into  weblab.(none):/home/marcsql/TREE/mysql-5.0-26503

Before this fix, the parser would accept illegal code in SQL exceptions
handlers, that later causes the runtime to crash when executing the code,
due to memory violations in the exception handler stack.

The root cause of the problem is instructions within an exception handler
that jumps to code located outside of the handler. This is illegal according
to the SQL 2003 standard, since labels located outside the handler are not
supposed to be visible (they are "out of scope"), so any instruction that
jumps to these labels, like ITERATE or LEAVE, should not parse.

The section of the standard that is relevant for this is :
  SQL:2003 SQL/PSM (ISO/IEC 9075-4:2003)
  section 13.1 <compound statement>,
  syntax rule 4
<quote>
  The scope of the <beginning label> is CS excluding every <SQL schema
  statement> contained in CS and excluding every
  <local handler declaration list> contained in CS. <beginning label> shall
  not be equivalent to any other <beginning label>s within that scope.
</quote>

With this fix, the C++ class sp_pcontext, which represent the "parsing
context" tree (a.k.a symbol table) of a stored procedure, has been changed
as follows:
- constructors have been cleaned up, so that only building a root node for
the tree is public; building nodes inside a tree is not public.
- a new member, m_label_scope, indicates if a given syntactic context
belongs to a DECLARE HANDLER block,
- label resolution, in the method find_label(), has been changed to
implement the restriction of scope regarding labels used in a compound
statement.

The actions in the parser, when parsing the body of a SQL exception handler,
have been changed as follows:
- the implementation of an exception handler (DECLARE HANDLER) now creates
explicitly a new sp_pcontext, to isolate the code inside the handler from
the containing compound statement context.
- registering exception handlers as a result occurs in the parent context,
see the rule sp_hcond_element
- the code in sp_hcond_list has been cleaned up, to avoid code duplication

In addition, the flags IN_SIMPLE_CASE and IN_HANDLER, declared in sp_head.h
have been removed, since they are unused and broken by design (as seen with
Bug 19194 (Right recursion in parser for CASE causes excessive stack usage,
limitation), representing a stack in a single flag is not possible.

Tests in sp-error have been added to show that illegal constructs are now
rejected.

Tests in sp have been added for code coverage, to show that ITERATE or LEAVE
statements are legal when jumping to a label in scope, inside the body of
an exception handler.


mysql-test/r/sp-error.result:
  SQL Exception handlers define a parsing context for label resolution.
mysql-test/r/sp.result:
  SQL Exception handlers define a parsing context for label resolution.
mysql-test/t/sp-error.test:
  SQL Exception handlers define a parsing context for label resolution.
mysql-test/t/sp.test:
  SQL Exception handlers define a parsing context for label resolution.
sql/sp_head.cc:
  Minor cleanup
sql/sp_head.h:
  Minor cleanup
sql/sp_pcontext.cc:
  SQL Exception handlers define a parsing context for label resolution.
sql/sp_pcontext.h:
  SQL Exception handlers define a parsing context for label resolution.
sql/sql_yacc.yy:
  SQL Exception handlers define a parsing context for label resolution.

include/my_global.h:
  Introduce constants to be used instead of magic numbers.
sql/field.cc:
  Polishing: use contants instead of magic numbers.
sql/ha_innodb.cc:
  Polishing: use contants instead of magic numbers.
sql/handler.cc:
  Polishing: use contants instead of magic numbers.
sql/item.cc:
  Polishing: use contants instead of magic numbers.
sql/item.h:
  Polishing: use contants instead of magic numbers.
sql/item_func.cc:
  Polishing: use contants instead of magic numbers.
sql/item_subselect.cc:
  Polishing: use contants instead of magic numbers.
sql/log_event.cc:
  Polishing: use contants instead of magic numbers.
sql/sql_base.cc:
  Polishing: use contants instead of magic numbers.
sql/sql_select.cc:
  Polishing: use contants instead of magic numbers.
sql/sql_show.cc:
  Polishing: use contants instead of magic numbers.
sql/sql_table.cc:
  Polishing: use contants instead of magic numbers.

into  moonlight.home:/home/tomash/src/mysql_ab/mysql-5.0-bug20492


sql/sql_select.cc:
  Auto merged
mysql-test/r/sp.result:
  Manual merge.
mysql-test/t/sp.test:
  Manual merge.

to a pointer to object, that is, int foo(); void *bar= (void*) foo
is not allowed.


sql/lex.h:
  Fix -ansi -pedantic warning.
sql/lex_symbol.h:
  Fix -ansi -pedantic warning.

Bug 8407, post review cleanup: use instr::get_cont_dest() to get the instruction
continuation instruction, for CONTINUE exception handlers.


sql/sp_head.cc:
  Post review cleanup: use instr::get_cont_dest() to get the instruction
  continuation instruction, for CONTINUE exception handlers.
sql/sp_head.h:
  Post review cleanup: use instr::get_cont_dest() to get the instruction
  continuation instruction, for CONTINUE exception handlers.

sql/sql_lex.cc:
  A fix for the windows build.

into  bodhi.local:/opt/local/work/mysql-5.0-26750


sql/mysqld.cc:
  Auto merged
sql/sql_class.cc:
  Auto merged
sql/sql_parse.cc:
  Auto merged
sql/sql_class.h:
  Manual merge.

fixes).

The legend: on a replication slave, in case a trigger creation
was filtered out because of application of replicate-do-table/
replicate-ignore-table rule, the parsed definition of a trigger was not 
cleaned up properly. LEX::sphead member was left around and leaked 
memory. Until the actual implementation of support of 
replicate-ignore-table rules for triggers by the patch for Bug 24478 it 
was never the case that "case SQLCOM_CREATE_TRIGGER"
was not executed once a trigger was parsed,
so the deletion of lex->sphead there worked and the memory did not leak.

The fix: 

The real cause of the bug is that there is no 1 or 2 places where
we can clean up the main LEX after parse. And the reason we 
can not have just one or two places where we clean up the LEX is
asymmetric behaviour of MYSQLparse in case of success or error. 

One of the root causes of this behaviour is the code in Item::Item()
constructor. There, a newly created item adds itself to THD::free_list
- a single-linked list of Items used in a statement. Yuck. This code
is unaware that we may have more than one statement active at a time,
and always assumes that the free_list of the current statement is
located in THD::free_list. One day we need to be able to explicitly
allocate an item in a given Query_arena.
Thus, when parsing a definition of a stored procedure, like
CREATE PROCEDURE p1() BEGIN SELECT a FROM t1; SELECT b FROM t1; END;
we actually need to reset THD::mem_root, THD::free_list and THD::lex
to parse the nested procedure statement (SELECT *).
The actual reset and restore is implemented in semantic actions
attached to sp_proc_stmt grammar rule.
The problem is that in case of a parsing error inside a nested statement
Bison generated parser would abort immediately, without executing the
restore part of the semantic action. This would leave THD in an 
in-the-middle-of-parsing state.
This is why we couldn't have had a single place where we clean up the LEX
after MYSQLparse - in case of an error we needed to do a clean up
immediately, in case of success a clean up could have been delayed.
This left the door open for a memory leak.

One of the following possibilities were considered when working on a fix:
- patch the replication logic to do the clean up. Rejected
as breaks module borders, replication code should not need to know the
gory details of clean up procedure after CREATE TRIGGER.
- wrap MYSQLparse with a function that would do a clean up.
Rejected as ideally we should fix the problem when it happens, not
adjust for it outside of the problematic code.
- make sure MYSQLparse cleans up after itself by invoking the clean up
functionality in the appropriate places before return. Implemented in 
this patch.
- use %destructor rule for sp_proc_stmt to restore THD - cleaner
than the prevoius approach, but rejected
because needs a careful analysis of the side effects, and this patch is 
for 5.0, and long term we need to use the next alternative anyway
- make sure that sp_proc_stmt doesn't juggle with THD - this is a 
large work that will affect many modules.

Cleanup: move main_lex and main_mem_root from Statement to its
only two descendants Prepared_statement and THD. This ensures that
when a Statement instance was created for purposes of statement backup,
we do not involve LEX constructor/destructor, which is fairly expensive.
In order to track that the transformation produces equivalent 
functionality please check the respective constructors and destructors
of Statement, Prepared_statement and THD - these members were
used only there.
This cleanup is unrelated to the patch.


sql/log_event.cc:
  THD::main_lex is private and should not be used.
sql/mysqld.cc:
  Move MYSQLerror to sql_yacc.yy as it depends on LEX headers now.
sql/sql_class.cc:
  Cleanup: move main_lex and main_mem_root to THD and Prepared_statement
sql/sql_class.h:
  Cleanup: move main_lex and main_mem_root to THD and Prepared_statement
sql/sql_lex.cc:
  Implement st_lex::restore_lex()
sql/sql_lex.h:
  Declare st_lex::restore_lex().
sql/sql_parse.cc:
  Consolidate the calls to unit.cleanup() and deletion of lex->sphead
  in mysql_parse (COM_QUERY handler)
sql/sql_prepare.cc:
  No need to delete lex->sphead to restore memory roots now in case of a 
  parse error - this is done automatically inside MYSQLparse
sql/sql_trigger.cc:
  This code could lead to double deletion apparently, as in case
  of an error lex.sphead was never reset.
sql/sql_yacc.yy:
  Trap all returns from the parser to ensure that MySQL-specific cleanup
  is invoked: we need to restore the global state of THD and LEX in 
  case of a parsing error. In case of a parsing success this happens as 
  part of normal grammar reduction process.

into  weblab.(none):/home/marcsql/TREE/mysql-5.0-8407_b


mysql-test/r/view.result:
  Auto merged
sql/mysqld.cc:
  Auto merged
sql/sp_head.cc:
  Auto merged
sql/sp_head.h:
  Auto merged
sql/sql_class.cc:
  Auto merged
sql/sql_class.h:
  Auto merged
sql/sql_update.cc:
  Auto merged
sql/table.cc:
  Auto merged
sql/table.h:
  Auto merged
sql/sql_base.cc:
  Manual merge

Bug 18914 (Calling certain SPs from triggers fail)
Bug 20713 (Functions will not not continue for SQLSTATE VALUE '42S02')
Bug 21825 (Incorrect message error deleting records in a table with a
  trigger for inserting)
Bug 22580 (DROP TABLE in nested stored procedure causes strange dependency
  error)
Bug 25345 (Cursors from Functions)


This fix resolves a long standing issue originally reported with bug 8407,
which affect the behavior of Stored Procedures, Stored Functions and Trigger
in many different ways, causing symptoms reported by all the bugs listed.
In all cases, the root cause of the problem traces back to 8407 and how the
server locks tables involved with sub statements.

Prior to this fix, the implementation of stored routines would:
- compute the transitive closure of all the tables referenced by a top level
statement
- open and lock all the tables involved
- execute the top level statement
"transitive closure of tables" means collecting:
- all the tables,
- all the stored functions,
- all the views,
- all the table triggers
- all the stored procedures
involved, and recursively inspect these objects definition to find more
references to more objects, until the list of every object referenced does
not grow any more.
This mechanism is known as "pre-locking" tables before execution.
The motivation for locking all the tables (possibly) used at once is to
prevent dead locks.

One problem with this approach is that, if the execution path the code
really takes during runtime does not use a given table, and if the table is
missing, the server would not execute the statement.
This in particular has a major impact on triggers, since a missing table
referenced by an update/delete trigger would prevent an insert trigger to run.

Another problem is that stored routines might define SQL exception handlers
to deal with missing tables, but the server implementation would never give
user code a chance to execute this logic, since the routine is never
executed when a missing table cause the pre-locking code to fail.

With this fix, the internal implementation of the pre-locking code has been
relaxed of some constraints, so that failure to open a table does not
necessarily prevent execution of a stored routine.

In particular, the pre-locking mechanism is now behaving as follows:

1) the first step, to compute the transitive closure of all the tables
possibly referenced by a statement, is unchanged.

2) the next step, which is to open all the tables involved, only attempts
to open the tables added by the pre-locking code, but silently fails without
reporting any error or invoking any exception handler is the table is not
present. This is achieved by trapping internal errors with
Prelock_error_handler

3) the locking step only locks tables that were successfully opened.

4) when executing sub statements, the list of tables used by each statements
is evaluated as before. The tables needed by the sub statement are expected
to be already opened and locked. Statement referencing tables that were not
opened in step 2) will fail to find the table in the open list, and only at
this point will execution of the user code fail.

5) when a runtime exception is raised at 4), the instruction continuation
destination (the next instruction to execute in case of SQL continue
handlers) is evaluated.
This is achieved with sp_instr::exec_open_and_lock_tables()

6) if a user exception handler is present in the stored routine, that
handler is invoked as usual, so that ER_NO_SUCH_TABLE exceptions can be
trapped by stored routines. If no handler exists, then the runtime execution
will fail as expected.

With all these changes, a side effect is that view security is impacted, in
two different ways.

First, a view defined as "select stored_function()", where the stored
function references a table that may not exist, is considered valid.
The rationale is that, because the stored function might trap exceptions
during execution and still return a valid result, there is no way to decide
when the view is created if a missing table really cause the view to be invalid.

Secondly, testing for existence of tables is now done later during
execution. View security, which consist of trapping errors and return a
generic ER_VIEW_INVALID (to prevent disclosing information) was only
implemented at very specific phases covering *opening* tables, but not
covering the runtime execution. Because of this existing limitation,
errors that were previously trapped and converted into ER_VIEW_INVALID are
not trapped, causing table names to be reported to the user.
This change is exposing an existing problem, which is independent and will
be resolved separately.


mysql-test/r/information_schema_db.result:
  Revised the pre-locking code implementation, aligned the tests.
mysql-test/r/sp-error.result:
  Revised the pre-locking code implementation, aligned the tests.
mysql-test/r/sp.result:
  Revised the pre-locking code implementation, aligned the tests.
mysql-test/r/trigger.result:
  Revised the pre-locking code implementation, aligned the tests.
mysql-test/r/view.result:
  Revised the pre-locking code implementation, aligned the tests.
mysql-test/t/sp-error.test:
  Revised the pre-locking code implementation, aligned the tests.
mysql-test/t/sp.test:
  Revised the pre-locking code implementation, aligned the tests.
mysql-test/t/trigger.test:
  Revised the pre-locking code implementation, aligned the tests.
sql/lock.cc:
  table->placeholder now checks for schema_table
sql/mysqld.cc:
  my_message_sql(): invoke internal exception handlers
sql/sp_head.cc:
  exec_open_and_lock_tables(): open and lock tables, or return the
  continuation destination of this instruction
sql/sp_head.h:
  exec_open_and_lock_tables(): open and lock tables, or return the
  continuation destination of this instruction
sql/sql_base.cc:
  Prelock_error_handler: delay open table errors until execution
sql/sql_class.cc:
  THD: add internal error handler, as an exception mechanism.
sql/sql_class.h:
  THD: add internal error handler, as an exception mechanism.
sql/sql_update.cc:
  table->placeholder now checks for schema_table
sql/table.cc:
  st_table_list::hide_view_error(): masked more errors for view security
sql/table.h:
  table->placeholder now checks for schema_table, and unopened tables

into  bodhi.local:/opt/local/work/mysql-5.0-runtime


sql/sql_parse.cc:
  Auto merged

conflicts without proper analysis and documentation of the nature of
the conflict.

sql/sql_yacc.yy:
  Rename: YYERROR_UNLESS -> YYABORT_UNLESS
  yyerror doesn't have to abort of the parser, whereas this macro
  does explicitly call YYABORT.

into  weblab.(none):/home/marcsql/TREE/mysql-5.0-26093


sql/item_func.cc:
  Auto merged

  results)

Before this fix, the function BENCHMARK() would fail to evaluate expressions
like "(select avg(a) from t1)" in debug builds (with an assert),
or would report a time of zero in non debug builds.

The root cause is that evaluation of DECIMAL_RESULT expressions was not
supported in Item_func_benchmark::val_int().

This has been fixed by this change.


mysql-test/r/func_misc.result:
  Added support for DECIMAL_RESULT in Item_func_benchmark::val_int()
mysql-test/t/func_misc.test:
  Added support for DECIMAL_RESULT in Item_func_benchmark::val_int()
sql/item_func.cc:
  Added support for DECIMAL_RESULT in Item_func_benchmark::val_int()

mysql-test/r/subselect.result:
  Manual merge
mysql-test/t/subselect.test:
  Manual merge

into  weblab.(none):/home/marcsql/TREE/mysql-5.0-rt-merge


mysql-test/mysql-test-run.pl:
  Auto merged
mysql-test/t/disabled.def:
  Auto merged
server-tools/instance-manager/instance_options.cc:
  Auto merged
server-tools/instance-manager/mysqlmanager.cc:
  Auto merged
sql/item_cmpfunc.cc:
  Auto merged
sql/item_cmpfunc.h:
  Auto merged
sql/item_subselect.cc:
  Auto merged
sql/item_subselect.h:
  Auto merged
sql/sp_head.cc:
  Auto merged
sql/sql_base.cc:
  Auto merged
sql/sql_class.cc:
  Auto merged
sql/sql_lex.cc:
  Auto merged
sql/sql_lex.h:
  Auto merged
sql/sql_parse.cc:
  Auto merged
sql/sql_yacc.yy:
  Auto merged

into  weblab.(none):/home/marcsql/TREE/mysql-4.1-runtime


sql/sql_parse.cc:
  Auto merged

into  mysql.com:/nfsdisk1/lars/MERGE/mysql-5.0-merge


sql/field.cc:
  Auto merged
sql/log.cc:
  Auto merged
sql/slave.cc:
  Auto merged
sql/sql_repl.cc:
  Auto merged

into  quant.(none):/ext/mysql/bkroot/mysql-5.0-rpl

into  bk-internal.mysql.com:/data0/bk/mysql-5.0-marvel

sql/slave.cc:
  Guard declaration of variable to avoid "unused variable" warning.
sql/sql_repl.cc:
  Guard declaration of variable to avoid "unused variable" warning.

client/mysqltest.c:
  Fixed a compiler warning.
support-files/compiler_warnings.supp:
  Suppressed compiler warnings on Win 64.

sql/ha_archive.cc:
  Fixed a warning from unused computed value. This block is
  only used in debug mode and changes nothing.
support-files/compiler_warnings.supp:
  Disabled a warning from BDB.

into  quant.(none):/ext/mysql/bkroot/mysql-5.0-rpl

into  quant.(none):/ext/mysql/bkroot/mysql-5.0-rpl

when merging into 5.1.


mysql-test/t/rpl_loaddata_charset.test:
  Rename: mysql-test/t/rpl_loaddata2.test -> mysql-test/t/rpl_loaddata_charset.test
mysql-test/r/rpl_loaddata_charset.result:
  Rename: mysql-test/r/rpl_loaddata2.result -> mysql-test/r/rpl_loaddata_charset.result

into  quant.(none):/ext/mysql/bk/mysql-5.0-rpl-warnings


sql/mysql_priv.h:
  Auto merged
sql/sql_insert.cc:
  Auto merged
sql/sql_yacc.yy:
  Auto merged

sql/mysql_priv.h:
  Removing compiler warning "NULL used in arithmetic"
sql/mysqld.cc:
  First argument to WARN_DEPRECATED is supposed to be a pointer (to THD structure)
sql/sql_insert.cc:
  Removing compiler warning "unused variable". Apparently query is not used when compiling libmysqld.
sql/sql_yacc.yy:
  Removing compiler error "Macro already defined"

Replacing local directory.


mysql-test/r/mysqlbinlog.result:
  Additional fix for bug N 15126
mysql-test/t/mysqlbinlog.test:
  Additional fix for bug N 15126

into  mysql.com:/nfsdisk1/lars/MERGE/mysql-5.0-merge


sql/mysql_priv.h:
  Auto merged
sql/sql_insert.cc:
  Auto merged
sql/sql_yacc.yy:
  Auto merged

client/mysql_upgrade.c:
  Fixed problem with mysql_upgrade being dependent
  on local my.cnf files and problem with memory not being freed.
client/mysqltest.c:
  Changed type to avoid warning.
cmd-line-utils/readline/xmalloc.c:
  Fix to avoid warning.
include/my_dbug.h:
  To disable parts from code in non-debug more.
sql/field.cc:
  Fixed warning.
sql/ha_archive.cc:
  Fixed warning.
sql/ha_berkeley.cc:
  Added casts to avoid warnings.
sql/ha_ndbcluster.cc:
  Fixed warnings.
sql/log.cc:
  Added casts to avoid warnings.
sql/slave.cc:
  Avoid warning.
sql/sql_repl.cc:
  Avoid warning.
support-files/compiler_warnings.supp:
  Added disabled warnings to compiler_warnings.supp file.
  These are backported mainly from 5.1 suppress file, but there
  are some additional new ones.

into  mysql.com:/home/bar/mysql-5.0.b24478

Bug N 15126 character_set_database is not replicated (LOAD DATA INFILE need it)
Positions of some binlog events were changed because of
additional logging of @@collation_database.

into  mysql.com:/home/bar/mysql-5.0.b15126


sql/log_event.cc:
  Auto merged
sql/log_event.h:
  Auto merged
sql/sql_class.cc:
  Auto merged
sql/sql_class.h:
  Auto merged
sql/sql_load.cc:
  Auto merged
sql/sql_yacc.yy:
  Auto merged
mysql-test/r/mysqlbinlog.result:
  After merge fix
mysql-test/t/mysqlbinlog.test:
  After merge fix