Backported fix for #7446: Attempt to use data in destroyed transactio…

…n pool
FirebirdSQL · Jan 16, 2023 · 3ab8a39 · 3ab8a39
1 parent 8c25b6e
commit 3ab8a39
Show file tree

Hide file tree

Showing 4 changed files with 36 additions and 11 deletions.
diff --git a/src/jrd/dfw.epp b/src/jrd/dfw.epp
@@ -5900,9 +5900,26 @@ static bool make_version(thread_db* tdbb, SSHORT phase, DeferredWork* work, jrd_
 
 							defaultRequest->req_timestamp.validate();
 
-							TRA_attach_request(transaction, defaultRequest);
-							dsc* result = EVL_expr(tdbb, defaultRequest, defaultNode);
-							TRA_detach_request(defaultRequest);
+							dsc* result = NULL;
+							{ // scope
+								class LocalClean
+								{
+								public:
+									LocalClean(jrd_req* const def)
+										: defaultRequest(def)
+									{ }
+									~LocalClean()
+									{
+										TRA_detach_request(defaultRequest);
+									}
+								private:
+									jrd_req* const defaultRequest;
+								};
+
+								LocalClean detach(defaultRequest);
+								TRA_attach_request(transaction, defaultRequest);
+								result = EVL_expr(tdbb, defaultRequest, defaultNode);
+							}
 
 							if (result)
 							{

diff --git a/src/jrd/exe.cpp b/src/jrd/exe.cpp
@@ -195,7 +195,6 @@ void StatusXcp::as_sqlstate(char* sqlstate) const
 static void execute_looper(thread_db*, jrd_req*, jrd_tra*, const StmtNode*, jrd_req::req_s);
 static void looper_seh(thread_db*, jrd_req*, const StmtNode*);
 static void release_blobs(thread_db*, jrd_req*);
-static void release_proc_save_points(jrd_req*);
 static void trigger_failure(thread_db*, jrd_req*);
 static void stuff_stack_trace(const jrd_req*);
 
@@ -700,7 +699,7 @@ void EXE_receive(thread_db* tdbb,
 			Savepoint* const save_sav_point = transaction->tra_save_point;
 			transaction->tra_save_point = request->req_proc_sav_point;
 			request->req_proc_sav_point = save_sav_point;
-			release_proc_save_points(request);
+			EXE_release_proc_save_points(request);
 		}
 		throw;
 	}
@@ -939,7 +938,7 @@ void EXE_unwind(thread_db* tdbb, jrd_req* request)
 	request->req_sorts.unlinkAll();
 
 	if (request->req_proc_sav_point && (request->req_flags & req_proc_fetch))
-		release_proc_save_points(request);
+		EXE_release_proc_save_points(request);
 
 	TRA_detach_request(request);
 
@@ -1481,18 +1480,18 @@ static void release_blobs(thread_db* tdbb, jrd_req* request)
 }
 
 
-static void release_proc_save_points(jrd_req* request)
+void EXE_release_proc_save_points(jrd_req* request)
 {
-/**************************************
+/************************************************************
  *
- *	r e l e a s e _ p r o c _ s a v e _ p o i n t s
+ *	E X E _ r e l e a s e _ p r o c _ s a v e _ p o i n t s
  *
- **************************************
+ ************************************************************
  *
  * Functional description
  *	Release savepoints used by this request.
  *
- **************************************/
+ ************************************************************/
 	Savepoint* sav_point = request->req_proc_sav_point;
 
 	if (request->req_transaction)

diff --git a/src/jrd/exe_proto.h b/src/jrd/exe_proto.h
@@ -51,6 +51,7 @@ void EXE_release(Jrd::thread_db*, Jrd::jrd_req*);
 void EXE_send(Jrd::thread_db*, Jrd::jrd_req*, USHORT, ULONG, const UCHAR*);
 void EXE_start(Jrd::thread_db*, Jrd::jrd_req*, Jrd::jrd_tra*);
 void EXE_unwind(Jrd::thread_db*, Jrd::jrd_req*);
+void EXE_release_proc_save_points(Jrd::jrd_req*);
 
 namespace Jrd
 {

diff --git a/src/jrd/tra.cpp b/src/jrd/tra.cpp
@@ -147,6 +147,14 @@ void TRA_detach_request(Jrd::jrd_req* request)
 	if (!request->req_transaction)
 		return;
 
+	// Release procedure savepoints used by this request
+	if (request->req_proc_sav_point)
+	{
+		fb_assert(request->req_flags & req_proc_fetch);
+		EXE_release_proc_save_points(request);
+		fb_assert(!request->req_proc_sav_point);
+	}
+
 	// Remove request from the doubly linked list
 	if (request->req_tra_next)
 	{