Merge pchardin@bk-internal.mysql.com:/home/bk/mysql-5.0-runtime

into  mysql.com:/home/cps/mysql/trees/mysql-5.0-virgin

mysql-test/r/csv.result

@@ -5000,3 +5000,13 @@ insert t1 values (1),(2),(3),(4),(5);
 truncate table t1;
 affected rows: 0
 drop table t1;
+create table bug15205 (val int(11) default null) engine=csv;
+create table bug15205_2 (val int(11) default null) engine=csv;
+select * from bug15205;
+ERROR HY000: Got error 1 from storage engine
+select * from bug15205_2;
+val
+select * from bug15205;
+val
+drop table bug15205;
+drop table bug15205_2;

mysql-test/t/csv.test

@@ -1384,3 +1384,27 @@ truncate table t1;              -- truncate
 --disable_info
 drop table t1;
 
+#
+# Bug #15205   Select from CSV table without the datafile causes crash
+#
+# NOTE: the bug is not deterministic
+
+# The crash happens because the necessary cleanup after an error wasn't
+# performed. Namely, the table share, inserted in the hash during table
+# open, was not deleted from hash. At the same time the share was freed
+# when an error was encountered. Thus, subsequent access to the hash
+# resulted in scanning through deleted memory and we were geting a crash.
+# that's why we need two tables in the bugtest
+
+create table bug15205 (val int(11) default null) engine=csv;
+create table bug15205_2 (val int(11) default null) engine=csv;
+--exec rm $MYSQLTEST_VARDIR/master-data/test/bug15205.CSV
+# system error (can't open the datafile)
+--error ER_GET_ERRNO
+select * from bug15205;
+select * from bug15205_2;
+--exec touch $MYSQLTEST_VARDIR/master-data/test/bug15205.CSV
+select * from bug15205;
+drop table bug15205;
+drop table bug15205_2;
+

sql/examples/ha_tina.cc

@@ -184,16 +184,18 @@ static TINA_SHARE *get_share(const char *table_name, TABLE *table)
     share->table_name_length=length;
     share->table_name=tmp_name;
     strmov(share->table_name,table_name);
-    fn_format(data_file_name, table_name, "", ".CSV",MY_REPLACE_EXT|MY_UNPACK_FILENAME);
+    fn_format(data_file_name, table_name, "", ".CSV",
+              MY_REPLACE_EXT | MY_UNPACK_FILENAME);
+
+    if ((share->data_file= my_open(data_file_name, O_RDWR|O_APPEND,
+                                   MYF(0))) == -1)
+      goto error;
+
     if (my_hash_insert(&tina_open_tables, (byte*) share))
       goto error;
     thr_lock_init(&share->lock);
     pthread_mutex_init(&share->mutex,MY_MUTEX_INIT_FAST);
 
-    if ((share->data_file= my_open(data_file_name, O_RDWR|O_APPEND,
-                                   MYF(0))) == -1)
-      goto error2;
-
     /* We only use share->data_file for writing, so we scan to the end to append */
     if (my_seek(share->data_file, 0, SEEK_END, MYF(0)) == MY_FILEPOS_ERROR)
       goto error2;
@@ -212,6 +214,7 @@ error3:
 error2:
   thr_lock_delete(&share->lock);
   pthread_mutex_destroy(&share->mutex);
+  hash_delete(&tina_open_tables, (byte*) share);
 error:
   pthread_mutex_unlock(&tina_mutex);
   my_free((gptr) share, MYF(0));