[TD-437] fix crash in client, while mnode return unexpceted msg

src/client/src/tscSql.c

@@ -579,9 +579,9 @@ void taos_free_result_imp(TAOS_RES *res, int keepCmd) {
   if ((pCmd->command == TSDB_SQL_SELECT ||
        pCmd->command == TSDB_SQL_SHOW ||
        pCmd->command == TSDB_SQL_RETRIEVE ||
-       pCmd->command == TSDB_SQL_FETCH) &&
-       (pRes->code != TSDB_CODE_QUERY_CANCELLED && ((pCmd->command < TSDB_SQL_LOCAL && pRes->completed == false) ||
-       (pRes->code == TSDB_CODE_SUCCESS && pCmd->command == TSDB_SQL_SELECT && pSql->pStream == NULL && pTableMetaInfo->pTableMeta != NULL)))) {
+       pCmd->command == TSDB_SQL_FETCH) && pRes->code == TSDB_CODE_SUCCESS &&
+       ((pCmd->command < TSDB_SQL_LOCAL && pRes->completed == false) ||
+       (pCmd->command == TSDB_SQL_SELECT && pSql->pStream == NULL && pTableMetaInfo->pTableMeta != NULL))) {
     pCmd->command = (pCmd->command > TSDB_SQL_MGMT) ? TSDB_SQL_RETRIEVE : TSDB_SQL_FETCH;
 
     tscTrace("%p send msg to free qhandle in vnode, code:%d, numOfRows:%d, command:%s", pSql, pRes->code, pRes->numOfRows,

src/client/src/tscUtil.c

@@ -1850,8 +1850,7 @@ SSqlObj* createSubqueryObj(SSqlObj* pSql, int16_t tableIndex, void (*fp)(), void
   STableMetaInfo* pFinalInfo = NULL;
 
   if (pPrevSql == NULL) {
-    STableMeta* pTableMeta = taosCacheAcquireByName(tscCacheHandle, name);
-    // todo handle error
+    STableMeta* pTableMeta = taosCacheAcquireByData(tscCacheHandle, pTableMetaInfo->pTableMeta);  // get by name may failed due to the cache cleanup
     assert(pTableMeta != NULL);
     pFinalInfo = tscAddTableMetaInfo(pNewQueryInfo, name, pTableMeta, pTableMetaInfo->vgroupList, pTableMetaInfo->tagColList);
   } else {  // transfer the ownership of pTableMeta to the newly create sql object.

src/mnode/src/mnodeTable.c

@@ -1269,9 +1269,9 @@ static int32_t mnodeProcessSuperTableVgroupMsg(SMnodeMsg *pMsg) {
   for (int32_t i = 0; i < numOfTable; ++i) {
     char *stableName = (char*)pInfo + sizeof(SCMSTableVgroupMsg) + (TSDB_TABLE_ID_LEN) * i;
     SSuperTableObj *pTable = mnodeGetSuperTable(stableName);
-    if (pTable->vgHash != NULL) {
+    if (pTable != NULL && pTable->vgHash != NULL) {
       contLen += (taosHashGetSize(pTable->vgHash) * sizeof(SCMVgroupInfo) + sizeof(SVgroupsInfo));
-    }
+    } 
     mnodeDecTableRef(pTable);
   }
 
@@ -1280,12 +1280,23 @@ static int32_t mnodeProcessSuperTableVgroupMsg(SMnodeMsg *pMsg) {
     return TSDB_CODE_SERV_OUT_OF_MEMORY;
   }
 
-  pRsp->numOfTables = htonl(numOfTable);
+  pRsp->numOfTables = 0;
   char *msg = (char *)pRsp + sizeof(SCMSTableVgroupRspMsg);
 
   for (int32_t i = 0; i < numOfTable; ++i) {
     char *stableName = (char*)pInfo + sizeof(SCMSTableVgroupMsg) + (TSDB_TABLE_ID_LEN) * i;
     SSuperTableObj *pTable = mnodeGetSuperTable(stableName);
+    if (pTable == NULL) {
+      mError("stable:%s, not exist while get stable vgroup info", stableName);
+      mnodeDecTableRef(pTable);
+      continue;
+    }
+    if (pTable->vgHash == NULL) {
+      mError("stable:%s, not vgroup exist while get stable vgroup info", stableName);
+      mnodeDecTableRef(pTable);
+      continue;
+    }
+
     SVgroupsInfo *pVgroupInfo = (SVgroupsInfo *)msg;
 
     SHashMutableIterator *pIter = taosHashCreateIter(pTable->vgHash);
@@ -1317,12 +1328,19 @@ static int32_t mnodeProcessSuperTableVgroupMsg(SMnodeMsg *pMsg) {
 
     // one table is done, try the next table
     msg += sizeof(SVgroupsInfo) + vgSize * sizeof(SCMVgroupInfo);
+    pRsp->numOfTables++;
   }
 
-  pMsg->rpcRsp.rsp = pRsp;
-  pMsg->rpcRsp.len = msg - (char *)pRsp;
+  if (pRsp->numOfTables != numOfTable) {
+    rpcFreeCont(pRsp);
+    return TSDB_CODE_INVALID_TABLE_ID;
+  } else {
+    pRsp->numOfTables = htonl(pRsp->numOfTables);
+    pMsg->rpcRsp.rsp = pRsp;
+    pMsg->rpcRsp.len = msg - (char *)pRsp;
 
-  return TSDB_CODE_SUCCESS;
+    return TSDB_CODE_SUCCESS;
+  }
 }
 
 static void mnodeProcessDropSuperTableRsp(SRpcMsg *rpcMsg) {
@@ -1423,7 +1441,7 @@ static SChildTableObj* mnodeDoCreateChildTable(SCMCreateTableMsg *pCreate, SVgOb
     SSuperTableObj *pSuperTable = mnodeGetSuperTable(pTagData->name);
     if (pSuperTable == NULL) {
       mError("table:%s, corresponding super table:%s does not exist", pCreate->tableId, pTagData->name);
-      free(pTable);
+      mnodeDestroyChildTable(pTable);
       terrno = TSDB_CODE_INVALID_TABLE;
       return NULL;
     }