ASAN heap-use-after-free in subselect_engine::calc_const_tables on 2nd execution of PS

CREATE TABLE t1 (a INT);

INSERT INTO t1 VALUES (3),(8);

CREATE TABLE t2 (b INT);

INSERT INTO t2 VALUES (2),(1);

prepare stmt from "SELECT a FROM t1

WHERE 9 IN ( SELECT MIN( a ) FROM t1 )  AND 1<>1 

HAVING a <> ( SELECT COUNT(*) FROM t2 ) 

ORDER BY a;";

execute stmt;

execute stmt;

 10.2 af9649c722810eb1754953eb406a84ec876ce693

Version: '10.2.19-MariaDB-debug-log' 

=================================================================

==4378==ERROR: AddressSanitizer: heap-use-after-free on address 0x622000039c1d at pc 0x55a599d3fe81 bp 0x7fc6107bae50 sp 0x7fc6107bae40

READ of size 1 at 0x622000039c1d thread T27

    #0 0x55a599d3fe80 in subselect_engine::calc_const_tables(List<TABLE_LIST>&) /git/10.2/sql/item_subselect.cc:4376

    #1 0x55a599d3ffd3 in subselect_single_select_engine::upper_select_const_tables() /git/10.2/sql/item_subselect.cc:4385

    #2 0x55a599d20274 in Item_subselect::update_used_tables() /git/10.2/sql/item_subselect.cc:950

    #3 0x55a5994ba9e5 in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join(Item*) /git/10.2/sql/item.h:4043

    #4 0x55a5994baa61 in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join(unsigned int, Item**) /git/10.2/sql/item.h:4055

    #5 0x55a5994be166 in Item_func::update_used_tables() /git/10.2/sql/item_func.h:144

    #6 0x55a5995811e8 in st_select_lex::update_used_tables() /git/10.2/sql/sql_lex.cc:4253

    #7 0x55a599634e04 in JOIN::optimize_inner() /git/10.2/sql/sql_select.cc:1232

    #8 0x55a599633aa0 in JOIN::optimize() /git/10.2/sql/sql_select.cc:1115

    #9 0x55a59964cd76 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /git/10.2/sql/sql_select.cc:3790

    #10 0x55a59962c938 in handle_select(THD*, LEX*, select_result*, unsigned long) /git/10.2/sql/sql_select.cc:376

    #11 0x55a5995b36f3 in execute_sqlcom_select /git/10.2/sql/sql_parse.cc:6477

    #12 0x55a5995a0703 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3484

    #13 0x55a599602b49 in Prepared_statement::execute(String*, bool) /git/10.2/sql/sql_prepare.cc:4787

    #14 0x55a5995fe511 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/10.2/sql/sql_prepare.cc:4216

    #15 0x55a5995f918b in mysql_sql_stmt_execute(THD*) /git/10.2/sql/sql_prepare.cc:3324

    #16 0x55a5995a0748 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3500

    #17 0x55a5995bbe58 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.2/sql/sql_parse.cc:8011

    #18 0x55a5995973a7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.2/sql/sql_parse.cc:1824

    #19 0x55a59959455b in do_command(THD*) /git/10.2/sql/sql_parse.cc:1378

    #20 0x55a5998b9aa1 in do_handle_one_connection(CONNECT*) /git/10.2/sql/sql_connect.cc:1335

    #21 0x55a5998b94a9 in handle_one_connection /git/10.2/sql/sql_connect.cc:1241

    #22 0x55a59aa5e8ff in pfs_spawn_thread /git/10.2/storage/perfschema/pfs.cc:1862

    #23 0x7fc627da66b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

    #24 0x7fc62723b41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

0x622000039c1d is located 2845 bytes inside of 5028-byte region [0x622000039100,0x62200003a4a4)

freed by thread T27 here:

    #0 0x7fc62921f2ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)

    #1 0x55a59ab7aaca in free_memory /git/10.2/mysys/safemalloc.c:279

    #2 0x55a59ab7a154 in sf_free /git/10.2/mysys/safemalloc.c:197

    #3 0x55a59ab4ac4d in my_free /git/10.2/mysys/my_malloc.c:217

    #4 0x55a59ab2cfd3 in free_root /git/10.2/mysys/my_alloc.c:393

    #5 0x55a5996a804f in free_tmp_table(THD*, TABLE*) /git/10.2/sql/sql_select.cc:18079

    #6 0x55a599d44e88 in subselect_hash_sj_engine::cleanup() /git/10.2/sql/item_subselect.cc:5220

    #7 0x55a599d1a434 in Item_subselect::cleanup() /git/10.2/sql/item_subselect.cc:155

    #8 0x55a599d1ab37 in Item_in_subselect::cleanup() /git/10.2/sql/item_subselect.cc:196

    #9 0x55a599592e94 in cleanup_items(Item*) /git/10.2/sql/sql_parse.cc:1135

    #10 0x55a5995fc572 in Prepared_statement::cleanup_stmt() /git/10.2/sql/sql_prepare.cc:3851

    #11 0x55a599602e1f in Prepared_statement::execute(String*, bool) /git/10.2/sql/sql_prepare.cc:4815

    #12 0x55a5995fe511 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/10.2/sql/sql_prepare.cc:4216

    #13 0x55a5995f918b in mysql_sql_stmt_execute(THD*) /git/10.2/sql/sql_prepare.cc:3324

    #14 0x55a5995a0748 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3500

    #15 0x55a5995bbe58 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.2/sql/sql_parse.cc:8011

    #16 0x55a5995973a7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.2/sql/sql_parse.cc:1824

    #17 0x55a59959455b in do_command(THD*) /git/10.2/sql/sql_parse.cc:1378

    #18 0x55a5998b9aa1 in do_handle_one_connection(CONNECT*) /git/10.2/sql/sql_connect.cc:1335

    #19 0x55a5998b94a9 in handle_one_connection /git/10.2/sql/sql_connect.cc:1241

    #20 0x55a59aa5e8ff in pfs_spawn_thread /git/10.2/storage/perfschema/pfs.cc:1862

    #21 0x7fc627da66b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

previously allocated by thread T27 here:

    #0 0x7fc62921f602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)

    #1 0x55a59ab79b25 in sf_malloc /git/10.2/mysys/safemalloc.c:118

    #2 0x55a59ab4a40f in my_malloc /git/10.2/mysys/my_malloc.c:101

    #3 0x55a59ab2c1a0 in alloc_root /git/10.2/mysys/my_alloc.c:242

    #4 0x55a59ab2c869 in multi_alloc_root /git/10.2/mysys/my_alloc.c:310

    #5 0x55a59969c489 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, char const*, bool, bool) /git/10.2/sql/sql_select.cc:16683

    #6 0x55a5995030d5 in select_materialize_with_stats::create_result_table(THD*, List<Item>*, bool, unsigned long long, char const*, bool, bool, bool) /git/10.2/sql/sql_class.cc:3827

    #7 0x55a599d42b67 in subselect_hash_sj_engine::init(List<Item>*, unsigned int) /git/10.2/sql/item_subselect.cc:4983

    #8 0x55a599d38535 in Item_in_subselect::setup_mat_engine() /git/10.2/sql/item_subselect.cc:3404

    #9 0x55a599986102 in JOIN::choose_subquery_plan(unsigned long long) /git/10.2/sql/opt_subselect.cc:5912

    #10 0x55a59965418b in make_join_statistics /git/10.2/sql/sql_select.cc:4580

    #11 0x55a599638251 in JOIN::optimize_inner() /git/10.2/sql/sql_select.cc:1580

    #12 0x55a599633aa0 in JOIN::optimize() /git/10.2/sql/sql_select.cc:1115

    #13 0x55a599d1efd2 in Item_in_subselect::optimize(double*, double*) /git/10.2/sql/item_subselect.cc:760

    #14 0x55a599984068 in setup_jtbm_semi_joins(JOIN*, List<TABLE_LIST>*, Item**) /git/10.2/sql/opt_subselect.cc:5551

    #15 0x55a599635e29 in JOIN::optimize_inner() /git/10.2/sql/sql_select.cc:1345

    #16 0x55a599633aa0 in JOIN::optimize() /git/10.2/sql/sql_select.cc:1115

    #17 0x55a59964cd76 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /git/10.2/sql/sql_select.cc:3790

    #18 0x55a59962c938 in handle_select(THD*, LEX*, select_result*, unsigned long) /git/10.2/sql/sql_select.cc:376

    #19 0x55a5995b36f3 in execute_sqlcom_select /git/10.2/sql/sql_parse.cc:6477

    #20 0x55a5995a0703 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3484

    #21 0x55a599602b49 in Prepared_statement::execute(String*, bool) /git/10.2/sql/sql_prepare.cc:4787

    #22 0x55a5995fe511 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/10.2/sql/sql_prepare.cc:4216

    #23 0x55a5995f918b in mysql_sql_stmt_execute(THD*) /git/10.2/sql/sql_prepare.cc:3324

    #24 0x55a5995a0748 in mysql_execute_command(THD*) /git/10.2/sql/sql_parse.cc:3500

    #25 0x55a5995bbe58 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.2/sql/sql_parse.cc:8011

    #26 0x55a5995973a7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.2/sql/sql_parse.cc:1824

    #27 0x55a59959455b in do_command(THD*) /git/10.2/sql/sql_parse.cc:1378

    #28 0x55a5998b9aa1 in do_handle_one_connection(CONNECT*) /git/10.2/sql/sql_connect.cc:1335

    #29 0x55a5998b94a9 in handle_one_connection /git/10.2/sql/sql_connect.cc:1241

Thread T27 created by T0 here:

    #0 0x7fc6291bd253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)

    #1 0x55a59aa5ecec in spawn_thread_v1 /git/10.2/storage/perfschema/pfs.cc:1912

    #2 0x55a5993a3e46 in inline_mysql_thread_create /git/10.2/include/mysql/psi/mysql_thread.h:1239

    #3 0x55a5993b806c in create_thread_to_handle_connection(CONNECT*) /git/10.2/sql/mysqld.cc:6454

    #4 0x55a5993b876c in create_new_thread /git/10.2/sql/mysqld.cc:6524

    #5 0x55a5993b97af in handle_connections_sockets() /git/10.2/sql/mysqld.cc:6799

    #6 0x55a5993b75bc in mysqld_main(int, char**) /git/10.2/sql/mysqld.cc:6073

    #7 0x55a5993a27df in main /git/10.2/sql/main.cc:25

    #8 0x7fc62715482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-use-after-free /git/10.2/sql/item_subselect.cc:4376 subselect_engine::calc_const_tables(List<TABLE_LIST>&)

Shadow bytes around the buggy address:

  0x0c447ffff330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c447ffff340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c447ffff350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c447ffff360: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c447ffff370: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c447ffff380: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c447ffff390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c447ffff3a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c447ffff3b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c447ffff3c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c447ffff3d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

==4378==ABORTING

----------SERVER LOG END-------------

 5.5 b68d8a05d326bed43aefa73d717c0307278ca6bb

Version: '5.5.63-MariaDB-debug'  socket: '/git/5.5/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution

=================================================================

==4146==ERROR: AddressSanitizer: heap-use-after-free on address 0x621000062195 at pc 0x000000bdc805 bp 0x7f1d7d987b00 sp 0x7f1d7d987af0

READ of size 1 at 0x621000062195 thread T15

    #0 0xbdc804 in subselect_engine::calc_const_tables(List<TABLE_LIST>&) /git/5.5/sql/item_subselect.cc:3783

    #1 0xbdc8a8 in subselect_single_select_engine::upper_select_const_tables() /git/5.5/sql/item_subselect.cc:3792

    #2 0xbc1c0d in Item_subselect::update_used_tables() /git/5.5/sql/item_subselect.cc:885

    #3 0xb2e737 in Item_func::update_used_tables() /git/5.5/sql/item_func.cc:448

    #4 0x66723f in st_select_lex::update_used_tables() /git/5.5/sql/sql_lex.cc:3925

    #5 0x75cb89 in JOIN::optimize() /git/5.5/sql/sql_select.cc:1020

    #6 0x76a8d7 in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /git/5.5/sql/sql_select.cc:3119

    #7 0x76b149 in handle_select(THD*, LEX*, select_result*, unsigned long) /git/5.5/sql/sql_select.cc:323

    #8 0x66d464 in execute_sqlcom_select /git/5.5/sql/sql_parse.cc:4678

    #9 0x6831a6 in mysql_execute_command(THD*) /git/5.5/sql/sql_parse.cc:2224

    #10 0x6c2f22 in Prepared_statement::execute(String*, bool) /git/5.5/sql/sql_prepare.cc:3933

    #11 0x6c380a in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /git/5.5/sql/sql_prepare.cc:3591

    #12 0x6c4520 in mysql_sql_stmt_execute(THD*) /git/5.5/sql/sql_prepare.cc:2740

    #13 0x6831ca in mysql_execute_command(THD*) /git/5.5/sql/sql_parse.cc:2234

    #14 0x694e8a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /git/5.5/sql/sql_parse.cc:5923

    #15 0x698287 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /git/5.5/sql/sql_parse.cc:1066

    #16 0x69c365 in do_command(THD*) /git/5.5/sql/sql_parse.cc:793

    #17 0x8ce523 in do_handle_one_connection(THD*) /git/5.5/sql/sql_connect.cc:1268

    #18 0x8ce79c in handle_one_connection /git/5.5/sql/sql_connect.cc:1184

    #19 0x143c257 in pfs_spawn_thread /git/5.5/storage/perfschema/pfs.cc:1015

    #20 0x7f1d8beed6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

    #21 0x7f1d8b39441c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

0x621000062195 is located 2197 bytes inside of 4108-byte region [0x621000061900,0x62100006290c)

freed by thread T15 here:

    #0 0x7f1d8c5d52ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)

    #1 0x15033da in free_memory /git/5.5/mysys/safemalloc.c:205

previously allocated by thread T15 here:

    #0 0x7f1d8c5d5602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)

    #1 0x15034d2 in sf_malloc /git/5.5/mysys/safemalloc.c:105

Thread T15 created by T0 here:

    #0 0x7f1d8c573253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)

    #1 0x143f821 in spawn_thread_v1 /git/5.5/storage/perfschema/pfs.cc:1038

SUMMARY: AddressSanitizer: heap-use-after-free /git/5.5/sql/item_subselect.cc:3783 subselect_engine::calc_const_tables(List<TABLE_LIST>&)

Shadow bytes around the buggy address:

  0x0c42800043e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c42800043f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4280004400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4280004410: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4280004420: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c4280004430: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4280004440: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4280004450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4280004460: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4280004470: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c4280004480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

==4146==ABORTING

----------SERVER LOG END-------------