Crash with set join_cache_level=4

--source include/have_innodb.inc

set join_cache_level=4;

CREATE TABLE t1 ( i1 int, v1 varchar(1)) ENGINE=InnoDB;

INSERT INTO t1 VALUES (7,'x');

CREATE TABLE t2 (i1 int, v1 varchar(1), KEY v1 (v1,i1)) ENGINE=InnoDB;

INSERT INTO t2 VALUES (NULL,'x'),(1,'x'),(3,'x'),(5,'x'),(8,'x'),(48,'x'),(228,'x'),(3,'y'),(1,'z'),(9,'z');

CREATE TABLE temp

SELECT t1.i1 AS f1, t1.v1 AS f2 FROM (t2 JOIN t1 ON (t1.v1 = t2.v1));

SELECT * FROM temp 

WHERE (f1,f2) IN (SELECT t1.i1, t1.v1 FROM (t2 JOIN t1 ON (t1.v1 = t2.v1)));

Version: '5.5.61-MariaDB-debug'  socket: '/home/alice/git/5.5/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution

=================================================================

==26480==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500021b943 at pc 0x00000085deca bp 0x7f2cf8aa4910 sp 0x7f2cf8aa4900

WRITE of size 1 at 0x62500021b943 thread T15

    #0 0x85dec9 in TABLE::create_key_part_by_field(st_key_part_info*, Field*, unsigned int) /home/alice/git/5.5/sql/table.cc:5992

    #1 0x6f8d5c in create_hj_key_for_table /home/alice/git/5.5/sql/sql_select.cc:8065

    #2 0x6f8d5c in create_ref_for_key /home/alice/git/5.5/sql/sql_select.cc:8130

    #3 0x6fed1c in get_best_combination(JOIN*) /home/alice/git/5.5/sql/sql_select.cc:7936

    #4 0x7576ae in make_join_statistics /home/alice/git/5.5/sql/sql_select.cc:3864

    #5 0x760a64 in JOIN::optimize() /home/alice/git/5.5/sql/sql_select.cc:1255

    #6 0x76a843 in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/alice/git/5.5/sql/sql_select.cc:3112

    #7 0x76b0b5 in handle_select(THD*, LEX*, select_result*, unsigned long) /home/alice/git/5.5/sql/sql_select.cc:323

    #8 0x66d7dc in execute_sqlcom_select /home/alice/git/5.5/sql/sql_parse.cc:4678

    #9 0x68351e in mysql_execute_command(THD*) /home/alice/git/5.5/sql/sql_parse.cc:2224

    #10 0x695202 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/alice/git/5.5/sql/sql_parse.cc:5923

    #11 0x6985ff in dispatch_command(enum_server_command, THD*, char*, unsigned int) /home/alice/git/5.5/sql/sql_parse.cc:1066

    #12 0x69c6dd in do_command(THD*) /home/alice/git/5.5/sql/sql_parse.cc:793

    #13 0x8ce433 in do_handle_one_connection(THD*) /home/alice/git/5.5/sql/sql_connect.cc:1268

    #14 0x8ce6ac in handle_one_connection /home/alice/git/5.5/sql/sql_connect.cc:1184

    #15 0x144278f in pfs_spawn_thread /home/alice/git/5.5/storage/perfschema/pfs.cc:1015

    #16 0x7f2d06de26b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

    #17 0x7f2d0648d41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

0x62500021b943 is located 7 bytes to the right of 8252-byte region [0x625000219900,0x62500021b93c)

allocated by thread T15 here:

    #0 0x7f2d078e8602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)

    #1 0x1508d94 in sf_malloc /home/alice/git/5.5/mysys/safemalloc.c:105

Thread T15 created by T0 here:

    #0 0x7f2d07886253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)

    #1 0x1445d59 in spawn_thread_v1 /home/alice/git/5.5/storage/perfschema/pfs.cc:1038

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/alice/git/5.5/sql/table.cc:5992 TABLE::create_key_part_by_field(st_key_part_info*, Field*, unsigned int)

Shadow bytes around the buggy address:

  0x0c4a8003b6d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a8003b6e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a8003b6f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a8003b700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a8003b710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0c4a8003b720: 00 00 00 00 00 f7 f7 04[fa]fa fa fa fa fa fa fa

  0x0c4a8003b730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c4a8003b740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c4a8003b750: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c4a8003b760: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c4a8003b770: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

Server version: 10.1.35-MariaDB-debug

Thread pointer: 0x7f9338741008

stack_bottom = 0x7f93436d5230 thread_stack 0x48400

mysys/stacktrace.c:267(my_print_stacktrace)[0x564abc0767e9]

sql/signal_handler.cc:168(handle_fatal_signal)[0x564abb9b8363]

/lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7f93428db390]

sql/sql_select.cc:9132(create_ref_for_key(JOIN*, st_join_table*, keyuse_t*, bool, unsigned long long))[0x564abb7c2240]

sql/sql_select.cc:8836(get_best_combination(JOIN*))[0x564abb7c13df]

sql/sql_select.cc:4264(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x564abb7b629d]

sql/sql_select.cc:1388(JOIN::optimize_inner())[0x564abb7abb5e]

sql/sql_select.cc:1058(JOIN::optimize())[0x564abb7aa96a]

sql/sql_select.cc:3470(mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x564abb7b3303]

sql/sql_select.cc:388(handle_select(THD*, LEX*, select_result*, unsigned long))[0x564abb7a8a41]

sql/sql_parse.cc:5944(execute_sqlcom_select(THD*, TABLE_LIST*))[0x564abb77785f]

sql/sql_parse.cc:2990(mysql_execute_command(THD*))[0x564abb76da07]

sql/sql_parse.cc:7449(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x564abb77b397]

sql/sql_parse.cc:1494(dispatch_command(enum_server_command, THD*, char*, unsigned int))[0x564abb769aa4]

sql/sql_parse.cc:1121(do_command(THD*))[0x564abb768822]

sql/sql_connect.cc:1330(do_handle_one_connection(THD*))[0x564abb8a856f]

sql/sql_connect.cc:1243(handle_one_connection)[0x564abb8a82be]

perfschema/pfs.cc:1863(pfs_spawn_thread)[0x564abc00829c]

/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7f93428d16ba]

x86_64/clone.S:111(clone)[0x7f9341f7c41d]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x7f932bdb9420): SELECT * FROM temp  WHERE (f1,f2) IN (SELECT t1.i1, t1.v1 FROM (t2 JOIN t1 ON (t1.v1 = t2.v1)))

Connection ID (thread ID): 3

Status: NOT_KILLED

Server version: 10.3.8-MariaDB-debug-log

Thread pointer: 0x7f16c8000b00

stack_bottom = 0x7f171c31be70 thread_stack 0x49000

mysys/stacktrace.c:269(my_print_stacktrace)[0x557e7670d783]

sql/signal_handler.cc:168(handle_fatal_signal)[0x557e75f5304e]

/lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7f17222bf390]

sql/key.cc:158(key_copy(unsigned char*, unsigned char const*, st_key*, unsigned int, bool))[0x557e7605dc57]

sql/sql_join_cache.cc:3656(JOIN_CACHE_BNLH::get_matching_chain_by_join_key())[0x557e75e0ec85]

sql/sql_join_cache.cc:3691(JOIN_CACHE_BNLH::prepare_look_for_matches(bool))[0x557e75e0ed16]

sql/sql_join_cache.cc:2273(JOIN_CACHE::join_matching_records(bool))[0x557e75e0cc10]

sql/sql_join_cache.cc:2088(JOIN_CACHE::join_records(bool))[0x557e75e0c660]

sql/sql_select.cc:19039(sub_select_cache(JOIN*, st_join_table*, bool))[0x557e75cdbdfc]

sql/sql_select.cc:19210(sub_select(JOIN*, st_join_table*, bool))[0x557e75cdc007]

sql/sql_select.cc:18801(do_select(JOIN*, Procedure*))[0x557e75cdb7d1]

sql/sql_select.cc:4011(JOIN::exec_inner())[0x557e75cb4bb1]

sql/sql_select.cc:3806(JOIN::exec())[0x557e75cb4024]

sql/sql_select.cc:4212(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x557e75cb528b]

sql/sql_select.cc:382(handle_select(THD*, LEX*, select_result*, unsigned long))[0x557e75ca7436]

sql/sql_parse.cc:6541(execute_sqlcom_select(THD*, TABLE_LIST*))[0x557e75c71db6]

sql/sql_parse.cc:3764(mysql_execute_command(THD*))[0x557e75c6820f]

sql/sql_parse.cc:8076(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x557e75c75cfc]

sql/sql_parse.cc:1849(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x557e75c62ce4]

sql/sql_parse.cc:1392(do_command(THD*))[0x557e75c61701]

sql/sql_connect.cc:1402(do_handle_one_connection(CONNECT*))[0x557e75dc6a4d]

sql/sql_connect.cc:1309(handle_one_connection)[0x557e75dc679e]

perfschema/pfs.cc:1864(pfs_spawn_thread)[0x557e7669ddf4]

/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7f17222b56ba]

x86_64/clone.S:111(clone)[0x7f172174a41d]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x7f16c8014cd8): SELECT * FROM temp  WHERE (f1,f2) IN (SELECT t1.i1, t1.v1 FROM (t2 JOIN t1 ON (t1.v1 = t2.v1)))

Connection ID (thread ID): 9

Status: NOT_KILLED