Server crashes in heap_rnext upon DELETE from a HEAP table

CREATE TABLE t1 (a VARCHAR(128), b VARCHAR(32), KEY(a) USING BTREE, KEY(b) USING BTREE) ENGINE=HEAP;

INSERT INTO t1 VALUES ('foo',NULL),('m','b'),(6,'j'),('bar','qux'),(NULL,NULL);

DELETE FROM t1 WHERE a <=> 'm' OR b <=> NULL;

# Cleanup

DROP TABLE t1;

#3  <signal handler called>

#4  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:325

#5  0x000056475c1759c9 in heap_rnext (info=0x7f0a4489d970, record=0x7f0a4489c588 "\374\001moo") at /data/src/10.1/storage/heap/hp_rnext.c:127

#6  0x000056475c17000c in ha_heap::index_next (this=0x7f0a44a77808, buf=0x7f0a4489c588 "\374\001moo") at /data/src/10.1/storage/heap/ha_heap.cc:317

#7  0x000056475bfd95e1 in handler::index_next_same (this=0x7f0a44a77808, buf=0x7f0a4489c588 "\374\001moo", key=0x7f0a44a77350 "\001", keylen=35) at /data/src/10.1/sql/handler.cc:4547

#8  0x000056475bfd6183 in handler::ha_index_next_same (this=0x7f0a44a77808, buf=0x7f0a4489c588 "\374\001moo", key=0x7f0a44a77350 "\001", keylen=35) at /data/src/10.1/sql/handler.cc:2799

#9  0x000056475bfdb996 in handler::read_range_next (this=0x7f0a44a77808) at /data/src/10.1/sql/handler.cc:5431

#10 0x000056475bf126cf in handler::multi_range_read_next (this=0x7f0a44a77808, range_info=0x7f0a4f183188) at /data/src/10.1/sql/multi_range_read.cc:257

#11 0x000056475c10346e in QUICK_RANGE_SELECT::get_next (this=0x7f0a4499f280) at /data/src/10.1/sql/opt_range.cc:11293

#12 0x000056475c102dfd in QUICK_ROR_UNION_SELECT::get_next (this=0x7f0a44a73100) at /data/src/10.1/sql/opt_range.cc:11160

#13 0x000056475c113537 in rr_quick (info=0x7f0a4f1833d0) at /data/src/10.1/sql/records.cc:350

#14 0x000056475c12abc4 in mysql_delete (thd=0x7f0a467cb070, table_list=0x7f0a448f6190, conds=0x7f0a448f6d70, order_list=0x7f0a467cf528, limit=18446744073709551613, options=0, result=0x0) at /data/src/10.1/sql/sql_delete.cc:570

#15 0x000056475bd94c45 in mysql_execute_command (thd=0x7f0a467cb070) at /data/src/10.1/sql/sql_parse.cc:3869

#16 0x000056475bd9f15c in mysql_parse (thd=0x7f0a467cb070, rawbuf=0x7f0a448f6088 "DELETE FROM t1 WHERE a <=> 'm' OR b <=> NULL", length=44, parser_state=0x7f0a4f1845f0) at /data/src/10.1/sql/sql_parse.cc:7208

#17 0x000056475bd8e332 in dispatch_command (command=COM_QUERY, thd=0x7f0a467cb070, packet=0x7f0a487ee071 "DELETE FROM t1 WHERE a <=> 'm' OR b <=> NULL", packet_length=44) at /data/src/10.1/sql/sql_parse.cc:1499

#18 0x000056475bd8d217 in do_command (thd=0x7f0a467cb070) at /data/src/10.1/sql/sql_parse.cc:1131

#19 0x000056475beca4e1 in do_handle_one_connection (thd_arg=0x7f0a467cb070) at /data/src/10.1/sql/sql_connect.cc:1331

#20 0x000056475beca212 in handle_one_connection (arg=0x7f0a467cb070) at /data/src/10.1/sql/sql_connect.cc:1242

#21 0x000056475c2e7e3a in pfs_spawn_thread (arg=0x7f0a4cc39c70) at /data/src/10.1/storage/perfschema/pfs.cc:1868

#22 0x00007f0a4ee074a4 in start_thread (arg=0x7f0a4f185700) at pthread_create.c:456

#23 0x00007f0a4d615d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

==20111==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000003b60 at pc 0x55ed6a9b254f bp 0x7f93f5e898d0 sp 0x7f93f5e898c8

READ of size 8 at 0x604000003b60 thread T6

    #0 0x55ed6a9b254e in tree_search_next /data/src/10.1/mysys/tree.c:474

    #1 0x55ed6a1c1ea4 in heap_rnext /data/src/10.1/storage/heap/hp_rnext.c:56

    #2 0x55ed6a1b6d6a in ha_heap::index_next(unsigned char*) /data/src/10.1/storage/heap/ha_heap.cc:317

    #3 0x55ed69df2710 in handler::index_next_same(unsigned char*, unsigned char const*, unsigned int) /data/src/10.1/sql/handler.cc:4547

    #4 0x55ed69e01052 in handler::ha_index_next_same(unsigned char*, unsigned char const*, unsigned int) /data/src/10.1/sql/handler.cc:2799

    #5 0x55ed69e0b4a5 in handler::read_range_next() /data/src/10.1/sql/handler.cc:5431

    #6 0x55ed69c987fa in handler::multi_range_read_next(void**) /data/src/10.1/sql/multi_range_read.cc:257

    #7 0x55ed6a097bce in QUICK_RANGE_SELECT::get_next() /data/src/10.1/sql/opt_range.cc:11293

    #8 0x55ed6a09c772 in QUICK_ROR_UNION_SELECT::get_next() /data/src/10.1/sql/opt_range.cc:11160

    #9 0x55ed6a0e7397 in rr_quick /data/src/10.1/sql/records.cc:350

    #10 0x55ed6a11af7d in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.1/sql/sql_delete.cc:570

    #11 0x55ed699ac147 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:3869

    #12 0x55ed699b8359 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7208

    #13 0x55ed699be884 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1499

    #14 0x55ed699c36ac in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1131

    #15 0x55ed69c1824a in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1331

    #16 0x55ed69c187d0 in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242

    #17 0x55ed6a4344d7 in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1868

    #18 0x7f94016bd4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

    #19 0x7f93ffecbd0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x604000003b60 is located 16 bytes inside of 48-byte region [0x604000003b50,0x604000003b80)

freed by thread T6 here:

    #0 0x7f9401994a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)

    #1 0x55ed6a9991da in my_free /data/src/10.1/mysys/my_malloc.c:218

previously allocated by thread T6 here:

    #0 0x7f9401994d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)

    #1 0x55ed6a998ff8 in my_malloc /data/src/10.1/mysys/my_malloc.c:101

Thread T6 created by T0 here:

    #0 0x7f9401903f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)

    #1 0x55ed6a43e9e6 in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1918

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.1/mysys/tree.c:474 in tree_search_next

Shadow bytes around the buggy address:

  0x0c087fff8710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c087fff8720: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00

  0x0c087fff8730: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00

  0x0c087fff8740: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00

  0x0c087fff8750: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00

=>0x0c087fff8760: fa fa 00 00 00 00 00 00 fa fa fd fd[fd]fd fd fd

  0x0c087fff8770: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00

  0x0c087fff8780: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fd

  0x0c087fff8790: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa

  0x0c087fff87a0: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa

  0x0c087fff87b0: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==20111==ABORTING