two crashes in the TC_LOG_MMAP:

1. don't forget to initialize page->ptr
2. don't signal active->cond, if active is NULL

1 files changed, 10 insertions, 2 deletions

diff --git a/sql/log.cc b/sql/log.cc
index 95b38f7ccd7..6d0314b1d19 100644
--- a/sql/log.cc
+++ b/sql/log.cc
@@ -5387,7 +5387,7 @@ int TC_LOG_MMAP::open(const char *opt_name)
     pg->state=POOL;
     pthread_mutex_init(&pg->lock, MY_MUTEX_INIT_FAST);
     pthread_cond_init (&pg->cond, 0);
-    pg->start=(my_xid *)(data + i*tc_log_page_size);
+    pg->ptr= pg->start=(my_xid *)(data + i*tc_log_page_size);
     pg->size=pg->free=tc_log_page_size/sizeof(my_xid);
     pg->end=pg->start + pg->size;
   }
@@ -5622,7 +5622,15 @@ int TC_LOG_MMAP::sync()
   /* marking 'syncing' slot free */
   pthread_mutex_lock(&LOCK_sync);
   syncing=0;
-  pthread_cond_signal(&active->cond);        // wake up a new syncer
+  /*
+    we check the "active" pointer without LOCK_active. Still, it's safe -
+    "active" can change from NULL to not NULL any time, but it
+    will take LOCK_sync before waiting on active->cond. That is, it can never
+    miss a signal.
+    And "active" can change to NULL only after LOCK_sync, so this is safe too.
+  */
+  if (active)
+    pthread_cond_signal(&active->cond);      // wake up a new syncer
   pthread_mutex_unlock(&LOCK_sync);
   return err;
 }