ASAN use-after-poison in trace_engine_stats upon ANALYZE FORMAT=JSON

ANALYZE FORMAT=JSON SELECT * FROM information_schema.GLOBAL_STATUS;

CREATE TABLE t1 (a INT);

INSERT INTO t1 VALUES (1),(2);

CREATE TABLE t2 (s INT);

INSERT INTO t2 VALUES (2),(3);

ANALYZE FORMAT=JSON SELECT * FROM t1 WHERE a IN (SELECT s FROM t2);

# Cleanup

DROP TABLE t1, t2;

==1465818==ERROR: AddressSanitizer: use-after-poison on address 0x61b00003c0b0 at pc 0x55b546a9d5ef bp 0x7f8d01b01ce0 sp 0x7f8d01b01cd8

READ of size 8 at 0x61b00003c0b0 thread T5

    #0 0x55b546a9d5ee in trace_engine_stats /data/src/10.6/sql/sql_explain.cc:1714

    #1 0x55b546a9e684 in Explain_table_access::print_explain_json(Explain_query*, Json_writer*, bool) /data/src/10.6/sql/sql_explain.cc:1873

    #2 0x55b546a99adb in Explain_basic_join::print_explain_json_interns(Explain_query*, Json_writer*, bool) /data/src/10.6/sql/sql_explain.cc:1128

    #3 0x55b546a99063 in Explain_select::print_explain_json(Explain_query*, Json_writer*, bool) /data/src/10.6/sql/sql_explain.cc:1027

    #4 0x55b546a93c00 in Explain_query::print_explain_json(select_result_sink*, bool) /data/src/10.6/sql/sql_explain.cc:247

    #5 0x55b546a932f6 in Explain_query::send_explain(THD*, bool) /data/src/10.6/sql/sql_explain.cc:175

    #6 0x55b5465a94f5 in execute_sqlcom_select /data/src/10.6/sql/sql_parse.cc:6287

    #7 0x55b5465978e1 in mysql_execute_command(THD*, bool) /data/src/10.6/sql/sql_parse.cc:3949

    #8 0x55b5465b4180 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.6/sql/sql_parse.cc:8041

    #9 0x55b546589fc7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/10.6/sql/sql_parse.cc:1896

    #10 0x55b546586cfb in do_command(THD*, bool) /data/src/10.6/sql/sql_parse.cc:1409

    #11 0x55b5469f4a9f in do_handle_one_connection(CONNECT*, bool) /data/src/10.6/sql/sql_connect.cc:1416

    #12 0x55b5469f4460 in handle_one_connection /data/src/10.6/sql/sql_connect.cc:1318

    #13 0x55b54764c35d in pfs_spawn_thread /data/src/10.6/storage/perfschema/pfs.cc:2201

    #14 0x7f8d092a7fd3 in start_thread nptl/pthread_create.c:442

    #15 0x7f8d093285bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x61b00003c0b0 is located 304 bytes inside of 1416-byte region [0x61b00003bf80,0x61b00003c508)

allocated by thread T5 here:

    #0 0x7f8d09eb89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x55b548249618 in my_malloc /data/src/10.6/mysys/my_malloc.c:91

    #2 0x55b548225f82 in alloc_root /data/src/10.6/mysys/my_alloc.c:249

    #3 0x55b54629a8a9 in Sql_alloc::operator new(unsigned long, st_mem_root*) /data/src/10.6/sql/sql_alloc.h:37

    #4 0x55b5477faa09 in heap_create_handler /data/src/10.6/storage/heap/ha_heap.cc:65

    #5 0x55b546dfed20 in get_new_handler(TABLE_SHARE*, st_mem_root*, handlerton*) /data/src/10.6/sql/handler.cc:382

    #6 0x55b5466d8842 in Create_tmp_table::choose_engine(THD*, TABLE*, TMP_TABLE_PARAM*) /data/src/10.6/sql/sql_select.cc:19658

    #7 0x55b5466d8fff in Create_tmp_table::finalize(THD*, TABLE*, TMP_TABLE_PARAM*, bool, bool) /data/src/10.6/sql/sql_select.cc:19691

    #8 0x55b5466e0433 in create_tmp_table_for_schema(THD*, TMP_TABLE_PARAM*, st_schema_table const&, long long, st_mysql_const_lex_string const&, bool, bool) /data/src/10.6/sql/sql_select.cc:20218

    #9 0x55b5467a1b6f in create_schema_table(THD*, TABLE_LIST*) /data/src/10.6/sql/sql_show.cc:8262

    #10 0x55b5467a4275 in mysql_schema_table(THD*, LEX*, TABLE_LIST*) /data/src/10.6/sql/sql_show.cc:8470

    #11 0x55b5463fc2bf in open_and_process_table /data/src/10.6/sql/sql_base.cc:3722

    #12 0x55b5463ffb6d in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.6/sql/sql_base.cc:4335

    #13 0x55b546404cc0 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.6/sql/sql_base.cc:5308

    #14 0x55b54635bdad in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.6/sql/sql_base.h:509

    #15 0x55b5465a86cc in execute_sqlcom_select /data/src/10.6/sql/sql_parse.cc:6194

    #16 0x55b5465978e1 in mysql_execute_command(THD*, bool) /data/src/10.6/sql/sql_parse.cc:3949

    #17 0x55b5465b4180 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.6/sql/sql_parse.cc:8041

    #18 0x55b546589fc7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/10.6/sql/sql_parse.cc:1896

    #19 0x55b546586cfb in do_command(THD*, bool) /data/src/10.6/sql/sql_parse.cc:1409

    #20 0x55b5469f4a9f in do_handle_one_connection(CONNECT*, bool) /data/src/10.6/sql/sql_connect.cc:1416

    #21 0x55b5469f4460 in handle_one_connection /data/src/10.6/sql/sql_connect.cc:1318

    #22 0x55b54764c35d in pfs_spawn_thread /data/src/10.6/storage/perfschema/pfs.cc:2201

    #23 0x7f8d092a7fd3 in start_thread nptl/pthread_create.c:442

Thread T5 created by T0 here:

    #0 0x7f8d09e49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x55b547648098 in my_thread_create /data/src/10.6/storage/perfschema/my_thread.h:52

    #2 0x55b54764c74c in pfs_spawn_thread_v1 /data/src/10.6/storage/perfschema/pfs.cc:2252

    #3 0x55b54627784b in inline_mysql_thread_create /data/src/10.6/include/mysql/psi/mysql_thread.h:1139

    #4 0x55b54628ea94 in create_thread_to_handle_connection(CONNECT*) /data/src/10.6/sql/mysqld.cc:5991

    #5 0x55b54628f0a5 in create_new_thread(CONNECT*) /data/src/10.6/sql/mysqld.cc:6050

    #6 0x55b54628f390 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.6/sql/mysqld.cc:6112

    #7 0x55b54628fd20 in handle_connections_sockets() /data/src/10.6/sql/mysqld.cc:6236

    #8 0x55b54628e311 in mysqld_main(int, char**) /data/src/10.6/sql/mysqld.cc:5886

    #9 0x55b546276958 in main /data/src/10.6/sql/main.cc:34

    #10 0x7f8d09246189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison /data/src/10.6/sql/sql_explain.cc:1714 in trace_engine_stats

Shadow bytes around the buggy address:

  0x0c367ffff7c0: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c367ffff7d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c367ffff7e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c367ffff7f0: 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c367ffff800: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

=>0x0c367ffff810: f7 f7 f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c367ffff820: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c367ffff830: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c367ffff840: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c367ffff850: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c367ffff860: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==1465818==ABORTING

commit 6e484c3bd99a6709e3554f32a99167042ea88496 (HEAD -> 10.6, origin/bb-10.11-mdev31577-v3, origin/HEAD, origin/10.6)

Author: Sergei Petrunia

Date:   Thu Jul 6 10:41:46 2023 +0300

    MDEV-31577: Make ANALYZE FORMAT=JSON print innodb stats