Assertion `marked_for_read()' failed in Field_long::val_str (and other types) on nested SELECT, ASAN heap-use-after-free in Item_field::print

SET SESSION optimizer_trace="enabled=on";

CREATE TABLE t1 (i INT) ENGINE=InnoDB;

CREATE TABLE t2 (c INT) ENGINE=MyISAM;

INSERT INTO t2 VALUES (1);

SELECT 1 FROM (SELECT 1 IN (SELECT 1 FROM t1 WHERE (SELECT 1 FROM t2 HAVING c)) FROM t2) AS z;

mysqld: /test/10.6_dbg/sql/field.cc:4417: virtual String* Field_long::val_str(String*, String*): Assertion `marked_for_read()' failed.

Core was generated by `/test/MD010121-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

[Current thread is 1 (Thread 0x14dea40a3700 (LWP 1993186))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x0000559e04f4f0d7 in my_write_core (sig=sig@entry=6) at /test/10.6_dbg/mysys/stacktrace.c:424

#2  0x0000559e046e3ab1 in handle_fatal_signal (sig=6) at /test/10.6_dbg/sql/signal_handler.cc:330

#3  <signal handler called>

#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

#5  0x000014dea5e63859 in __GI_abort () at abort.c:79

#6  0x000014dea5e63729 in __assert_fail_base (fmt=0x14dea5ff9588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x559e052388dc "marked_for_read()", file=0x559e052386c3 "/test/10.6_dbg/sql/field.cc", line=4417, function=<optimized out>) at assert.c:92

#7  0x000014dea5e74f36 in __GI___assert_fail (assertion=assertion@entry=0x559e052388dc "marked_for_read()", file=file@entry=0x559e052386c3 "/test/10.6_dbg/sql/field.cc", line=line@entry=4417, function=function@entry=0x559e0523b238 "virtual String* Field_long::val_str(String*, String*)") at assert.c:101

#8  0x0000559e046bd20b in Field_long::val_str (this=0x14de54077218, val_buffer=0x14dea40a0dc0, val_ptr=<optimized out>) at /test/10.6_dbg/sql/field.cc:4417

#9  0x0000559e04705ab9 in Item_field::val_str (this=0x14de5407b1e8, str=0x14dea40a0dc0) at /test/10.6_dbg/sql/item.cc:3245

#10 0x0000559e047118c9 in Item::print_value (this=0x14de5407b1e8, str=0x14dea40a1300) at /test/10.6_dbg/sql/item.cc:516

#11 0x0000559e04711b03 in Item_field::print (this=<optimized out>, str=<optimized out>, query_type=<optimized out>) at /test/10.6_dbg/sql/item.cc:7661

#12 0x0000559e04711682 in Item::print_parenthesised (this=this@entry=0x14de5407b1e8, str=str@entry=0x14dea40a1300, query_type=query_type@entry=1033, parent_prec=CMP_PRECEDENCE) at /test/10.6_dbg/sql/item.cc:486

#13 0x0000559e04787579 in Item_func::print_op (this=0x14de54014c38, str=0x14dea40a1300, query_type=1033) at /test/10.6_dbg/sql/item_func.cc:638

#14 0x0000559e04752d9f in Item_bool_rowready_func2::print (this=<optimized out>, str=<optimized out>, query_type=<optimized out>) at /test/10.6_dbg/sql/item_cmpfunc.h:524

#15 0x0000559e0449255d in st_select_lex::print (this=0x14de54013e38, thd=thd@entry=0x14de54000db8, str=str@entry=0x14dea40a1300, query_type=query_type@entry=1033) at /test/10.6_dbg/sql/sql_select.cc:27735

#16 0x0000559e047f1a54 in subselect_single_select_engine::print (this=0x14de54015830, str=0x14dea40a1300, query_type=1033) at /test/10.6_dbg/sql/item_subselect.cc:4495

#17 0x0000559e047f1fc9 in Item_subselect::print (this=0x14de54015688, str=0x14dea40a1300, query_type=1033) at /test/10.6_dbg/sql/item_subselect.cc:1038

#18 0x0000559e046406d9 in Json_writer::add_str (this=this@entry=0x14de54070510, item=item@entry=0x14de54015688) at /test/10.6_dbg/sql/opt_trace.cc:697

#19 0x0000559e04453403 in Json_value_helper::add_str (item=0x14de54015688, this=<synthetic pointer>) at /test/10.6_dbg/sql/my_json_writer.h:454

#20 Json_writer_object::add (value=0x14de54015688, name=0x559e050c5b1e "original_condition", this=<synthetic pointer>) at /test/10.6_dbg/sql/my_json_writer.h:454

#21 optimize_cond (join=join@entry=0x14de5407a600, conds=0x14de54015688, join_list=0x14de540133c8, ignore_on_conds=ignore_on_conds@entry=false, cond_value=cond_value@entry=0x14de5407a918, cond_equal=cond_equal@entry=0x14de5407aa40, flags=1) at /test/10.6_dbg/sql/sql_select.cc:17002

#22 0x0000559e0449e345 in JOIN::optimize_inner (this=this@entry=0x14de5407a600) at /test/10.6_dbg/sql/sql_select.cc:1995

#23 0x0000559e0449f06c in JOIN::optimize (this=this@entry=0x14de5407a600) at /test/10.6_dbg/sql/sql_select.cc:1627

#24 0x0000559e043e7517 in st_select_lex::optimize_unflattened_subqueries (this=0x14de540127e0, const_only=const_only@entry=false) at /test/10.6_dbg/sql/sql_lex.cc:4852

#25 0x0000559e045d84cb in JOIN::optimize_unflattened_subqueries (this=this@entry=0x14de54079b10) at /test/10.6_dbg/sql/opt_subselect.cc:5555

#26 0x0000559e0449c554 in JOIN::optimize_stage2 (this=this@entry=0x14de54079b10) at /test/10.6_dbg/sql/sql_select.cc:2826

#27 0x0000559e0449ee3b in JOIN::optimize_inner (this=this@entry=0x14de54079b10) at /test/10.6_dbg/sql/sql_select.cc:2277

#28 0x0000559e0449f06c in JOIN::optimize (this=this@entry=0x14de54079b10) at /test/10.6_dbg/sql/sql_select.cc:1627

#29 0x0000559e0449f9ba in mysql_select (thd=thd@entry=0x14de54000db8, tables=0x14de540172c8, fields=@0x14de54012930: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14de54012ce8, last = 0x14de54012ce8, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x14de54018350, unit=0x14de54004f80, select_lex=0x14de540127e0) at /test/10.6_dbg/sql/sql_select.cc:4654

#30 0x0000559e0449fcd0 in handle_select (thd=thd@entry=0x14de54000db8, lex=lex@entry=0x14de54004eb8, result=result@entry=0x14de54018350, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_dbg/sql/sql_select.cc:417

#31 0x0000559e0441219d in execute_sqlcom_select (thd=thd@entry=0x14de54000db8, all_tables=0x14de540172c8) at /test/10.6_dbg/sql/sql_parse.cc:6116

#32 0x0000559e0441ec7c in mysql_execute_command (thd=thd@entry=0x14de54000db8) at /test/10.6_dbg/sql/sql_parse.cc:3820

#33 0x0000559e0440b072 in mysql_parse (thd=thd@entry=0x14de54000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14dea40a23d0) at /test/10.6_dbg/sql/sql_parse.cc:7881

#34 0x0000559e044191ec in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14de54000db8, packet=packet@entry=0x14de54008d39 "SELECT 1 FROM (SELECT 1 IN (SELECT 1 FROM t1 WHERE (SELECT 1 FROM t2 HAVING c)) FROM t2) AS z", packet_length=packet_length@entry=93) at /test/10.6_dbg/sql/sql_class.h:1293

#35 0x0000559e0441c52d in do_command (thd=0x14de54000db8) at /test/10.6_dbg/sql/sql_parse.cc:1348

#36 0x0000559e045787fc in do_handle_one_connection (connect=<optimized out>, connect@entry=0x559e07d5e9a8, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410

#37 0x0000559e04578f03 in handle_one_connection (arg=arg@entry=0x559e07d5e9a8) at /test/10.6_dbg/sql/sql_connect.cc:1312

#38 0x0000559e04a2e88f in pfs_spawn_thread (arg=0x559e07c86898) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201

#39 0x000014dea6371609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#40 0x000014dea5f60293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95