A fix and a test case for Bug#14210 "Simple query with > operator on

large table gives server crash": make sure that when a MyISAM temporary
table is created for a cursor, it's created in its memory root,
not the memory root of the current query.


mysql-test/r/sp.result:
  Test results fixed: a test case for Bug#14210
mysql-test/t/sp.test:
  A test case for Bug#14210 "Simple query with > operator on large table 
  gives server crash"
sql/handler.cc:
  - rewrite get_new_handler to accept a memory root and use it for
sql/handler.h:
  - get_new_handler declaration changed
sql/opt_range.cc:
  - get_new_handler declaration changed
sql/sql_base.cc:
  - get_new_handler declaration changed
sql/sql_select.cc:
  - the actual fix for Bug#14210. In create_myisam_from_heap we should
  create the new table handler in TABLE::mem_root, not in THD::mem_root:
  the latter is freed shortly after cursor is open.
  - adjust create_tmp_table to explicitly supply &table->mem_root
  to get_new_handler when creating a handler for a new temporary table
sql/sql_table.cc:
  - get_new_handler declaration changed
sql/table.cc:
  - get_new_handler declaration changed
sql/unireg.cc:
  - get_new_handler declaration changed
tests/mysql_client_test.c:
  A test case for Bug#14210 "Simple query with > operator on large table
   gives server crash": a C API test case is worth adding because of different
  memory allocation/freeing patterns in handling of C API and SP cursors

1 files changed, 54 insertions, 0 deletions

diff --git a/tests/mysql_client_test.c b/tests/mysql_client_test.c
index f46b1cf1784..949c3d5bf1c 100644
--- a/tests/mysql_client_test.c
+++ b/tests/mysql_client_test.c
@@ -14319,6 +14319,7 @@ static void test_bug12243()
   mysql_autocommit(mysql, TRUE);                /* restore default */
 }
 
+
 /*
   Bug#11718: query with function, join and order by returns wrong type
 */
@@ -14367,6 +14368,58 @@ static void test_bug12925()
 
 
 /*
+  Bug#14210 "Simple query with > operator on large table gives server
+  crash"
+*/
+
+static void test_bug14210()
+{
+  MYSQL_STMT *stmt;
+  int rc, i;
+  const char *stmt_text;
+  ulong type;
+
+  myheader("test_bug14210");
+
+  mysql_query(mysql, "drop table if exists t1");
+  /*
+    To trigger the problem the table must be InnoDB, although the problem
+    itself is not InnoDB related. In case the table is MyISAM this test
+    is harmless.
+  */
+  mysql_query(mysql, "create table t1 (a varchar(255)) type=InnoDB");
+  rc= mysql_query(mysql, "insert into t1 (a) values (repeat('a', 256))");
+  myquery(rc);
+  rc= mysql_query(mysql, "set @@session.max_heap_table_size=16384");
+  /* Create a big enough table (more than max_heap_table_size) */
+  for (i= 0; i < 8; i++)
+  {
+    rc= mysql_query(mysql, "insert into t1 (a) select a from t1");
+    myquery(rc);
+  }
+  /* create statement */
+  stmt= mysql_stmt_init(mysql);
+  type= (ulong) CURSOR_TYPE_READ_ONLY;
+  mysql_stmt_attr_set(stmt, STMT_ATTR_CURSOR_TYPE, (const void*) &type);
+
+  stmt_text= "select a from t1";
+
+  rc= mysql_stmt_prepare(stmt, stmt_text, strlen(stmt_text));
+  check_execute(stmt, rc);
+  rc= mysql_stmt_execute(stmt);
+  while ((rc= mysql_stmt_fetch(stmt)) == 0)
+    ;
+  DIE_UNLESS(rc == MYSQL_NO_DATA);
+
+  rc= mysql_stmt_close(stmt);
+
+  rc= mysql_query(mysql, "drop table t1");
+  myquery(rc);
+  rc= mysql_query(mysql, "set @@session.max_heap_table_size=default");
+  myquery(rc);
+}
+
+/*
   Read and parse arguments and MySQL options from my.cnf
 */
 
@@ -14621,6 +14674,7 @@ static struct my_tests_st my_tests[]= {
   { "test_bug11901", test_bug11901 },
   { "test_bug11904", test_bug11904 },
   { "test_bug12243", test_bug12243 },
+  { "test_bug14210", test_bug14210 },
   { 0, 0 }
 };