diff options
author | Marko Mäkelä <marko.makela@mariadb.com> | 2023-01-23 13:15:41 +0200 |
---|---|---|
committer | Marko Mäkelä <marko.makela@mariadb.com> | 2023-01-23 13:15:41 +0200 |
commit | 851c56771e11d50648430bb47644966996b9aa82 (patch) | |
tree | 190e330099cb4b1128ed2dcd8a94fd52e5b1f485 /storage | |
parent | 1bbf37e0db459f6368b6a48e366e3f2558853f68 (diff) | |
parent | 647a7232ff12361a271c33223f1e1bbee6da5675 (diff) | |
download | mariadb-git-851c56771e11d50648430bb47644966996b9aa82.tar.gz |
Merge 10.5 into 10.6
Diffstat (limited to 'storage')
-rw-r--r-- | storage/innobase/mtr/mtr0mtr.cc | 22 | ||||
-rw-r--r-- | storage/spider/ha_spider.cc | 6 | ||||
-rw-r--r-- | storage/spider/mysql-test/spider/bugfix/r/mdev_30191.result | 44 | ||||
-rw-r--r-- | storage/spider/mysql-test/spider/bugfix/t/mdev_30191.cnf | 3 | ||||
-rw-r--r-- | storage/spider/mysql-test/spider/bugfix/t/mdev_30191.test | 51 |
5 files changed, 102 insertions, 24 deletions
diff --git a/storage/innobase/mtr/mtr0mtr.cc b/storage/innobase/mtr/mtr0mtr.cc index ce72b26693c..66a3df3a1ce 100644 --- a/storage/innobase/mtr/mtr0mtr.cc +++ b/storage/innobase/mtr/mtr0mtr.cc @@ -247,6 +247,7 @@ void mtr_t::commit_shrink(fil_space_t &space) ut_ad(!m_memo.empty()); ut_ad(!recv_recovery_is_on()); ut_ad(m_log_mode == MTR_LOG_ALL); + ut_ad(!m_freed_pages); ut_ad(UT_LIST_GET_LEN(space.chain) == 1); log_write_and_flush_prepare(); @@ -261,26 +262,7 @@ void mtr_t::commit_shrink(fil_space_t &space) os_file_truncate(space.chain.start->name, space.chain.start->handle, os_offset_t{space.size} << srv_page_size_shift, true); - if (m_freed_pages) - { - ut_ad(!m_freed_pages->empty()); - ut_ad(m_freed_space == &space); - ut_ad(memo_contains(*m_freed_space)); - ut_ad(is_named_space(m_freed_space)); - m_freed_space->update_last_freed_lsn(m_commit_lsn); - - if (!is_trim_pages()) - for (const auto &range : *m_freed_pages) - m_freed_space->add_free_range(range); - else - m_freed_space->clear_freed_ranges(); - delete m_freed_pages; - m_freed_pages= nullptr; - m_freed_space= nullptr; - /* mtr_t::start() will reset m_trim_pages */ - } - else - ut_ad(!m_freed_space); + space.clear_freed_ranges(); const page_id_t high{space.id, space.size}; diff --git a/storage/spider/ha_spider.cc b/storage/spider/ha_spider.cc index 4cb9a736a26..77e942541a7 100644 --- a/storage/spider/ha_spider.cc +++ b/storage/spider/ha_spider.cc @@ -1365,10 +1365,8 @@ int ha_spider::reset() #endif result_list.direct_distinct = FALSE; store_error_num = 0; - if ( - wide_handler && - wide_handler->sql_command != SQLCOM_END - ) { + if (wide_handler) + { wide_handler->sql_command = SQLCOM_END; wide_handler->between_flg = FALSE; wide_handler->idx_bitmap_is_set = FALSE; diff --git a/storage/spider/mysql-test/spider/bugfix/r/mdev_30191.result b/storage/spider/mysql-test/spider/bugfix/r/mdev_30191.result new file mode 100644 index 00000000000..941f210cbbe --- /dev/null +++ b/storage/spider/mysql-test/spider/bugfix/r/mdev_30191.result @@ -0,0 +1,44 @@ +# +# MDEV-30191 SIGSEGV & heap-use-after-free in spider_db_print_item_type, SIGABRT in __cxa_pure_virtual/spider_db_print_item_type, Got error 128 "Out of memory in engine", 56/112 memory not freed, and Assertion `fixed()' failed in Item_sp_variable::val_str on SP call +# +for master_1 +for child2 +child2_1 +child2_2 +child2_3 +for child3 +connection child2_1; +CREATE DATABASE auto_test_remote; +USE auto_test_remote; +CREATE TABLE tbl_a (c INT); +connection master_1; +CREATE DATABASE auto_test_local; +USE auto_test_local; +CREATE TABLE tbl_a ( +c INT +) ENGINE=Spider DEFAULT CHARSET=utf8 COMMENT='table "tbl_a", srv "s_2_1"'; +CREATE TABLE tbl_b (c INT); +CREATE PROCEDURE sp() BEGIN +DECLARE v1 DATE; +WHILE EXISTS (SELECT 1 FROM tbl_a WHERE c>v1 AND c<=v1) DO +SELECT 1; +END WHILE; +WHILE EXISTS (SELECT 1 +FROM tbl_a +WHERE c<v1 AND EXISTS (SELECT 1 +FROM tbl_b +WHERE tbl_a.c=tbl_b.c)) DO +SELECT 1; +END WHILE; +END $$ +CALL sp(); +connection master_1; +DROP DATABASE IF EXISTS auto_test_local; +connection child2_1; +DROP DATABASE IF EXISTS auto_test_remote; +for master_1 +for child2 +child2_1 +child2_2 +child2_3 +for child3 diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.cnf b/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.cnf new file mode 100644 index 00000000000..05dfd8a0bce --- /dev/null +++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.cnf @@ -0,0 +1,3 @@ +!include include/default_mysqld.cnf +!include ../my_1_1.cnf +!include ../my_2_1.cnf diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.test b/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.test new file mode 100644 index 00000000000..8d19a3515cf --- /dev/null +++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.test @@ -0,0 +1,51 @@ +--echo # +--echo # MDEV-30191 SIGSEGV & heap-use-after-free in spider_db_print_item_type, SIGABRT in __cxa_pure_virtual/spider_db_print_item_type, Got error 128 "Out of memory in engine", 56/112 memory not freed, and Assertion `fixed()' failed in Item_sp_variable::val_str on SP call +--echo # + +--disable_query_log +--disable_result_log +--source ../../t/test_init.inc +--enable_result_log +--enable_query_log + +--connection child2_1 +CREATE DATABASE auto_test_remote; +USE auto_test_remote; +CREATE TABLE tbl_a (c INT); + +--connection master_1 +CREATE DATABASE auto_test_local; +USE auto_test_local; + +eval CREATE TABLE tbl_a ( + c INT +) $MASTER_1_ENGINE $MASTER_1_CHARSET COMMENT='table "tbl_a", srv "s_2_1"'; +CREATE TABLE tbl_b (c INT); + +--delimiter $$ +CREATE PROCEDURE sp() BEGIN + DECLARE v1 DATE; + WHILE EXISTS (SELECT 1 FROM tbl_a WHERE c>v1 AND c<=v1) DO + SELECT 1; + END WHILE; + WHILE EXISTS (SELECT 1 + FROM tbl_a + WHERE c<v1 AND EXISTS (SELECT 1 + FROM tbl_b + WHERE tbl_a.c=tbl_b.c)) DO + SELECT 1; + END WHILE; +END $$ +--delimiter ; +CALL sp(); + +--connection master_1 +DROP DATABASE IF EXISTS auto_test_local; +--connection child2_1 +DROP DATABASE IF EXISTS auto_test_remote; + +--disable_query_log +--disable_result_log +--source ../t/test_deinit.inc +--enable_query_log +--enable_result_log |