Merge 10.5 into 10.6

5 files changed, 102 insertions, 24 deletions

diff --git a/storage/innobase/mtr/mtr0mtr.cc b/storage/innobase/mtr/mtr0mtr.cc
index ce72b26693c..66a3df3a1ce 100644
--- a/storage/innobase/mtr/mtr0mtr.cc
+++ b/storage/innobase/mtr/mtr0mtr.cc
@@ -247,6 +247,7 @@ void mtr_t::commit_shrink(fil_space_t &space)
   ut_ad(!m_memo.empty());
   ut_ad(!recv_recovery_is_on());
   ut_ad(m_log_mode == MTR_LOG_ALL);
+  ut_ad(!m_freed_pages);
   ut_ad(UT_LIST_GET_LEN(space.chain) == 1);
 
   log_write_and_flush_prepare();
@@ -261,26 +262,7 @@ void mtr_t::commit_shrink(fil_space_t &space)
   os_file_truncate(space.chain.start->name, space.chain.start->handle,
                    os_offset_t{space.size} << srv_page_size_shift, true);
 
-  if (m_freed_pages)
-  {
-    ut_ad(!m_freed_pages->empty());
-    ut_ad(m_freed_space == &space);
-    ut_ad(memo_contains(*m_freed_space));
-    ut_ad(is_named_space(m_freed_space));
-    m_freed_space->update_last_freed_lsn(m_commit_lsn);
-
-    if (!is_trim_pages())
-      for (const auto &range : *m_freed_pages)
-        m_freed_space->add_free_range(range);
-    else
-      m_freed_space->clear_freed_ranges();
-    delete m_freed_pages;
-    m_freed_pages= nullptr;
-    m_freed_space= nullptr;
-    /* mtr_t::start() will reset m_trim_pages */
-  }
-  else
-    ut_ad(!m_freed_space);
+  space.clear_freed_ranges();
 
   const page_id_t high{space.id, space.size};
 
diff --git a/storage/spider/ha_spider.cc b/storage/spider/ha_spider.cc
index 4cb9a736a26..77e942541a7 100644
--- a/storage/spider/ha_spider.cc
+++ b/storage/spider/ha_spider.cc
@@ -1365,10 +1365,8 @@ int ha_spider::reset()
 #endif
   result_list.direct_distinct = FALSE;
   store_error_num = 0;
-  if (
-    wide_handler &&
-    wide_handler->sql_command != SQLCOM_END
-  ) {
+  if (wide_handler)
+  {
     wide_handler->sql_command = SQLCOM_END;
     wide_handler->between_flg = FALSE;
     wide_handler->idx_bitmap_is_set = FALSE;
diff --git a/storage/spider/mysql-test/spider/bugfix/r/mdev_30191.result b/storage/spider/mysql-test/spider/bugfix/r/mdev_30191.result
new file mode 100644
index 00000000000..941f210cbbe
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/r/mdev_30191.result
@@ -0,0 +1,44 @@
+#
+# MDEV-30191 SIGSEGV & heap-use-after-free in spider_db_print_item_type, SIGABRT in __cxa_pure_virtual/spider_db_print_item_type, Got error 128 "Out of memory in engine", 56/112 memory not freed, and Assertion `fixed()' failed in Item_sp_variable::val_str on SP call
+#
+for master_1
+for child2
+child2_1
+child2_2
+child2_3
+for child3
+connection child2_1;
+CREATE DATABASE auto_test_remote;
+USE auto_test_remote;
+CREATE TABLE tbl_a (c INT);
+connection master_1;
+CREATE DATABASE auto_test_local;
+USE auto_test_local;
+CREATE TABLE tbl_a (
+c INT
+) ENGINE=Spider DEFAULT CHARSET=utf8 COMMENT='table "tbl_a", srv "s_2_1"';
+CREATE TABLE tbl_b (c INT);
+CREATE PROCEDURE sp() BEGIN
+DECLARE v1 DATE;
+WHILE EXISTS (SELECT 1 FROM tbl_a WHERE c>v1 AND c<=v1) DO
+SELECT 1;
+END WHILE;
+WHILE EXISTS (SELECT 1
+FROM tbl_a
+WHERE c<v1 AND EXISTS (SELECT 1
+FROM tbl_b
+WHERE tbl_a.c=tbl_b.c)) DO
+SELECT 1;
+END WHILE; 
+END $$
+CALL sp();
+connection master_1;
+DROP DATABASE IF EXISTS auto_test_local;
+connection child2_1;
+DROP DATABASE IF EXISTS auto_test_remote;
+for master_1
+for child2
+child2_1
+child2_2
+child2_3
+for child3
diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.cnf b/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.cnf
new file mode 100644
index 00000000000..05dfd8a0bce
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.cnf
@@ -0,0 +1,3 @@
+!include include/default_mysqld.cnf
+!include ../my_1_1.cnf
+!include ../my_2_1.cnf
diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.test b/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.test
new file mode 100644
index 00000000000..8d19a3515cf
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_30191.test
@@ -0,0 +1,51 @@
+--echo #
+--echo # MDEV-30191 SIGSEGV & heap-use-after-free in spider_db_print_item_type, SIGABRT in __cxa_pure_virtual/spider_db_print_item_type, Got error 128 "Out of memory in engine", 56/112 memory not freed, and Assertion `fixed()' failed in Item_sp_variable::val_str on SP call
+--echo #
+ 
+--disable_query_log
+--disable_result_log
+--source ../../t/test_init.inc
+--enable_result_log
+--enable_query_log
+ 
+--connection child2_1
+CREATE DATABASE auto_test_remote;
+USE auto_test_remote;
+CREATE TABLE tbl_a (c INT);
+ 
+--connection master_1
+CREATE DATABASE auto_test_local;
+USE auto_test_local;
+ 
+eval CREATE TABLE tbl_a (
+    c INT
+) $MASTER_1_ENGINE $MASTER_1_CHARSET COMMENT='table "tbl_a", srv "s_2_1"';
+CREATE TABLE tbl_b (c INT);
+ 
+--delimiter $$
+CREATE PROCEDURE sp() BEGIN
+    DECLARE v1 DATE;
+    WHILE EXISTS (SELECT 1 FROM tbl_a WHERE c>v1 AND c<=v1) DO
+        SELECT 1;
+    END WHILE;
+    WHILE EXISTS (SELECT 1
+                 FROM tbl_a
+                 WHERE c<v1 AND EXISTS (SELECT 1
+                                       FROM tbl_b
+                                       WHERE tbl_a.c=tbl_b.c)) DO
+        SELECT 1;
+    END WHILE; 
+END $$
+--delimiter ;
+CALL sp();
+ 
+--connection master_1
+DROP DATABASE IF EXISTS auto_test_local;
+--connection child2_1
+DROP DATABASE IF EXISTS auto_test_remote;
+ 
+--disable_query_log
+--disable_result_log
+--source ../t/test_deinit.inc
+--enable_query_log
+--enable_result_log