Assertion `sp > last_savepoint()' failed in federatedx_io_mysql::savepoint_set or crash upon shutdown

INSTALL SONAME 'ha_federatedx';

eval CREATE SERVER fedlink FOREIGN DATA WRAPPER mysql OPTIONS (USER 'root', HOST '127.0.0.1', DATABASE 'test', PORT $MASTER_MYPORT);

CREATE TABLE t (a INT);

CREATE TABLE t_fed ENGINE=FEDERATED CONNECTION='fedlink/t';

START TRANSACTION;

--error ER_BAD_FIELD_ERROR

UPDATE t_fed SET a = 1 WHERE b > 0;

--connect (con1,localhost,root,,test)

UPDATE t_fed SET a = 1;

# Cleanup

--disconnect con1

--connection default

DROP TABLE t_fed, t;

UNINSTALL SONAME 'ha_federatedx';

mysqld: /data/src/10.3/storage/federatedx/federatedx_io_mysql.cc:240: virtual int federatedx_io_mysql::savepoint_set(ulong): Assertion `sp > last_savepoint()' failed.

220727 16:00:11 [ERROR] mysqld got signal 6 ;

#7  0x00007f4b8cb48662 in __GI___assert_fail (assertion=0x7f4b86b1e0ce "sp > last_savepoint()", file=0x7f4b86b1df88 "/data/src/10.3/storage/federatedx/federatedx_io_mysql.cc", line=240, function=0x7f4b86b1e0e8 "virtual int federatedx_io_mysql::savepoint_set(ulong)") at assert.c:101

#8  0x00007f4b86b1a23e in federatedx_io_mysql::savepoint_set (this=0x7f4b740ac6b8, sp=1) at /data/src/10.3/storage/federatedx/federatedx_io_mysql.cc:240

#9  0x00007f4b86b18d20 in federatedx_txn::sp_acquire (this=0x7f4b680084d0, sp=0x7f4b680084e0) at /data/src/10.3/storage/federatedx/federatedx_txn.cc:301

#10 0x00007f4b86b19179 in federatedx_txn::stmt_begin (this=0x7f4b680084d0) at /data/src/10.3/storage/federatedx/federatedx_txn.cc:366

#11 0x00007f4b86b14dbc in ha_federatedx::external_lock (this=0x7f4b74037438, thd=0x7f4b68000d90, lock_type=1) at /data/src/10.3/storage/federatedx/ha_federatedx.cc:3504

#12 0x000055a6883cde11 in handler::ha_external_lock (this=0x7f4b74037438, thd=0x7f4b68000d90, lock_type=1) at /data/src/10.3/sql/handler.cc:6420

#13 0x000055a6884f7c55 in lock_external (thd=0x7f4b68000d90, tables=0x7f4b680123b0, count=1) at /data/src/10.3/sql/lock.cc:391

#14 0x000055a6884f7905 in mysql_lock_tables (thd=0x7f4b68000d90, sql_lock=0x7f4b68012380, flags=0) at /data/src/10.3/sql/lock.cc:336

#15 0x000055a6884f77c2 in mysql_lock_tables (thd=0x7f4b68000d90, tables=0x7f4b68012378, count=1, flags=0) at /data/src/10.3/sql/lock.cc:299

#16 0x000055a68800880a in lock_tables (thd=0x7f4b68000d90, tables=0x7f4b680119c0, count=1, flags=0) at /data/src/10.3/sql/sql_base.cc:5370

#17 0x000055a6881a20d2 in mysql_update (thd=0x7f4b68000d90, table_list=0x7f4b680119c0, fields=..., values=..., conds=0x0, order_num=0, order=0x0, limit=18446744073709551615, ignore=false, found_return=0x7f4b86afbef0, updated_return=0x7f4b86afbfb0) at /data/src/10.3/sql/sql_update.cc:372

#18 0x000055a68809c174 in mysql_execute_command (thd=0x7f4b68000d90) at /data/src/10.3/sql/sql_parse.cc:4344

#19 0x000055a6880a81aa in mysql_parse (thd=0x7f4b68000d90, rawbuf=0x7f4b680118f0 "UPDATE t_fed SET a = 1", length=22, parser_state=0x7f4b86afc5b0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7871

#20 0x000055a6880949df in dispatch_command (command=COM_QUERY, thd=0x7f4b68000d90, packet=0x7f4b68023571 "UPDATE t_fed SET a = 1", packet_length=22, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1852

#21 0x000055a68809339d in do_command (thd=0x7f4b68000d90) at /data/src/10.3/sql/sql_parse.cc:1398

#22 0x000055a6882109e8 in do_handle_one_connection (connect=0x55a68a614250) at /data/src/10.3/sql/sql_connect.cc:1403

#23 0x000055a688210753 in handle_one_connection (arg=0x55a68a614250) at /data/src/10.3/sql/sql_connect.cc:1308

#24 0x000055a688bc0866 in pfs_spawn_thread (arg=0x55a68a6d4cf0) at /data/src/10.3/storage/perfschema/pfs.cc:1869

#25 0x00007f4b8cce1ea7 in start_thread (arg=<optimized out>) at pthread_create.c:477

#26 0x00007f4b8cc11def in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

INSTALL SONAME 'ha_federatedx';

eval CREATE SERVER fedlink FOREIGN DATA WRAPPER mysql OPTIONS (USER 'root', HOST '127.0.0.1', DATABASE 'test', PORT $MASTER_MYPORT);

CREATE TABLE t (a int);

CREATE TABLE t_fed ENGINE=FEDERATED CONNECTION='fedlink/t';

START TRANSACTION;

UPDATE t_fed SET a = 1;

--connect (con1,localhost,root,,test)

--error 0,ER_BAD_FIELD_ERROR

UPDATE t_fed SET x = 1;

--connection default

COMMIT;

==1950275==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a00005b3f8 at pc 0x55ebce248a60 bp 0x7f25885b8970 sp 0x7f25885b8968

READ of size 8 at 0x62a00005b3f8 thread T8

    #0 0x55ebce248a5f in thd_increment_bytes_sent /data/src/10.3/sql/sql_class.cc:4345

    #1 0x55ebce10244e in net_real_write /data/src/10.3/sql/net_serv.cc:743

    #2 0x55ebce102bbf in net_flush /data/src/10.3/sql/net_serv.cc:384

    #3 0x55ebce10374a in net_write_command /data/src/10.3/sql/net_serv.cc:533

    #4 0x55ebce90cc43 in cli_advanced_command /data/src/10.3/sql-common/client.c:714

    #5 0x55ebce905d07 in mysql_close_slow_part /data/src/10.3/sql-common/client.c:3754

    #6 0x55ebce905d07 in mysql_close_slow_part /data/src/10.3/sql-common/client.c:3746

    #7 0x55ebce905d68 in mysql_close /data/src/10.3/sql-common/client.c:3766

    #8 0x55ebce905d68 in mysql_close /data/src/10.3/sql-common/client.c:3759

    #9 0x7f2588864084 in federatedx_io_mysql::~federatedx_io_mysql() /data/src/10.3/storage/federatedx/federatedx_io_mysql.cc:153

    #10 0x7f25888640c1 in federatedx_io_mysql::~federatedx_io_mysql() /data/src/10.3/storage/federatedx/federatedx_io_mysql.cc:157

    #11 0x7f2588861aa4 in federatedx_txn::close(st_fedrated_server*) /data/src/10.3/storage/federatedx/federatedx_txn.cc:86

    #12 0x7f258884b481 in free_server /data/src/10.3/storage/federatedx/ha_federatedx.cc:1677

    #13 0x7f258884baf3 in free_share /data/src/10.3/storage/federatedx/ha_federatedx.cc:1716

    #14 0x7f2588857977 in ha_federatedx::close() /data/src/10.3/storage/federatedx/ha_federatedx.cc:1846

    #15 0x55ebce5ca7d0 in closefrm(TABLE*) /data/src/10.3/sql/table.cc:3790

    #16 0x55ebce8405a7 in intern_close_table /data/src/10.3/sql/table_cache.cc:222

    #17 0x55ebce8405a7 in tc_purge(bool) /data/src/10.3/sql/table_cache.cc:335

    #18 0x55ebce1fdcfe in close_cached_tables(THD*, TABLE_LIST*, bool, unsigned long) /data/src/10.3/sql/sql_base.cc:377

    #19 0x55ebce0e28cb in clean_up /data/src/10.3/sql/mysqld.cc:2241

    #20 0x55ebce0e28cb in clean_up /data/src/10.3/sql/mysqld.cc:2208

    #21 0x55ebce0e784d in unireg_end() /data/src/10.3/sql/mysqld.cc:2116

    #22 0x55ebce0f07e6 in kill_server /data/src/10.3/sql/mysqld.cc:2043

    #23 0x55ebce0f250d in kill_server_thread /data/src/10.3/sql/mysqld.cc:2066

    #24 0x55ebcf8c34a4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869

    #25 0x7f2593461ea6 in start_thread nptl/pthread_create.c:477

    #26 0x7f2593391dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)

0x62a00005b3f8 is located 4600 bytes inside of 23104-byte region [0x62a00005a200,0x62a00005fc40)

freed by thread T5 here:

    #0 0x7f2593d03b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123

    #1 0x55ebce0e8df8 in one_thread_per_connection_end(THD*, bool) /data/src/10.3/sql/mysqld.cc:3131

    #2 0x55ebce67c2b5 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1422

    #3 0x55ebce67cc7a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #4 0x55ebcf8c34a4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869

    #5 0x7f2593461ea6 in start_thread nptl/pthread_create.c:477

previously allocated by thread T5 here:

    #0 0x7f2593d03e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145

    #1 0x55ebcf994812 in my_malloc /data/src/10.3/mysys/my_malloc.c:101

    #2 0x55ebce67bb0e in ilink::operator new(unsigned long) /data/src/10.3/sql/sql_list.h:622

    #3 0x55ebce67bb0e in CONNECT::create_thd(THD*) /data/src/10.3/sql/sql_connect.cc:1507

    #4 0x55ebce67bf1e in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1346

    #5 0x55ebce67cc7a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308

    #6 0x55ebcf8c34a4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869

    #7 0x7f2593461ea6 in start_thread nptl/pthread_create.c:477

Thread T8 created by T3 here:

    #0 0x7f2593caf2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214

    #1 0x55ebcf8c7afa in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919

    #2 0x55ebce0e4a6f in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275

    #3 0x55ebce0e4a6f in signal_hand /data/src/10.3/sql/mysqld.cc:3620

    #4 0x55ebcf8c34a4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869

    #5 0x7f2593461ea6 in start_thread nptl/pthread_create.c:477

Thread T3 created by T0 here:

    #0 0x7f2593caf2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214

    #1 0x55ebcf8c7afa in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919

    #2 0x55ebce0fcdff in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275

    #3 0x55ebce0fcdff in start_signal_handler /data/src/10.3/sql/mysqld.cc:3516

    #4 0x55ebce0fcdff in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6127

    #5 0x7f25932bad09 in __libc_start_main ../csu/libc-start.c:308

Thread T5 created by T0 here:

    #0 0x7f2593caf2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214

    #1 0x55ebcf8c7afa in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919

    #2 0x55ebce0eaf2b in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275

    #3 0x55ebce0eaf2b in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668

    #4 0x55ebce0fb23d in create_new_thread /data/src/10.3/sql/mysqld.cc:6738

    #5 0x55ebce0fb23d in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996

    #6 0x55ebce0fd1e5 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290

    #7 0x7f25932bad09 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/sql/sql_class.cc:4345 in thd_increment_bytes_sent

Shadow bytes around the buggy address:

  0x0c5480003620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5480003630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5480003640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5480003650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5480003660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c5480003670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]

  0x0c5480003680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c5480003690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c54800036a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c54800036b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c54800036c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==1950275==ABORTING