Bug #57659 Segfault in Query_cache::invalidate_data for TRUNCATE TABLE

This crash could happen if TRUNCATE TABLE indirectly failed to open a
merge table due to failures to open underlying tables. Even if opening
failed, the TRUNCATE TABLE code would try to invalidate the table in
the query cache. Since this table had been closed and memory released,
this could lead to a crash.

This bug was introduced by a combination of the changes introduced by
the patch for Bug#52044, where failing to open a table will cause opened
tables to be closed. And the changes in patch for Bug#49938, where
TRUNCATE TABLE uses the standard open tables function.

This patch fixes the problem by setting the TABLE pointer to NULL before 
invalidating the query cache.

Test case added to truncate_coverage.test.

1 files changed, 27 insertions, 0 deletions

diff --git a/mysql-test/r/truncate_coverage.result b/mysql-test/r/truncate_coverage.result
index a7a4b9c70f4..728702f7ab5 100644
--- a/mysql-test/r/truncate_coverage.result
+++ b/mysql-test/r/truncate_coverage.result
@@ -78,3 +78,30 @@ COMMIT;
 UNLOCK TABLES;
 DROP TABLE t1;
 SET DEBUG_SYNC='RESET';
+#
+# Bug#57659 Segfault in Query_cache::invalidate_data for TRUNCATE TABLE
+#
+# Note that this test case only reproduces the problem
+# when it is run with valgrind.
+DROP TABLE IF EXISTS t1, m1;
+CREATE TABLE t1(a INT) engine=memory;
+CREATE TABLE m1(a INT) engine=merge UNION(t1);
+# Connection con1
+SET DEBUG_SYNC= 'open_tables_after_open_and_process_table SIGNAL opened WAIT_FOR dropped';
+# Sending:
+TRUNCATE TABLE m1;
+# Connection con2
+SET DEBUG_SYNC= 'now WAIT_FOR opened';
+# Sending:
+FLUSH TABLES;
+# Connection default
+# Waiting for FLUSH TABLES to be blocked.
+SET DEBUG_SYNC= 'now SIGNAL dropped';
+# Connection con1
+# Reaping: TRUNCATE TABLE m1
+ERROR HY000: Unable to open underlying table which is differently defined or of non-MyISAM type or doesn't exist
+# Connection con2
+# Reaping: FLUSH TABLES
+# Connection default
+SET DEBUG_SYNC= 'RESET';
+DROP TABLE m1, t1;