bk commit into 5.1 tree (andrey:1.2147) BUG#16408

[ahristov]

Below is the list of changes that have just been committed into a local
5.1 repository of andrey. When andrey does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet
  1.2147 06/03/15 17:45:58 andrey@lmy004. +6 -0
  fix for bug #16408 Events: crash for an event in a procedure
  (post 1st review patch - mutex are deinitted)

  sql/sql_yacc.yy
    1.475 06/03/15 17:45:49 andrey@lmy004. +4 -4
    allocate lex->et on thd->mem_root, thus it will survive
    if prepared in a procedure call.

  sql/sql_parse.cc
    1.527 06/03/15 17:45:49 andrey@lmy004. +13 -6
    don't delete lex->et because it is allocated on thd->mem_root

  sql/event_timed.cc
    1.46 06/03/15 17:45:49 andrey@lmy004. +4 -3
    add a comment

  sql/event.h
    1.27 06/03/15 17:45:49 andrey@lmy004. +43 -5
    add operator new/delete implementation.
    new allocates on mem_root in the parser, on thd->mem_root as seen in sql_yacc.yy
    Otherwise, we allocate on the heap.

  mysql-test/t/events_bugs.test
    1.2 06/03/15 17:45:49 andrey@lmy004. +17 -0
    test bug #16408 Events: crash for an event in a procedure

  mysql-test/r/events_bugs.result
    1.3 06/03/15 17:45:49 andrey@lmy004. +10 -0
    test bug #16408 Events: crash for an event in a procedure

# This is a BitKeeper patch.  What follows are the unified diffs for the
# set of deltas contained in the patch.  The rest of the patch, the part
# that BitKeeper cares about, is below these diffs.
# User:	andrey
# Host:	lmy004.
# Root:	/work/mysql-5.1-bug16408

--- 1.526/sql/sql_parse.cc	2006-03-01 21:39:23 +01:00
+++ 1.527/sql/sql_parse.cc	2006-03-15 17:45:49 +01:00
@@ -3799,10 +3799,14 @@ end_with_restore_list:
         send_ok(thd, rows_affected);
 
       /* lex->unit.cleanup() is called outside, no need to call it here */
-    } while (0);  
-    lex->et->free_sphead_on_delete= true;
-    delete lex->et;
-    lex->et= 0;
+    } while (0);
+    if (!thd->spcont)
+    {
+      lex->et->free_sphead_on_delete= true;
+      lex->et->free_sp();
+      lex->et->deinit_mutexes();
+    }
+    
     break;
   }
   case SQLCOM_SHOW_CREATE_EVENT:
@@ -5754,7 +5758,9 @@ void mysql_parse(THD *thd, char *inBuf, 
           if (thd->lex->et)
           {
             thd->lex->et->free_sphead_on_delete= true;
-            delete thd->lex->et;
+            /* alloced on thd->mem_root so no real memory free but dtor call */
+            thd->lex->et->free_sp();
+            thd->lex->et->deinit_mutexes();
             thd->lex->et= NULL;
           }
 	}
@@ -5795,7 +5801,8 @@ void mysql_parse(THD *thd, char *inBuf, 
       if (thd->lex->et)
       {
         thd->lex->et->free_sphead_on_delete= true;
-        delete thd->lex->et;
+        lex->et->free_sp();
+        lex->et->deinit_mutexes();
         thd->lex->et= NULL;
       }
     }

--- 1.474/sql/sql_yacc.yy	2006-03-07 20:00:43 +01:00
+++ 1.475/sql/sql_yacc.yy	2006-03-15 17:45:49 +01:00
@@ -1345,7 +1345,7 @@ create:
 
             lex->create_info.options= $3;
 
-            if (!(lex->et= new Event_timed())) // implicitly calls Event_timed::init()
+            if (!(lex->et= new(YYTHD->mem_root) Event_timed())) // implicitly calls
Event_timed::init()
               YYABORT;
 
             /*
@@ -4863,7 +4863,7 @@ alter:
             }
             lex->spname= 0;//defensive programming
 
-            if (!(et= new Event_timed()))// implicitly calls Event_timed::init()
+            if (!(et= new (YYTHD->mem_root) Event_timed()))// implicitly calls
Event_timed::init()
               YYABORT;
             lex->et = et;
 
@@ -7755,7 +7755,7 @@ drop:
               YYABORT;
             }
 
-            if (!(lex->et= new Event_timed()))
+            if (!(lex->et= new (YYTHD->mem_root) Event_timed()))
               YYABORT;
 	  
             if (!lex->et_compile_phase)
@@ -8479,7 +8479,7 @@ show_param:
           {
             Lex->sql_command = SQLCOM_SHOW_CREATE_EVENT;
             Lex->spname= $3;
-            Lex->et= new Event_timed();
+            Lex->et= new (YYTHD->mem_root) Event_timed();
             if (!Lex->et)
               YYABORT;
             Lex->et->init_definer(YYTHD);

--- 1.2/mysql-test/r/events_bugs.result	2006-02-21 02:40:15 +01:00
+++ 1.3/mysql-test/r/events_bugs.result	2006-03-15 17:45:49 +01:00
@@ -1,5 +1,15 @@
 create database if not exists events_test;
 use events_test;
+set @a=3;
+CREATE PROCEDURE p_16 () CREATE EVENT e_16 ON SCHEDULE EVERY @a SECOND DO SET @a=5;
+call p_16();
+"Here we used to crash!"
+call p_16();
+ERROR HY000: Event 'e_16' already exists
+call p_16();
+ERROR HY000: Event 'e_16' already exists
+DROP PROCEDURE p_16;
+DROP EVENT e_16;
 set global event_scheduler=0;
 "Wait a bit to settle down"
 delete from mysql.event;

--- 1.1/mysql-test/t/events_bugs.test	2006-02-20 23:52:12 +01:00
+++ 1.2/mysql-test/t/events_bugs.test	2006-03-15 17:45:49 +01:00
@@ -1,6 +1,23 @@
 create database if not exists events_test;
 use events_test;
 #
+# START - BUG#16408: Events: crash for an event in a procedure
+#
+set @a=3;
+CREATE PROCEDURE p_16 () CREATE EVENT e_16 ON SCHEDULE EVERY @a SECOND DO SET @a=5;
+call p_16();
+--echo "Here we used to crash!"
+--error 1515
+call p_16();
+--error 1515
+call p_16();
+DROP PROCEDURE p_16;
+DROP EVENT e_16;
+#
+# END   - BUG#16408: Events: crash for an event in a procedure
+#
+
+#
 # Start - 16407: Events: Changes in sql_mode won't be taken into account
 #
 set global event_scheduler=0;

--- 1.26/sql/event.h	2006-02-28 18:33:25 +01:00
+++ 1.27/sql/event.h	2006-03-15 17:45:49 +01:00
@@ -40,7 +40,6 @@
 #define EVENT_EXEC_NO_MORE      (1L << 0)
 #define EVENT_NOT_USED          (1L << 1)
 
-
 extern ulong opt_event_executor;
 
 enum enum_event_on_completion
@@ -122,6 +121,39 @@ public:
   bool free_sphead_on_delete;
   uint flags;//all kind of purposes
 
+  static void *operator new(size_t size)
+  {
+    void *p;
+    DBUG_ENTER("Event_timed::new(size)");
+    p= my_malloc(size, MYF(0));
+    DBUG_PRINT("info", ("alloc_ptr=0x%lx", p));
+    DBUG_RETURN(p);
+  }
+
+  static void *operator new(size_t size, MEM_ROOT *mem_root)
+  { return (void*) alloc_root(mem_root, (uint) size); }
+
+  static void operator delete(void *ptr, size_t size)
+  {
+    DBUG_ENTER("Event_timed::delete(ptr,size)");
+    DBUG_PRINT("enter", ("free_ptr=0x%lx", ptr));
+    TRASH(ptr, size);
+    my_free((gptr) ptr, MYF(0));
+    DBUG_VOID_RETURN;
+  }
+
+  static void operator delete(void *ptr, MEM_ROOT *mem_root)
+  {
+    /*
+      Don't free the memory it will be done by the mem_root but
+      we need to call the destructor because we free other resources
+      which are not allocated on the root but on the heap, or we
+      deinit mutexes.
+    */
+    DBUG_ASSERT(0);
+  }
+
+
   Event_timed():in_spawned_thread(0),locked_by_thread_id(0),
                 running(0), status_changed(false),
                 last_executed_changed(false), expression(0), created(0),
@@ -136,15 +168,21 @@ public:
   }
 
   ~Event_timed()
-  {
-    pthread_mutex_destroy(&this->LOCK_running);
+  {    
+    deinit_mutexes();
+
     if (free_sphead_on_delete)
-	    free_sp();
+      free_sp();
   }
 
-
   void
   init();
+  
+  void
+  deinit_mutexes()
+  {
+    pthread_mutex_destroy(&this->LOCK_running);
+  }
 
   int
   init_definer(THD *thd);

--- 1.45/sql/event_timed.cc	2006-03-02 21:01:56 +01:00
+++ 1.46/sql/event_timed.cc	2006-03-15 17:45:49 +01:00
@@ -1229,12 +1229,12 @@ Event_timed::change_security_context(THD
                              definer_host.str, dbname.str))
   {
     my_error(ER_NO_SUCH_USER, MYF(0), definer_user.str, definer_host.str);
-    DBUG_RETURN(TRUE);
+    DBUG_RETURN(true);
   }
   *backup= thd->security_ctx;
   thd->security_ctx= s_ctx;
 #endif
-  DBUG_RETURN(FALSE);
+  DBUG_RETURN(false);
 }
 
 
@@ -1369,7 +1369,8 @@ Event_timed::compile(THD *thd, MEM_ROOT 
   ret= 0;
 done:
   lex.et->free_sphead_on_delete= false;
-  delete lex.et;
+  lex.et->deinit_mutexes();
+
   lex_end(&lex);
   DBUG_PRINT("note", ("return old data on its place. set back NAMES"));