MDEV-28696 View created as "select b''; " references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them

Like in MDEV-16110 we must release items allocated on thd->mem_root by
reopening the table.

MDEV-16290 relocated MDEV-16110 fix in 10.5 so it works for MDEV-28576
as well. 10.3 without MDEV-16290 now duplicates this fix.

The change from MDEV-29465 exposed a flaw in replace_column_table
where again we were not properly updating the column-level bits.

replace_table_table was changed in MDEV-29465 to properly update
grant_table->init_cols, however replace_column_table still only
modified grant_column->rights when the GRANT_COLUMN already existed.

This lead to a missmatch between GRANT_COLUMN::init_rights and
GRANT_COLUMN::rights, *if* the GRANT_COLUMN already existed.

As an example:

GRANT SELECT (col1) ...
Here:
For col1
GRANT_COLUMN::init_rights and GRANT_COLUMN::rights are set to 1 (SELECT) in
replace_column_table.

GRANT INSERT (col1) ...
Here, without this patch GRANT_COLUMN::init_rights is still 1 and
GRANT_COLUMN::rights is 3 (SELECT_PRIV | INSERT_PRIV)

Finally, if before this patch, one does:

REVOKE SELECT (col1) ...

replace_table_table will see that init_rights loses bit 1 thus it
considers there are no more rights granted on that particular table.

This prompts the whole GRANT_TABLE to be removed via the first revoke,
when the GRANT_COLUMN corresponding to it should still have init_rights == 2.

By also updating replace_column_table to keep init_rights in sync
properly, the issue is resolved.

Reviewed by <serg@mariadb.com>

- Bug happens only in case when the range function on empty key single
column index (XINDEXS) is used.
- Solution is to return with empty result in this scenario.

Reviewed by: <>

Commit 32158be7 added a new test `bad_startup_options`. This test fails
if run as root, which is common on many CI systems.

This test should include `not_as_root.inc` so it is skipped, just
like all other similar tests in MariaDB.

All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the
BSD-new license. I am contributing on behalf of my employer
Amazon Web Services, Inc.

Fixes up commit b8ad6fbd

Ensure that all memory allocated by TABLE_LIST::change_refs_to_fields() is
in the same memory root!

The following tests are disabled when running --valgrding without --big:
- rpl.rpl_ssl
- rpl.rpl_semi_sync_event
- All encryption test (which includes have_file_key_management.inc)

MDEV-16735 describes how mysql_upgrade fails when alter_algorithm
is set to a value different than 'DEFAULT'/'COPY'. It was marked as
fixed by 0ee08683, but the fix didn't covered the possibility of having
the global value of alter_algorithm set to something different than
'DEFAULT'/'COPY'. To ensure that the upgrade process works properly
regardless the global value of alter_altorithm, this commit force it's
value to 'DEFAULT' (note the quotes) for the mysql_upgrade session.

All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the
BSD-new license. I am contributing on behalf of my employer
Amazon Web Services, Inc.

Reviewer: <serg@mariadb.com>
Closes PR #2244

MDEV-28996 ASAN errors in String::q_append / spider_string::q_append / spider_db_mbase_util::open_item_func

The server crashed due to the stack-use-after-scope on tmp_str.
tmp_str will be used later so should not point to the local buffer.

The crash occurs because of the following call of TABLE_LIST::init_one_table():

  table_list.init_one_table(
    &table_list.db, &table_list.table_name, 0, TL_WRITE);

One should not pass table_list.db and table_list.table_name to the function
because it update the very members internally.

The function is called previously, and there is no need to call it again.
So, simply removing the call will resolve the problem.

Virtual column values are updated in handler in reading commands,
like ha_index_next, etc. This was missing for ha_ft_read.

handler::ha_ft_read: add table->update_virtual_fields() call

This patch adds the correct setting of the "--ssl-verify-server-cert"
option in the client-side utilities such as mysqlcheck and mysqlslap,
as well as the correct setting of the "--ssl-crl" option when executing
queries on the slave side, and also add the correct option codes in
the "sslopts-logopts.h" file (in the latter case, incorrect values
are not a problem right now, but may cause subtle test failures in
the future, if the option handling code changes).

- InnoDB AHI tries to access the concurrent instant alter column,
leads to asan failure. Instant alter column should acquire the
clustered index search latch in exclusive mode before changing
the table cache definition.

- Removed the default parameter for the function
btr_search_drop_page_hash_index()

- Addressed the DWITH_INNODB_AHI=0 compilation failure
by passing two parameters from all callers of
btr_search_drop_page_hash_index()

Because of the default warning level, aborted unauthenticated
connections are in the error log. These errors frequently occur
in production environments because cancelled connectiosn occur
all the time when web pages are shutdown.

Rather than flood our user's errors log with these ordinary
messages, lets push them down to the warning level at log-warnings=4
level.

Concept approved by Monty.

MDEV-29473 UBSAN: Signed integer overflow: X * Y cannot be represented in type 'int' in strings/dtoa.c

Fixing a few problems relealed by UBSAN in type_float.test

- multiplication overflow in dtoa.c

- uninitialized Field::geom_type (and Field::srid as well)

- Wrong call-back function types used in combination with SHOW_FUNC.
  Changes in the mysql_show_var_func data type definition were not
  properly addressed all around the code by the following commits:
    b4ff6456
    18feb62f
    0ee879ff

  Adding a helper SHOW_FUNC_ENTRY() function and replacing
  all mysql_show_var_func declarations using SHOW_FUNC
  to SHOW_FUNC_ENTRY, to catch mysql_show_var_func in the future
  at compilation time.

- InnoDB fails to free the persistent cursor for the clustered index
when InnoDB replays the update operation on the table that is
being rebuilt.

This fixes the following test invocation:
./mtr --no-reorder parts.partition_special_myisam parts.partition_debug

This was broken ever since afd4b25d
a.k.a. mysql/mysql-server@bde21e58108a1f311d15088c50414bb43ab45d62

CONNECT engine was using dividing UTF8 columns by 3 to get the length,
but in reality it did need the byte length.

This fixes MDEV-26722 too.

Per fsp0types.h, SDI is on tablespace flags position 14 where MariaDB
stores its pagesize. Flag at position 13, also in MariaDB pagesize
flags, is a MySQL encryption flag.

These are checked only if fsp_flags_is_valid fails, so valid MariaDB
pages sizes don't become errors.

The error message "Cannot reset LSNs in table" was rather specific and
not always true to replaced with more generic error.

ALTER TABLE tbl IMPORT TABLESPACE now reports Unsupported on MySQL
tablespace (rather than index corrupted) along with a server error
message.

MySQL innodb Errors are with with UNSUPPORTED rather than CORRUPTED
to avoid user anxiety.

Reviewer: Marko Mäkelä

MDEV-10087 mysqld_update()/mysql_delete() continues execution even after subquery with JOIN gets error from storage engine

The issue is that record_should_be_deleted() returns true in
mysql_delete() even if sub-select with join gets error from storage
engine when DELETE FROM ... WHERE ... IN (SELECT ...) statement is
executed.

The same is true for mysql_update() where select->skip_record() returns
true even if sub-select with join gets error from storage engine.

In the test case if sub-select is chosen as deadlock victim the whole
transaction is rolled back during sub-select execution, but
mysql_delete()/mysql_update() continues transaction execution and invokes
table->delete_row() as record_should_be_deleted() wrongly returns true
in mysql_delete() and table->update_row() as select->skip_record(thd)
wrongly returns 1 for mysql_update().

record_should_be_deleted() wrogly returns true because thd->is_error()
returns false SQL_SELECT::skip_record() invoked from
record_should_be_deleted().

It's supposed that THD error should be set in rr_handle_error() called
from rr_sequential() during sub-select JOIN::exec_inner() execution.

But rr_handle_error() does not set THD error because
READ_RECORD::print_error is not set in JOIN_TAB::read_record.

READ_RECORD::print_error should be initialized in
init_read_record()/init_read_record_idx(). But make_join_readinfo() does
not invoke init_read_record()/init_read_record_idx() for
JOIN_TAB::read_record.

The fix is to set JOIN_TAB::read_record.print_error in
make_join_readinfo(), i.e. in the same place where
JOIN_TAB::read_record.table is set.

Reviewed by Sergey Petrunya.

This is a backport of commit 8b6a308e
from MariaDB Server 10.6.11. No attempt to reproduce the hang
in earlier an earlier version of MariaDB Server than 10.6 was made.

In each caller of fseg_n_reserved_pages() except ibuf_init_at_db_start()
which is a special case for ibuf.index at database startup, we must hold
an index latch that prevents concurrent allocation or freeing of index
pages.

Any operation that allocates or free pages that belong to an index tree
must first acquire an index latch in non-shared mode, and while
holding that, acquire an index root page latch in non-shared mode.

btr_get_size(), btr_get_size_and_reserved(): Assert that a strong enough
index latch is being held.

dict_stats_update_transient_for_index(),
dict_stats_analyze_index(): Acquire a strong enough index latch.

These operations had followed the same order of acquiring latches in
every InnoDB version since the very beginning
(commit c533308a).

The hang was introduced in
commit 2e814d47 which imported
mysql/mysql-server@ac74632293bea967b352d1b472abedeeaa921b98
which failed to strengthen the locking requirements of the function
btr_get_size().

* MDEV-29397 Fix note turning into error

ODBC Rewind triggered an error with no SQL, but this is sometimes a
valid condition (as can be seen with other classes). Setting this to a 0
return stops errors firing when they shouldn't.

Also fixes ASAN hits from in MDEV-29687 tabext.cpp.

spatial_index_info: Replaces index_tuple_info_t. Always take
a memory heap as a parameter to the member functions.
Remove pointer indirection for m_dtuple_vec.

spatial_index_info::add(): Duplicate any PRIMARY KEY fields that would
point to within ext->buf because that buffer will be allocated in
a shorter-lifetime memory heap.

Every operation that is going to write redo log is supposed to
invoke log_free_check() before acquiring any latches. If there
is a risk of log buffer overrun, a log checkpoint would be
triggered by that call.

ibuf_merge_space(), ibuf_merge_in_background(),
ibuf_delete_for_discarded_space(): Invoke log_free_check()
when the current thread is not holding any page latches.

Unfortunately, in lower-level code called from ibuf_insert()
or ibuf_merge_or_delete_for_page(), some page latches may be
held and a call to log_free_check() could hang.

ibuf_set_bitmap_for_bulk_load(): Use the caller's mini-transaction.
The caller should have invoked log_free_check() while not holding
any page latches.

Something appears to be broken in the DBUG subsystem.
Let us remove frequent calls to it from the InnoDB internal SQL interpreter
that is used in the purge of transaction history.

The DBUG_PRINT in que_eval_sql() can remain for now, because those
operations are much less frequent.

InnoDB crash recovery can run out of memory before
commit 50324ce6 in
MariaDB Server 10.5.

Let us disable some frequently failing recovery tests
in earlier versions.

Not creating explicit record locks will speed up the test.

Also, disable the use of InnoDB persistent statistics in the test of
MDEV-27270 to avoid intermittent failures in 10.6 or later
(after commit 9608773f)
due to the nondeterministic scheduling of STATS_AUTO_PERSISTENT.

The file plugin_exports became unused in
commit fec844ac

- mariabackup fails to assign srv_undo_space_id_start when the
dedicated undo tablespaces are disabled

When trying to output stacktrace, and addr2line is not installed, the
child process forked by start_addr2line_fork() will fail to do exec(),
and finish with exit(1).

There is a problem with exit() though - it runs exit handlers,
and for the forked copy of crashing process, it is a bad idea.

In 10.5+ code for example, exit handlers include
tpool::task_group static destructors, and it will hang infinitely
waiting for completion of the outstanding tasks.

The fix is to use _exit() instead, which skips the execution of exit
handlers