Bug#31210 - INSERT DELAYED crashes server when used on

            partitioned table

Trying INSERT DELAYED on a partitioned table, that has not been
used right before, crashes the server. When a table is used for
select or update, it is kept open for some time. This period I
mean with "right before".

Information about partitioning of a table is stored in form of
a string in the .frm file. Parsing of this string requires a
correctly set up lexical analyzer (lex). The partitioning code
uses a new temporary instance of a lex. But it does still refer
to the previously active lex. The delayd insert thread does not
initialize its lex though...

Added initialization for thd->lex before open table in the delayed
thread and at all other places where it is necessary to call
lex_start() if all tables would be partitioned and need to parse
the .frm file.


mysql-test/r/partition_hash.result:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Added test result
mysql-test/t/partition_hash.test:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Added test
sql/event_scheduler.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().
sql/events.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().
sql/ha_ndbcluster_binlog.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().
sql/slave.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().
sql/sql_acl.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().
sql/sql_base.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Asserted that lex is initialized in open_table().
sql/sql_connect.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().
sql/sql_insert.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Added initialization for thd->lex before open table.
sql/sql_lex.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Added 'is_lex_started' to test if lex is initialized.
sql/sql_lex.h:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Added 'is_lex_started' to test if lex is initialized.
sql/sql_plugin.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().
sql/sql_servers.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().
sql/sql_udf.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().
sql/table.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Asserted that lex is initialized in open_table_from_share().
sql/tztime.cc:
  Bug#31210 - INSERT DELAYED crashes server when used on
              partitioned table
  Initialized lex for later use in open_table().

15 files changed, 26 insertions, 2 deletions

diff --git a/sql/event_scheduler.cc b/sql/event_scheduler.cc
index b03b51f1134..52c7d291da7 100644
--- a/sql/event_scheduler.cc
+++ b/sql/event_scheduler.cc
@@ -127,6 +127,7 @@ post_init_event_thread(THD *thd)
     thd->cleanup();
     return TRUE;
   }
+  lex_start(thd);
 
   pthread_mutex_lock(&LOCK_thread_count);
   threads.append(thd);
diff --git a/sql/events.cc b/sql/events.cc
index 5246bccc388..84301d811f0 100644
--- a/sql/events.cc
+++ b/sql/events.cc
@@ -884,6 +884,7 @@ Events::init(my_bool opt_noacl)
   */
   thd->thread_stack= (char*) &thd;
   thd->store_globals();
+  lex_start(thd);
 
   /*
     We will need Event_db_repository anyway, even if the scheduler is
diff --git a/sql/ha_ndbcluster_binlog.cc b/sql/ha_ndbcluster_binlog.cc
index 5d5c8a26447..5f67c6f73ea 100644
--- a/sql/ha_ndbcluster_binlog.cc
+++ b/sql/ha_ndbcluster_binlog.cc
@@ -3621,6 +3621,7 @@ pthread_handler_t ndb_binlog_thread_func(void *arg)
     pthread_exit(0);
     DBUG_RETURN(NULL);
   }
+  lex_start(thd);
 
   thd->init_for_queries();
   thd->command= COM_DAEMON;
diff --git a/sql/slave.cc b/sql/slave.cc
index fcbd4eb841b..a89d5262cbf 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -1510,6 +1510,7 @@ static int init_slave_thread(THD* thd, SLAVE_THD_TYPE thd_type)
     delete thd;
     DBUG_RETURN(-1);
   }
+  lex_start(thd);
 
   if (thd_type == SLAVE_THD_SQL)
     thd->proc_info= "Waiting for the next event in relay log";
diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index 7e017d7d028..495b7e06c8a 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -277,6 +277,7 @@ my_bool acl_init(bool dont_read_acl_tables)
     DBUG_RETURN(1); /* purecov: inspected */
   thd->thread_stack= (char*) &thd;
   thd->store_globals();
+  lex_start(thd);
   /*
     It is safe to call acl_reload() since acl_* arrays and hashes which
     will be freed there are global static objects and thus are initialized
@@ -3493,6 +3494,7 @@ my_bool grant_init()
     DBUG_RETURN(1);				/* purecov: deadcode */
   thd->thread_stack= (char*) &thd;
   thd->store_globals();
+  lex_start(thd);
   return_val=  grant_reload(thd);
   delete thd;
   /* Remember that we don't have a THD */
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index 337fde53dac..119da29c316 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -2248,6 +2248,9 @@ TABLE *open_table(THD *thd, TABLE_LIST *table_list, MEM_ROOT *mem_root,
   HASH_SEARCH_STATE state;
   DBUG_ENTER("open_table");
 
+  /* Parsing of partitioning information from .frm needs thd->lex set up. */
+  DBUG_ASSERT(thd->lex->is_lex_started);
+
   /* find a unused table in the open table cache */
   if (refresh)
     *refresh=0;
diff --git a/sql/sql_connect.cc b/sql/sql_connect.cc
index 6bb0f62d843..225a54448ac 100644
--- a/sql/sql_connect.cc
+++ b/sql/sql_connect.cc
@@ -1087,6 +1087,7 @@ pthread_handler_t handle_one_connection(void *arg)
   {
     NET *net= &thd->net;
 
+    lex_start(thd);
     if (login_connection(thd))
       goto end_thread;
 
diff --git a/sql/sql_insert.cc b/sql/sql_insert.cc
index ebbf4cafb19..fb4a563c4d6 100644
--- a/sql/sql_insert.cc
+++ b/sql/sql_insert.cc
@@ -2264,7 +2264,12 @@ pthread_handler_t handle_delayed_insert(void *arg)
     goto err;
   }
 
-  /* open table */
+  /*
+    Open table requires an initialized lex in case the table is
+    partitioned. The .frm file contains a partial SQL string which is
+    parsed using a lex, that depends on initialized thd->lex.
+  */
+  lex_start(thd);
   if (!(di->table=open_ltable(thd, &di->table_list, TL_WRITE_DELAYED, 0)))
   {
     thd->fatal_error();				// Abort waiting inserts
diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index 0a5f83af400..26c9790923a 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -362,6 +362,7 @@ void lex_start(THD *thd)
   lex->server_options.owner= 0;
   lex->server_options.port= -1;
 
+  lex->is_lex_started= TRUE;
   DBUG_VOID_RETURN;
 }
 
@@ -2138,7 +2139,7 @@ void Query_tables_list::destroy_query_tables_list()
 
 st_lex::st_lex()
   :result(0), yacc_yyss(0), yacc_yyvs(0),
-   sql_command(SQLCOM_END), option_type(OPT_DEFAULT)
+   sql_command(SQLCOM_END), option_type(OPT_DEFAULT), is_lex_started(0)
 {
 
   my_init_dynamic_array2(&plugins, sizeof(plugin_ref),
diff --git a/sql/sql_lex.h b/sql/sql_lex.h
index 08104769704..d0822fed3c2 100644
--- a/sql/sql_lex.h
+++ b/sql/sql_lex.h
@@ -1703,6 +1703,7 @@ typedef struct st_lex : public Query_tables_list
   st_alter_tablespace *alter_tablespace_info;
   
   bool escape_used;
+  bool is_lex_started; /* If lex_start() did run. For debugging. */
 
   st_lex();
 
diff --git a/sql/sql_plugin.cc b/sql/sql_plugin.cc
index 2af528f6699..c8d9116f196 100644
--- a/sql/sql_plugin.cc
+++ b/sql/sql_plugin.cc
@@ -1329,6 +1329,7 @@ static void plugin_load(MEM_ROOT *tmp_root, int *argc, char **argv)
   }
   new_thd->thread_stack= (char*) &tables;
   new_thd->store_globals();
+  lex_start(new_thd);
   new_thd->db= my_strdup("mysql", MYF(0));
   new_thd->db_length= 5;
   bzero((uchar*)&tables, sizeof(tables));
diff --git a/sql/sql_servers.cc b/sql/sql_servers.cc
index a780c561ffe..d1d7801538c 100644
--- a/sql/sql_servers.cc
+++ b/sql/sql_servers.cc
@@ -140,6 +140,7 @@ bool servers_init(bool dont_read_servers_table)
     DBUG_RETURN(TRUE);
   thd->thread_stack= (char*) &thd;
   thd->store_globals();
+  lex_start(thd);
   /*
     It is safe to call servers_reload() since servers_* arrays and hashes which
     will be freed there are global static objects and thus are initialized
diff --git a/sql/sql_udf.cc b/sql/sql_udf.cc
index 19582af38f4..112280a10b2 100644
--- a/sql/sql_udf.cc
+++ b/sql/sql_udf.cc
@@ -135,6 +135,7 @@ void udf_init()
   initialized = 1;
   new_thd->thread_stack= (char*) &new_thd;
   new_thd->store_globals();
+  lex_start(new_thd);
   new_thd->set_db(db, sizeof(db)-1);
 
   bzero((uchar*) &tables,sizeof(tables));
diff --git a/sql/table.cc b/sql/table.cc
index ccddbf8134b..26008f0aa19 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -1608,6 +1608,9 @@ int open_table_from_share(THD *thd, TABLE_SHARE *share, const char *alias,
   DBUG_PRINT("enter",("name: '%s.%s'  form: 0x%lx", share->db.str,
                       share->table_name.str, (long) outparam));
 
+  /* Parsing of partitioning information from .frm needs thd->lex set up. */
+  DBUG_ASSERT(thd->lex->is_lex_started);
+
   error= 1;
   bzero((char*) outparam, sizeof(*outparam));
   outparam->in_use= thd;
diff --git a/sql/tztime.cc b/sql/tztime.cc
index 9eb38e97827..920f8e87d13 100644
--- a/sql/tztime.cc
+++ b/sql/tztime.cc
@@ -1575,6 +1575,7 @@ my_tz_init(THD *org_thd, const char *default_tzname, my_bool bootstrap)
     DBUG_RETURN(1);
   thd->thread_stack= (char*) &thd;
   thd->store_globals();
+  lex_start(thd);
 
   /* Init all memory structures that require explicit destruction */
   if (hash_init(&tz_names, &my_charset_latin1, 20,