From de130323b4401ba9dfcb08ebd7f8d688cb317a80 Mon Sep 17 00:00:00 2001 From: Sergei Golubchik Date: Wed, 28 Sep 2022 14:27:55 +0200 Subject: MDEV-29368 Assertion `trx->mysql_thd == thd' failed in innobase_kill_query from process_timers/timer_handler and use-after-poison in innobase_kill_query This is a 10.5 version of 9b750dcbd89e, fix for MDEV-23536 Race condition between KILL and transaction commit InnoDB needs to remove trx from thd before destroying it (trx), otherwise a concurrent KILL might get a pointer from thd to a destroyed trx. ha_close_connection() should allow engines to clear ha_data in hton->on close_connection(). To prevent the engine from being unloaded while hton->close_connection() is running, we remove the lock from ha_data and unlock the plugin manually. --- mysql-test/main/kill_debug.result | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'mysql-test/main/kill_debug.result') diff --git a/mysql-test/main/kill_debug.result b/mysql-test/main/kill_debug.result index d0fadb5c7b5..061e7602383 100644 --- a/mysql-test/main/kill_debug.result +++ b/mysql-test/main/kill_debug.result @@ -221,3 +221,19 @@ DROP FUNCTION MY_KILL; set global sql_mode=default; disconnect con1; disconnect con2; +# +# MDEV-29368 Assertion `trx->mysql_thd == thd' failed in innobase_kill_query from process_timers/timer_handler and use-after-poison in innobase_kill_query +# +connect foo,localhost,root; +create table t1 (a int) engine=innodb; +insert t1 values (1); +set debug_sync='THD_cleanup_after_set_killed SIGNAL go0 WAIT_FOR go1'; +set debug_sync='innobase_connection_closed SIGNAL go2 WAIT_FOR go3'; +disconnect foo; +connection default; +set debug_sync='now WAIT_FOR go0'; +set debug_sync='found_killee SIGNAL go1 WAIT_FOR go2'; +kill $id; +set debug_sync='now SIGNAL go3'; +drop table t1; +set debug_sync='reset'; -- cgit v1.2.1