MDEV-14762 Server crashes in MDL_ticket::has_stronger_or_equal_type u…

…pon inserting into temporary sequence Fix is to not upgrade MDL locks for temporary tables
MariaDB · Apr 5, 2018 · d8da97b · d8da97b
1 parent 3dd0166
commit d8da97b
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 3 deletions.
diff --git a/mysql-test/suite/sql_sequence/temporary.result b/mysql-test/suite/sql_sequence/temporary.result
@@ -10,3 +10,10 @@ select * from s1;
 next_not_cached_value	minimum_value	maximum_value	start_value	increment	cache_size	cycle_option	cycle_count
 1001	1	9223372036854775806	1	1	1000	0	0
 drop temporary sequence s1;
+#
+# MDEV-14762 Server crashes in MDL_ticket::has_stronger_or_equal_type
+# upon inserting into temporary sequence
+#
+CREATE TEMPORARY SEQUENCE s1 ENGINE=InnoDB;
+INSERT INTO s1 VALUES (1, 1, 1000, 1, 1, 1, 1, 0);
+DROP TEMPORARY SEQUENCE s1;
diff --git a/mysql-test/suite/sql_sequence/temporary.test b/mysql-test/suite/sql_sequence/temporary.test
@@ -14,3 +14,12 @@ alter table s1 engine myisam;
 select nextval(s1);
 select * from s1;
 drop temporary sequence s1;
+
+--echo #
+--echo # MDEV-14762 Server crashes in MDL_ticket::has_stronger_or_equal_type
+--echo # upon inserting into temporary sequence
+--echo #
+
+CREATE TEMPORARY SEQUENCE s1 ENGINE=InnoDB;
+INSERT INTO s1 VALUES (1, 1, 1000, 1, 1, 1, 1, 0);
+DROP TEMPORARY SEQUENCE s1;
diff --git a/sql/ha_sequence.cc b/sql/ha_sequence.cc
@@ -237,9 +237,12 @@ int ha_sequence::write_row(uchar *buf)
     THD *thd= table->in_use;
     if (thd->lock->table_count != 1)
       DBUG_RETURN(ER_WRONG_INSERT_INTO_SEQUENCE);
-    if (thd->mdl_context.upgrade_shared_lock(table->mdl_ticket, MDL_EXCLUSIVE,
-                                             thd->variables.lock_wait_timeout))
-      DBUG_RETURN(ER_LOCK_WAIT_TIMEOUT);
+    if (table->s->tmp_table == NO_TMP_TABLE &&
+        thd->mdl_context.upgrade_shared_lock(table->mdl_ticket,
+                                             MDL_EXCLUSIVE,
+                                             thd->variables.
+                                             lock_wait_timeout))
+        DBUG_RETURN(ER_LOCK_WAIT_TIMEOUT);
 
     tmp_seq.read_fields(table);
     if (tmp_seq.check_and_adjust(0))