ASAN errors in grn_obj_unlink / ha_mroonga::clear_indexes upon index operations

INSTALL SONAME 'ha_mroonga';

CREATE TABLE t (a VARCHAR(64), FULLTEXT(a)) ENGINE=Mroonga;

ALTER TABLE t RENAME KEY a TO ftext, ADD KEY (a);

# Cleanup

DROP TABLE t;

UNINSTALL SONAME 'ha_mroonga';

==3638282==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e00002bee0 at pc 0x7f086a9a2fa6 bp 0x7f086bde4c40 sp 0x7f086bde4c38

READ of size 1 at 0x60e00002bee0 thread T5

    #0 0x7f086a9a2fa5 in grn_obj_unlink /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:10871

    #1 0x7f086a80483d in ha_mroonga::clear_indexes() /data/src/10.5/storage/mroonga/ha_mroonga.cpp:9094

    #2 0x7f086a7c3c6c in ha_mroonga::close() /data/src/10.5/storage/mroonga/ha_mroonga.cpp:4996

    #3 0x55aa5e7c7ff3 in handler::ha_close() /data/src/10.5/sql/handler.cc:3106

    #4 0x55aa5e306fba in closefrm(TABLE*) /data/src/10.5/sql/table.cc:4426

    #5 0x55aa5e6064e3 in intern_close_table /data/src/10.5/sql/table_cache.cc:220

    #6 0x55aa5e606753 in tc_remove_table /data/src/10.5/sql/table_cache.cc:258

    #7 0x55aa5e607cf0 in tc_release_table(TABLE*) /data/src/10.5/sql/table_cache.cc:449

    #8 0x55aa5de026ad in close_thread_table(THD*, TABLE**) /data/src/10.5/sql/sql_base.cc:994

    #9 0x55aa5de00d92 in close_all_tables_for_name(THD*, TABLE_SHARE*, ha_extra_function, TABLE*) /data/src/10.5/sql/sql_base.cc:749

    #10 0x55aa5e24c3c0 in mysql_inplace_alter_table /data/src/10.5/sql/sql_table.cc:8298

    #11 0x55aa5e2609e0 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /data/src/10.5/sql/sql_table.cc:10892

    #12 0x55aa5e40392b in Sql_cmd_alter_table::execute(THD*) /data/src/10.5/sql/sql_alter.cc:598

    #13 0x55aa5dfb8311 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:6083

    #14 0x55aa5dfc584c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8118

    #15 0x55aa5df9b1ed in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891

    #16 0x55aa5df97b80 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375

    #17 0x55aa5e3e6be6 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1416

    #18 0x55aa5e3e65ae in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1318

    #19 0x55aa5f033e17 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201

    #20 0x7f08738a7fd3 in start_thread nptl/pthread_create.c:442

    #21 0x7f08739285bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x60e00002bee0 is located 0 bytes inside of 152-byte region [0x60e00002bee0,0x60e00002bf78)

freed by thread T5 here:

    #0 0x7f08742b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52

    #1 0x7f086b05b222 in grn_free_default /data/src/10.5/storage/mroonga/vendor/groonga/lib/alloc.c:827

    #2 0x7f086ac6f52d in grn_ii_close /data/src/10.5/storage/mroonga/vendor/groonga/lib/ii.c:4426

    #3 0x7f086a9a2c64 in grn_obj_close /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:10836

    #4 0x7f086a992e19 in _grn_obj_remove_index /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:9721

    #5 0x7f086a993bbb in _grn_obj_remove /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:9837

    #6 0x7f086a98e72b in remove_index /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:9046

    #7 0x7f086a992b9b in _grn_obj_remove_ja /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:9665

    #8 0x7f086a993b3d in _grn_obj_remove /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:9829

    #9 0x7f086a98fa51 in remove_columns /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:9101

    #10 0x7f086a992a63 in _grn_obj_remove_array /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:9636

    #11 0x7f086a993afe in _grn_obj_remove /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:9825

    #12 0x7f086a994379 in grn_obj_remove /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:9879

    #13 0x7f086a7b50a5 in ha_mroonga::storage_create_index_table(TABLE*, char const*, _grn_obj*, st_mroonga_share*, st_key*, _grn_obj**, unsigned int) /data/src/10.5/storage/mroonga/ha_mroonga.cpp:3916

    #14 0x7f086a7b624d in ha_mroonga::storage_create_index(TABLE*, char const*, _grn_obj*, st_mroonga_share*, st_key*, _grn_obj**, _grn_obj**, unsigned int) /data/src/10.5/storage/mroonga/ha_mroonga.cpp:4023

    #15 0x7f086a856e2b in ha_mroonga::storage_inplace_alter_table_add_index(TABLE*, Alter_inplace_info*) /data/src/10.5/storage/mroonga/ha_mroonga.cpp:14950

    #16 0x7f086a85b890 in ha_mroonga::storage_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.5/storage/mroonga/ha_mroonga.cpp:15404

    #17 0x7f086a85bbe3 in ha_mroonga::inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.5/storage/mroonga/ha_mroonga.cpp:15420

    #18 0x55aa5e26ddbb in handler::ha_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.5/sql/handler.h:4523

    #19 0x55aa5e24b371 in mysql_inplace_alter_table /data/src/10.5/sql/sql_table.cc:8146

    #20 0x55aa5e2609e0 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /data/src/10.5/sql/sql_table.cc:10892

    #21 0x55aa5e40392b in Sql_cmd_alter_table::execute(THD*) /data/src/10.5/sql/sql_alter.cc:598

    #22 0x55aa5dfb8311 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:6083

    #23 0x55aa5dfc584c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8118

    #24 0x55aa5df9b1ed in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891

    #25 0x55aa5df97b80 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375

    #26 0x55aa5e3e6be6 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1416

    #27 0x55aa5e3e65ae in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1318

    #28 0x55aa5f033e17 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201

    #29 0x7f08738a7fd3 in start_thread nptl/pthread_create.c:442

previously allocated by thread T5 here:

    #0 0x7f08742b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x7f086b05a9a8 in grn_malloc_default /data/src/10.5/storage/mroonga/vendor/groonga/lib/alloc.c:780

    #2 0x7f086ac6d4f3 in grn_ii_create /data/src/10.5/storage/mroonga/vendor/groonga/lib/ii.c:4299

    #3 0x7f086a9419f9 in grn_column_create /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:4961

    #4 0x7f086a7b65f2 in ha_mroonga::storage_create_index(TABLE*, char const*, _grn_obj*, st_mroonga_share*, st_key*, _grn_obj**, _grn_obj**, unsigned int) /data/src/10.5/storage/mroonga/ha_mroonga.cpp:4050

    #5 0x7f086a7b7bc2 in ha_mroonga::storage_create_indexes(TABLE*, char const*, _grn_obj*, st_mroonga_share*) /data/src/10.5/storage/mroonga/ha_mroonga.cpp:4133

    #6 0x7f086a7afff0 in ha_mroonga::storage_create(char const*, TABLE*, HA_CREATE_INFO*, st_mroonga_share*) /data/src/10.5/storage/mroonga/ha_mroonga.cpp:3577

    #7 0x7f086a7b8d49 in ha_mroonga::create(char const*, TABLE*, HA_CREATE_INFO*) /data/src/10.5/storage/mroonga/ha_mroonga.cpp:4231

    #8 0x55aa5e7dc478 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /data/src/10.5/sql/handler.cc:5175

    #9 0x55aa5e7e0bb0 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /data/src/10.5/sql/handler.cc:5643

    #10 0x55aa5e2381e8 in create_table_impl /data/src/10.5/sql/sql_table.cc:5367

    #11 0x55aa5e238b23 in mysql_create_table_no_lock(THD*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/src/10.5/sql/sql_table.cc:5451

    #12 0x55aa5e239b07 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /data/src/10.5/sql/sql_table.cc:5609

    #13 0x55aa5e26c80e in Sql_cmd_create_table_like::execute(THD*) /data/src/10.5/sql/sql_table.cc:12393

    #14 0x55aa5dfb8311 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:6083

    #15 0x55aa5dfc584c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8118

    #16 0x55aa5df9b1ed in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891

    #17 0x55aa5df97b80 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375

    #18 0x55aa5e3e6be6 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1416

    #19 0x55aa5e3e65ae in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1318

    #20 0x55aa5f033e17 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201

    #21 0x7f08738a7fd3 in start_thread nptl/pthread_create.c:442

Thread T5 created by T0 here:

    #0 0x7f0874249726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x55aa5f02fb4a in my_thread_create /data/src/10.5/storage/perfschema/my_thread.h:52

    #2 0x55aa5f034206 in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252

    #3 0x55aa5dc8cfcc in inline_mysql_thread_create /data/src/10.5/include/mysql/psi/mysql_thread.h:1323

    #4 0x55aa5dca2d3f in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6060

    #5 0x55aa5dca3350 in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6119

    #6 0x55aa5dca3623 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6184

    #7 0x55aa5dca4214 in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6311

    #8 0x55aa5dca25bc in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5706

    #9 0x55aa5dc8b978 in main /data/src/10.5/sql/main.cc:25

    #10 0x7f0873846189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.5/storage/mroonga/vendor/groonga/lib/db.c:10871 in grn_obj_unlink

Shadow bytes around the buggy address:

  0x0c1c7fffd780: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c1c7fffd790: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa

  0x0c1c7fffd7a0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c1c7fffd7b0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa

  0x0c1c7fffd7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0c1c7fffd7d0: 00 00 00 fa fa fa fa fa fa fa fa fa[fd]fd fd fd

  0x0c1c7fffd7e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa

  0x0c1c7fffd7f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1c7fffd800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1c7fffd810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c1c7fffd820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==3638282==ABORTING

230820 21:09:58 [ERROR] mysqld got signal 6 ;

This could be because you hit a bug. It is also possible that this binary

or one of the libraries it was linked against is corrupt, improperly built,

or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help

diagnose the problem, but since we have already crashed, 

something is definitely wrong and this may fail.

Server version: 10.5.23-MariaDB-debug-log source revision: 7c9837ce744d1ce4b45e250369607bb440338bcd

key_buffer_size=1048576

read_buffer_size=131072

max_used_connections=1

max_threads=153

thread_count=1

It is possible that mysqld could use up to 

key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63769 K  bytes of memory

Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x62b000069218

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x7f086bdebc50 thread_stack 0x100000

sanitizer_common/sanitizer_common_interceptors.inc:4277(__interceptor_backtrace.part.0)[0x7f0874251f31]

mysys/stacktrace.c:212(my_print_stacktrace)[0x55aa5fc99948]

sql/signal_handler.cc:241(handle_fatal_signal)[0x55aa5e7aea5b]

libc_sigaction.c:0(__restore_rt)[0x7f087385af90]

nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7f08738a9ccc]

posix/raise.c:27(__GI_raise)[0x7f087385aef2]

stdlib/abort.c:81(__GI_abort)[0x7f0873845472]

sanitizer_common/sanitizer_posix_libcdep.cpp:137(__sanitizer::Abort())[0x7f08742d650f]

sanitizer_common/sanitizer_termination.cpp:59(__sanitizer::Die())[0x7f08742e2ba1]

asan/asan_report.cpp:190(__asan::ScopedInErrorReport::~ScopedInErrorReport())[0x7f08742c1f5e]

asan/asan_report.cpp:479(__asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool))[0x7f08742c14c6]

asan/asan_rtl.cpp:120(__asan_report_load1)[0x7f08742c23fc]

lib/db.c:10871(grn_obj_unlink)[0x7f086a9a2fa6]

mroonga/ha_mroonga.cpp:9088(ha_mroonga::clear_indexes())[0x7f086a80483e]

mroonga/ha_mroonga.cpp:4998(ha_mroonga::close())[0x7f086a7c3c6d]

sql/handler.cc:3106(handler::ha_close())[0x55aa5e7c7ff4]

sql/table.cc:4426(closefrm(TABLE*))[0x55aa5e306fbb]

sql/table_cache.cc:221(intern_close_table(TABLE*))[0x55aa5e6064e4]

sql/table_cache.cc:259(tc_remove_table(TABLE*))[0x55aa5e606754]

sql/table_cache.cc:449(tc_release_table(TABLE*))[0x55aa5e607cf1]

sql/sql_base.cc:995(close_thread_table(THD*, TABLE**))[0x55aa5de026ae]

sql/sql_base.cc:749(close_all_tables_for_name(THD*, TABLE_SHARE*, ha_extra_function, TABLE*))[0x55aa5de00d93]

sql/sql_table.cc:8303(mysql_inplace_alter_table(THD*, TABLE_LIST*, TABLE*, TABLE*, Alter_inplace_info*, MDL_request*, Alter_table_ctx*))[0x55aa5e24c3c1]

sql/sql_table.cc:10892(mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool))[0x55aa5e2609e1]

sql/sql_alter.cc:598(Sql_cmd_alter_table::execute(THD*))[0x55aa5e40392c]

sql/sql_parse.cc:6083(mysql_execute_command(THD*))[0x55aa5dfb8312]

sql/sql_parse.cc:8118(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55aa5dfc584d]

sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55aa5df9b1ee]

sql/sql_parse.cc:1375(do_command(THD*))[0x55aa5df97b81]

sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x55aa5e3e6be7]

sql/sql_connect.cc:1320(handle_one_connection)[0x55aa5e3e65af]

perfschema/pfs.cc:2203(pfs_spawn_thread)[0x55aa5f033e18]

nptl/pthread_create.c:442(start_thread)[0x7f08738a7fd4]

x86_64/clone3.S:83(clone3)[0x7f08739285bc]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x62b000038238): ALTER TABLE t RENAME KEY a TO ftext, ADD KEY (a)

Connection ID (thread ID): 4

Status: NOT_KILLED

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off

The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains

information that should help you find out what is causing the crash.

Writing a core file...

Working directory at /dev/shm/var_auto_j8Tc/mysqld.1/data

Resource Limits:

Limit                     Soft Limit           Hard Limit           Units     

Max cpu time              unlimited            unlimited            seconds   

Max file size             unlimited            unlimited            bytes     

Max data size             unlimited            unlimited            bytes     

Max stack size            8388608              unlimited            bytes     

Max core file size        unlimited            unlimited            bytes     

Max resident set          unlimited            unlimited            bytes     

Max processes             385718               385718               processes 

Max open files            65536                65536                files     

Max locked memory         12648972288          12648972288          bytes     

Max address space         unlimited            unlimited            bytes     

Max file locks            unlimited            unlimited            locks     

Max pending signals       385718               385718               signals   

Max msgqueue size         819200               819200               bytes     

Max nice priority         0                    0                    

Max realtime priority     0                    0                    

Max realtime timeout      unlimited            unlimited            us        

Core pattern: core