Merge quant.(none):/ext/mysql/bkroot/mysql-5.0-rpl

into  quant.(none):/ext/mysql/bk/mysql-5.0-bug25306


sql/slave.cc:
  Auto merged
sql/sql_repl.cc:
  Auto merged

1 files changed, 14 insertions, 5 deletions

diff --git a/sql/slave.cc b/sql/slave.cc
index d58a3f549d8..572fafd58b5 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -3759,8 +3759,13 @@ err:
   mi->abort_slave= 0;
   mi->slave_running= 0;
   mi->io_thd= 0;
-  pthread_mutex_unlock(&mi->run_lock);
+  /*
+    Note: the order of the two following calls (first broadcast, then unlock)
+    is important. Otherwise a killer_thread can execute between the calls and
+    delete the mi structure leading to a crash! (see BUG#25306 for details)
+   */ 
   pthread_cond_broadcast(&mi->stop_cond);       // tell the world we are done
+  pthread_mutex_unlock(&mi->run_lock);
 #ifndef DBUG_OFF
   if (abort_slave_event_count && !events_till_abort)
     goto slave_begin;
@@ -3978,8 +3983,13 @@ the slave SQL thread with \"SLAVE START\". We stopped at log \
   THD_CHECK_SENTRY(thd);
   delete thd;
   pthread_mutex_unlock(&LOCK_thread_count);
-  pthread_cond_broadcast(&rli->stop_cond);
 
+ /*
+  Note: the order of the broadcast and unlock calls below (first broadcast, then unlock)
+  is important. Otherwise a killer_thread can execute between the calls and
+  delete the mi structure leading to a crash! (see BUG#25306 for details)
+ */ 
+  pthread_cond_broadcast(&rli->stop_cond);
 #ifndef DBUG_OFF
   /*
     Bug #19938 Valgrind error (race) in handle_slave_sql()
@@ -3987,9 +3997,8 @@ the slave SQL thread with \"SLAVE START\". We stopped at log \
   */
   const int eta= rli->events_till_abort;
 #endif
-
-  // tell the world we are done
-  pthread_mutex_unlock(&rli->run_lock);
+  pthread_mutex_unlock(&rli->run_lock);  // tell the world we are done
+  
 #ifndef DBUG_OFF // TODO: reconsider the code below
   if (abort_slave_event_count && !eta)
     goto slave_begin;