Fixed BUG#5287: Stored procedure crash if leave outside loop.

Bug in diff_handlers and diff_cursors made it attempt to pop
the wrong number at jumps sometimes.

4 files changed, 33 insertions, 7 deletions

diff --git a/mysql-test/r/sp.result b/mysql-test/r/sp.result
index 9abb60634d9..8b20ae68dce 100644
--- a/mysql-test/r/sp.result
+++ b/mysql-test/r/sp.result
@@ -1764,6 +1764,18 @@ call bug5251()|
 Table	Checksum
 test.t1	0
 drop procedure bug5251|
+create procedure bug5287(param1 int)
+label1:
+begin
+declare c cursor for select 5;
+loop
+if param1 >= 0 then
+leave label1;
+end if;
+end loop;
+end|
+call bug5287(1)|
+drop procedure bug5287|
 drop table if exists fac|
 create table fac (n int unsigned not null primary key, f bigint unsigned)|
 create procedure ifac(n int unsigned)
diff --git a/mysql-test/t/sp.test b/mysql-test/t/sp.test
index 0c3bda1311c..c420865b2b3 100644
--- a/mysql-test/t/sp.test
+++ b/mysql-test/t/sp.test
@@ -1924,6 +1924,23 @@ call bug5251()|
 call bug5251()|
 drop procedure bug5251|
 
+#
+# BUG#5287: Stored procedure crash if leave outside loop
+#
+create procedure bug5287(param1 int)
+label1:
+  begin
+    declare c cursor for select 5;
+
+    loop
+      if param1 >= 0 then
+        leave label1;
+      end if;
+    end loop;
+end|
+call bug5287(1)|
+drop procedure bug5287|
+
 
 #
 # Some "real" examples
diff --git a/sql/sp_pcontext.cc b/sql/sp_pcontext.cc
index c83259c3926..3b60f0936f9 100644
--- a/sql/sp_pcontext.cc
+++ b/sql/sp_pcontext.cc
@@ -28,7 +28,7 @@
 
 sp_pcontext::sp_pcontext(sp_pcontext *prev)
   : Sql_alloc(), m_psubsize(0), m_csubsize(0), m_hsubsize(0),
-    m_parent(prev), m_handlers(0)
+    m_handlers(0), m_parent(prev)
 {
   VOID(my_init_dynamic_array(&m_pvar, sizeof(sp_pvar_t *), 16, 8));
   VOID(my_init_dynamic_array(&m_cond, sizeof(sp_cond_type_t *), 16, 8));
@@ -94,7 +94,7 @@ sp_pcontext::diff_handlers(sp_pcontext *ctx)
 
   while (pctx && pctx != ctx)
   {
-    n+= pctx->max_handlers();
+    n+= pctx->m_handlers;
     pctx= pctx->parent_context();
   }
   if (pctx)
@@ -109,12 +109,9 @@ sp_pcontext::diff_cursors(sp_pcontext *ctx)
   sp_pcontext *pctx= this;
 
   while (pctx && pctx != ctx)
-  {
-    n+= pctx->max_cursors();
     pctx= pctx->parent_context();
-  }
   if (pctx)
-    return n;
+    return ctx->current_cursors() - pctx->current_cursors();
   return 0;			// Didn't find ctx
 }
 
diff --git a/sql/sp_pcontext.h b/sql/sp_pcontext.h
index 6db62614aa5..36e4ed06aa7 100644
--- a/sql/sp_pcontext.h
+++ b/sql/sp_pcontext.h
@@ -275,6 +275,7 @@ protected:
   uint m_psubsize;		
   uint m_csubsize;
   uint m_hsubsize;
+  uint m_handlers;		// No. of handlers in this context
 
 private:
 
@@ -282,7 +283,6 @@ private:
 
   uint m_poffset;		// Variable offset for this context
   uint m_coffset;		// Cursor offset for this context
-  uint m_handlers;		// No. of handlers in this context
 
   DYNAMIC_ARRAY m_pvar;		// Parameters/variables
   DYNAMIC_ARRAY m_cond;		// Conditions