ASAN errors in dict_v_col_t::detach upon adding key to virtual column

--source include/have_innodb.inc

CREATE TABLE t (a INT) ENGINE=InnoDB WITH SYSTEM VERSIONING;

SET SYSTEM_VERSIONING_ALTER_HISTORY= KEEP;

ALTER TABLE t ADD COLUMN v VARCHAR(128) GENERATED ALWAYS AS (CRC32('MariaDB'));

ALTER TABLE t ADD INDEX (v);

# Cleanup

DROP TABLE t;

==3917009==ERROR: AddressSanitizer: use-after-poison on address 0x61a00006f380 at pc 0x55ecce2664a5 bp 0x7fc35ea591e0 sp 0x7fc35ea591d8

READ of size 8 at 0x61a00006f380 thread T19

    #0 0x55ecce2664a4 in std::forward_list<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::empty() const /usr/include/c++/12/bits/forward_list.h:802

    #1 0x55ecce7fd4e5 in dict_v_col_t::detach(dict_index_t const&) /data/src/10.6/storage/innobase/include/dict0mem.h:764

    #2 0x55ecce7fdaa4 in dict_col_t::detach(dict_index_t const&) /data/src/10.6/storage/innobase/include/dict0mem.h:1475

    #3 0x55ecce7fd8dd in dict_index_t::detach_columns() /data/src/10.6/storage/innobase/include/dict0mem.h:1264

    #4 0x55ecce7ec169 in dict_index_remove_from_cache_low /data/src/10.6/storage/innobase/dict/dict0dict.cc:2143

    #5 0x55ecce7e9741 in dict_sys_t::remove(dict_table_t*, bool, bool) /data/src/10.6/storage/innobase/dict/dict0dict.cc:1887

    #6 0x55ecce23374d in innobase_reload_table /data/src/10.6/storage/innobase/handler/handler0alter.cc:10378

    #7 0x55ecce23a823 in ha_innobase::commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /data/src/10.6/storage/innobase/handler/handler0alter.cc:11531

    #8 0x55eccd75376c in handler::ha_commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /data/src/10.6/sql/handler.cc:5272

    #9 0x55eccd1624e9 in mysql_inplace_alter_table /data/src/10.6/sql/sql_table.cc:7484

    #10 0x55eccd177fe8 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /data/src/10.6/sql/sql_table.cc:10354

    #11 0x55eccd338808 in Sql_cmd_alter_table::execute(THD*) /data/src/10.6/sql/sql_alter.cc:553

    #12 0x55ecccece09b in mysql_execute_command(THD*, bool) /data/src/10.6/sql/sql_parse.cc:6014

    #13 0x55ecccedb478 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.6/sql/sql_parse.cc:8036

    #14 0x55eccceb12bf in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/10.6/sql/sql_parse.cc:1896

    #15 0x55eccceadffd in do_command(THD*, bool) /data/src/10.6/sql/sql_parse.cc:1409

    #16 0x55eccd31b307 in do_handle_one_connection(CONNECT*, bool) /data/src/10.6/sql/sql_connect.cc:1416

    #17 0x55eccd31acc8 in handle_one_connection /data/src/10.6/sql/sql_connect.cc:1318

    #18 0x55eccdf77e2d in pfs_spawn_thread /data/src/10.6/storage/perfschema/pfs.cc:2201

    #19 0x7fc36fca7fd3 in start_thread nptl/pthread_create.c:442

    #20 0x7fc36fd285bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x61a00006f380 is located 768 bytes inside of 1176-byte region [0x61a00006f080,0x61a00006f518)

allocated by thread T19 here:

    #0 0x7fc3706b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x55ecce1ce33b in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /data/src/10.6/storage/innobase/include/ut0new.h:375

    #2 0x55ecce3b3733 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.6/storage/innobase/mem/mem0mem.cc:277

    #3 0x55ecce1e8018 in mem_heap_create_func /data/src/10.6/storage/innobase/include/mem0mem.inl:377

    #4 0x55ecce220e3f in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.6/storage/innobase/handler/handler0alter.cc:8060

    #5 0x55eccd75345e in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.6/sql/handler.cc:5252

    #6 0x55eccd161a0b in mysql_inplace_alter_table /data/src/10.6/sql/sql_table.cc:7372

    #7 0x55eccd177fe8 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /data/src/10.6/sql/sql_table.cc:10354

    #8 0x55eccd338808 in Sql_cmd_alter_table::execute(THD*) /data/src/10.6/sql/sql_alter.cc:553

    #9 0x55ecccece09b in mysql_execute_command(THD*, bool) /data/src/10.6/sql/sql_parse.cc:6014

    #10 0x55ecccedb478 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.6/sql/sql_parse.cc:8036

    #11 0x55eccceb12bf in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/10.6/sql/sql_parse.cc:1896

    #12 0x55eccceadffd in do_command(THD*, bool) /data/src/10.6/sql/sql_parse.cc:1409

    #13 0x55eccd31b307 in do_handle_one_connection(CONNECT*, bool) /data/src/10.6/sql/sql_connect.cc:1416

    #14 0x55eccd31acc8 in handle_one_connection /data/src/10.6/sql/sql_connect.cc:1318

    #15 0x55eccdf77e2d in pfs_spawn_thread /data/src/10.6/storage/perfschema/pfs.cc:2201

    #16 0x7fc36fca7fd3 in start_thread nptl/pthread_create.c:442

Thread T19 created by T0 here:

    #0 0x7fc370649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x55eccdf73b68 in my_thread_create /data/src/10.6/storage/perfschema/my_thread.h:52

    #2 0x55eccdf7821c in pfs_spawn_thread_v1 /data/src/10.6/storage/perfschema/pfs.cc:2252

    #3 0x55ecccb9f7ea in inline_mysql_thread_create /data/src/10.6/include/mysql/psi/mysql_thread.h:1139

    #4 0x55ecccbb6a23 in create_thread_to_handle_connection(CONNECT*) /data/src/10.6/sql/mysqld.cc:5985

    #5 0x55ecccbb7034 in create_new_thread(CONNECT*) /data/src/10.6/sql/mysqld.cc:6044

    #6 0x55ecccbb731f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.6/sql/mysqld.cc:6106

    #7 0x55ecccbb7caf in handle_connections_sockets() /data/src/10.6/sql/mysqld.cc:6230

    #8 0x55ecccbb62a0 in mysqld_main(int, char**) /data/src/10.6/sql/mysqld.cc:5880

    #9 0x55ecccb9e958 in main /data/src/10.6/sql/main.cc:34

    #10 0x7fc36fc46189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison /usr/include/c++/12/bits/forward_list.h:802 in std::forward_list<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::empty() const

Shadow bytes around the buggy address:

  0x0c3480005e20: 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c3480005e30: 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00

  0x0c3480005e40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7

  0x0c3480005e50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00

  0x0c3480005e60: 00 00 f7 02 f7 00 f7 00 f7 00 00 00 00 f7 f7 f7

=>0x0c3480005e70:[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c3480005e80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c3480005e90: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c3480005ea0: f7 f7 f7 fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3480005eb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3480005ec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==3917009==ABORTING

230606 15:16:58 [ERROR] mysqld got signal 6 ;

This could be because you hit a bug. It is also possible that this binary

or one of the libraries it was linked against is corrupt, improperly built,

or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help

diagnose the problem, but since we have already crashed, 

something is definitely wrong and this may fail.

Server version: 10.6.14-MariaDB-debug-log source revision: a3e5b5c4db47cd29dc090d27db1d7f915cf774f6

key_buffer_size=1048576

read_buffer_size=131072

max_used_connections=1

max_threads=153

thread_count=1

It is possible that mysqld could use up to 

key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63870 K  bytes of memory

Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x62b0000bd218

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x7fc35ea5fc10 thread_stack 0x100000

sanitizer_common/sanitizer_common_interceptors.inc:4277(__interceptor_backtrace.part.0)[0x7fc370651f31]

mysys/stacktrace.c:215(my_print_stacktrace)[0x55ecceb7f1a9]

sql/signal_handler.cc:241(handle_fatal_signal)[0x55eccd7256e1]

libc_sigaction.c:0(__restore_rt)[0x7fc36fc5af90]

nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7fc36fca9ccc]

posix/raise.c:27(__GI_raise)[0x7fc36fc5aef2]

stdlib/abort.c:81(__GI_abort)[0x7fc36fc45472]

sanitizer_common/sanitizer_posix_libcdep.cpp:137(__sanitizer::Abort())[0x7fc3706d650f]

sanitizer_common/sanitizer_termination.cpp:59(__sanitizer::Die())[0x7fc3706e2ba1]

asan/asan_report.cpp:190(__asan::ScopedInErrorReport::~ScopedInErrorReport())[0x7fc3706c1f5e]

asan/asan_report.cpp:479(__asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool))[0x7fc3706c14c6]

asan/asan_rtl.cpp:123(__asan_report_load8)[0x7fc3706c25ac]

bits/forward_list.h:802(std::forward_list<dict_v_idx_t, ut_allocator<dict_v_idx_t, true> >::empty() const)[0x55ecce2664a5]

include/dict0mem.h:764(dict_v_col_t::detach(dict_index_t const&))[0x55ecce7fd4e6]

include/dict0mem.h:1476(dict_col_t::detach(dict_index_t const&))[0x55ecce7fdaa5]

include/dict0mem.h:1264(dict_index_t::detach_columns())[0x55ecce7fd8de]

dict/dict0dict.cc:2143(dict_index_remove_from_cache_low(dict_table_t*, dict_index_t*, unsigned long))[0x55ecce7ec16a]

dict/dict0dict.cc:1885(dict_sys_t::remove(dict_table_t*, bool, bool))[0x55ecce7e9742]

handler/handler0alter.cc:10379(innobase_reload_table(THD*, dict_table_t*, st_mysql_const_lex_string const&, ha_innobase_inplace_ctx&))[0x55ecce23374e]

handler/handler0alter.cc:11531(ha_innobase::commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool))[0x55ecce23a824]

sql/handler.cc:5273(handler::ha_commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool))[0x55eccd75376d]

sql/sql_table.cc:7484(mysql_inplace_alter_table(THD*, TABLE_LIST*, TABLE*, TABLE*, Alter_inplace_info*, MDL_request*, st_ddl_log_state*, TRIGGER_RENAME_PARAM*, Alter_table_ctx*))[0x55eccd1624ea]

sql/sql_table.cc:10354(mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool))[0x55eccd177fe9]

sql/sql_alter.cc:553(Sql_cmd_alter_table::execute(THD*))[0x55eccd338809]

sql/sql_parse.cc:6014(mysql_execute_command(THD*, bool))[0x55ecccece09c]

sql/sql_parse.cc:8036(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55ecccedb479]

sql/sql_parse.cc:1898(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55eccceb12c0]

sql/sql_parse.cc:1409(do_command(THD*, bool))[0x55eccceadffe]

sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x55eccd31b308]

sql/sql_connect.cc:1320(handle_one_connection)[0x55eccd31acc9]

perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55eccdf77e2e]

nptl/pthread_create.c:442(start_thread)[0x7fc36fca7fd4]

x86_64/clone3.S:83(clone3)[0x7fc36fd285bc]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x62b0000c4238): ALTER TABLE t ADD INDEX (v)

Connection ID (thread ID): 4

Status: NOT_KILLED

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=off

The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains

information that should help you find out what is causing the crash.

Writing a core file...

Working directory at /dev/shm/var_auto_rwxk/mysqld.1/data

Resource Limits:

Limit                     Soft Limit           Hard Limit           Units     

Max cpu time              unlimited            unlimited            seconds   

Max file size             unlimited            unlimited            bytes     

Max data size             unlimited            unlimited            bytes     

Max stack size            8388608              unlimited            bytes     

Max core file size        unlimited            unlimited            bytes     

Max resident set          unlimited            unlimited            bytes     

Max processes             385793               385793               processes 

Max open files            65536                65536                files     

Max locked memory         12649951232          12649951232          bytes     

Max address space         unlimited            unlimited            bytes     

Max file locks            unlimited            unlimited            locks     

Max pending signals       385793               385793               signals   

Max msgqueue size         819200               819200               bytes     

Max nice priority         0                    0                    

Max realtime priority     0                    0                    

Max realtime timeout      unlimited            unlimited            us        

Core pattern: core

Kernel version: Linux version 6.1.0-3-amd64 (debian-kernel@lists.debian.org) (gcc-12 (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC Debian 6.1.8-1 (2023-01-29)

commit f8240a2723f0cad948a02fc5381f050d02e45e95

Author: Marko Mäkelä

Date:   Mon Jul 4 11:15:15 2022 +0300

    MDEV-26294 Duplicate entries in unique index not detected when changing collation