Bug #29156 events crash server in test suite

don't free thd->lex->sphead if we didn't do lex_start(),
as we can have garbage there

mysql-test/r/events_bugs.result

@@ -557,4 +557,51 @@ CREATE EVENT new_event ON SCHEDULE AT NOW() ENDS NOW() DO SELECT 1;
 ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ENDS NOW() DO SELECT 1' at line 1
 CREATE EVENT new_event ON SCHEDULE AT NOW() STARTS NOW() ENDS NOW() DO SELECT 1;
 ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'STARTS NOW() ENDS NOW() DO SELECT 1' at line 1
+USE test;
+SHOW GRANTS FOR CURRENT_USER;
+Grants for root@localhost
+GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION
+SET GLOBAL event_scheduler = ON;
+CREATE TABLE event_log (id int KEY AUTO_INCREMENT,
+ev_nm char(40), ev_cnt int,
+ev_tm timestamp) ENGINE=MyISAM;
+SET @ev_base_date = 20281224180000;
+SET autocommit=0;
+CREATE USER evtest1@localhost;
+SET PASSWORD FOR evtest1@localhost = password('ev1');
+REVOKE ALL PRIVILEGES, GRANT OPTION FROM evtest1@localhost;
+GRANT create, insert, select, event ON events_test.* TO evtest1@localhost;
+GRANT select,insert ON TEST.* TO evtest1@lcalhost;
+SHOW GRANTS FOR evtest1@localhost;
+Grants for evtest1@localhost
+GRANT USAGE ON *.* TO 'evtest1'@'localhost' IDENTIFIED BY PASSWORD '*3170F3644E31580C25DE4A08F4C07CC9A2D40C32'
+GRANT SELECT, INSERT, CREATE, EVENT ON `events_test`.* TO 'evtest1'@'localhost'
+connection e1;
+USE events_test;
+CREATE EVENT ev_sched_1823 ON SCHEDULE EVERY 2 SECOND
+DO BEGIN
+SET AUTOCOMMIT = 0;
+SET @evname = 'ev_sched_1823';
+SET @cnt = 0;
+SELECT COUNT(*) INTO @cnt FROM test.event_log WHERE ev_nm = @evname;
+INSERT INTO test.event_log VALUES (NULL,@evname,@cnt+1,current_timestamp());
+COMMIT;
+SELECT COUNT(*) INTO @cnt FROM test.event_log WHERE ev_nm = @evname;
+INSERT INTO test.event_log VALUES (NULL,@evname,@cnt+1,current_timestamp());
+ROLLBACK;
+END;|
+connection default;
+DROP USER evtest1@localhost;
+USE test;
+=====================================================================================
+select id,ev_nm,ev_cnt from event_log order by id;
+id	ev_nm	ev_cnt
+1	ev_sched_1823	1
+2	ev_sched_1823	2
+3	ev_sched_1823	3
+4	ev_sched_1823	4
+5	ev_sched_1823	5
+6	ev_sched_1823	6
+DROP TABLE event_log;
+SET GLOBAL event_scheduler = OFF;
 DROP DATABASE events_test;

mysql-test/t/events_bugs.test

@@ -648,7 +648,64 @@ CREATE EVENT new_event ON SCHEDULE AT NOW() ENDS NOW() DO SELECT 1;
 --error ER_PARSE_ERROR
 CREATE EVENT new_event ON SCHEDULE AT NOW() STARTS NOW() ENDS NOW() DO SELECT 1;
 
-
+#
+# START - BUG#28924 If I drop the user who is the definer of an active event then server cores
+#
+let $engine=MyISAM;
+USE test;
+SHOW GRANTS FOR CURRENT_USER;
+SET GLOBAL event_scheduler = ON;
+eval CREATE TABLE event_log (id int KEY AUTO_INCREMENT,
+                             ev_nm char(40), ev_cnt int,
+                             ev_tm timestamp) ENGINE=$engine; 
+SET @ev_base_date = 20281224180000;
+--disable_warnings
+SET autocommit=0;
+#DROP DATABASE IF EXISTS ev_db_1;
+#CREATE DATABASE ev_db_1;
+--enable_warnings
+CREATE USER evtest1@localhost;
+SET PASSWORD FOR evtest1@localhost = password('ev1');
+REVOKE ALL PRIVILEGES, GRANT OPTION FROM evtest1@localhost;
+GRANT create, insert, select, event ON events_test.* TO evtest1@localhost;
+GRANT select,insert ON TEST.* TO evtest1@lcalhost;
+SHOW GRANTS FOR evtest1@localhost;
+
+--echo connection e1;
+--replace_result $MASTER_MYPORT MASTER_MYPORT $MASTER_MYSOCK MASTER_MYSOCK
+connect (e1,localhost,evtest1,ev1,events_test,$MASTER_MYPORT,$MASTER_MYSOCK);
+USE events_test;
+
+DELIMITER |;
+CREATE EVENT ev_sched_1823 ON SCHEDULE EVERY 2 SECOND
+DO BEGIN
+       SET AUTOCOMMIT = 0;
+       SET @evname = 'ev_sched_1823';
+       SET @cnt = 0;
+       SELECT COUNT(*) INTO @cnt FROM test.event_log WHERE ev_nm = @evname;
+       INSERT INTO test.event_log VALUES (NULL,@evname,@cnt+1,current_timestamp());
+       COMMIT;
+       SELECT COUNT(*) INTO @cnt FROM test.event_log WHERE ev_nm = @evname;
+       INSERT INTO test.event_log VALUES (NULL,@evname,@cnt+1,current_timestamp());
+       ROLLBACK;
+END;|
+DELIMITER ;|
+
+--sleep 6
+--echo connection default;
+connection default;
+DROP USER evtest1@localhost;
+
+--sleep 6
+USE test;
+--echo =====================================================================================
+--sleep 5
+#--disable_result_log
+select id,ev_nm,ev_cnt from event_log order by id;
+#--enable_result_log
+DROP TABLE event_log;
+#DROP DATABASE ev_db_1;
+SET GLOBAL event_scheduler = OFF;
 
 # 
 # End of tests

sql/event_data_objects.cc

@@ -1778,7 +1778,7 @@ Event_job_data::execute(THD *thd, bool drop)
                     "[%s].[%s.%s] execution failed, "
                     "failed to authenticate the user.",
                     definer.str, dbname.str, name.str);
-    goto end;
+    goto end_no_lex_start;
   }
 #endif
 
@@ -1795,11 +1795,11 @@ Event_job_data::execute(THD *thd, bool drop)
                     "[%s].[%s.%s] execution failed, "
                     "user no longer has EVENT privilege.",
                     definer.str, dbname.str, name.str);
-    goto end;
+    goto end_no_lex_start;
   }
 
   if (construct_sp_sql(thd, &sp_sql))
-    goto end;
+    goto end_no_lex_start;
 
   /*
     Set up global thread attributes to reflect the properties of
@@ -1860,6 +1860,13 @@ Event_job_data::execute(THD *thd, bool drop)
   }
 
 end:
+  if (thd->lex->sphead)                        /* NULL only if a parse error */
+  {
+    delete thd->lex->sphead;
+    thd->lex->sphead= NULL;
+  }
+
+end_no_lex_start:
   if (drop && !thd->is_fatal_error)
   {
     /*
@@ -1887,11 +1894,6 @@ Event_job_data::execute(THD *thd, bool drop)
         ret= 1;
     }
   }
-  if (thd->lex->sphead)                        /* NULL only if a parse error */
-  {
-    delete thd->lex->sphead;
-    thd->lex->sphead= NULL;
-  }
 #ifndef NO_EMBEDDED_ACCESS_CHECKS
   if (save_sctx)
     event_sctx.restore_security_context(thd, save_sctx);