# Test for use-after-free in cli_read_rows_nonblocking when connection is killed # during result set row reading. --source include/have_debug.inc --source include/count_sessions.inc --enable_async_client --echo # Create a large table with 100 rows CREATE TABLE t1 (id INT AUTO_INCREMENT PRIMARY KEY, data VARCHAR(1000)) ENGINE=InnoDB; --disable_query_log let $i = 100; while ($i) { eval INSERT INTO t1 (data) VALUES (REPEAT('x', 500)); dec $i; } --enable_query_log connect (con1, localhost, root,,); connect (con2, localhost, root,,); connection con1; --disable_reconnect let $con1_id = `SELECT CONNECTION_ID()`; --echo # Select with SLEEP at row 50 - server processes first 49 rows, then waits send SELECT id, IF(id=50, SLEEP(30), 0) AS s, data FROM t1 ORDER BY id; connection con2; --echo # Wait for query to be in User sleep state (at row 50) let $wait_condition = SELECT COUNT(*) = 1 FROM information_schema.processlist WHERE id = $con1_id AND state = 'User sleep'; --source include/wait_condition.inc --echo # Kill connection while client is reading rows eval KILL CONNECTION $con1_id; connection con1; --echo # Reap should fail due to killed connection --error 1317,2013 reap; --echo # Cleanup --disable_async_client connection default; # Note: con1 is already killed, don't disconnect it disconnect con2; DROP TABLE t1; --source include/wait_until_count_sessions.inc