ASAN errors in spider_conn_queue_and_merge_loop_check

--source plugin/spider/spider/include/init_spider.inc

SET spider_same_server_link= on;

eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);

CREATE TABLE t (a INT);

CREATE TABLE t1_spider (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't'";

CREATE TABLE t2_spider (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't'";

SELECT * FROM t1_spider, t2_spider;

SELECT table_name, index_name, cardinality FROM INFORMATION_SCHEMA.STATISTICS WHERE table_name IN ('t1_spider','t2_spider');

RENAME TABLE t1_spider TO t3_spider;

SELECT * FROM t3_spider;

# Cleanup

DROP TABLE t3_spider, t2_spider, t;

--source plugin/spider/spider/include/deinit_spider.inc

==3280==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000025b48 at pc 0x7f41c82328e8 bp 0x7f41c8b068b0 sp 0x7f41c8b068a8

WRITE of size 8 at 0x614000025b48 thread T5

    #0 0x7f41c82328e7 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /data/src/10.5/storage/spider/spd_conn.cc:1763:43

    #1 0x7f41c822b2e3 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /data/src/10.5/storage/spider/spd_conn.cc:2038:20

    #2 0x7f41c822584e in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.5/storage/spider/spd_conn.cc:1373:9

    #3 0x7f41c82d6534 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/src/10.5/storage/spider/spd_table.cc:5350:13

    #4 0x7f41c83b3d36 in ha_spider::open(char const*, int, unsigned int) /data/src/10.5/storage/spider/ha_spider.cc:444:18

    #5 0x180128c in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.5/sql/handler.cc:3013:7

    #6 0x117a570 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.5/sql/table.cc:4322:33

    #7 0xada623 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.5/sql/sql_base.cc:2014:12

    #8 0xae9aea in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /data/src/10.5/sql/sql_base.cc:3805:14

    #9 0xae5777 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:4288:14

    #10 0xaf3ab8 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:5235:7

    #11 0xa01153 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.5/sql/sql_base.h:507:10

    #12 0xd3568f in execute_sqlcom_select(THD*, TABLE_LIST*) /data/src/10.5/sql/sql_parse.cc:6235:14

    #13 0xd1ad80 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4005:12

    #14 0xd01ae2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8100:18

    #15 0xcf9d4d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891:7

    #16 0xd04374 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375:17

    #17 0x12ad9ef in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1418:11

    #18 0x12acf73 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312:5

    #19 0x23b95f7 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201:3

    #20 0x7f41d208bea6 in start_thread nptl/pthread_create.c:477:8

    #21 0x7f41d1dc3dee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x614000025b48 is located 264 bytes inside of 436-byte region [0x614000025a40,0x614000025bf4)

freed by thread T5 here:

    #0 0x89b3ed in free (/mnt8t/bld/10.5-asan/bin/mariadbd+0x89b3ed)

    #1 0x3484847 in free_memory /data/src/10.5/mysys/safemalloc.c:280:3

    #2 0x348489d in sf_free /data/src/10.5/mysys/safemalloc.c:198:3

    #3 0x343cf38 in my_free /data/src/10.5/mysys/my_malloc.c:211:3

    #4 0x7f41c837472c in spider_free_mem(st_spider_transaction*, void*, unsigned long) /data/src/10.5/storage/spider/spd_malloc.cc:188:3

    #5 0x7f41c823261b in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /data/src/10.5/storage/spider/spd_conn.cc:1735:5

    #6 0x7f41c822b2e3 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /data/src/10.5/storage/spider/spd_conn.cc:2038:20

    #7 0x7f41c822584e in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.5/storage/spider/spd_conn.cc:1373:9

    #8 0x7f41c82d6534 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/src/10.5/storage/spider/spd_table.cc:5350:13

    #9 0x7f41c83b3d36 in ha_spider::open(char const*, int, unsigned int) /data/src/10.5/storage/spider/ha_spider.cc:444:18

    #10 0x180128c in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.5/sql/handler.cc:3013:7

    #11 0x117a570 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.5/sql/table.cc:4322:33

    #12 0xada623 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.5/sql/sql_base.cc:2014:12

    #13 0xae9aea in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /data/src/10.5/sql/sql_base.cc:3805:14

    #14 0xae5777 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:4288:14

    #15 0xaf3ab8 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:5235:7

    #16 0xa01153 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.5/sql/sql_base.h:507:10

    #17 0xd3568f in execute_sqlcom_select(THD*, TABLE_LIST*) /data/src/10.5/sql/sql_parse.cc:6235:14

    #18 0xd1ad80 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4005:12

    #19 0xd01ae2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8100:18

    #20 0xcf9d4d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891:7

    #21 0xd04374 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375:17

    #22 0x12ad9ef in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1418:11

    #23 0x12acf73 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312:5

    #24 0x23b95f7 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201:3

    #25 0x7f41d208bea6 in start_thread nptl/pthread_create.c:477:8

previously allocated by thread T5 here:

    #0 0x89b66d in malloc (/mnt8t/bld/10.5-asan/bin/mariadbd+0x89b66d)

    #1 0x34837fb in sf_malloc /data/src/10.5/mysys/safemalloc.c:121:34

    #2 0x343bb73 in my_malloc /data/src/10.5/mysys/my_malloc.c:90:29

    #3 0x7f41c8375440 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /data/src/10.5/storage/spider/spd_malloc.cc:236:29

    #4 0x7f41c8231415 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*) /data/src/10.5/storage/spider/spd_conn.cc:1679:9

    #5 0x7f41c822b2e3 in spider_conn_queue_loop_check(st_spider_conn*, ha_spider*, int) /data/src/10.5/storage/spider/spd_conn.cc:2038:20

    #6 0x7f41c822584e in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.5/storage/spider/spd_conn.cc:1373:9

    #7 0x7f41c812b4f7 in spider_check_trx_and_get_conn(THD*, ha_spider*, bool) /data/src/10.5/storage/spider/spd_trx.cc:3825:15

    #8 0x7f41c8467e25 in ha_spider::check_crd() /data/src/10.5/storage/spider/ha_spider.cc:9138:20

    #9 0x7f41c8464570 in ha_spider::info(unsigned int) /data/src/10.5/storage/spider/ha_spider.cc:8674:24

    #10 0xfd25d3 in get_schema_stat_record(THD*, TABLE_LIST*, TABLE*, bool, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*) /data/src/10.5/sql/sql_show.cc:6713:25

    #11 0xf9b265 in fill_schema_table_by_open(THD*, st_mem_root*, bool, TABLE*, st_schema_table*, st_mysql_const_lex_string*, st_mysql_const_lex_string*, Open_tables_backup*, bool) /data/src/10.5/sql/sql_show.cc:4682:13

    #12 0xf99efc in get_all_tables(THD*, TABLE_LIST*, Item*) /data/src/10.5/sql/sql_show.cc:5316:17

    #13 0xfc1c79 in get_schema_tables_result(JOIN*, enum_schema_table_state) /data/src/10.5/sql/sql_show.cc:8854:11

    #14 0xe8d942 in JOIN::exec_inner() /data/src/10.5/sql/sql_select.cc:4497:7

    #15 0xe8aac6 in JOIN::exec() /data/src/10.5/sql/sql_select.cc:4320:3

    #16 0xe0685b in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.5/sql/sql_select.cc:4797:9

    #17 0xe05482 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:444:10

    #18 0xd36648 in execute_sqlcom_select(THD*, TABLE_LIST*) /data/src/10.5/sql/sql_parse.cc:6314:12

    #19 0xd1ad80 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4005:12

    #20 0xd01ae2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8100:18

    #21 0xcf9d4d in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891:7

    #22 0xd04374 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375:17

    #23 0x12ad9ef in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1418:11

    #24 0x12acf73 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312:5

    #25 0x23b95f7 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201:3

    #26 0x7f41d208bea6 in start_thread nptl/pthread_create.c:477:8

Thread T5 created by T0 here:

    #0 0x88609a in pthread_create (/mnt8t/bld/10.5-asan/bin/mariadbd+0x88609a)

    #1 0x23b9c4c in my_thread_create(unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.5/storage/perfschema/my_thread.h:52:10

    #2 0x23b9bd6 in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252:15

    #3 0x8d4ab2 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.5/include/mysql/psi/mysql_thread.h:1323:11

    #4 0x8e671f in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6051:19

    #5 0x8e704e in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6110:3

    #6 0x8e7ab0 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6175:5

    #7 0x8e49a4 in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6302:9

    #8 0x8d8c34 in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5697:3

    #9 0x8cdc11 in main /data/src/10.5/sql/main.cc:25:10

    #10 0x7f41d1cecd09 in __libc_start_main csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.5/storage/spider/spd_conn.cc:1763:43 in spider_conn_queue_and_merge_loop_check(st_spider_conn*, st_spider_conn_loop_check*)

Shadow bytes around the buggy address:

  0x0c287fffcb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c287fffcb20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c287fffcb30: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa

  0x0c287fffcb40: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c287fffcb50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c287fffcb60: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd

  0x0c287fffcb70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa

  0x0c287fffcb80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c287fffcb90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c287fffcba0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c287fffcbb0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc