From 3154f27b0373a191475bb826e03b18baf76efc1e Mon Sep 17 00:00:00 2001
From: Daniel Black <daniel@mariadb.org>
Date: Tue, 26 May 2026 12:43:43 +1000
Subject: [PATCH] MDEV-31808 crash upon altering table with NEXTVAL for default
 under exclusive lock

A segfault in mysql_lock_merge waa the result of a null argument
when called from open_and_lock_internal_tables. As the argument
was null there was no lock to merge and thd->lock was already in place,
so no futher action is required in open_and_lock_internal_tables.

After passing the previous correctly on open_table of the
sequence used in the table, we get to the checking the thd->open_table
list where tdc is flushed. This puts the open_table into an error
condition to reopen all tables. When we are just opening a sequence,
this condition isn't one we want to fail on.
---
 mysql-test/main/alter_table_combinations.result |  9 +++++++++
 mysql-test/main/alter_table_combinations.test   | 14 ++++++++++++++
 sql/sql_base.cc                                 |  6 +++++-
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/mysql-test/main/alter_table_combinations.result b/mysql-test/main/alter_table_combinations.result
index 08cf6c4707c0e..51588d8e705f5 100644
--- a/mysql-test/main/alter_table_combinations.result
+++ b/mysql-test/main/alter_table_combinations.result
@@ -321,4 +321,13 @@ drop table t1;
 #
 # End of 10.5 tests
 #
+#
+# MDEV-31808 Server crash upon altering table with NEXTVAL for default under exclusive lock
+#
+CREATE SEQUENCE s ENGINE=Aria;
+CREATE TABLE t (a INT DEFAULT(NEXTVAL(s)), b INT);
+ALTER TABLE t FORCE, ALGORITHM=COPY, LOCK=EXCLUSIVE;
+DROP TABLE t;
+DROP SEQUENCE s;
+# End of 10.6 tests
 set @@default_storage_engine= @save_default_engine;
diff --git a/mysql-test/main/alter_table_combinations.test b/mysql-test/main/alter_table_combinations.test
index 7c8d7f4209689..b208f0e4416f7 100644
--- a/mysql-test/main/alter_table_combinations.test
+++ b/mysql-test/main/alter_table_combinations.test
@@ -260,4 +260,18 @@ drop table t1;
 --echo # End of 10.5 tests
 --echo #
 
+--echo #
+--echo # MDEV-31808 Server crash upon altering table with NEXTVAL for default under exclusive lock
+--echo #
+
+CREATE SEQUENCE s ENGINE=Aria;
+CREATE TABLE t (a INT DEFAULT(NEXTVAL(s)), b INT);
+ALTER TABLE t FORCE, ALGORITHM=COPY, LOCK=EXCLUSIVE;
+
+# Cleanup
+DROP TABLE t;
+DROP SEQUENCE s;
+
+--echo # End of 10.6 tests
+
 set @@default_storage_engine= @save_default_engine;
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index 379337af99c7d..cbac955df1fc3 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -2085,7 +2085,7 @@ bool open_table(THD *thd, TABLE_LIST *table_list, Open_table_context *ot_ctx)
       goto retry_share;
     }
 
-    if (thd->open_tables && thd->open_tables->s->tdc->flushed)
+    if (!table_list->sequence && thd->open_tables && thd->open_tables->s->tdc->flushed)
     {
       /*
         If the version changes while we're opening the tables,
@@ -5006,6 +5006,10 @@ bool open_and_lock_internal_tables(TABLE *table, bool lock_table)
                     MYSQL_LOCK_USE_MALLOC))
       goto err;
 
+    /* no existing lock to merge with */
+    if (save_lock == nullptr)
+      DBUG_RETURN(0);
+
     if (!(new_lock= mysql_lock_merge(save_lock, thd->lock)))
     {
       thd->lock= save_lock;