Bug#24487414 - SIG 11 IN DD::INFO_SCHEMA::STATISTICS_CACHE::READ_STAT_BY_OPEN_TABLE

Attempt to access TABLE instance when open table (to obtain
statistics) fails because of KILL query or connection operation
resulted in the issue reported.

For the non-innodb tables, its statistics is obtained by opening
the table. Current code assumes that when open table fails then
Diagnostics_area is always set with an error. If Diagnostics_area
is not set then open table success condition code is executed.
This works well when table open fails because of the error. Open
table fails even when query or connections is killed. In this case
Diagnostics_area might not be set. In such scenario, attempt
access TABLE instance from the pointer in TABLE_LIST resulted in
the crash.

To fix the issue, the failures from open_tables() is handled
irrespective of whether the diagnostics area is set. If we find
error being reported in diagnostics area, we write it to comment
field as we do now. If we do not find a error reported, then we
just make the UDF return failure. The query is later terminated
by call to send_kill_message() when we check thd->killed flag.

Author: phulakun

mysql-test/r/dd_is_debug.result

@@ -0,0 +1,16 @@
+#
+# Bug#24487414 - SIG 11 IN DD::INFO_SCHEMA::STATISTICS_CACHE::READ_STAT_BY_OPEN_TABLE
+#
+SET @old_information_schema_stats= @@session.information_schema_stats;
+SET @@session.information_schema_stats= latest;
+CREATE TABLE time_zone(f1 INT PRIMARY KEY) ENGINE=MyISAM;
+INSERT INTO time_zone VALUES (10);
+SET SESSION DEBUG="+d,simulate_kill_query_on_open_table";
+# Without fix, following query results in crash when query is killed while
+# opening "test.time_zone" table.
+SELECT * FROM INFORMATION_SCHEMA.STATISTICS WHERE TABLE_SCHEMA='test' AND
+TABLE_NAME = 'time_zone';
+ERROR 70100: Query execution was interrupted
+SET SESSION DEBUG="-d,simulate_kill_query_on_open_table";
+DROP TABLE time_zone;
+SET @@session.information_schema_stats= @old_information_schema_stats;

mysql-test/t/dd_is_debug.test

@@ -0,0 +1,30 @@
+#
+# Tests for INFORMATION_SCHEMA system views requiring debug build of server.
+#
+--source include/have_debug.inc
+
+--echo #
+--echo # Bug#24487414 - SIG 11 IN DD::INFO_SCHEMA::STATISTICS_CACHE::READ_STAT_BY_OPEN_TABLE
+--echo #
+SET @old_information_schema_stats= @@session.information_schema_stats;
+SET @@session.information_schema_stats= latest;
+
+# time_zone table name is used here to set debug point
+# kill_query_on_open_table_from_tz_find from the
+# simulate_kill_query_on_open_table debug point.
+CREATE TABLE time_zone(f1 INT PRIMARY KEY) ENGINE=MyISAM;
+INSERT INTO time_zone VALUES (10);
+
+SET SESSION DEBUG="+d,simulate_kill_query_on_open_table";
+--echo # Without fix, following query results in crash when query is killed while
+--echo # opening "test.time_zone" table.
+--error ER_QUERY_INTERRUPTED
+SELECT * FROM INFORMATION_SCHEMA.STATISTICS WHERE TABLE_SCHEMA='test' AND
+                                                  TABLE_NAME = 'time_zone';
+SET SESSION DEBUG="-d,simulate_kill_query_on_open_table";
+
+DROP TABLE time_zone;
+
+SET @@session.information_schema_stats= @old_information_schema_stats;
+
+###########################################################################

sql/dd/info_schema/stats.cc

@@ -620,6 +620,9 @@ ulonglong Statistics_cache::read_stat_by_open_table(
    */
   lex->sql_command= SQLCOM_SELECT;
 
+  DBUG_EXECUTE_IF("simulate_kill_query_on_open_table",
+                  DBUG_SET("+d,kill_query_on_open_table_from_tz_find"););
+
   // Push deadlock error handler.
   thd->push_internal_handler(&mdl_deadlock_error_handler);
 
@@ -630,6 +633,8 @@ ulonglong Statistics_cache::read_stat_by_open_table(
 
   thd->pop_internal_handler();
 
+  DBUG_EXECUTE_IF("simulate_kill_query_on_open_table",
+                  DBUG_SET("-d,kill_query_on_open_table_from_tz_find"););
   DEBUG_SYNC(thd, "after_open_table_mdl_shared_to_fetch_stats");
 
   if (!open_result && table_list->is_view_or_derived())
@@ -645,30 +650,45 @@ ulonglong Statistics_cache::read_stat_by_open_table(
    */
   lex->sql_command= old_lex->sql_command;
 
-  if (open_result && thd->is_error())
+  if (open_result)
   {
-    /*
-      Hide error for a non-existing table.
-      For example, this error can occur when we use a where condition
-      with a db name and table, but the table does not exist.
-     */
-    if (!(thd->get_stmt_da()->mysql_errno() == ER_NO_SUCH_TABLE) &&
-        !(thd->get_stmt_da()->mysql_errno() == ER_WRONG_OBJECT))
-      push_warning(thd, Sql_condition::SL_WARNING,
-                   thd->get_stmt_da()->mysql_errno(),
-                   thd->get_stmt_da()->message_text());
+    DBUG_ASSERT(thd->is_error() || thd->is_killed());
 
-    /* Cache empty statistics when we see a error.
-       This will make sure,
+    if (thd->is_error())
+    {
+      /*
+        Hide error for a non-existing table.
+        For example, this error can occur when we use a where condition
+        with a db name and table, but the table does not exist.
+      */
+      if (!(thd->get_stmt_da()->mysql_errno() == ER_NO_SUCH_TABLE) &&
+          !(thd->get_stmt_da()->mysql_errno() == ER_WRONG_OBJECT))
+        push_warning(thd, Sql_condition::SL_WARNING,
+                     thd->get_stmt_da()->mysql_errno(),
+                     thd->get_stmt_da()->message_text());
 
-       1. You will not invoke open_tables_for_query() gain.
+      /* Cache empty statistics when we see a error.
+         This will make sure,
 
-       2. You will not see junk values for statistics in results.
-    */
-    cache_stats(schema_name_ptr, table_name_ptr, ha_stat);
+         1. You will not invoke open_tables_for_query() gain.
 
-    m_error= thd->get_stmt_da()->message_text();
-    thd->clear_error();
+         2. You will not see junk values for statistics in results.
+      */
+      cache_stats(schema_name_ptr, table_name_ptr, ha_stat);
+
+      m_error= thd->get_stmt_da()->message_text();
+      thd->clear_error();
+    }
+    else
+    {
+      /*
+        Table open fails even when query or connection is killed. In this
+        case Diagnostics_area might not be set. So just returning error from
+        here. Query is later terminated by call to send_kill_message() when
+        we check thd->killed flag.
+      */
+      error= -1;
+    }
 
     goto end;
   }