Unexpected ER_DUP_KEY, ASAN errors, double free detected in tcache with JSON_HB histogram

SET histogram_type= JSON_HB;

CREATE TABLE t (pk INT AUTO_INCREMENT, f VARCHAR(8), PRIMARY KEY (pk));

INSERT INTO t (f) VALUES ('foo');

ANALYZE TABLE t PERSISTENT FOR ALL;

ALTER TABLE t MODIFY f TEXT, ORDER BY pk;

INSERT INTO t (f) VALUES ('bar');

query 'INSERT INTO t (f) VALUES ('bar')' failed: ER_DUP_ENTRY (1062): Duplicate entry '1' for key 'PRIMARY'

--source include/have_innodb.inc

SET histogram_type= JSON_HB;

CREATE TABLE t (pk INT AUTO_INCREMENT, f VARCHAR(8), PRIMARY KEY (pk));

INSERT INTO t (f) VALUES ('foo');

ANALYZE TABLE t PERSISTENT FOR ALL;

ALTER TABLE t MODIFY f TEXT, ORDER BY pk;

--error ER_DUP_ENTRY

INSERT INTO t (f) VALUES ('bar');

SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE='SEQUENCE';

SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE='SEQUENCE';

==1697104==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e0000310b8 at pc 0x55cd9f878ac2 bp 0x7fbf54ee6280 sp 0x7fbf54ee6270

READ of size 8 at 0x60e0000310b8 thread T20

    #0 0x55cd9f878ac1 in my_free /data/src/preview-10.7-MDEV-26519-json-histograms-asan/mysys/my_malloc.c:198

    #1 0x55cd9d888a41 in Binary_string::free_buffer() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_string.h:227

    #2 0x55cd9d888e4d in Binary_string::free() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_string.h:675

    #3 0x55cd9d888ca9 in Binary_string::~Binary_string() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_string.h:271

    #4 0x55cd9d889105 in String::~String() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_string.h:787

    #5 0x55cd9e2b5b64 in Field_blob::~Field_blob() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/field.h:4355

    #6 0x55cd9e2b5b8f in Field_blob::~Field_blob() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/field.h:4355

    #7 0x55cd9dfd4731 in closefrm(TABLE*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/table.cc:4439

    #8 0x55cd9de36179 in fill_schema_table_from_frm /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_show.cc:5070

    #9 0x55cd9de379e6 in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_show.cc:5301

    #10 0x55cd9de6aa42 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_show.cc:8830

    #11 0x55cd9dd3b956 in JOIN::exec_inner() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_select.cc:4692

    #12 0x55cd9dd396ef in JOIN::exec() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_select.cc:4513

    #13 0x55cd9dd3dc4a in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_select.cc:4991

    #14 0x55cd9dd0e0ac in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_select.cc:545

    #15 0x55cd9dc3b177 in execute_sqlcom_select /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:6253

    #16 0x55cd9dc29c5c in mysql_execute_command(THD*, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:3944

    #17 0x55cd9dc4645f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:8029

    #18 0x55cd9dc1c514 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:1894

    #19 0x55cd9dc19238 in do_command(THD*, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:1402

    #20 0x55cd9e0b3080 in do_handle_one_connection(CONNECT*, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_connect.cc:1418

    #21 0x55cd9e0b290c in handle_one_connection /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_connect.cc:1312

    #22 0x55cd9ec50484 in pfs_spawn_thread /data/src/preview-10.7-MDEV-26519-json-histograms-asan/storage/perfschema/pfs.cc:2201

    #23 0x7fbf68874608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

    #24 0x7fbf68447292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x60e0000310b8 is located 120 bytes inside of 148-byte region [0x60e000031040,0x60e0000310d4)

freed by thread T20 here:

    #0 0x7fbf68f827cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)

    #1 0x55cd9f8abdb1 in free_memory /data/src/preview-10.7-MDEV-26519-json-histograms-asan/mysys/safemalloc.c:297

    #2 0x55cd9f8ab1ee in sf_free /data/src/preview-10.7-MDEV-26519-json-histograms-asan/mysys/safemalloc.c:203

    #3 0x55cd9f878bfa in my_free /data/src/preview-10.7-MDEV-26519-json-histograms-asan/mysys/my_malloc.c:211

    #4 0x55cd9d888a41 in Binary_string::free_buffer() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_string.h:227

    #5 0x55cd9d888e4d in Binary_string::free() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_string.h:675

    #6 0x55cd9d888ca9 in Binary_string::~Binary_string() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_string.h:271

    #7 0x55cd9d889105 in String::~String() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_string.h:787

    #8 0x55cd9e2b5b64 in Field_blob::~Field_blob() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/field.h:4355

    #9 0x55cd9e2b5b8f in Field_blob::~Field_blob() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/field.h:4355

    #10 0x55cd9dfd4731 in closefrm(TABLE*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/table.cc:4439

    #11 0x55cd9de36179 in fill_schema_table_from_frm /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_show.cc:5070

    #12 0x55cd9de379e6 in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_show.cc:5301

    #13 0x55cd9de6aa42 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_show.cc:8830

    #14 0x55cd9dd3b956 in JOIN::exec_inner() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_select.cc:4692

    #15 0x55cd9dd396ef in JOIN::exec() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_select.cc:4513

    #16 0x55cd9dd3dc4a in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_select.cc:4991

    #17 0x55cd9dd0e0ac in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_select.cc:545

    #18 0x55cd9dc3b177 in execute_sqlcom_select /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:6253

    #19 0x55cd9dc29c5c in mysql_execute_command(THD*, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:3944

    #20 0x55cd9dc4645f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:8029

    #21 0x55cd9dc1c514 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:1894

    #22 0x55cd9dc19238 in do_command(THD*, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:1402

    #23 0x55cd9e0b3080 in do_handle_one_connection(CONNECT*, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_connect.cc:1418

    #24 0x55cd9e0b290c in handle_one_connection /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_connect.cc:1312

    #25 0x55cd9ec50484 in pfs_spawn_thread /data/src/preview-10.7-MDEV-26519-json-histograms-asan/storage/perfschema/pfs.cc:2201

    #26 0x7fbf68874608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

previously allocated by thread T20 here:

    #0 0x7fbf68f82bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)

    #1 0x55cd9f8aaba2 in sf_malloc /data/src/preview-10.7-MDEV-26519-json-histograms-asan/mysys/safemalloc.c:126

    #2 0x55cd9f877dd4 in my_malloc /data/src/preview-10.7-MDEV-26519-json-histograms-asan/mysys/my_malloc.c:90

    #3 0x55cd9debfe3f in Binary_string::real_alloc(unsigned long) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_string.cc:45

    #4 0x55cd9d94bdc4 in Binary_string::alloc(unsigned long) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_string.h:698

    #5 0x55cd9e470d33 in Field_blob::store(char const*, unsigned long, charset_info_st const*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/field.cc:8642

    #6 0x55cd9e06d608 in Field::store_text(char const*, unsigned long, charset_info_st const*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/field.h:936

    #7 0x55cd9e19cc8a in Histogram_json_hb::parse(st_mem_root*, Field*, enum_histogram_type, char const*, unsigned long) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/opt_histogram_json.cc:498

    #8 0x55cd9deb9e8e in Column_stat::load_histogram(st_mem_root*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_statistics.cc:1235

    #9 0x55cd9dead7ac in read_histograms_for_table /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_statistics.cc:3188

    #10 0x55cd9deae7d8 in read_statistics_for_tables(THD*, TABLE_LIST*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_statistics.cc:3325

    #11 0x55cd9deada98 in read_statistics_for_tables_if_needed(THD*, TABLE_LIST*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_statistics.cc:3234

    #12 0x55cd9da87d9d in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_base.cc:5276

    #13 0x55cd9d9e04ef in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_base.h:509

    #14 0x55cd9db61acc in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_insert.cc:758

    #15 0x55cd9dc2dc0e in mysql_execute_command(THD*, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:4563

    #16 0x55cd9dc4645f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:8029

    #17 0x55cd9dc1c514 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:1894

    #18 0x55cd9dc19238 in do_command(THD*, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_parse.cc:1402

    #19 0x55cd9e0b3080 in do_handle_one_connection(CONNECT*, bool) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_connect.cc:1418

    #20 0x55cd9e0b290c in handle_one_connection /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/sql_connect.cc:1312

    #21 0x55cd9ec50484 in pfs_spawn_thread /data/src/preview-10.7-MDEV-26519-json-histograms-asan/storage/perfschema/pfs.cc:2201

    #22 0x7fbf68874608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

Thread T20 created by T0 here:

    #0 0x7fbf68eaf805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)

    #1 0x55cd9ec4b43a in my_thread_create /data/src/preview-10.7-MDEV-26519-json-histograms-asan/storage/perfschema/my_thread.h:48

    #2 0x55cd9ec50877 in pfs_spawn_thread_v1 /data/src/preview-10.7-MDEV-26519-json-histograms-asan/storage/perfschema/pfs.cc:2252

    #3 0x55cd9d863e18 in inline_mysql_thread_create /data/src/preview-10.7-MDEV-26519-json-histograms-asan/include/mysql/psi/mysql_thread.h:1139

    #4 0x55cd9d87bb9e in create_thread_to_handle_connection(CONNECT*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/mysqld.cc:5952

    #5 0x55cd9d87c21a in create_new_thread(CONNECT*) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/mysqld.cc:6011

    #6 0x55cd9d87c587 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/mysqld.cc:6073

    #7 0x55cd9d87cf85 in handle_connections_sockets() /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/mysqld.cc:6197

    #8 0x55cd9d87b39a in mysqld_main(int, char**) /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/mysqld.cc:5847

    #9 0x55cd9d86313c in main /data/src/preview-10.7-MDEV-26519-json-histograms-asan/sql/main.cc:34

    #10 0x7fbf6834c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/preview-10.7-MDEV-26519-json-histograms-asan/mysys/my_malloc.c:198 in my_free

Shadow bytes around the buggy address:

  0x0c1c7fffe1c0: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa

  0x0c1c7fffe1d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c1c7fffe1e0: 00 00 04 fa fa fa fa fa fa fa fa fa 00 00 00 00

  0x0c1c7fffe1f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa

  0x0c1c7fffe200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

=>0x0c1c7fffe210: fd fd fd fd fd fd fd[fd]fd fd fd fa fa fa fa fa

  0x0c1c7fffe220: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c1c7fffe230: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa

  0x0c1c7fffe240: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c1c7fffe250: fd fd fd fd fa fa fa fa fa fa fa fa fd fd fd fd

  0x0c1c7fffe260: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

free(): double free detected in tcache 2

211026 22:43:40 [ERROR] mysqld got signal 6 ;

This could be because you hit a bug. It is also possible that this binary

or one of the libraries it was linked against is corrupt, improperly built,

or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help

diagnose the problem, but since we have already crashed, 

something is definitely wrong and this may fail.

Server version: 10.7.0-MariaDB-log

key_buffer_size=1048576

read_buffer_size=131072

max_used_connections=1

max_threads=153

thread_count=1

It is possible that mysqld could use up to 

key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63731 K  bytes of memory

Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x7f6df8000c58

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x7f6e2ca7cd98 thread_stack 0x49000

mysys/stacktrace.c:213(my_print_stacktrace)[0x55939326cf52]

sql/signal_handler.cc:226(handle_fatal_signal)[0x559392dba995]

sigaction.c:0(__restore_rt)[0x7f6e33d403c0]

??:0(gsignal)[0x7f6e3382b18b]

??:0(abort)[0x7f6e3380a859]

??:0(__fsetlocking)[0x7f6e338753ee]

??:0(pthread_attr_setschedparam)[0x7f6e3387d47c]

??:0(pthread_attr_setschedparam)[0x7f6e3387f0ed]

sql/field.h:4355(Field_blob::~Field_blob())[0x559392db126f]

sql/table.cc:4437(closefrm(TABLE*))[0x559392c6981a]

sql/sql_show.cc:5070(get_all_tables(THD*, TABLE_LIST*, Item*))[0x559392c1bb5f]

sql/sql_show.cc:8830(get_schema_tables_result(JOIN*, enum_schema_table_state))[0x559392c1c86e]

sql/sql_select.cc:4691(JOIN::exec_inner())[0x559392c004ff]

sql/sql_select.cc:4514(JOIN::exec())[0x559392c00cb2]

sql/sql_select.cc:4993(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x559392bfee1a]

sql/sql_select.cc:545(handle_select(THD*, LEX*, select_result*, unsigned long))[0x559392bff5e7]

sql/sql_parse.cc:6253(execute_sqlcom_select(THD*, TABLE_LIST*))[0x559392b85fe1]

sql/sql_parse.cc:3944(mysql_execute_command(THD*, bool))[0x559392b93f1f]

sql/sql_parse.cc:8046(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x559392b810f3]

sql/sql_parse.cc:1896(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x559392b8d0fd]

sql/sql_parse.cc:1404(do_command(THD*, bool))[0x559392b8f008]

sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x559392ca2197]

sql/sql_connect.cc:1312(handle_one_connection)[0x559392ca24cd]

perfschema/pfs.cc:2204(pfs_spawn_thread)[0x559392fac7fd]

nptl/pthread_create.c:478(start_thread)[0x7f6e33d34609]

??:0(clone)[0x7f6e33907293]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x7f6df8010890): SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE='SEQUENCE'

Connection ID (thread ID): 4

Status: NOT_KILLED