SET GLOBAL log_bin_trust_function_creators=1;

CREATE FUNCTION f2() RETURNS INT RETURN (SELECT 1 FROM t1);

CREATE TABLE t1 (c1 CHAR BINARY CHARACTER SET 'latin1' COLLATE 'latin1_bin',c2 YEAR,c3 YEAR,PRIMARY KEY(c1)) ENGINE=InnoDB;

SELECT f2()='_u1@localhost';

DROP TABLE t1,t2,t3,t4,t5,t6;

SHOW FUNCTION CODE f2;

Core was generated by `/test/MD150225-mariadb-11.4.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x000055b873b6666f in TABLE::versioned (this=0x14df50027e08)at /test/11.4_dbg/sql/table.h:1828

1828	    return s->versioned;

[Current thread is 1 (LWP 1955430)]

(gdb) bt

#0  0x000055b873b6666f in TABLE::versioned (this=0x14df50027e08)at /test/11.4_dbg/sql/table.h:1828

#1  0x000055b873cc30d8 in TABLE_LIST::print (this=0x14df500261c8, thd=0x14df50000d58, eliminated_tables=0, str=0x14dfa1d45a50, query_type=QT_ITEM_ORIGINAL_FUNC_NULLIF)at /test/11.4_dbg/sql/sql_select.cc:31698

#2  0x000055b873cd1acc in print_table_array (thd=0x14df50000d58, eliminated_tables=0, str=0x14dfa1d45a50, table=0x14df50019ce0, end=0x14df50019ce8, query_type=QT_ITEM_ORIGINAL_FUNC_NULLIF)at /test/11.4_dbg/sql/sql_select.cc:31380

#3  0x000055b873cc36e9 in print_join (thd=0x14df50000d58, eliminated_tables=0, str=0x14dfa1d45a50, tables=0x14df50025de8, query_type=QT_ITEM_ORIGINAL_FUNC_NULLIF)at /test/11.4_dbg/sql/sql_select.cc:31536

#4  0x000055b873cc45ff in st_select_lex::print (this=0x14df50025c30, thd=0x14df50000d58, str=0x14dfa1d45a50, query_type=QT_ITEM_ORIGINAL_FUNC_NULLIF)at /test/11.4_dbg/sql/sql_select.cc:32049

#5  0x000055b874159b8c in subselect_single_select_engine::print (this=0x14df50026a88, str=0x14dfa1d45a50, query_type=QT_ITEM_ORIGINAL_FUNC_NULLIF)at /test/11.4_dbg/sql/item_subselect.cc:4713

#6  0x000055b87414a03d in Item_subselect::print (this=0x14df500268f8, str=0x14dfa1d45a50, query_type=QT_ITEM_ORIGINAL_FUNC_NULLIF)at /test/11.4_dbg/sql/item_subselect.cc:1086

#7  0x000055b873eb9b21 in sp_instr_freturn::print (this=0x14df50026b28, str=0x14dfa1d45a50) at /test/11.4_dbg/sql/sp_instr.cc:1508

#8  0x000055b873b05426 in sp_head::show_routine_code (this=0x14df50024cc0, thd=0x14df50000d58) at /test/11.4_dbg/sql/sp_head.cc:3440

#9  0x000055b873c1475f in mysql_execute_command (thd=0x14df50000d58, is_called_from_prepared_stmt=false) at /test/11.4_dbg/sql/sql_parse.cc:5655

#10 0x000055b873c047a4 in mysql_parse (thd=0x14df50000d58, rawbuf=0x14df50019ac0 "SHOW FUNCTION CODE f2", length=21, parser_state=0x14dfa1d47a30) at /test/11.4_dbg/sql/sql_parse.cc:7907

#11 0x000055b873c01c54 in dispatch_command (command=COM_QUERY, thd=0x14df50000d58, packet=0x14df5000afd9 "", packet_length=21, blocking=true) at /test/11.4_dbg/sql/sql_parse.cc:1904

#12 0x000055b873c05353 in do_command (thd=0x14df50000d58, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1417

#13 0x000055b873de75a9 in do_handle_one_connection (connect=0x55b878273c68, put_in_cache=true) at /test/11.4_dbg/sql/sql_connect.cc:1408

#14 0x000055b873de7342 in handle_one_connection (arg=0x55b8783440d8)at /test/11.4_dbg/sql/sql_connect.cc:1320

#15 0x000014dfa909ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#16 0x000014dfa9129c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

ASAN|heap-use-after-free|sql/table.h|TABLE::versioned|TABLE_LIST::print|print_table_array|print_join

CREATE FUNCTION f1() RETURNS INT RETURN (SELECT * FROM t1);

CREATE TABLE t1 (c1 INT,c2 INT) ENGINE=MEMORY UNION=(t3,t4) INSERT_METHOD=LAST;

INSERT INTO t1 VALUES (f1(),"max");

DROP TABLE t1;

SHOW FUNCTION CODE f1;

CREATE FUNCTION f0() RETURNS INT RETURN (SELECT * FROM t);

CREATE TABLE t (a INT);

CREATE TABLE t2 SELECT f0();

DROP TABLE IF EXISTS t;

SHOW FUNCTION f0;

==3332064==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000074998 at pc 0x55ce9f30a582 bp 0x151ed1b83ae0 sp 0x151ed1b83ad0

READ of size 8 at 0x619000074998 thread T22

    #0 0x55ce9f30a581 in TABLE::versioned() const /test/mtest/MDEV-5816/11.1_dbg_san/sql/table.h:1844

    #1 0x55ce9f30a581 in TABLE_LIST::print(THD*, unsigned long long, String*, enum_query_type) /test/mtest/MDEV-5816/11.1_dbg_san/sql/sql_select.cc:30721

    #2 0x55ce9f30c3c3 in print_table_array /test/mtest/MDEV-5816/11.1_dbg_san/sql/sql_select.cc:30403

    #3 0x55ce9f30c3c3 in print_join /test/mtest/MDEV-5816/11.1_dbg_san/sql/sql_select.cc:30559

    #4 0x55ce9f312f73 in st_select_lex::print(THD*, String*, enum_query_type) /test/mtest/MDEV-5816/11.1_dbg_san/sql/sql_select.cc:31072

    #5 0x55cea13f9958 in subselect_single_select_engine::print(String*, enum_query_type) /test/mtest/MDEV-5816/11.1_dbg_san/sql/item_subselect.cc:4668

    #6 0x55cea141cda9 in Item_subselect::print(String*, enum_query_type) /test/mtest/MDEV-5816/11.1_dbg_san/sql/item_subselect.cc:1081

    #7 0x55ce9ff262e8 in sp_instr_freturn::print(String*) /test/mtest/MDEV-5816/11.1_dbg_san/sql/sp_instr.cc:1402

    #8 0x55ce9e95fdb3 in sp_head::show_routine_code(THD*) /test/mtest/MDEV-5816/11.1_dbg_san/sql/sp_head.cc:3341

    #9 0x55ce9efa58f9 in mysql_execute_command(THD*, bool) /test/mtest/MDEV-5816/11.1_dbg_san/sql/sql_parse.cc:5543

    #10 0x55ce9eef2d8f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/mtest/MDEV-5816/11.1_dbg_san/sql/sql_parse.cc:7769

    #11 0x55ce9ef60edc in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/mtest/MDEV-5816/11.1_dbg_san/sql/sql_parse.cc:1892

    #12 0x55ce9ef72804 in do_command(THD*, bool) /test/mtest/MDEV-5816/11.1_dbg_san/sql/sql_parse.cc:1405

    #13 0x55ce9fa11c11 in do_handle_one_connection(CONNECT*, bool) /test/mtest/MDEV-5816/11.1_dbg_san/sql/sql_connect.cc:1416

    #14 0x55ce9fa1438b in handle_one_connection /test/mtest/MDEV-5816/11.1_dbg_san/sql/sql_connect.cc:1318

    #15 0x151ef5dd0608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477

    #16 0x151ef5045132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

# mysqld options in use during reduction: --sql_mode=ONLY_FULL_GROUP_BY --log-output=none --performance-schema --performance-schema-instrument='%=on' --default-tmp-storage-engine=MyISAM --innodb_file_per_table=1 --innodb_flush_method=O_DIRECT

USE test;

CREATE TEMPORARY TABLE t1 ( i int) ;

CREATE TABLE ti (a SMALLINT UNSIGNED NOT NULL, b BIGINT UNSIGNED, c BINARY(94), d VARCHAR(56), e VARBINARY(95) NOT NULL, f VARCHAR(58) NOT NULL, g LONGBLOB, h TINYBLOB NOT NULL, id BIGINT NOT NULL, KEY(b), KEY(e), PRIMARY KEY(id)) ;

CREATE TABLE  t2  (a BINARY(246));

CREATE TABLE t1 (a INT, b VARCHAR(20)) ;

create function f1() returns int deterministic return (select max(a) from  t4 );

CREATE TABLE  t4  (f1 INTEGER, PRIMARY KEY (f1)) ;

DROP TABLE t1;

SET @@global.table_open_cache = FALSE;

SELECT f1();

call mtr.add_suppression("Plugin keyring_vault reported");

SELECT EVENT_ID, EVENT_NAME, TIMER_WAIT FROM performance_schema.events_waits_history WHERE EVENT_NAME LIKE 'abcdefghijklmnopqrstuvwxyz';

UPDATE t1 SET field1 = 'abcdefghijklmnopqrstuvwxyz' WHERE field2 = 'abcdefghijklmnopqrstuvwxyz';

INSERT INTO ti VALUES (17667088284071814827,115,'abcdefghijklmnopqrstuvwxyz','abcdefghijklmnopqrstuvwxyz','abcdefghijklmnopqrstuvwxyz','abcdefghijklmnopqrstuvwxyz','abcdefghijklmnopqrstuvwxyz','abcdefghijklmnopqrstuvwxyz',10);

SELECT * FROM performance_schema.hosts;

INSERT INTO  t2  VALUES (-1340711133,14018,'abcdefghijklmnopqrstuvwxyz','abcdefghijklmnopqrstuvwxyz','abcdefghijklmnopqrstuvwxyz','abcdefghijklmnopqrstuvwxyz','abcdefghijklmnopqrstuvwxyz','abcdefghijklmnopqrstuvwxyz',4);

select * from t1 A, t1 B where B.rowkey=A.a;

show function code f1; ;

set innodb_default_encryption_key_id = 99;

USE test;

CREATE TABLE t1(c1 VARBINARY(30) NOT NULL, INDEX i1 (c1));

select SQL_CALC_FOUND_ROWS b,count(*) as c FROM t1  group by b order by c desc limit 1;

CREATE FUNCTION f1 () RETURNS int RETURN (SELECT COUNT(*) FROM t1 );

DROP TABLE IF EXISTS t1;

create TABLE t1 (c1 int) engine=InnoDB pack_keys=0;

INSERT INTO t VALUES (-2954245530716247387,3303582,'Fs0j8Aoxn9zWAkm4hJx8IMXQLF3KIryMiFyvWj','A0OosL','nY05l6MK6PKBLwvYA1vDzAjBzkjHxaOmzEPi4VMMwalMVQqZrFI2F12E2idYFD','Ryw','R','O',7);

select test.f1();

ALTER TABLE `t1` ADD COLUMN `b` INT;

SHOW FUNCTION CODE f1; ;

SELECT SLEEP(3);

mysqld: /test/10.4_dbg/sql/table.h:1680: bool TABLE::versioned() const: Assertion `s' failed.

Core was generated by `/test/MD110820-mariadb-10.4.15-linux-x86_64-dbg/bin/mysqld --no-defaults --max_'.

Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

[Current thread is 1 (Thread 0x147dc40b2700 (LWP 1029395))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

#1  0x00005581112a18a6 in my_write_core (sig=sig@entry=6) at /test/10.4_dbg/mysys/stacktrace.c:482

#2  0x0000558110a1dcdc in handle_fatal_signal (sig=6) at /test/10.4_dbg/sql/signal_handler.cc:343

#3  <signal handler called>

#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51

#5  0x0000147dcdbf88b1 in __GI_abort () at abort.c:79

#6  0x0000147dcdbe842a in __assert_fail_base (fmt=0x147dcdd6fa38 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55811167aba5 "s", file=file@entry=0x55811137b959 "/test/10.4_dbg/sql/table.h", line=line@entry=1680, function=function@entry=0x5581113a4d30 <_ZZNK5TABLE9versionedEvE19__PRETTY_FUNCTION__> "bool TABLE::versioned() const") at assert.c:92

#7  0x0000147dcdbe84a2 in __GI___assert_fail (assertion=assertion@entry=0x55811167aba5 "s", file=file@entry=0x55811137b959 "/test/10.4_dbg/sql/table.h", line=line@entry=1680, function=function@entry=0x5581113a4d30 <_ZZNK5TABLE9versionedEvE19__PRETTY_FUNCTION__> "bool TABLE::versioned() const") at assert.c:101

#8  0x00005581107d6562 in TABLE::versioned (this=0x147d5c5f0fc0) at /test/10.4_dbg/sql/table.h:1680

#9  TABLE_LIST::print (this=0x147d5c61d168, thd=thd@entry=0x147d5c000d50, eliminated_tables=eliminated_tables@entry=0, str=str@entry=0x147dc40ae9b0, query_type=query_type@entry=QT_ITEM_ORIGINAL_FUNC_NULLIF) at /test/10.4_dbg/sql/sql_select.cc:27360

#10 0x00005581107d6ab4 in print_table_array (query_type=QT_ITEM_ORIGINAL_FUNC_NULLIF, end=0x147d5c6bf390, table=0x147d5c6bf388, str=0x147dc40ae9b0, eliminated_tables=0, thd=0x147d5c000d50) at /test/10.4_dbg/sql/sql_select.cc:27050

#11 print_join (thd=thd@entry=0x147d5c000d50, eliminated_tables=0, str=str@entry=0x147dc40ae9b0, tables=0x147d5c61cc88, query_type=query_type@entry=QT_ITEM_ORIGINAL_FUNC_NULLIF) at /test/10.4_dbg/sql/sql_select.cc:27206

#12 0x00005581107d705e in st_select_lex::print (this=this@entry=0x147d5c61cac8, thd=0x147d5c000d50, str=str@entry=0x147dc40ae9b0, query_type=query_type@entry=QT_ITEM_ORIGINAL_FUNC_NULLIF) at /test/10.4_dbg/sql/sql_select.cc:27506

#13 0x0000558110b076da in subselect_single_select_engine::print (this=0x147d5c61d9d0, str=0x147dc40ae9b0, query_type=QT_ITEM_ORIGINAL_FUNC_NULLIF) at /test/10.4_dbg/sql/item_subselect.cc:4457

#14 0x0000558110b07c39 in Item_subselect::print (this=0x147d5c61d848, str=0x147dc40ae9b0, query_type=QT_ITEM_ORIGINAL_FUNC_NULLIF) at /test/10.4_dbg/sql/item_subselect.cc:1002

#15 0x00005581106a271a in sp_instr_freturn::print (this=0x147d5c61da10, str=0x147dc40ae9b0) at /test/10.4_dbg/sql/sp_head.cc:4112

#16 0x00005581106aca8a in sp_head::show_routine_code (this=0x147d5c61bdf8, thd=thd@entry=0x147d5c000d50) at /test/10.4_dbg/sql/sp_head.cc:3312

#17 0x0000558110772221 in mysql_execute_command (thd=thd@entry=0x147d5c000d50) at /test/10.4_dbg/sql/sql_parse.cc:5888

#18 0x0000558110775090 in mysql_parse (thd=thd@entry=0x147d5c000d50, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x147dc40b1470, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:7896

#19 0x0000558110777920 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x147d5c000d50, packet=packet@entry=0x147d5cd3d361 "", packet_length=packet_length@entry=22, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:1834

#20 0x000055811077b35b in do_command (thd=0x147d5c000d50) at /test/10.4_dbg/sql/sql_parse.cc:1352

#21 0x00005581108a78b6 in do_handle_one_connection (connect=connect@entry=0x558114a66560) at /test/10.4_dbg/sql/sql_connect.cc:1412

#22 0x00005581108a79d6 in handle_one_connection (arg=arg@entry=0x558114a66560) at /test/10.4_dbg/sql/sql_connect.cc:1316

#23 0x00005581111b4898 in pfs_spawn_thread (arg=0x558114974440) at /test/10.4_dbg/storage/perfschema/pfs.cc:1869

#24 0x0000147dceb5f6db in start_thread (arg=0x147dc40b2700) at pthread_create.c:463

#25 0x0000147dcdcd9a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

DROP DATABASE test;

CREATE DATABASE test;

USE test;

SET INNODB_DEFAULT_ENCRYPTION_KEY_ID=99;

CREATE TABLE t(c INT) ENGINE=InnoDB;

CREATE FUNCTION f() RETURNS INT RETURN (SELECT * FROM t);

SELECT f();

ALTER TABLE t ADD COLUMN d INT;

SHOW FUNCTION CODE f;