[draft]different crashes

=================================================================

==16360==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000165dd8 at pc 0x560cdd689c16 bp 0x7f3a43ed3ac0 sp 0x7f3a43ed3ab0

READ of size 4 at 0x615000165dd8 thread T32

    #0 0x560cdd689c15 in sf_malloc_usable_size /git/10.4/mysys/safemalloc.c:215

    #1 0x560cdd65bedf in my_free /git/10.4/mysys/my_malloc.c:212

    #2 0x560cdca9d80c in maria_create /git/10.4/storage/maria/ma_create.c:1275

    #3 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227

    #4 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630

    #5 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004

    #6 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514

    #7 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952

    #8 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074

    #9 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163

    #10 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282

    #11 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103

    #12 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850

    #13 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395

    #14 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402

    #15 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308

    #16 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

    #17 0x7f3a723db41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

0x615000165dd8 is located 88 bytes inside of 500-byte region [0x615000165d80,0x615000165f74)

freed by thread T32 here:

    #0 0x7f3a741a52ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)

    #1 0x560cdd68a494 in free_memory /git/10.4/mysys/safemalloc.c:279

    #2 0x560cdd689b1e in sf_free /git/10.4/mysys/safemalloc.c:197

    #3 0x560cdd65bf15 in my_free /git/10.4/mysys/my_malloc.c:221

    #4 0x560cdca9cffd in maria_create /git/10.4/storage/maria/ma_create.c:1171

    #5 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227

    #6 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630

    #7 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004

    #8 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514

    #9 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952

    #10 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074

    #11 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163

    #12 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282

    #13 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103

    #14 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850

    #15 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395

    #16 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402

    #17 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308

    #18 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

previously allocated by thread T32 here:

    #0 0x7f3a741a5602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)

    #1 0x560cdd6894ef in sf_malloc /git/10.4/mysys/safemalloc.c:118

    #2 0x560cdd65b692 in my_malloc /git/10.4/mysys/my_malloc.c:101

    #3 0x560cdca9cb9b in maria_create /git/10.4/storage/maria/ma_create.c:1091

    #4 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227

    #5 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630

    #6 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004

    #7 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514

    #8 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952

    #9 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074

    #10 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163

    #11 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282

    #12 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103

    #13 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850

    #14 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395

    #15 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402

    #16 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308

    #17 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Thread T32 created by T0 here:

    #0 0x7f3a74143253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)

    #1 0x560cdd6b4c01 in spawn_thread_noop /git/10.4/mysys/psi_noop.c:187

    #2 0x560cdbc1fe74 in inline_mysql_thread_create /git/10.4/include/mysql/psi/mysql_thread.h:1268

    #3 0x560cdbc3505c in create_thread_to_handle_connection(CONNECT*) /git/10.4/sql/mysqld.cc:6333

    #4 0x560cdbc3575c in create_new_thread(CONNECT*) /git/10.4/sql/mysqld.cc:6403

    #5 0x560cdbc35ae7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /git/10.4/sql/mysqld.cc:6520

    #6 0x560cdbc36764 in handle_connections_sockets() /git/10.4/sql/mysqld.cc:6685

    #7 0x560cdbc3451c in mysqld_main(int, char**) /git/10.4/sql/mysqld.cc:5955

    #8 0x560cdbc1e59f in main /git/10.4/sql/main.cc:25

    #9 0x7f3a722f482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-use-after-free /git/10.4/mysys/safemalloc.c:215 sf_malloc_usable_size

Shadow bytes around the buggy address:

  0x0c2a80024b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a80024b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a80024b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a80024b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a80024ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

=>0x0c2a80024bb0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd

  0x0c2a80024bc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a80024bd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2a80024be0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa

  0x0c2a80024bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2a80024c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

==16360==ABORTING