#23 0x081a66f7 in dispatch_command(enum_server_command, THD*, char*, unsigned) (command=COM_QUERY, thd=0x86bd8e0, packet=0x86e4001 "", packet_length=28) at sql_parse.cc:1486
#24 0x081a5fec in do_command(THD*) (thd=0x86bd8e0) at sql_parse.cc:1296
#25 0x081a545d in handle_one_connection (arg=0x0) at sql_parse.cc:1032
#26 0x4e5c798c in start_thread () from /lib/tls/libpthread.so.0
#27 0x4e44616a in clone () from /lib/tls/libc.so.6

fixed in 5.0.3