From: dan Date: Thu, 21 May 2015 17:24:32 +0000 (+0000) Subject: Prevent a virtual table from being destroyed while it is in use. Also: replace Vdbe... X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ed89b29d68f348e2879c0c0160607d6fd6b8f870;p=thirdparty%2Fsqlite.git Prevent a virtual table from being destroyed while it is in use. Also: replace Vdbe.inVtabMethod with sqlite3.nVDestroy. Simplify the EXPLAIN output for P4.pVtab to only show the sqlite3_vtab pointer. Cherrypick of [cbeb9a1aed8c]. FossilOrigin-Name: b3bb660af9472e2c511d1fe87b5193256f74c0db --- diff --git a/manifest b/manifest index ab3da2c949..fb3fd995c4 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Avoid\sever\swriting\sbefore\sthe\sstart\sof\san\sallocated\sbuffer\sin\sthe\sDIRECT_OVERFLOW_READ\scode.\sFix\sfor\s[e3a290961a6].\sCherrypick\sof\s[c3c15d20c691]. -D 2015-05-21T17:21:05.934 +C Prevent\sa\svirtual\stable\sfrom\sbeing\sdestroyed\swhile\sit\sis\sin\suse.\sAlso:\sreplace\sVdbe.inVtabMethod\swith\ssqlite3.nVDestroy.\s\sSimplify\sthe\sEXPLAIN\soutput\sfor\sP4.pVtab\sto\sonly\sshow\sthe\ssqlite3_vtab\spointer.\sCherrypick\sof\s[cbeb9a1aed8c]. +D 2015-05-21T17:24:32.265 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f F Makefile.in 5eb79e334a5de69c87740edd56af6527dd219308 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23 @@ -224,10 +224,10 @@ F src/resolve.c 0ea356d32a5e884add23d1b9b4e8736681dd5697 F src/rowset.c a9c9aae3234b44a6d7c6f5a3cadf90dce1e627be F src/select.c 5b44995dad6cddd69f40b46101d2ca91509eaaef F src/shell.c 75bb7bd2c80bb44861598f322a417c4bafe98fd7 -F src/sqlite.h.in ed9d35990c61f0388ca6405706455c4095310553 +F src/sqlite.h.in 1609d8ba66bf9f60511f4b01a6624ba821339256 F src/sqlite3.rc 992c9f5fb8285ae285d6be28240a7e8d3a7f2bad F src/sqlite3ext.h 886f5a34de171002ad46fae8c36a7d8051c190fc -F src/sqliteInt.h 978e6e01780b5d7dd328e1247ca878e074f64f6c +F src/sqliteInt.h 9ff3e1126716c36e6c68b3cf8b20f5d34a03127d F src/sqliteLimit.h 164b0e6749d31e0daa1a4589a169d31c0dec7b3d F src/status.c 7ac05a5c7017d0b9f0b4bcd701228b784f987158 F src/table.c 2cd62736f845d82200acfa1287e33feb3c15d62e @@ -283,16 +283,16 @@ F src/update.c ea336ce7b8b3fc5e316ba8f082e6445babf81059 F src/utf.c a0314e637768a030e6e84a957d0c4f6ba910cc05 F src/util.c 3076bdd51cdbf60a6e2e57fada745be37133c73e F src/vacuum.c 3728d74919d4fb1356f9e9a13e27773db60b7179 -F src/vdbe.c d48406347c284767935c9f8bac6f799f2c5b2558 +F src/vdbe.c 63f8f7b874fd6b6a1a86d63ca119220a2278a967 F src/vdbe.h c63fad052c9e7388d551e556e119c0bcf6bebdf8 -F src/vdbeInt.h f5513f2b5ac1e2c5128996c7ea23add256a301df +F src/vdbeInt.h 20e5edac63158bd340e31b8ca071f0868bf16442 F src/vdbeapi.c 24e40422382beb774daab11fe9fe9d37e8a04949 -F src/vdbeaux.c 25d62ef82cf1be2a1255eacac636fa0d943d8b3d +F src/vdbeaux.c 3021f190c41e2aacd835e2cae59221d827f5b162 F src/vdbeblob.c 9205ce9d3b064d9600f8418a897fc88b5687d9ac F src/vdbemem.c d90a1e8acf8b63dc9d14cbbea12bfec6cec31394 F src/vdbesort.c f7f5563bf7d4695ca8f3203f3bf9de96d04ed0b3 F src/vdbetrace.c 6f52bc0c51e144b7efdcfb2a8f771167a8816767 -F src/vtab.c d2713ff716e99b30e899bf822d9e3faa2488e7ce +F src/vtab.c efb28e3017a49d727aa8095d355a6181d157ab48 F src/wal.c 264df50a1b33124130b23180ded2e2c5663c652a F src/wal.h df01efe09c5cb8c8e391ff1715cca294f89668a4 F src/walker.c 11edb74d587bc87b33ca96a5173e3ec1b8389e45 @@ -1056,7 +1056,7 @@ F test/vacuum4.test d3f8ecff345f166911568f397d2432c16d2867d9 F test/varint.test ab7b110089a08b9926ed7390e7e97bdefeb74102 F test/veryquick.test 57ab846bacf7b90cf4e9a672721ea5c5b669b661 F test/view.test f311691d696a5cc27e3c1b875cec1b0866b4ccd9 -F test/vtab1.test b631d147b198cfd7903ab5fed028eb2a3d321dc6 +F test/vtab1.test 2ec3981c685454e8934c097674cf4321483114e2 F test/vtab2.test 7bcffc050da5c68f4f312e49e443063e2d391c0d F test/vtab3.test baad99fd27217f5d6db10660522e0b7192446de1 F test/vtab4.test 942f8b8280b3ea8a41dae20e7822d065ca1cb275 @@ -1187,8 +1187,8 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4 F tool/warnings.sh 0abfd78ceb09b7f7c27c688c8e3fe93268a13b32 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f -P 80633682d714e5bedc129d8f579a46cc7c2040e6 -Q +c3c15d20c6913811956a5041c959a56ca4eeb5eb -R a14351485096703f0ae3593f0280678f +P 31b13eb52894db75b52b6419bd9ec980b4c3ac43 +Q +cbeb9a1aed8ce3fb569a7717ad03c7c058b68de6 +R ef0792a2d780c2a5f59e3111e51497e1 U dan -Z 4475ac0ddfbc6008239591329b8dd6f2 +Z 2e7e26283d4581d959f7c58268e40754 diff --git a/manifest.uuid b/manifest.uuid index 015fd28767..f80e0ef5b7 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -31b13eb52894db75b52b6419bd9ec980b4c3ac43 \ No newline at end of file +b3bb660af9472e2c511d1fe87b5193256f74c0db \ No newline at end of file diff --git a/src/sqlite.h.in b/src/sqlite.h.in index 230f8d4028..bf2299f62f 100644 --- a/src/sqlite.h.in +++ b/src/sqlite.h.in @@ -5498,7 +5498,7 @@ int sqlite3_create_module_v2( */ struct sqlite3_vtab { const sqlite3_module *pModule; /* The module for this virtual table */ - int nRef; /* NO LONGER USED */ + int nRef; /* Number of open cursors */ char *zErrMsg; /* Error message from sqlite3_mprintf() */ /* Virtual table implementations will typically add additional fields */ }; diff --git a/src/sqliteInt.h b/src/sqliteInt.h index 1b41482d8c..5021fe8bed 100644 --- a/src/sqliteInt.h +++ b/src/sqliteInt.h @@ -994,6 +994,7 @@ struct sqlite3 { int nVdbeRead; /* Number of active VDBEs that read or write */ int nVdbeWrite; /* Number of active VDBEs that read and write */ int nVdbeExec; /* Number of nested calls to VdbeExec() */ + int nVDestroy; /* Number of active OP_VDestroy operations */ int nExtension; /* Number of loaded extensions */ void **aExtension; /* Array of shared library handles */ void (*xTrace)(void*,const char*); /* Trace function */ diff --git a/src/vdbe.c b/src/vdbe.c index db4bedd9ef..f16a6400aa 100644 --- a/src/vdbe.c +++ b/src/vdbe.c @@ -4946,30 +4946,15 @@ case OP_IdxGE: { /* jump */ */ case OP_Destroy: { /* out2-prerelease */ int iMoved; - int iCnt; - Vdbe *pVdbe; int iDb; assert( p->readOnly==0 ); -#ifndef SQLITE_OMIT_VIRTUALTABLE - iCnt = 0; - for(pVdbe=db->pVdbe; pVdbe; pVdbe = pVdbe->pNext){ - if( pVdbe->magic==VDBE_MAGIC_RUN && pVdbe->bIsReader - && pVdbe->inVtabMethod<2 && pVdbe->pc>=0 - ){ - iCnt++; - } - } -#else - iCnt = db->nVdbeRead; -#endif pOut->flags = MEM_Null; - if( iCnt>1 ){ + if( db->nVdbeRead > db->nVDestroy+1 ){ rc = SQLITE_LOCKED; p->errorAction = OE_Abort; }else{ iDb = pOp->p3; - assert( iCnt==1 ); assert( DbMaskTest(p->btreeMask, iDb) ); iMoved = 0; /* Not needed. Only to silence a warning. */ rc = sqlite3BtreeDropTable(db->aDb[iDb].pBt, pOp->p1, &iMoved); @@ -6007,9 +5992,9 @@ case OP_VCreate: { ** of that table. */ case OP_VDestroy: { - p->inVtabMethod = 2; + db->nVDestroy++; rc = sqlite3VtabCallDestroy(db, pOp->p1, pOp->p4.z); - p->inVtabMethod = 0; + db->nVDestroy--; break; } #endif /* SQLITE_OMIT_VIRTUALTABLE */ @@ -6025,14 +6010,17 @@ case OP_VOpen: { VdbeCursor *pCur; sqlite3_vtab_cursor *pVtabCursor; sqlite3_vtab *pVtab; - sqlite3_module *pModule; + const sqlite3_module *pModule; assert( p->bIsReader ); pCur = 0; pVtabCursor = 0; pVtab = pOp->p4.pVtab->pVtab; - pModule = (sqlite3_module *)pVtab->pModule; - assert(pVtab && pModule); + if( pVtab==0 || NEVER(pVtab->pModule==0) ){ + rc = SQLITE_LOCKED; + break; + } + pModule = pVtab->pModule; rc = pModule->xOpen(pVtab, &pVtabCursor); sqlite3VtabImportErrmsg(p, pVtab); if( SQLITE_OK==rc ){ @@ -6043,6 +6031,7 @@ case OP_VOpen: { pCur = allocateCursor(p, pOp->p1, 0, -1, 0); if( pCur ){ pCur->pVtabCursor = pVtabCursor; + pVtab->nRef++; }else{ db->mallocFailed = 1; pModule->xClose(pVtabCursor); @@ -6108,9 +6097,7 @@ case OP_VFilter: { /* jump */ apArg[i] = &pArgc[i+1]; } - p->inVtabMethod = 1; rc = pModule->xFilter(pVtabCursor, iQuery, pOp->p4.z, nArg, apArg); - p->inVtabMethod = 0; sqlite3VtabImportErrmsg(p, pVtab); if( rc==SQLITE_OK ){ res = pModule->xEof(pVtabCursor); @@ -6213,9 +6200,7 @@ case OP_VNext: { /* jump */ ** data is available) and the error code returned when xColumn or ** some other method is next invoked on the save virtual table cursor. */ - p->inVtabMethod = 1; rc = pModule->xNext(pCur->pVtabCursor); - p->inVtabMethod = 0; sqlite3VtabImportErrmsg(p, pVtab); if( rc==SQLITE_OK ){ res = pModule->xEof(pCur->pVtabCursor); @@ -6290,7 +6275,7 @@ case OP_VRename: { */ case OP_VUpdate: { sqlite3_vtab *pVtab; - sqlite3_module *pModule; + const sqlite3_module *pModule; int nArg; int i; sqlite_int64 rowid; @@ -6302,7 +6287,11 @@ case OP_VUpdate: { ); assert( p->readOnly==0 ); pVtab = pOp->p4.pVtab->pVtab; - pModule = (sqlite3_module *)pVtab->pModule; + if( pVtab==0 || NEVER(pVtab->pModule==0) ){ + rc = SQLITE_LOCKED; + break; + } + pModule = pVtab->pModule; nArg = pOp->p2; assert( pOp->p4type==P4_VTAB ); if( ALWAYS(pModule->xUpdate) ){ diff --git a/src/vdbeInt.h b/src/vdbeInt.h index 141573eef4..82df7c0737 100644 --- a/src/vdbeInt.h +++ b/src/vdbeInt.h @@ -300,14 +300,6 @@ typedef unsigned bft; /* Bit Field Type */ ** ** The "sqlite3_stmt" structure pointer that is returned by sqlite3_prepare() ** is really a pointer to an instance of this structure. -** -** The Vdbe.inVtabMethod variable is set to non-zero for the duration of -** any virtual table method invocations made by the vdbe program. It is -** set to 2 for xDestroy method calls and 1 for all other methods. This -** variable is used for two purposes: to allow xDestroy methods to execute -** "DROP TABLE" statements and to prevent some nasty side effects of -** malloc failure when SQLite is invoked recursively by a virtual table -** method function. */ struct Vdbe { sqlite3 *db; /* The database connection that owns this statement */ @@ -335,7 +327,6 @@ struct Vdbe { u8 errorAction; /* Recovery action to do in case of an error */ u8 minWriteFileFormat; /* Minimum file format for writable database files */ bft explain:2; /* True if EXPLAIN present on SQL command */ - bft inVtabMethod:2; /* See comments above */ bft changeCntOn:1; /* True to update the change-counter */ bft expired:1; /* True if the VM needs to be recompiled */ bft runOnlyOnce:1; /* Automatically expire on reset */ diff --git a/src/vdbeaux.c b/src/vdbeaux.c index fb3f7c3a8c..a1440fb976 100644 --- a/src/vdbeaux.c +++ b/src/vdbeaux.c @@ -1088,7 +1088,7 @@ static char *displayP4(Op *pOp, char *zTemp, int nTemp){ #ifndef SQLITE_OMIT_VIRTUALTABLE case P4_VTAB: { sqlite3_vtab *pVtab = pOp->p4.pVtab->pVtab; - sqlite3_snprintf(nTemp, zTemp, "vtab:%p:%p", pVtab, pVtab->pModule); + sqlite3_snprintf(nTemp, zTemp, "vtab:%p", pVtab); break; } #endif @@ -1749,9 +1749,9 @@ void sqlite3VdbeFreeCursor(Vdbe *p, VdbeCursor *pCx){ if( pCx->pVtabCursor ){ sqlite3_vtab_cursor *pVtabCursor = pCx->pVtabCursor; const sqlite3_module *pModule = pVtabCursor->pVtab->pModule; - p->inVtabMethod = 1; + assert( pVtabCursor->pVtab->nRef>0 ); + pVtabCursor->pVtab->nRef--; pModule->xClose(pVtabCursor); - p->inVtabMethod = 0; } #endif } diff --git a/src/vtab.c b/src/vtab.c index f72f5deda9..6633f81643 100644 --- a/src/vtab.c +++ b/src/vtab.c @@ -778,11 +778,15 @@ int sqlite3VtabCallDestroy(sqlite3 *db, int iDb, const char *zTab){ pTab = sqlite3FindTable(db, zTab, db->aDb[iDb].zName); if( ALWAYS(pTab!=0 && pTab->pVTable!=0) ){ - VTable *p = vtabDisconnectAll(db, pTab); - - assert( rc==SQLITE_OK ); + VTable *p; + for(p=pTab->pVTable; p; p=p->pNext){ + assert( p->pVtab ); + if( p->pVtab->nRef>0 ){ + return SQLITE_LOCKED; + } + } + p = vtabDisconnectAll(db, pTab); rc = p->pMod->pModule->xDestroy(p->pVtab); - /* Remove the sqlite3_vtab* from the aVTrans[] array, if applicable */ if( rc==SQLITE_OK ){ assert( pTab->pVTable==p && p->pNext==0 ); diff --git a/test/vtab1.test b/test/vtab1.test index 0542ee6fdd..a71a2c7b1a 100644 --- a/test/vtab1.test +++ b/test/vtab1.test @@ -1395,4 +1395,59 @@ do_execsql_test 21.3 { SELECT * FROM t9v WHERE a=b; } {2 2 2} + +#------------------------------------------------------------------------- +# The following tests verify that a DROP TABLE command on a virtual +# table does not cause other operations to crash. +# +# 23.1: Dropping a vtab while a SELECT is running on it. +# +# 23.2: Dropping a vtab while a SELECT that will, but has not yet, +# open a cursor on the vtab, is running. In this case the +# DROP TABLE succeeds and the SELECT hits an error. +# +# 23.3: Dropping a vtab from within a user-defined-function callback +# in the middle of an "INSERT INTO vtab SELECT ..." statement. +# +reset_db +load_static_extension db wholenumber +#load_static_extension db eval +db func execsql execsql +register_echo_module db + +do_test 23.1 { + execsql { CREATE VIRTUAL TABLE t1 USING wholenumber } + set res "" + db eval { SELECT value FROM t1 WHERE value<10 } { + if {$value == 5} { + set res [catchsql { DROP TABLE t1 }] + } + } + set res +} {1 {database table is locked}} + +do_test 23.2 { + execsql { + CREATE TABLE t2(value); + INSERT INTO t2 VALUES(1), (2), (3); + } + + set res2 [list [catch { + db eval { + SELECT value FROM t2 UNION ALL + SELECT value FROM t1 WHERE value<10 + } { + if {$value == 2} { set res1 [catchsql { DROP TABLE t1 }] } + } + } msg] $msg] + list $res1 $res2 +} {{0 {}} {1 {database table is locked}}} + +do_test 23.3.1 { + execsql { CREATE VIRTUAL TABLE t1e USING echo(t2) } + execsql { INSERT INTO t1e SELECT 4 } + catchsql { INSERT INTO t1e SELECT execsql('DROP TABLE t1e') } +} {1 {database table is locked}} +do_execsql_test 23.3.2 { SELECT * FROM t1e } {1 2 3 4} + finish_test