Server crash in subselect_single_select_engine::exec or Assertion `(st_select_lex*)join->select_lex == this' failed in st_select_lex::cleanup upon 2nd execution of PS with condition_pushdown_from_having on constant table

CREATE TABLE t1 (a CHAR(8)) ENGINE=MyISAM;

SET optimizer_switch='condition_pushdown_from_having=on';

SET character_set_connection= euckr;

PREPARE stmt FROM "SELECT a FROM t1 GROUP BY a HAVING a = (SELECT 'baz')";

EXECUTE stmt;

EXECUTE stmt;

# Cleanup

DEALLOCATE PREPARE stmt;

DROP TABLE t1;

#3  <signal handler called>

#4  0x000055bbb7e4f3bc in subselect_single_select_engine::exec (this=0x7f11300c6228) at /data/src/10.4/sql/item_subselect.cc:3851

#5  0x000055bbb7e4df3d in Item_subselect::exec (this=0x7f11300c60a0) at /data/src/10.4/sql/item_subselect.cc:746

#6  0x000055bbb7e4e5cf in Item_singlerow_subselect::val_str (this=0x7f11300c60a0, str=0x7f1130010db8) at /data/src/10.4/sql/item_subselect.cc:1356

#7  0x000055bbb7e35a5d in Item_func_conv_charset::val_str (this=0x7f1130010cf0, str=0x7f11412fd9e0) at /data/src/10.4/sql/item_strfunc.cc:3503

#8  0x000055bbb7cd7714 in Type_handler_string_result::Item_eq_value (this=<optimized out>, thd=<optimized out>, attr=0x7f11300115b8, a=<optimized out>, b=0x7f1130010cf0) at /data/src/10.4/sql/sql_type.cc:8014

#9  0x000055bbb7de624a in Item_equal::add_const (this=0x7f11300114f8, thd=<optimized out>, c=0x7f1130010cf0) at /data/src/10.4/sql/item_cmpfunc.cc:6627

#10 0x000055bbb7de655b in Item_equal::merge_with_check (this=this@entry=0x7f11300114f8, thd=thd@entry=0x7f11300009a8, item=0x7f11300114f8, save_merged=save_merged@entry=true) at /data/src/10.4/sql/item_cmpfunc.cc:6752

#11 0x000055bbb7bd0bb0 in propagate_new_equalities (thd=thd@entry=0x7f11300009a8, cond=cond@entry=0x7f11300114f8, new_equalities=0x7f11300116e8, inherited=inherited@entry=0x0, is_simplifiable_cond=is_simplifiable_cond@entry=0x7f11412fdcaf) at /data/src/10.4/sql/sql_select.cc:17086

#12 0x000055bbb7cb91e6 in and_new_conditions_to_optimized_cond (thd=0x7f11300009a8, cond=0x7f11300114f8, cond_eq=cond_eq@entry=0x7f1130010410, new_conds=..., cond_value=cond_value@entry=0x7f11300102e8) at /data/src/10.4/sql/opt_subselect.cc:5996

#13 0x000055bbb7bea7c5 in JOIN::optimize_inner (this=this@entry=0x7f113000ffd8) at /data/src/10.4/sql/sql_select.cc:2038

#14 0x000055bbb7bece83 in JOIN::optimize (this=this@entry=0x7f113000ffd8) at /data/src/10.4/sql/sql_select.cc:1610

#15 0x000055bbb7bed040 in mysql_select (thd=thd@entry=0x7f11300009a8, tables=0x7f11300c4a30, wild_num=0, fields=..., conds=<optimized out>, og_num=1, order=0x0, group=0x7f11300c5220, having=0x7f11300c6268, proc_param=0x0, select_options=2416184064, result=0x7f11300c6cc0, unit=0x7f11300c2918, select_lex=0x7f11300c4468) at /data/src/10.4/sql/sql_select.cc:4673

#16 0x000055bbb7beda36 in handle_select (thd=thd@entry=0x7f11300009a8, lex=lex@entry=0x7f11300c2858, result=result@entry=0x7f11300c6cc0, setup_tables_done_option=setup_tables_done_option@entry=0) at /data/src/10.4/sql/sql_select.cc:422

#17 0x000055bbb7a97afa in execute_sqlcom_select (thd=thd@entry=0x7f11300009a8, all_tables=0x7f11300c4a30) at /data/src/10.4/sql/sql_parse.cc:6355

#18 0x000055bbb7b91dfd in mysql_execute_command (thd=0x7f11300009a8) at /data/src/10.4/sql/sql_parse.cc:3889

#19 0x000055bbb7bad32d in Prepared_statement::execute (this=this@entry=0x7f11300758f8, expanded_query=expanded_query@entry=0x7f1141300680, open_cursor=open_cursor@entry=false) at /data/src/10.4/sql/sql_prepare.cc:4765

#20 0x000055bbb7bad432 in Prepared_statement::execute_loop (this=0x7f11300758f8, expanded_query=0x7f1141300680, open_cursor=<optimized out>, packet=<optimized out>, packet_end=<optimized out>) at /data/src/10.4/sql/sql_prepare.cc:4251

#21 0x000055bbb7bad6ef in mysql_sql_stmt_execute (thd=thd@entry=0x7f11300009a8) at /data/src/10.4/sql/sql_prepare.cc:3368

#22 0x000055bbb7b922fc in mysql_execute_command (thd=thd@entry=0x7f11300009a8) at /data/src/10.4/sql/sql_parse.cc:3905

#23 0x000055bbb7b98a8a in mysql_parse (thd=thd@entry=0x7f11300009a8, rawbuf=<optimized out>, length=12, parser_state=parser_state@entry=0x7f1141302580, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/src/10.4/sql/sql_parse.cc:7896

#24 0x000055bbb7b9ad49 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f11300009a8, packet=packet@entry=0x7f1130007a19 "EXECUTE stmt", packet_length=packet_length@entry=12, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/src/10.4/sql/sql_parse.cc:1835

#25 0x000055bbb7b9c506 in do_command (thd=0x7f11300009a8) at /data/src/10.4/sql/sql_parse.cc:1353

#26 0x000055bbb7c7a942 in do_handle_one_connection (connect=connect@entry=0x55bbbb7da778) at /data/src/10.4/sql/sql_connect.cc:1412

#27 0x000055bbb7c7a9fd in handle_one_connection (arg=arg@entry=0x55bbbb7da778) at /data/src/10.4/sql/sql_connect.cc:1316

#28 0x000055bbb82bb8c1 in pfs_spawn_thread (arg=0x55bbbb7da7d8) at /data/src/10.4/storage/perfschema/pfs.cc:1869

#29 0x00007f11483b04a4 in start_thread (arg=0x7f1141303700) at pthread_create.c:456

#30 0x00007f114742ed0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

mysqld: /data/src/10.4/sql/sql_union.cc:2069: bool st_select_lex::cleanup(): Assertion `(st_select_lex*)join->select_lex == this' failed.

200728 14:35:31 [ERROR] mysqld got signal 6 ;

#7  0x00007f6c54ed4f12 in __GI___assert_fail (assertion=0x55e752500698 "(st_select_lex*)join->select_lex == this", file=0x55e7525001d8 "/data/src/10.4/sql/sql_union.cc", line=2069, function=0x55e752501000 <st_select_lex::cleanup()::__PRETTY_FUNCTION__> "bool st_select_lex::cleanup()") at assert.c:101

#8  0x000055e7518ebde8 in st_select_lex::cleanup (this=0x7f6c34184e28) at /data/src/10.4/sql/sql_union.cc:2069

#9  0x000055e751c21faa in subselect_single_select_engine::prepare (this=0x7f6c34185cd0, thd=0x7f6c34000af0) at /data/src/10.4/sql/item_subselect.cc:3714

#10 0x000055e751c14e04 in Item_subselect::fix_fields (this=0x7f6c34185b48, thd_param=0x7f6c34000af0, ref=0x7f6c34185da8) at /data/src/10.4/sql/item_subselect.cc:283

#11 0x000055e7516c9897 in Item::fix_fields_if_needed (this=0x7f6c34185b48, thd=0x7f6c34000af0, ref=0x7f6c34185da8) at /data/src/10.4/sql/item.h:960

#12 0x000055e751bc0463 in Item_func::fix_fields (this=0x7f6c34185d10, thd=0x7f6c34000af0, ref=0x7f6c34013560) at /data/src/10.4/sql/item_func.cc:352

#13 0x000055e7516c9897 in Item::fix_fields_if_needed (this=0x7f6c34185d10, thd=0x7f6c34000af0, ref=0x7f6c34013560) at /data/src/10.4/sql/item.h:960

#14 0x000055e7516c98c5 in Item::fix_fields_if_needed_for_scalar (this=0x7f6c34185d10, thd=0x7f6c34000af0, ref=0x7f6c34013560) at /data/src/10.4/sql/item.h:964

#15 0x000055e75174e06d in Item::fix_fields_if_needed_for_bool (this=0x7f6c34185d10, thd=0x7f6c34000af0, ref=0x7f6c34013560) at /data/src/10.4/sql/item.h:968

#16 0x000055e751825f67 in JOIN::prepare (this=0x7f6c340133b0, tables_init=0x7f6c341844d8, wild_num=0, conds_init=0x0, og_num=1, order_init=0x0, skip_order_by=false, group_init=0x7f6c34184cc8, having_init=0x7f6c34185d10, proc_param_init=0x0, select_lex_arg=0x7f6c34183f10, unit_arg=0x7f6c341823c0) at /data/src/10.4/sql/sql_select.cc:1291

#17 0x000055e7518327b5 in mysql_select (thd=0x7f6c34000af0, tables=0x7f6c341844d8, wild_num=0, fields=..., conds=0x0, og_num=1, order=0x0, group=0x7f6c34184cc8, having=0x7f6c34185d10, proc_param=0x0, select_options=2416184064, result=0x7f6c34186768, unit=0x7f6c341823c0, select_lex=0x7f6c34183f10) at /data/src/10.4/sql/sql_select.cc:4650

#18 0x000055e75182242c in handle_select (thd=0x7f6c34000af0, lex=0x7f6c34182300, result=0x7f6c34186768, setup_tables_done_option=0) at /data/src/10.4/sql/sql_select.cc:422

#19 0x000055e7517e8ca4 in execute_sqlcom_select (thd=0x7f6c34000af0, all_tables=0x7f6c341844d8) at /data/src/10.4/sql/sql_parse.cc:6355

#20 0x000055e7517df2db in mysql_execute_command (thd=0x7f6c34000af0) at /data/src/10.4/sql/sql_parse.cc:3889

#21 0x000055e75180c9cc in Prepared_statement::execute (this=0x7f6c34132f70, expanded_query=0x7f6c4b057b50, open_cursor=false) at /data/src/10.4/sql/sql_prepare.cc:4765

#22 0x000055e75180ae2e in Prepared_statement::execute_loop (this=0x7f6c34132f70, expanded_query=0x7f6c4b057b50, open_cursor=false, packet=0x0, packet_end=0x0) at /data/src/10.4/sql/sql_prepare.cc:4251

#23 0x000055e751808902 in mysql_sql_stmt_execute (thd=0x7f6c34000af0) at /data/src/10.4/sql/sql_prepare.cc:3368

#24 0x000055e7517df320 in mysql_execute_command (thd=0x7f6c34000af0) at /data/src/10.4/sql/sql_parse.cc:3905

#25 0x000055e7517ecc51 in mysql_parse (thd=0x7f6c34000af0, rawbuf=0x7f6c34013198 "EXECUTE stmt", length=12, parser_state=0x7f6c4b058570, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:7896

#26 0x000055e7517d9186 in dispatch_command (command=COM_QUERY, thd=0x7f6c34000af0, packet=0x7f6c341364f1 "EXECUTE stmt", packet_length=12, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1835

#27 0x000055e7517d7928 in do_command (thd=0x7f6c34000af0) at /data/src/10.4/sql/sql_parse.cc:1353

#28 0x000055e751960afe in do_handle_one_connection (connect=0x55e754490ce0) at /data/src/10.4/sql/sql_connect.cc:1412

#29 0x000055e75196084d in handle_one_connection (arg=0x55e754490ce0) at /data/src/10.4/sql/sql_connect.cc:1316

#30 0x000055e752360a0d in pfs_spawn_thread (arg=0x55e7544ac900) at /data/src/10.4/storage/perfschema/pfs.cc:1869

#31 0x00007f6c56e5d4a4 in start_thread (arg=0x7f6c4b059700) at pthread_create.c:456

#32 0x00007f6c54f91d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

==3521==ERROR: AddressSanitizer: use-after-poison on address 0x62b000062d40 at pc 0x55915fe7f22d bp 0x7fd711f10250 sp 0x7fd711f10248

READ of size 8 at 0x62b000062d40 thread T5

    #0 0x55915fe7f22c in JOIN::destroy() /data/src/10.4/sql/sql_select.cc:4494

    #1 0x55915ff9e6e2 in st_select_lex::cleanup() /data/src/10.4/sql/sql_union.cc:2070

    #2 0x559160550d50 in subselect_single_select_engine::prepare(THD*) /data/src/10.4/sql/item_subselect.cc:3714

    #3 0x55916054f71c in Item_subselect::fix_fields(THD*, Item**) /data/src/10.4/sql/item_subselect.cc:283

    #4 0x559160479cbe in Item::fix_fields_if_needed(THD*, Item**) /data/src/10.4/sql/item.h:960

    #5 0x559160479cbe in Item_func::fix_fields(THD*, Item**) /data/src/10.4/sql/item_func.cc:352

    #6 0x55915fdef843 in Item::fix_fields_if_needed(THD*, Item**) /data/src/10.4/sql/item.h:960

    #7 0x55915fdef843 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /data/src/10.4/sql/item.h:964

    #8 0x55915fe9d14d in Item::fix_fields_if_needed_for_bool(THD*, Item**) /data/src/10.4/sql/item.h:968

    #9 0x55915fe9d14d in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/src/10.4/sql/sql_select.cc:1291

    #10 0x55915fed12fc in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4650

    #11 0x55915fed1b8f in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:422

    #12 0x55915fb3d0d0 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6355

    #13 0x55915fdcf70c in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3889

    #14 0x55915fe18ce7 in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:4765

    #15 0x55915fe192b3 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4251

    #16 0x55915fe19ba3 in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3368

    #17 0x55915fdd2138 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3905

    #18 0x55915fde5118 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7896

    #19 0x55915fdeb2ea in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1835

    #20 0x55915fdee986 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1353

    #21 0x5591600606e7 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412

    #22 0x55916006090a in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316

    #23 0x559161067833 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869

    #24 0x7fd71c9b44a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)

    #25 0x7fd71aae8d0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)

0x62b000062d40 is located 2880 bytes inside of 24608-byte region [0x62b000062200,0x62b000068220)

allocated by thread T5 here:

    #0 0x7fd71cc8bd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)

    #1 0x559161120efc in my_malloc /data/src/10.4/mysys/my_malloc.c:101

Thread T5 created by T0 here:

    #0 0x7fd71cbfaf59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)

    #1 0x55916106fab2 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919

SUMMARY: AddressSanitizer: use-after-poison /data/src/10.4/sql/sql_select.cc:4494 in JOIN::destroy()

Shadow bytes around the buggy address:

  0x0c5680004550: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004560: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004570: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004580: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004590: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

=>0x0c56800045a0: f7 f7 f7 f7 f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7

  0x0c56800045b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c56800045c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c56800045d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c56800045e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c56800045f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Heap right redzone:      fb

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack partial redzone:   f4

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==3521==ABORTING