Bug#30882 Dropping a temporary table inside a stored function may cause a server crash

If a stored function that contains a drop temporary table statement
is invoked by a create temporary table of the same name may cause
a server crash. The problem is that when dropping a table no check
is done to ensure that table is not being used by some outer query
(or outer statement), potentially leaving the outer query with a
reference to a stale (freed) table.

The solution is when dropping a temporary table, always check if
the table is being used by some outer statement as a temporary
table can be dropped inside stored procedures.

The check is performed by looking at the TABLE::query_id value for
temporary tables. To simplify this check and to solve a bug related
to handling of temporary tables in prelocked mode, this patch changes
the way in which this member is used to track the fact that table is
used/unused. Now we ensure that TABLE::query_id is zero for unused
temporary tables (which means that all temporary tables which were
used by a statement should be marked as free for reuse after it's
execution has been completed).

1 files changed, 62 insertions, 0 deletions

diff --git a/mysql-test/r/handler_innodb.result b/mysql-test/r/handler_innodb.result
index e9e5c7dbdd5..d9a1a0aa12b 100644
--- a/mysql-test/r/handler_innodb.result
+++ b/mysql-test/r/handler_innodb.result
@@ -575,3 +575,65 @@ ERROR 42S02: Table 'test.t1' doesn't exist
 handler t1 close;
 handler t2 close;
 drop table t2;
+drop table if exists t1;
+create temporary table t1 (a int, b char(1), key a(a), key b(a,b));
+insert into t1 values (0,"a"),(1,"b"),(2,"c"),(3,"d"),(4,"e"),
+(5,"f"),(6,"g"),(7,"h"),(8,"i"),(9,"j");
+select a,b from t1;
+a	b
+0	a
+1	b
+2	c
+3	d
+4	e
+5	f
+6	g
+7	h
+8	i
+9	j
+handler t1 open as a1;
+handler a1 read a first;
+a	b
+0	a
+handler a1 read a next;
+a	b
+1	b
+handler a1 read a next;
+a	b
+2	c
+select a,b from t1;
+ERROR HY000: Can't reopen table: 'a1'
+handler a1 read a prev;
+a	b
+1	b
+handler a1 read a prev;
+a	b
+0	a
+handler a1 read a=(6) where b="g";
+a	b
+6	g
+handler a1 close;
+select a,b from t1;
+a	b
+0	a
+1	b
+2	c
+3	d
+4	e
+5	f
+6	g
+7	h
+8	i
+9	j
+handler t1 open as a2;
+handler a2 read a first;
+a	b
+0	a
+handler a2 read a last;
+a	b
+9	j
+handler a2 read a prev;
+a	b
+8	i
+handler a2 close;
+drop table t1;