sql/mysqld.cc

    fixed concurrency bug with a very quickly disconnecting client -
    the client could disconnect and delete thd before pthread_create 
    could write to &thd->real_id 
sql/sql_list.h
    while tracking down the bug, made new/delete go through my_malloc/my_free
    for ilink - did not help, but this is better anyway - cleaner exit with a message in
    out of memory codition at least.


sql/mysqld.cc:
  fixed concurrency bug with a very quickly disconnecting client -
  the client could disconnect and delete thd before pthread_create 
  could write to &thd->real_id
sql/sql_list.h:
  while tracking down the bug, made new/delete go through my_malloc/my_free
  for ilink - did not help, but this is better anyway - cleaner exit with a message in
  out of memory codition at least.

sql/mysqld.cc

@@ -2091,7 +2091,6 @@ static void create_new_thread(THD *thd)
       threads.append(thd);
       DBUG_PRINT("info",(("creating thread %d"), thd->thread_id));
       thd->connect_time = time(NULL);
-      (void) pthread_mutex_unlock(&LOCK_thread_count);
       if ((error=pthread_create(&thd->real_id,&connection_attrib,
 				handle_one_connection,
 				(void*) thd)))
@@ -2099,7 +2098,6 @@ static void create_new_thread(THD *thd)
 	DBUG_PRINT("error",
 		   ("Can't create thread to handle request (error %d)",
 		    error));
-	(void) pthread_mutex_lock(&LOCK_thread_count);
 	thread_count--;
 	thd->killed=1;				// Safety
 	(void) pthread_mutex_unlock(&LOCK_thread_count);
@@ -2110,6 +2108,8 @@ static void create_new_thread(THD *thd)
 	(void) pthread_mutex_unlock(&LOCK_thread_count);
 	DBUG_VOID_RETURN;
       }
+      
+      (void) pthread_mutex_unlock(&LOCK_thread_count);
     }
   }
   DBUG_PRINT("info",(("Thread %d created"), thd->thread_id));

sql/sql_list.h

@@ -225,6 +225,15 @@ template <class T> class List_iterator :public base_list_iterator
 
 struct ilink {
   struct ilink **prev,*next;
+  static void *operator new(size_t size)
+  {
+    return (void*)my_malloc((uint)size, MYF(MY_WME | MY_FAE));
+  }
+  static void operator delete(void* ptr_arg, size_t size)
+  {
+     my_free((gptr)ptr_arg, MYF(MY_WME|MY_ALLOW_ZERO_PTR));
+  }
+
   inline ilink()
   {
     prev=0; next=0;