ASAN global-buffer-overflow in QUICK_GROUP_MIN_MAX_SELECT::add_range with use_stat_tables

--source include/have_innodb.inc

SET use_stat_tables= PREFERABLY;

CREATE TABLE t1 (a INT) ENGINE=InnoDB;

INSERT INTO t1 VALUES (1),(2);

CREATE TABLE t2 (f1 VARCHAR(3), f2 VARCHAR(35), KEY(f1,f2)) ENGINE=InnoDB;

ANALYZE TABLE t1, t2;

SELECT * FROM t1 WHERE ('a','b') NOT IN (SELECT f1, MIN(f2) FROM t2 WHERE f2 <> '' GROUP BY f1);

# Cleanup

DROP TABLE t1, t2;

==12898==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5624a55c7054 at pc 0x7f6f896696ff bp 0x7f6f73e104c0 sp 0x7f6f73e0fc70

READ of size 38 at 0x5624a55c7054 thread T23

    #0 0x7f6f896696fe  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x8d6fe)

    #1 0x5624a3d15010 in QUICK_GROUP_MIN_MAX_SELECT::add_range(SEL_ARG*) /data/src/10.1/sql/opt_range.cc:13614

    #2 0x5624a3d1622d in TRP_GROUP_MIN_MAX::make_quick(PARAM*, bool, st_mem_root*) /data/src/10.1/sql/opt_range.cc:13362

    #3 0x5624a3d03fcc in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool) /data/src/10.1/sql/opt_range.cc:2688

    #4 0x5624a3562609 in get_quick_record_count /data/src/10.1/sql/sql_select.cc:3538

    #5 0x5624a35f7bf3 in make_join_statistics /data/src/10.1/sql/sql_select.cc:4158

    #6 0x5624a35f7bf3 in JOIN::optimize_inner() /data/src/10.1/sql/sql_select.cc:1405

    #7 0x5624a35ff34b in JOIN::optimize() /data/src/10.1/sql/sql_select.cc:1059

    #8 0x5624a34cb460 in st_select_lex::optimize_unflattened_subqueries(bool) /data/src/10.1/sql/sql_lex.cc:3805

    #9 0x5624a386e460 in JOIN::optimize_constant_subqueries() /data/src/10.1/sql/opt_subselect.cc:5368

    #10 0x5624a35f16c5 in JOIN::optimize_inner() /data/src/10.1/sql/sql_select.cc:1214

    #11 0x5624a35ff34b in JOIN::optimize() /data/src/10.1/sql/sql_select.cc:1059

    #12 0x5624a3601657 in mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.1/sql/sql_select.cc:3487

    #13 0x5624a3601f61 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.1/sql/sql_select.cc:377

    #14 0x5624a34cf069 in execute_sqlcom_select /data/src/10.1/sql/sql_parse.cc:5690

    #15 0x5624a34ea622 in mysql_execute_command(THD*) /data/src/10.1/sql/sql_parse.cc:3037

    #16 0x5624a3501052 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.1/sql/sql_parse.cc:7208

    #17 0x5624a3507f02 in dispatch_command(enum_server_command, THD*, char*, unsigned int) /data/src/10.1/sql/sql_parse.cc:1499

    #18 0x5624a350d3c9 in do_command(THD*) /data/src/10.1/sql/sql_parse.cc:1131

    #19 0x5624a37b45e3 in do_handle_one_connection(THD*) /data/src/10.1/sql/sql_connect.cc:1331

    #20 0x5624a37b4b9f in handle_one_connection /data/src/10.1/sql/sql_connect.cc:1242

    #21 0x5624a40ef064 in pfs_spawn_thread /data/src/10.1/storage/perfschema/pfs.cc:1868

    #22 0x7f6f893c64a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

    #23 0x7f6f87bd4d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x5624a55c7054 is located 0 bytes to the right of global variable 'is_null_string' defined in '/data/src/10.1/sql/opt_range.cc:140:14' (0x5624a55c7040) of size 20

SUMMARY: AddressSanitizer: global-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x8d6fe) 

Shadow bytes around the buggy address:

  0x0ac514ab0db0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ac514ab0dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ac514ab0dd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ac514ab0de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ac514ab0df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0ac514ab0e00: 00 00 00 00 00 00 00 00 00 00[04]f9 f9 f9 f9 f9

  0x0ac514ab0e10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ac514ab0e20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ac514ab0e30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ac514ab0e40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ac514ab0e50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

Thread T23 created by T0 here:

    #0 0x7f6f8960cf59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)

    #1 0x5624a40fa9e8 in spawn_thread_v1 /data/src/10.1/storage/perfschema/pfs.cc:1918

==12898==ABORTING

EXPLAIN EXTENDED

SELECT * FROM t1 WHERE ('a','b') NOT IN (SELECT f1, MIN(f2) FROM t2 WHERE f2 <> '' GROUP BY f1);

id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra

1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	2	100.00	

2	SUBQUERY	t2	range	NULL	f1	44	NULL	1	0.00	Using where; Using index for group-by

Warnings:

Note	1003	select `test`.`t1`.`a` AS `a` from `test`.`t1` where 1