Server crash in mem_block_validate or Failing assertion: block->magic_n == MEM_BLOCK_MAGIC_N upon ALTER TABLE after unsuccessful FK addition

--source include/have_innodb.inc

CREATE TABLE t1 (

  pk INT AUTO_INCREMENT,

  f1 VARCHAR(8),

  f2 INT,

  PRIMARY KEY (pk),

  FULLTEXT(f1)

) ENGINE=InnoDB;

CREATE TABLE t2 (f INT) ENGINE=InnoDB;

--error ER_CANT_CREATE_TABLE

ALTER TABLE t1 ADD FOREIGN KEY (f2) REFERENCES t2 (f), DROP FOREIGN KEY IF EXISTS x;

ALTER TABLE t2 FORCE;

# Cleanup

DROP TABLE t1, t2;

2018-12-08 18:19:59 9 [Note] InnoDB: Deferring DROP TABLE `test`.`FTS_0000000000000021_CONFIG`; renaming to test/#sql-ib36-607431777

2018-12-08 18:19:59 9 [ERROR] InnoDB: Unable to drop FTS index aux table test/FTS_0000000000000021_CONFIG: Cannot drop constraint

2018-12-08 18:19:59 9 [ERROR] InnoDB:  Unable to remove ancillary FTS tables for table `test`.`#sql-4a06_9` : Cannot drop constraint

2018-12-08 18:19:59 9 [ERROR] InnoDB: Flagged corruption of `PRIMARY` in table `test`.`#sql-4a06_9` in DROP TABLE

2018-12-08 18:19:59 9 [ERROR] InnoDB: Flagged corruption of `FTS_DOC_ID_INDEX` in table `test`.`#sql-4a06_9` in DROP TABLE

2018-12-08 18:19:59 9 [ERROR] InnoDB: Flagged corruption of `f2` in table `test`.`#sql-4a06_9` in DROP TABLE

2018-12-08 18:19:59 9 [ERROR] InnoDB: Flagged corruption of `f1` in table `test`.`#sql-4a06_9` in DROP TABLE

2018-12-08 18:19:59 9 [ERROR] InnoDB: Table `test`.`#sql-4a06_9`is corrupted

2018-12-08 18:19:59 9 [ERROR] InnoDB: Operating system error number 17 in a file operation.

2018-12-08 18:19:59 9 [ERROR] InnoDB: Error number 17 means 'File exists'

2018-12-08 18:19:59 9 [Note] InnoDB: Some operating system error numbers are described at https://mariadb.com/kb/en/library/operating-system-error-codes/

2018-12-08 18:19:59 9 [Note] InnoDB: The file './test/#sql-4a06_9.ibd' already exists though the corresponding table did not exist in the InnoDB data dictionary. You can resolve the problem by removing the file.

2018-12-08 18:19:59 9 [ERROR] InnoDB: Cannot create file './test/#sql-4a06_9.ibd'

#3  <signal handler called>

#4  0x0000563a91bfad1d in mem_block_validate (block=0x0) at /data/src/10.3/storage/innobase/include/mem0mem.ic:154

#5  0x0000563a91bfb04e in mem_heap_free (heap=0x0) at /data/src/10.3/storage/innobase/include/mem0mem.ic:514

#6  0x0000563a91bfc6bc in dict_mem_table_free (table=0x7fc618052dc8) at /data/src/10.3/storage/innobase/dict/dict0mem.cc:247

#7  0x0000563a91934f08 in prepare_inplace_alter_table_dict (ha_alter_info=0x7fc66d93c360, altered_table=0x7fc618047000, old_table=0x7fc618053230, table_name=0x7fc61806040d "t2", flags=33, flags2=80, fts_doc_id_col=18446744073709551615, add_fts_doc_id=false, add_fts_doc_id_idx=false) at /data/src/10.3/storage/innobase/handler/handler0alter.cc:5022

#8  0x0000563a9193be04 in ha_innobase::prepare_inplace_alter_table (this=0x7fc618052618, altered_table=0x7fc618047000, ha_alter_info=0x7fc66d93c360) at /data/src/10.3/storage/innobase/handler/handler0alter.cc:6996

#9  0x0000563a915e34fb in handler::ha_prepare_inplace_alter_table (this=0x7fc618052618, altered_table=0x7fc618047000, ha_alter_info=0x7fc66d93c360) at /data/src/10.3/sql/handler.cc:4436

#10 0x0000563a913ba1bd in mysql_inplace_alter_table (thd=0x7fc618000b00, table_list=0x7fc618014db0, table=0x7fc618053230, altered_table=0x7fc618047000, ha_alter_info=0x7fc66d93c360, inplace_supported=HA_ALTER_INPLACE_COPY_NO_LOCK, target_mdl_request=0x7fc66d93c490, alter_ctx=0x7fc66d93d090) at /data/src/10.3/sql/sql_table.cc:7520

#11 0x0000563a913c041f in mysql_alter_table (thd=0x7fc618000b00, new_db=0x7fc6180051b8, new_name=0x7fc618005578, create_info=0x7fc66d93dc80, table_list=0x7fc618014db0, alter_info=0x7fc66d93dbc0, order_num=0, order=0x0, ignore=false) at /data/src/10.3/sql/sql_table.cc:9699

#12 0x0000563a914480f3 in Sql_cmd_alter_table::execute (this=0x7fc618015400, thd=0x7fc618000b00) at /data/src/10.3/sql/sql_alter.cc:497

#13 0x0000563a912e9cbf in mysql_execute_command (thd=0x7fc618000b00) at /data/src/10.3/sql/sql_parse.cc:6284

#14 0x0000563a912eed8f in mysql_parse (thd=0x7fc618000b00, rawbuf=0x7fc618014cd8 "ALTER TABLE t2 FORCE", length=20, parser_state=0x7fc66d93f5f0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:8091

#15 0x0000563a912dbf43 in dispatch_command (command=COM_QUERY, thd=0x7fc618000b00, packet=0x7fc61800b1e1 "ALTER TABLE t2 FORCE", packet_length=20, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1850

#16 0x0000563a912da967 in do_command (thd=0x7fc618000b00) at /data/src/10.3/sql/sql_parse.cc:1395

#17 0x0000563a9144267e in do_handle_one_connection (connect=0x563a94a3b300) at /data/src/10.3/sql/sql_connect.cc:1402

#18 0x0000563a91442402 in handle_one_connection (arg=0x563a94a3b300) at /data/src/10.3/sql/sql_connect.cc:1308

#19 0x0000563a918dca41 in pfs_spawn_thread (arg=0x563a94a7cca0) at /data/src/10.3/storage/perfschema/pfs.cc:1862

#20 0x00007fc6760b5494 in start_thread (arg=0x7fc66d940700) at pthread_create.c:333

#21 0x00007fc6746b693f in clone () from /lib/x86_64-linux-gnu/libc.so.6

2018-12-08 18:11:03 0x7f3f3411e700  InnoDB: Assertion failure in file /data/src/10.3/storage/innobase/include/mem0mem.ic line 154

InnoDB: Failing assertion: block->magic_n == MEM_BLOCK_MAGIC_N

5  0x00007f3f38fd93fa in abort () from /lib/x86_64-linux-gnu/libc.so.6

#6  0x000055f46ab084c0 in ut_dbg_assertion_failed (expr=0x55f46b148460 "block->magic_n == MEM_BLOCK_MAGIC_N", file=0x55f46b1483f8 "/data/src/10.3/storage/innobase/include/mem0mem.ic", line=154) at /data/src/10.3/storage/innobase/ut/ut0dbg.cc:60

#7  0x000055f46abded49 in mem_block_validate (block=0x7f3ee004bf00) at /data/src/10.3/storage/innobase/include/mem0mem.ic:154

#8  0x000055f46abdf04e in mem_heap_free (heap=0x7f3ee004bf00) at /data/src/10.3/storage/innobase/include/mem0mem.ic:514

#9  0x000055f46abe06bc in dict_mem_table_free (table=0x7f3ee0051048) at /data/src/10.3/storage/innobase/dict/dict0mem.cc:247

#10 0x000055f46a918f08 in prepare_inplace_alter_table_dict (ha_alter_info=0x7f3f3411a360, altered_table=0x7f3ee00641c0, old_table=0x7f3ee005fa80, table_name=0x7f3ee0052a6d "t2", flags=33, flags2=80, fts_doc_id_col=18446744073709551615, add_fts_doc_id=false, add_fts_doc_id_idx=false) at /data/src/10.3/storage/innobase/handler/handler0alter.cc:5022

#11 0x000055f46a91fe04 in ha_innobase::prepare_inplace_alter_table (this=0x7f3ee0050038, altered_table=0x7f3ee00641c0, ha_alter_info=0x7f3f3411a360) at /data/src/10.3/storage/innobase/handler/handler0alter.cc:6996

#12 0x000055f46a5c74fb in handler::ha_prepare_inplace_alter_table (this=0x7f3ee0050038, altered_table=0x7f3ee00641c0, ha_alter_info=0x7f3f3411a360) at /data/src/10.3/sql/handler.cc:4436

#13 0x000055f46a39e1bd in mysql_inplace_alter_table (thd=0x7f3ee0000b00, table_list=0x7f3ee0014db0, table=0x7f3ee005fa80, altered_table=0x7f3ee00641c0, ha_alter_info=0x7f3f3411a360, inplace_supported=HA_ALTER_INPLACE_COPY_NO_LOCK, target_mdl_request=0x7f3f3411a490, alter_ctx=0x7f3f3411b090) at /data/src/10.3/sql/sql_table.cc:7520

#14 0x000055f46a3a441f in mysql_alter_table (thd=0x7f3ee0000b00, new_db=0x7f3ee00051b8, new_name=0x7f3ee0005578, create_info=0x7f3f3411bc80, table_list=0x7f3ee0014db0, alter_info=0x7f3f3411bbc0, order_num=0, order=0x0, ignore=false) at /data/src/10.3/sql/sql_table.cc:9699

#15 0x000055f46a42c0f3 in Sql_cmd_alter_table::execute (this=0x7f3ee0015400, thd=0x7f3ee0000b00) at /data/src/10.3/sql/sql_alter.cc:497

#16 0x000055f46a2cdcbf in mysql_execute_command (thd=0x7f3ee0000b00) at /data/src/10.3/sql/sql_parse.cc:6284

#17 0x000055f46a2d2d8f in mysql_parse (thd=0x7f3ee0000b00, rawbuf=0x7f3ee0014cd8 "ALTER TABLE t2 FORCE", length=20, parser_state=0x7f3f3411d5f0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:8091

#18 0x000055f46a2bff43 in dispatch_command (command=COM_QUERY, thd=0x7f3ee0000b00, packet=0x7f3ee000b1e1 "ALTER TABLE t2 FORCE", packet_length=20, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1850

#19 0x000055f46a2be967 in do_command (thd=0x7f3ee0000b00) at /data/src/10.3/sql/sql_parse.cc:1395

#20 0x000055f46a42667e in do_handle_one_connection (connect=0x55f46e02f300) at /data/src/10.3/sql/sql_connect.cc:1402

#21 0x000055f46a426402 in handle_one_connection (arg=0x55f46e02f300) at /data/src/10.3/sql/sql_connect.cc:1308

#22 0x000055f46a8c0a41 in pfs_spawn_thread (arg=0x55f46e070ca0) at /data/src/10.3/storage/perfschema/pfs.cc:1862

#23 0x00007f3f3aa8c494 in start_thread (arg=0x7f3f3411e700) at pthread_create.c:333

#24 0x00007f3f3908d93f in clone () from /lib/x86_64-linux-gnu/libc.so.6

==19417==ERROR: AddressSanitizer: heap-use-after-free on address 0x6170000b8798 at pc 0x55afe08c9e02 bp 0x7fa3d1555540 sp 0x7fa3d1555538

READ of size 8 at 0x6170000b8798 thread T27

    #0 0x55afe08c9e01 in prepare_inplace_alter_table_dict /data/src/10.3/storage/innobase/handler/handler0alter.cc:5520

    #1 0x55afe08d48e5 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.3/storage/innobase/handler/handler0alter.cc:6996

    #2 0x55afe009933c in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.3/sql/handler.cc:4436

    #3 0x55afdfb86ad1 in mysql_inplace_alter_table /data/src/10.3/sql/sql_table.cc:7520

    #4 0x55afdfb940ac in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9699

    #5 0x55afdfcde7f1 in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:497

    #6 0x55afdf97bcb4 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6284

    #7 0x55afdf986bb2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8091

    #8 0x55afdf960c88 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850

    #9 0x55afdf95dd10 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395

    #10 0x55afdfccf828 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402

    #11 0x55afdfccf234 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #12 0x55afe0800f09 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #13 0x7fa3dcc44493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

    #14 0x7fa3db24593e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x6170000b8798 is located 152 bytes inside of 768-byte region [0x6170000b8700,0x6170000b8a00)

freed by thread T27 here:

    #0 0x7fa3dceae527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)

    #1 0x55afe09b5ebd in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /data/src/10.3/storage/innobase/mem/mem0mem.cc:415

    #2 0x55afe0dd8939 in mem_heap_free /data/src/10.3/storage/innobase/include/mem0mem.ic:528

    #3 0x55afe0ddb364 in dict_mem_table_free(dict_table_t*) /data/src/10.3/storage/innobase/dict/dict0mem.cc:247

    #4 0x55afe0ae46fe in row_create_table_for_mysql(dict_table_t*, trx_t*, fil_encryption_t, unsigned int) /data/src/10.3/storage/innobase/row/row0mysql.cc:2476

    #5 0x55afe08c9886 in prepare_inplace_alter_table_dict /data/src/10.3/storage/innobase/handler/handler0alter.cc:5496

    #6 0x55afe08d48e5 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.3/storage/innobase/handler/handler0alter.cc:6996

    #7 0x55afe009933c in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.3/sql/handler.cc:4436

    #8 0x55afdfb86ad1 in mysql_inplace_alter_table /data/src/10.3/sql/sql_table.cc:7520

    #9 0x55afdfb940ac in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9699

    #10 0x55afdfcde7f1 in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:497

    #11 0x55afdf97bcb4 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6284

    #12 0x55afdf986bb2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8091

    #13 0x55afdf960c88 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850

    #14 0x55afdf95dd10 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395

    #15 0x55afdfccf828 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402

    #16 0x55afdfccf234 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #17 0x55afe0800f09 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #18 0x7fa3dcc44493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

previously allocated by thread T27 here:

    #0 0x7fa3dceae73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)

    #1 0x55afe09b54c3 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.3/storage/innobase/mem/mem0mem.cc:269

    #2 0x55afe09b5be6 in mem_heap_add_block(mem_block_info_t*, unsigned long) /data/src/10.3/storage/innobase/mem/mem0mem.cc:375

    #3 0x55afe0dd860d in mem_heap_alloc /data/src/10.3/storage/innobase/include/mem0mem.ic:201

    #4 0x55afe0dd83df in mem_heap_zalloc /data/src/10.3/storage/innobase/include/mem0mem.ic:170

    #5 0x55afe0dda8f5 in dict_mem_table_create(char const*, fil_space_t*, unsigned long, unsigned long, unsigned long, unsigned long) /data/src/10.3/storage/innobase/dict/dict0mem.cc:151

    #6 0x55afe08c4dff in prepare_inplace_alter_table_dict /data/src/10.3/storage/innobase/handler/handler0alter.cc:5079

    #7 0x55afe08d48e5 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.3/storage/innobase/handler/handler0alter.cc:6996

    #8 0x55afe009933c in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.3/sql/handler.cc:4436

    #9 0x55afdfb86ad1 in mysql_inplace_alter_table /data/src/10.3/sql/sql_table.cc:7520

    #10 0x55afdfb940ac in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9699

    #11 0x55afdfcde7f1 in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:497

    #12 0x55afdf97bcb4 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6284

    #13 0x55afdf986bb2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8091

    #14 0x55afdf960c88 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1850

    #15 0x55afdf95dd10 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1395

    #16 0x55afdfccf828 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402

    #17 0x55afdfccf234 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #18 0x55afe0800f09 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862

    #19 0x7fa3dcc44493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

Thread T27 created by T0 here:

    #0 0x7fa3dce7dbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)

    #1 0x55afe08014d1 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912

    #2 0x55afdf6c8a78 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268

    #3 0x55afdf6dec0a in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6572

    #4 0x55afdf6df30f in create_new_thread /data/src/10.3/sql/mysqld.cc:6642

    #5 0x55afdf6e0326 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6917

    #6 0x55afdf6de0c7 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6194

    #7 0x55afdf6c6aff in main /data/src/10.3/sql/main.cc:25

    #8 0x7fa3db17d2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/innobase/handler/handler0alter.cc:5520 prepare_inplace_alter_table_dict

Shadow bytes around the buggy address:

  0x0c2e8000f0a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2e8000f0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c2e8000f0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa

  0x0c2e8000f0d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c2e8000f0e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c2e8000f0f0: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2e8000f100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2e8000f110: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2e8000f120: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2e8000f130: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c2e8000f140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Contiguous container OOB:fc

  ASan internal:           fe

==19417==ABORTING

mysqltest: At line 14: query 'ALTER TABLE t2 FORCE' failed: 1813: Tablespace for table '(null)' exists. Please DISCARD the tablespace before IMPORT

mysqltest: At line 14: query 'ALTER TABLE t2 FORCE' failed: 1813: Tablespace for table 'test/#sql-4602_9' exists. Please DISCARD the tablespace before IMPORT