1. 28 Apr, 2022 2 commits
  2. 27 Apr, 2022 1 commit
    • Igor Babaev's avatar
      MDEV-26412 Server crash in Item_field::fix_outer_field for INSERT SELECT · 39feab3c
      Igor Babaev authored
      IF an INSERT/REPLACE SELECT statement contained an ON expression in the top
      level select and this expression used a subquery with a column reference
      that could not be resolved then an attempt to resolve this reference as
      an outer reference caused a crash of the server. This happened because the
      outer context field in the Name_resolution_context structure was not set
      to NULL for such references. Rather it pointed to the first element in
      the select_stack.
      
      Note that starting from 10.4 we cannot use the SELECT_LEX::outer_select()
      method when parsing a SELECT construct.
      
      Approved by Oleksandr Byelkin <sanja@mariadb.com>
      39feab3c
  3. 26 Apr, 2022 4 commits
  4. 25 Apr, 2022 1 commit
    • Brandon Nesterenko's avatar
      MDEV-26473: mysqld got exception 0xc0000005 (rpl_slave_state/rpl_load_gtid_slave_state) · d16c3aca
      Brandon Nesterenko authored
      Problem:
      ========
      During mysqld initialization, if the number of GTIDs added since
      that last purge of the mysql.gtid_slave_pos tables is greater than
      or equal to the –-gtid-cleanup-batch-size value, a race condition
      can occur. Specifically, the binlog background thread will submit
      the bg_gtid_delete_pending job to the mysql handle manager; however,
      the mysql handle manager may not be initialized, leading to crashes.
      
      Solution:
      ========
      Force the mysql handle manager to initialize/start before the binlog
      background thread is created.
      
      Reviewed By:
      ============
      Andrei Elkin <andrei.elkin@mariadb.com>
      d16c3aca
  5. 22 Apr, 2022 3 commits
    • Brandon Nesterenko's avatar
      MDEV-11853: semisync thread can be killed after sync binlog but before ACK in the sync state · a83c7ab1
      Brandon Nesterenko authored
      Problem:
      ========
      If a primary is shutdown during an active semi-sync connection
      during the period when the primary is awaiting an ACK, the primary
      hard kills the active communication thread and does not ensure the
      transaction was received by a replica. This can lead to an
      inconsistent replication state.
      
      Solution:
      ========
      During shutdown, the primary should wait for an ACK or timeout
      before hard killing a thread which is awaiting a communication. We
      extend the `SHUTDOWN WAIT FOR SLAVES` logic to identify and ignore
      any threads waiting for a semi-sync ACK in phase 1. Then, before
      stopping the ack receiver thread, the shutdown is delayed until all
      waiting semi-sync connections receive an ACK or time out. The
      connections are then killed in phase 2.
      
      Notes:
       1) There remains an unresolved corner case that affects this
      patch. MDEV-28141: Slave crashes with Packets out of order when
      connecting to a shutting down master. Specifically, If a slave is
      connecting to a master which is actively shutting down, the slave
      can crash with a "Packets out of order" assertion error. To get
      around this issue in the MTR tests, the primary will wait a small
      amount of time before phase 1 killing threads to let the replicas
      safely stop (if applicable).
       2) This patch also fixes MDEV-28114: Semi-sync Master ACK Receiver
      Thread Can Error on COM_QUIT
      
      Reviewed By
      ============
      Andrei Elkin <andrei.elkin@mariadb.com>
      a83c7ab1
    • Sergei Petrunia's avatar
      MDEV-26402: A SEGV in Item_field::used_tables/update_depend_map_for_order... · 807945f2
      Sergei Petrunia authored
      When doing condition pushdown from HAVING into WHERE,
      Item_equal::create_pushable_equalities() calls
      item->set_extraction_flag(IMMUTABLE_FL) for constant items.
      Then, Item::cleanup_excluding_immutables_processor() checks for this flag
      to see if it should call item->cleanup() or leave the item as-is.
      
      The failure happens when a constant item has a non-constant one inside it,
      like:
      
         (tbl.col=0 AND impossible_cond)
      
      item->walk(cleanup_excluding_immutables_processor) works in a bottom-up
      way so it
      1. will call Item_func_eq(tbl.col=0)->cleanup()
      2. will not call Item_cond_and->cleanup (as the AND is constant)
      
      This creates an item tree where a fixed Item has an un-fixed Item inside
      it which eventually causes an assertion failure.
      
      Fixed by introducing this rule: instead of just calling
      
        item->set_extraction_flag(IMMUTABLE_FL);
      
      we call Item::walk() to set the flag for all sub-items of the item.
      807945f2
    • Daniel Black's avatar
      MDEV-28227 Error message Chinese translation (typos) · 32041e70
      Daniel Black authored
      Thanks Marko for noticing.
      32041e70
  6. 21 Apr, 2022 6 commits
    • Vlad Lesin's avatar
      MDEV-26224 InnoDB fails to remove AUTO_INCREMENT attribute · 188aae65
      Vlad Lesin authored
      Reset dict_table_t::persistent_autoinc when inplace alter table is
      committed successfully.
      188aae65
    • Marko Mäkelä's avatar
      WolfSSL v5.2.0-stable · aec85607
      Marko Mäkelä authored
      aec85607
    • Marko Mäkelä's avatar
      Fix clang -Wunused-but-set-variable · f84b5d78
      Marko Mäkelä authored
      f84b5d78
    • Marko Mäkelä's avatar
      Merge 10.3 into 10.4 · 39478409
      Marko Mäkelä authored
      39478409
    • Marko Mäkelä's avatar
      MDEV-28369 ibuf_bitmap_mutex is an unnecessary contention point · 4730314a
      Marko Mäkelä authored
      The only purpose of ibuf_bitmap_mutex is to prevent a deadlock between
      two concurrent invocations of ibuf_update_free_bits_for_two_pages_low()
      on the same pair of bitmap pages, but in opposite order.
      The mutex is unnecessarily serializing the execution of the function
      even when it is being invoked on totally different tablespaces.
      To avoid deadlocks, it suffices to ensure that the two page latches
      are being acquired in a deterministic (sorted) order.
      4730314a
    • Haidong Ji's avatar
      MDEV-28227 Error message Chinese translation · d7189fbc
      Haidong Ji authored
      - Simplified Chinese translation added
      - Character encoding is gdk
      -- gdk covers more characters
      -- gdk includes both Simplified and Traditional
      -- best option I think, may need to work along with other locale
      settings
      - Other cleanup
      -- Within each error, messages are sorted according to language code
      -- More consistent formatting (8 spaces proceeding each translation)
      -- jps removed as duplicate of jpn translation
      
      This should be a good starting point. More refinement is appreciated,
      and needed down the road.
      
      English "containt" (sic) spelling fixes on ER_FK_NO_INDEX_{CHILD,PARENT}
      resulting in mtr test case adjustments.
      
      Edited/reviewed by Daniel Black
      d7189fbc
  7. 20 Apr, 2022 3 commits
  8. 19 Apr, 2022 2 commits
  9. 18 Apr, 2022 4 commits
    • Aleksey Midenkov's avatar
      MDEV-24176 Server crashes after insert in the table with virtual · 08c7ab40
      Aleksey Midenkov authored
      column generated using date_format() and if()
      
      vcol_info->expr is allocated on expr_arena at parsing stage. Since
      expr item is allocated on expr_arena all its containee items must be
      allocated on expr_arena too. Otherwise fix_session_expr() will
      encounter prematurely freed item.
      
      When table is reopened from cache vcol_info contains stale
      expression. We refresh expression via TABLE::vcol_fix_exprs() but
      first we must prepare a proper context (Vcol_expr_context) which meets
      some requirements:
      
      1. As noted above expr update must be done on expr_arena as there may
      be new items created. It was a bug in fix_session_expr_for_read() and
      was just not reproduced because of no second refix. Now refix is done
      for more cases so it does reproduce. Tests affected: vcol.binlog
      
      2. Also name resolution context must be narrowed to the single table.
      Tested by: vcol.update main.default vcol.vcol_syntax gcol.gcol_bugfixes
      
      3. sql_mode must be clean and not fail expr update.
      
      sql_mode such as MODE_NO_BACKSLASH_ESCAPES, MODE_NO_ZERO_IN_DATE, etc
      must not affect vcol expression update. If the table was created
      successfully any further evaluation must not fail. Tests affected:
      main.func_like
      
      Reviewed by: Sergei Golubchik <serg@mariadb.org>
      08c7ab40
    • Aleksey Midenkov's avatar
      MDEV-24176 Preparations · c02ebf35
      Aleksey Midenkov authored
      1. moved fix_vcol_exprs() call to open_table()
      
      mysql_alter_table() doesn't do lock_tables() so it cannot win from
      fix_vcol_exprs() from there. Tests affected: main.default_session
      
      2. Vanilla cleanups and comments.
      c02ebf35
    • Oleg Smirnov's avatar
      MDEV-24529 Assertion failed in vers_select_conds_t::print · 39cc2545
      Oleg Smirnov authored
      This commit adds processing of SYSTEM_TIME_BEFORE and SYSTEM_TIME_HISTORY
      to vers_select_conds_t::print().
      39cc2545
    • Oleg Smirnov's avatar
      MDEV-27699 ANALYZE FORMAT=JSON fields are incorrect for UNION ALL queries · 7498978e
      Oleg Smirnov authored
      UNION ALL queries are a subject of optimization introduced in MDEV-334
      when creation of a temporary table is skipped.
      While there is a check for this optimization in Explain_union::print_explain()
      there was no such in Explain_union::print_explain_json(). This resulted in
      printing irrelevant data like:
        "union_result": {
          "table_name": "<union2,3>",
          "access_type": "ALL",
          "r_loops": 0,
          "r_rows": null
      in case when creation of the temporary table was actually optimized out.
      This commits adds a check whether the temporary table was actually created
      during the UNION ALL processing and eliminates printing of the irrelevant data.
      7498978e
  10. 16 Apr, 2022 1 commit
  11. 14 Apr, 2022 2 commits
  12. 13 Apr, 2022 2 commits
  13. 12 Apr, 2022 3 commits
  14. 11 Apr, 2022 5 commits
    • Shunpoco's avatar
      MDEV-27448 MTR returns success (zero) upon invalid option · 767d8d83
      Shunpoco authored
      I change from `exit;` to `exit(1);` on a function `usage()`.
      When we try to run mtr with a wrong option, a function `usage()` is called with the wrong option as its argument. In this case, because the function call `exit` in a first if statement, we get exit status 0.
      767d8d83
    • Rucha Deodhar's avatar
      MDEV-22266: Diagnostics_area::sql_errno() const: Assertion · 3327bb60
      Rucha Deodhar authored
      `m_status == DA_ERROR' failed on SELECT after setting tmp_disk_table_size.
      
      Analysis: Mismatch in number of warnings between "194 warnings" vs
      "64 rows in set" is because of max_error_count variable which has default
      value of 64.
      About the corrupted tables, the error that occurs because of insufficient
      tmp_disk_table_size variable is not reported correctly and we continue to
      execute the statement. But because the previous error (about table being
      full)is not reported correctly, this error moves up the stack and is
      wrongly reported as parsing error later on while parsing frm file of one
      of the information schema table. This parsing error gives corrupted table
      error.
      As for the innodb error, it occurs even when tmp_disk_table_size is not
      insufficient is default but the internal error handler takes care of it
      and the error doesn't show. But when tmp_disk_table_size is insufficient,
      the fatal error which wasn't reported correctly moves up the stack so
      internal error handler is not called. So it shows errors.
      Fix: Report the error correctly.
      3327bb60
    • Alexander Barkov's avatar
      MDEV-27690 Crash on `CHARACTER SET csname COLLATE DEFAULT` in column definition · 833f4486
      Alexander Barkov authored
      This is a temporary fix for 10.2.
      This problem was permanently fixed in 10.9 under terms of MDEV-27743.
      
      This patch should propagate up to 10.8 then null-merged to 10.9.
      833f4486
    • Monty's avatar
      MDEV-28269 Assertion `save_errno' in maria_write or ER_GET_ERRNO · 6891c487
      Monty authored
      The issue was that the value of MARIA_FOUND_WRONG_KEY was a value
      that could be returned by ha_key_cmp.
      
      This was already fixed in MyISAM, now using the same fix in Aria:
      Setting the value to INT_MAX32, which should be impossible in any
      normal cases.
      
      I also fixed so that if there is a wrong key, we now get a proper error
      message and not an assert.
      6891c487
    • KiyoshiTakeda's avatar
      MDEV-28225 Disallow user to create Spider temporary table · 4d1955d3
      KiyoshiTakeda authored
      Creating a temporary table with Spider is non-sense because a Spider
      table cannot hold any physical data and it requires an additional
      effort to manage even if it is configured correctly.
      
      Set HTON_TEMPORARY_NOT_SUPPORTED to spider_hton->flags.  
      
      Reviewed-by: nayuta.yanagisawa@hey.com
      Co-authored-by: d8sk4ueun@gmail.com
      4d1955d3
  15. 09 Apr, 2022 1 commit
    • Alexander Barkov's avatar
      MDEV-28267 ASAN heap-use-after-free in Item_sp::func_name_cstring · 2ae92e89
      Alexander Barkov authored
      This crash happens on a combination of multiple conditions:
      
      - There is a thead#1 running an "ANALYZE FORMAT=JSON" query for a
        "SELECT .. FROM INFORMATION_SCHEMA.COLUMNS WHERE .. "
      - The WHERE clause contains a stored function call, say f1().
      - The WHERE clause is built in the way so that the function f1()
        is never actually called, e.g.
          WHERE .. AND (TRUE OR f1()=expr)
      - The database contains multiple VIEWs that have the function f1() call,
        e.g. in their <select list>
      - The WHERE clause is built in the way so that these VIEWs match
        the condition.
      - There is a parallel thread#2 running. It creates or drops or recreates
        some other stored routine, say f2(), which is not used in the ANALYZE query.
        It effectively invalidates the stored routine cache for thread#1
        without locking.
        Note, it is important that f2() is NOT used by ANALYZE query.
        Otherwise, thread#2 would be locked until the ANALYZE query
        finishes.
      
      When all of the above conditions are met, the following happens:
      
      1. thread#1 starts the ANALYZE query. It notices a call for the stored function
         f1() in the WHERE condition. The function f1() gets parsed and cached
         to the SP cache. Its address also gets assigned to Item_func_sp::m_sp.
      
      2. thread#1 starts iterating through all tables that
         match the WHERE condition to find the information about their columns.
      
      3. thread#1 processes columns of the VIEW v1.
         It notices a call for f1() in the VIEW v1 definition.
         But f1() is already cached in the step#1 and it is up to date.
         So nothing happens with the SP cache.
      
      4. thread#2 re-creates f2() in a non-locking mode.
         It effectively invalidates the SP cache in thread#1.
      
      5. thread#1 processes columns of the VIEW v2.
         It notices a call for f1() in the VIEW v2 definition.
         It also notices that the cached version of f1() is not up to date.
         It frees the old definition of f1(), parses it again, and puts a
         new version of f1() to the SP cache.
      
      6. thread#1 finishes processing rows and generates the JSON output.
         When printing the "attached_condition" value, it calls
         Item_func_sp::print() for f1(). But this Item_func_sp links
         to the old (freed) version of f1().
      
      The above scenario demonstrates that Item_func_sp::m_sp can point to an
      alredy freed instance when Item_func_sp::func_name() is called,
      so accessing to Item_sp::m_sp->m_handler is not safe.
      
      This patch rewrites the code to use Item_func_sp::m_handler instead,
      which is always reliable.
      
      Note, this patch is only a cleanup for MDEV-28166 to quickly fix the regression.
      It fixes MDEV-28267. But it does not fix the core problem:
      The code behind I_S does not take into account that the SP
      cache can be updated while evaluating rows of the COLUMNS table.
      This is a corner case and it never happens with any other tables.
      I_S.COLUMNS is very special.
      
      Another example of the core problem is reported in MDEV-25243.
      The code accesses to Item_sp::m_sp->m_chistics of an
      already freed m_sp, again. It will be addressed separately.
      2ae92e89