A patch for BUG#31418: User locks misfunctioning after

mysql_change_user().

The problem was that THD::ull was not reset in THD::cleanup().

The fix is to reset it.


sql/sql_class.cc:
  Reset THD::ull after cleanup to prevent memory corruption.
tests/mysql_client_test.c:
  Add test case for BUG#31418.

sql/sql_class.cc

@@ -698,6 +698,7 @@ void THD::cleanup(void)
     pthread_mutex_lock(&LOCK_user_locks);
     item_user_lock_release(ull);
     pthread_mutex_unlock(&LOCK_user_locks);
+    ull= NULL;
   }
 
   cleanup_done=1;

tests/mysql_client_test.c

@@ -16827,7 +16827,7 @@ static void bug20023_change_user(MYSQL *con)
                            opt_db ? opt_db : "test"));
 }
 
-static void bug20023_query_int_variable(MYSQL *con,
+static bool query_int_variable(MYSQL *con,
                                const char *var_name,
                                int *var_value)
 {
@@ -16836,16 +16836,25 @@ static void bug20023_query_int_variable(MYSQL *con,
 
   char query_buffer[MAX_TEST_QUERY_LENGTH];
 
+  bool is_null;
+
   my_snprintf(query_buffer,
           sizeof (query_buffer),
-          "SELECT @@%s",
+          "SELECT %s",
           (const char *) var_name);
 
   DIE_IF(mysql_query(con, query_buffer));
   DIE_UNLESS(rs= mysql_store_result(con));
   DIE_UNLESS(row= mysql_fetch_row(rs));
+
+  is_null= row[0] == NULL;
+
+  if (!is_null)
     *var_value= atoi(row[0]);
+
   mysql_free_result(rs);
+
+  return is_null;
 }
 
 static void test_bug20023()
@@ -16879,12 +16888,12 @@ static void test_bug20023()
     Remember original SQL_BIG_SELECTS, MAX_JOIN_SIZE values.
   ***********************************************************************/
 
-  bug20023_query_int_variable(&con,
-                              "session.sql_big_selects",
+  query_int_variable(&con,
+                     "@@session.sql_big_selects",
                      &sql_big_selects_orig);
 
-  bug20023_query_int_variable(&con,
-                              "global.max_join_size",
+  query_int_variable(&con,
+                     "@@global.max_join_size",
                      &max_join_size_orig);
 
   /***********************************************************************
@@ -16897,8 +16906,8 @@ static void test_bug20023()
 
   /* Query SQL_BIG_SELECTS. */
 
-  bug20023_query_int_variable(&con,
-                              "session.sql_big_selects",
+  query_int_variable(&con,
+                     "@@session.sql_big_selects",
                      &sql_big_selects_2);
 
   /* Check that SQL_BIG_SELECTS is reset properly. */
@@ -16921,8 +16930,8 @@ static void test_bug20023()
 
   /* Query SQL_BIG_SELECTS. */
 
-  bug20023_query_int_variable(&con,
-                              "session.sql_big_selects",
+  query_int_variable(&con,
+                     "@@session.sql_big_selects",
                      &sql_big_selects_3);
 
   /* Check that SQL_BIG_SELECTS is 0. */
@@ -16945,8 +16954,8 @@ static void test_bug20023()
 
   /* Query SQL_BIG_SELECTS. */
 
-  bug20023_query_int_variable(&con,
-                              "session.sql_big_selects",
+  query_int_variable(&con,
+                     "@@session.sql_big_selects",
                      &sql_big_selects_4);
 
   /* Check that SQL_BIG_SELECTS is 1. */
@@ -16974,8 +16983,8 @@ static void test_bug20023()
 
   /* Query SQL_BIG_SELECTS. */
 
-  bug20023_query_int_variable(&con,
-                              "session.sql_big_selects",
+  query_int_variable(&con,
+                     "@@session.sql_big_selects",
                      &sql_big_selects_5);
 
   /* Check that SQL_BIG_SELECTS is 1. */
@@ -16989,6 +16998,98 @@ static void test_bug20023()
   mysql_close(&con);
 }
 
+static void bug31418_impl()
+{
+  MYSQL con;
+
+  bool is_null;
+  int rc;
+
+  /* Create a new connection. */
+
+  DIE_UNLESS(mysql_init(&con));
+
+  DIE_UNLESS(mysql_real_connect(&con,
+                                opt_host,
+                                opt_user,
+                                opt_password,
+                                opt_db ? opt_db : "test",
+                                opt_port,
+                                opt_unix_socket,
+                                CLIENT_FOUND_ROWS));
+
+  /***********************************************************************
+    Check that lock is free:
+      - IS_FREE_LOCK() should return 1;
+      - IS_USED_LOCK() should return NULL;
+  ***********************************************************************/
+
+  is_null= query_int_variable(&con,
+                              "IS_FREE_LOCK('bug31418')",
+                              &rc);
+  DIE_UNLESS(!is_null && rc);
+
+  is_null= query_int_variable(&con,
+                              "IS_USED_LOCK('bug31418')",
+                              &rc);
+  DIE_UNLESS(is_null);
+
+  /***********************************************************************
+    Acquire lock and check the lock status (the lock must be in use):
+      - IS_FREE_LOCK() should return 0;
+      - IS_USED_LOCK() should return non-zero thread id;
+  ***********************************************************************/
+
+  query_int_variable(&con, "GET_LOCK('bug31418', 1)", &rc);
+  DIE_UNLESS(rc);
+
+  is_null= query_int_variable(&con,
+                              "IS_FREE_LOCK('bug31418')",
+                              &rc);
+  DIE_UNLESS(!is_null && !rc);
+
+  is_null= query_int_variable(&con,
+                              "IS_USED_LOCK('bug31418')",
+                              &rc);
+  DIE_UNLESS(!is_null && rc);
+
+  /***********************************************************************
+    Issue COM_CHANGE_USER command and check the lock status
+    (the lock must be free):
+      - IS_FREE_LOCK() should return 1;
+      - IS_USED_LOCK() should return NULL;
+  **********************************************************************/
+
+  bug20023_change_user(&con);
+
+  is_null= query_int_variable(&con,
+                              "IS_FREE_LOCK('bug31418')",
+                              &rc);
+  DIE_UNLESS(!is_null && rc);
+
+  is_null= query_int_variable(&con,
+                              "IS_USED_LOCK('bug31418')",
+                              &rc);
+  DIE_UNLESS(is_null);
+
+  /***********************************************************************
+   That's it. Cleanup.
+  ***********************************************************************/
+
+  mysql_close(&con);
+}
+
+static void test_bug31418()
+{
+  /* Run test case for BUG#31418 for three different connections. */
+
+  bug31418_impl();
+
+  bug31418_impl();
+
+  bug31418_impl();
+}
+
 
 /*
   Read and parse arguments and MySQL options from my.cnf
@@ -17286,6 +17387,7 @@ static struct my_tests_st my_tests[]= {
   { "test_change_user", test_change_user },
   { "test_bug30472", test_bug30472 },
   { "test_bug20023", test_bug20023 },
+  { "test_bug31418", test_bug31418 },
   { 0, 0 }
 };