Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28998

ASAN errors in spider_fields::free_conn_holder or spider_create_group_by_handler

    XMLWordPrintable

Details

    Description

      --source plugin/spider/spider/include/init_spider.inc
       
      SET spider_same_server_link = on;
      eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);
       
      CREATE TABLE t1 (a INT);
      INSERT INTO t1 VALUES (1),(2);
      CREATE TABLE t1_SPIDER (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't1'";
       
      CREATE TABLE t2 AS SELECT a FROM t1_SPIDER;
       
      # Cleanup
      DROP TABLE t2, t1_SPIDER, t1;
       
      --source plugin/spider/spider/include/deinit_spider.inc
      

      10.3 e34f8781

      ==4139841==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e00001ea10 at pc 0x7f7105e0a505 bp 0x7f7106159190 sp 0x7f7106159188
      WRITE of size 8 at 0x61e00001ea10 thread T5
          #0 0x7f7105e0a504 in spider_fields::free_conn_holder(spider_conn_holder*) /data/src/10.3/storage/spider/spd_group_by_handler.cc:862:54
          #1 0x7f7105e09e62 in spider_fields::~spider_fields() /data/src/10.3/storage/spider/spd_group_by_handler.cc:95:7
          #2 0x7f7105e0a7ab in spider_fields::~spider_fields() /data/src/10.3/storage/spider/spd_group_by_handler.cc:61:1
          #3 0x7f7105e1e710 in spider_group_by_handler::~spider_group_by_handler() /data/src/10.3/storage/spider/spd_group_by_handler.cc:1190:3
          #4 0x7f7105e1e8ab in spider_group_by_handler::~spider_group_by_handler() /data/src/10.3/storage/spider/spd_group_by_handler.cc:1188:1
          #5 0xd6ce31 in Pushdown_query::~Pushdown_query() /data/src/10.3/sql/sql_select.h:2469:23
          #6 0xcc89a1 in JOIN::cleanup(bool) /data/src/10.3/sql/sql_select.cc:13243:5
          #7 0xcc753f in JOIN::destroy() /data/src/10.3/sql/sql_select.cc:4177:3
          #8 0xef3d42 in st_select_lex::cleanup() /data/src/10.3/sql/sql_union.cc:2102:18
          #9 0xc328f1 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4366:29
          #10 0xc312d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372:10
          #11 0xea3fc3 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11400:20
          #12 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
          #13 0xb42226 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
          #14 0xb32dac in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
          #15 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
          #16 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
          #17 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
          #18 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
          #19 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8
          #20 0x7f7110b9adee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
       
      0x61e00001ea10 is located 2448 bytes inside of 2628-byte region [0x61e00001e080,0x61e00001eac4)
      freed by thread T5 here:
          #0 0x71c53d in free (/mnt8t/bld/10.3-asan/bin/mysqld+0x71c53d)
          #1 0x306d1c7 in free_memory /data/src/10.3/mysys/safemalloc.c:279:3
          #2 0x306d21d in sf_free /data/src/10.3/mysys/safemalloc.c:197:3
          #3 0x30252cf in my_free /data/src/10.3/mysys/my_malloc.c:223:5
          #4 0x7f7105bb854c in spider_free_mem(st_spider_transaction*, void*, unsigned long) /data/src/10.3/storage/spider/spd_malloc.cc:187:3
          #5 0x7f7105a7a1c1 in spider_free_conn(st_spider_conn*) /data/src/10.3/storage/spider/spd_conn.cc:1246:3
          #6 0x7f7105a79679 in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /data/src/10.3/storage/spider/spd_conn.cc:309:9
          #7 0x7f710596ecd0 in spider_free_trx_conn(st_spider_transaction*, bool) /data/src/10.3/storage/spider/spd_trx.cc:116:9
          #8 0x7f710599b02f in spider_commit(handlerton*, THD*, bool) /data/src/10.3/storage/spider/spd_trx.cc:3454:5
          #9 0x15a85a0 in commit_one_phase_2(THD*, bool, THD_TRANS*, bool) /data/src/10.3/sql/handler.cc:1658:17
          #10 0x15a8e56 in ha_commit_one_phase(THD*, bool) /data/src/10.3/sql/handler.cc:1638:8
          #11 0x15a6926 in ha_commit_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1500:12
          #12 0x10c6e19 in trans_commit_stmt(THD*) /data/src/10.3/sql/transaction.cc:506:10
          #13 0xaa1c85 in select_create::send_eof() /data/src/10.3/sql/sql_insert.cc:4760:5
          #14 0xe08373 in Pushdown_query::execute(JOIN*) /data/src/10.3/sql/group_by_handler.cc:126:50
          #15 0xcc52d4 in do_select(JOIN*, Procedure*) /data/src/10.3/sql/sql_select.cc:19331:36
          #16 0xcc28a5 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4151:50
          #17 0xcbf33e in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3945:3
          #18 0xc326ec in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4354:9
          #19 0xc312d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372:10
          #20 0xea3fc3 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11400:20
          #21 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
          #22 0xb42226 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
          #23 0xb32dac in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
          #24 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
          #25 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
          #26 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
          #27 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
          #28 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8
       
      previously allocated by thread T5 here:
          #0 0x71c7bd in malloc (/mnt8t/bld/10.3-asan/bin/mysqld+0x71c7bd)
          #1 0x306c180 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118:28
          #2 0x3024d4f in my_malloc /data/src/10.3/mysys/my_malloc.c:101:10
          #3 0x7f7105bb925e in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /data/src/10.3/storage/spider/spd_malloc.cc:235:29
          #4 0x7f7105a7b8bd in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:472:7
          #5 0x7f7105a829fb in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:1074:20
          #6 0x7f7105b2632c in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/src/10.3/storage/spider/spd_table.cc:5020:13
          #7 0x7f7105bf1b45 in ha_spider::open(char const*, int, unsigned int) /data/src/10.3/storage/spider/ha_spider.cc:359:8
          #8 0x15b2873 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2778:7
          #9 0xf6ae58 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3690:33
          #10 0x94ca65 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:2004:12
          #11 0x95a7d5 in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /data/src/10.3/sql/sql_base.cc:3731:14
          #12 0x956531 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4206:14
          #13 0x963998 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5146:7
          #14 0xeaf50f in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:495:10
          #15 0xea3957 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11348:10
          #16 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
          #17 0xb42226 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
          #18 0xb32dac in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
          #19 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
          #20 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
          #21 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
          #22 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
          #23 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8
       
      Thread T5 created by T0 here:
          #0 0x7071ea in pthread_create (/mnt8t/bld/10.3-asan/bin/mysqld+0x7071ea)
          #1 0x2e99b09 in spawn_thread_v1(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.3/storage/perfschema/pfs.cc:1919:15
          #2 0x757a1a in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.3/include/mysql/psi/mysql_thread.h:1275:11
          #3 0x769453 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668:15
          #4 0x76ac4a in create_new_thread(CONNECT*) /data/src/10.3/sql/mysqld.cc:6738:3
          #5 0x7689cd in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996:9
          #6 0x75b3de in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290:3
          #7 0x74ed61 in main /data/src/10.3/sql/main.cc:25:10
          #8 0x7f7110ac3d09 in __libc_start_main csu/../csu/libc-start.c:308:16
       
      SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/spider/spd_group_by_handler.cc:862:54 in spider_fields::free_conn_holder(spider_conn_holder*)
      Shadow bytes around the buggy address:
        0x0c3c7fffbcf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3c7fffbd00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3c7fffbd10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3c7fffbd20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3c7fffbd30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c3c7fffbd40: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3c7fffbd50: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
        0x0c3c7fffbd60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3c7fffbd70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3c7fffbd80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3c7fffbd90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==4139841==ABORTING
      

      Same test case, only t2 already exists; very different stack trace:

      --source plugin/spider/spider/include/init_spider.inc
       
      SET spider_same_server_link = on;
      eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);
       
      CREATE TABLE t1 (a INT);
      INSERT INTO t1 VALUES (1),(2);
      CREATE TABLE t1_SPIDER (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't1'";
       
      CREATE TABLE t2 (x INT);
      CREATE OR REPLACE TABLE t2 AS SELECT a FROM t1_SPIDER;
       
      # Cleanup
      DROP TABLE t2, t1_SPIDER, t1;
       
      --source plugin/spider/spider/include/deinit_spider.inc
      

      10.3 63137022

      ==620941==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c00004d95c at pc 0x7f5a73caf99f bp 0x7f5a73eefd20 sp 0x7f5a73eefd18
      READ of size 4 at 0x61c00004d95c thread T5
          #0 0x7f5a73caf99e in spider_create_group_by_handler(THD*, Query*) /data/src/10.3/storage/spider/spd_group_by_handler.cc:1964
          #1 0x55c848e0d039 in JOIN::make_aggr_tables_info() /data/src/10.3/sql/sql_select.cc:2927
          #2 0x55c848e2c971 in JOIN::optimize_stage2() /data/src/10.3/sql/sql_select.cc:2697
          #3 0x55c848e367da in JOIN::optimize_inner() /data/src/10.3/sql/sql_select.cc:2003
          #4 0x55c848e3d741 in JOIN::optimize() /data/src/10.3/sql/sql_select.cc:1519
          #5 0x55c848e45b58 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4340
          #6 0x55c848e465ff in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372
          #7 0x55c848f0cd96 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11399
          #8 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
          #9 0x55c848d045d7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
          #10 0x55c848d09119 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
          #11 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
          #12 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #13 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #14 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
          #15 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477
          #16 0x7f5a7e840dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)
       
      0x61c00004d95c is located 220 bytes inside of 1880-byte region [0x61c00004d880,0x61c00004dfd8)
      freed by thread T5 here:
          #0 0x7f5a7f1b2b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
          #1 0x7f5a73be9811 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /data/src/10.3/storage/spider/spd_malloc.cc:187
          #2 0x7f5a73b4ebf0 in spider_free_conn(st_spider_conn*) /data/src/10.3/storage/spider/spd_conn.cc:1246
          #3 0x7f5a73b4f28f in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /data/src/10.3/storage/spider/spd_conn.cc:286
          #4 0x7f5a73ae5293 in spider_free_trx_conn(st_spider_transaction*, bool) /data/src/10.3/storage/spider/spd_trx.cc:116
          #5 0x7f5a73af5152 in spider_rollback(handlerton*, THD*, bool) /data/src/10.3/storage/spider/spd_trx.cc:3527
          #6 0x55c8493415d2 in ha_rollback_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1765
          #7 0x55c8490595ba in trans_rollback_stmt(THD*) /data/src/10.3/sql/transaction.cc:569
          #8 0x55c848f07aee in create_table_impl /data/src/10.3/sql/sql_table.cc:5025
          #9 0x55c848f0889b in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/src/10.3/sql/sql_table.cc:5239
          #10 0x55c848c53d30 in select_create::create_table_from_items(THD*, List<Item>*, st_mysql_lock**, TABLEOP_HOOKS*) /data/src/10.3/sql/sql_insert.cc:4352
          #11 0x55c848c54a97 in select_create::prepare(List<Item>&, st_select_lex_unit*) /data/src/10.3/sql/sql_insert.cc:4543
          #12 0x55c848e03c0b in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/src/10.3/sql/sql_select.cc:1407
          #13 0x55c848e45b41 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4332
          #14 0x55c848e465ff in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372
          #15 0x55c848f0cd96 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11399
          #16 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
          #17 0x55c848d045d7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
          #18 0x55c848d09119 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
          #19 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
          #20 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #21 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #22 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
          #23 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477
       
      previously allocated by thread T5 here:
          #0 0x7f5a7f1b2e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
          #1 0x55c84a344462 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
          #2 0x7f5a73be9b3b in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /data/src/10.3/storage/spider/spd_malloc.cc:235
          #3 0x7f5a73b612d6 in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:472
          #4 0x7f5a73b6689e in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:1074
          #5 0x7f5a73bb9662 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/src/10.3/storage/spider/spd_table.cc:5020
          #6 0x7f5a73c05504 in ha_spider::open(char const*, int, unsigned int) /data/src/10.3/storage/spider/ha_spider.cc:359
          #7 0x55c84934692f in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2778
          #8 0x55c848f9df74 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3690
          #9 0x55c848bacd8f in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:2004
          #10 0x55c848bb5eb9 in open_and_process_table /data/src/10.3/sql/sql_base.cc:3731
          #11 0x55c848bb5eb9 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4206
          #12 0x55c848bb7b9e in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5146
          #13 0x55c848f0ca66 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:495
          #14 0x55c848f0ca66 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11347
          #15 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
          #16 0x55c848d045d7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
          #17 0x55c848d09119 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
          #18 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
          #19 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #20 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #21 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
          #22 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477
       
      Thread T5 created by T0 here:
          #0 0x7f5a7f15e2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
          #1 0x55c84a27774a in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
          #2 0x55c848a9bf3b in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
          #3 0x55c848a9bf3b in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668
          #4 0x55c848aac24d in create_new_thread /data/src/10.3/sql/mysqld.cc:6738
          #5 0x55c848aac24d in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996
          #6 0x55c848aae1f5 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290
          #7 0x7f5a7e769d09 in __libc_start_main ../csu/libc-start.c:308
       
      SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/spider/spd_group_by_handler.cc:1964 in spider_create_group_by_handler(THD*, Query*)
      Shadow bytes around the buggy address:
        0x0c3880001ad0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3880001ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3880001af0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
        0x0c3880001b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3880001b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c3880001b20: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
        0x0c3880001b30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3880001b40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3880001b50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3880001b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c3880001b70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==620941==ABORTING
      

      This one also crashes on a non-ASAN build.

      Attachments

        Issue Links

          Activity

            People

              ycp Yuchen Pei
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.