• Dmitry Shulga's avatar
    MDEV-23902: MariaDB crash on calling function · 68353dc9
    Dmitry Shulga authored
    On creation of a VIEW that depends on a stored routine an instance of
    the class Item_func_sp is allocated on a memory root of SP statement.
    It happens since mysql_make_view() calls the method
      THD::activate_stmt_arena_if_needed()
    before parsing definition of the view.
    On the other hand, when sp_head's rcontext is created an instance of
    the class Field referenced by the data member
      Item_func_sp::result_field
    is allocated on the Item_func_sp's Query_arena (call arena) that set up
    inside the method
      Item_sp::execute_impl
    just before calling the method
      sp_head::execute_function()
    
    On return from the method sp_head::execute_function() all items allocated
    on the Item_func_sp's Query_arena are released and its memory root is freed
    (see implementation of the method Item_sp::execute_impl). As a consequence,
    the pointer
      Item_func_sp::result_field
    references to the deallocated memory. Later, when the method
      sp_head::execute
    cleans up items allocated for just executed SP instruction the method
      Item_func_sp::cleanup is invoked and tries to delete an object referenced
    by data member Item_func_sp::result_field that points to already deallocated
    memory, that results in a server abnormal termination.
    
    To fix the issue the current active arena shouldn't be switched to
    a statement arena inside the function mysql_make_view() that invoked indirectly
    by the method sp_head::rcontext_create. It is implemented by introducing
    the new Query_arena's state STMT_SP_QUERY_ARGUMENTS that is set when explicit
    Query_arena is created for placing SP arguments and other caller's side items
    used during SP execution. Then the method THD::activate_stmt_arena_if_needed()
    checks Query_arena's state and returns immediately without switching to
    statement's arena.
    68353dc9
item.cc 298 KB