AddressSanitizer errors in ha_spider::field_exchange with UNION on partitioned table

--source plugin/spider/spider/include/init_spider.inc

--source include/have_partition.inc

SET spider_same_server_link= on;

eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);

CREATE TABLE t1 (a INT);

INSERT INTO t1 VALUES (1),(2);

CREATE TABLE t2 (a INT);

INSERT INTO t2 VALUES (3),(4);

CREATE TABLE t_spider (a INT) ENGINE=SPIDER PARTITION BY HASH(a) (

  PARTITION p1 COMMENT = "wrapper 'mysql', srv 's', table 't1'",

  PARTITION p2 COMMENT = "wrapper 'mysql', srv 's', table 't2'"  

);

SELECT DISTINCT a FROM t_spider UNION SELECT a FROM t_spider;

# Cleanup

DROP TABLE t_spider, t1, t2;

--source plugin/spider/spider/include/deinit_spider.inc

==2666832==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190001edcc8 at pc 0x7f91e6fa8acd bp 0x7f91e7297660 sp 0x7f91e7297658

READ of size 8 at 0x6190001edcc8 thread T5

    #0 0x7f91e6fa8acc in ha_spider::field_exchange(Field*) /data/src/10.3/storage/spider/ha_spider.cc:12199

    #1 0x7f91e6fa9f94 in ha_spider::set_searched_bitmap_from_item_list() /data/src/10.3/storage/spider/ha_spider.cc:12725

    #2 0x7f91e6fab39f in ha_spider::set_select_column_mode() /data/src/10.3/storage/spider/ha_spider.cc:12770

    #3 0x7f91e6fab39f in ha_spider::set_select_column_mode() /data/src/10.3/storage/spider/ha_spider.cc:12733

    #4 0x7f91e6fc5db7 in ha_spider::rnd_init(bool) /data/src/10.3/storage/spider/ha_spider.cc:7545

    #5 0x558e9a7d0450 in handler::ha_rnd_init(bool) /data/src/10.3/sql/handler.h:3059

    #6 0x558e9a7d0450 in ha_partition::rnd_init(bool) /data/src/10.3/sql/ha_partition.cc:5031

    #7 0x558e9983af9b in handler::ha_rnd_init(bool) /data/src/10.3/sql/handler.h:3059

    #8 0x558e9983af9b in handler::ha_rnd_init_with_error(bool) /data/src/10.3/sql/handler.cc:3073

    #9 0x558e99c97c6e in init_read_record(READ_RECORD*, THD*, TABLE*, SQL_SELECT*, SORT_INFO*, int, bool, bool) /data/src/10.3/sql/records.cc:294

    #10 0x558e992e25b0 in join_init_read_record(st_join_table*) /data/src/10.3/sql/sql_select.cc:20834

    #11 0x558e9929a0cf in sub_select(JOIN*, st_join_table*, bool) /data/src/10.3/sql/sql_select.cc:19892

    #12 0x558e9932e14f in do_select /data/src/10.3/sql/sql_select.cc:19433

    #13 0x558e9932e14f in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4151

    #14 0x558e9932f999 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3945

    #15 0x558e994264fe in st_select_lex_unit::exec() /data/src/10.3/sql/sql_union.cc:1546

    #16 0x558e994323bf in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long) /data/src/10.3/sql/sql_union.cc:42

    #17 0x558e99332355 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:362

    #18 0x558e991c302f in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6339

    #19 0x558e991e8198 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3870

    #20 0x558e991f0637 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870

    #21 0x558e991f5179 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852

    #22 0x558e991faf1d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398

    #23 0x558e99518c96 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #24 0x558e995194fa in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #25 0x558e9a75ee14 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869

    #26 0x7f91f1cb6ea6 in start_thread nptl/pthread_create.c:477

    #27 0x7f91f1be6dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)

0x6190001edcc8 is located 72 bytes inside of 992-byte region [0x6190001edc80,0x6190001ee060)

freed by thread T5 here:

    #0 0x7f91f2558b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123

    #1 0x558e9a81cb7d in free_root /data/src/10.3/mysys/my_alloc.c:430

    #2 0x558e992bf4cb in free_tmp_table(THD*, TABLE*) /data/src/10.3/sql/sql_select.cc:19199

    #3 0x558e9932a864 in JOIN::cleanup(bool) /data/src/10.3/sql/sql_select.cc:13201

    #4 0x558e9932b467 in JOIN::join_free() /data/src/10.3/sql/sql_select.cc:13091

    #5 0x558e9932e01c in do_select /data/src/10.3/sql/sql_select.cc:19480

    #6 0x558e9932e01c in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4151

    #7 0x558e9932f999 in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3945

    #8 0x558e994264fe in st_select_lex_unit::exec() /data/src/10.3/sql/sql_union.cc:1546

    #9 0x558e994323bf in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long) /data/src/10.3/sql/sql_union.cc:42

    #10 0x558e99332355 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:362

    #11 0x558e991c302f in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6339

    #12 0x558e991e8198 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3870

    #13 0x558e991f0637 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870

    #14 0x558e991f5179 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852

    #15 0x558e991faf1d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398

    #16 0x558e99518c96 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #17 0x558e995194fa in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #18 0x558e9a75ee14 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869

    #19 0x7f91f1cb6ea6 in start_thread nptl/pthread_create.c:477

previously allocated by thread T5 here:

    #0 0x7f91f2558e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145

    #1 0x558e9a82fe62 in my_malloc /data/src/10.3/mysys/my_malloc.c:101

    #2 0x558e9a81c39b in alloc_root /data/src/10.3/mysys/my_alloc.c:251

    #3 0x558e9a81d155 in memdup_root /data/src/10.3/mysys/my_alloc.c:494

    #4 0x558e997bb30d in Field::make_new_field(st_mem_root*, TABLE*, bool) /data/src/10.3/sql/field.cc:2347

    #5 0x558e992b0efe in create_tmp_field_from_field(THD*, Field*, st_mysql_const_lex_string*, TABLE*, Item_field*) /data/src/10.3/sql/sql_select.cc:17140

    #6 0x558e992b2254 in create_tmp_field(THD*, TABLE*, Item*, Item::Type, Item***, Field**, Field**, bool, bool, bool, bool) /data/src/10.3/sql/sql_select.cc:17427

    #7 0x558e992c2ae3 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /data/src/10.3/sql/sql_select.cc:17885

    #8 0x558e992f3e64 in JOIN::create_postjoin_aggr_table(st_join_table*, List<Item>*, st_order*, bool, bool, bool) /data/src/10.3/sql/sql_select.cc:3458

    #9 0x558e992f6b58 in JOIN::make_aggr_tables_info() /data/src/10.3/sql/sql_select.cc:3058

    #10 0x558e993189d1 in JOIN::optimize_stage2() /data/src/10.3/sql/sql_select.cc:2697

    #11 0x558e9932283a in JOIN::optimize_inner() /data/src/10.3/sql/sql_select.cc:2003

    #12 0x558e993297a1 in JOIN::optimize() /data/src/10.3/sql/sql_select.cc:1519

    #13 0x558e99424eb1 in st_select_lex_unit::optimize() /data/src/10.3/sql/sql_union.cc:1434

    #14 0x558e994256f4 in st_select_lex_unit::exec() /data/src/10.3/sql/sql_union.cc:1468

    #15 0x558e994323bf in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long) /data/src/10.3/sql/sql_union.cc:42

    #16 0x558e99332355 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:362

    #17 0x558e991c302f in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6339

    #18 0x558e991e8198 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3870

    #19 0x558e991f0637 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870

    #20 0x558e991f5179 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852

    #21 0x558e991faf1d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398

    #22 0x558e99518c96 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403

    #23 0x558e995194fa in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #24 0x558e9a75ee14 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869

    #25 0x7f91f1cb6ea6 in start_thread nptl/pthread_create.c:477

Thread T5 created by T0 here:

    #0 0x7f91f25042a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214

    #1 0x558e9a76346a in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919

    #2 0x558e98f87f9b in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275

    #3 0x558e98f87f9b in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668

    #4 0x558e98f982ad in create_new_thread /data/src/10.3/sql/mysqld.cc:6738

    #5 0x558e98f982ad in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996

    #6 0x558e98f9a255 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290

    #7 0x7f91f1b0fd09 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/spider/ha_spider.cc:12199 in ha_spider::field_exchange(Field*)

Shadow bytes around the buggy address:

  0x0c3280035b40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3280035b50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3280035b60: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3280035b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3280035b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

=>0x0c3280035b90: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd

  0x0c3280035ba0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3280035bb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3280035bc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3280035bd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3280035be0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc