ASAN errors in Field_new_decimal::cmp / SEL_ARG::sel_cmp upon query from Archive table

INSTALL SONAME 'ha_archive';

CREATE TABLE t (f DECIMAL(20,5)) ENGINE=Archive;

INSERT INTO t VALUES (1),(2);

ANALYZE TABLE t PERSISTENT FOR ALL;

SELECT f FROM t GROUP BY f HAVING f <> 0;

# Cleanup

DROP TABLE t;

UNINSTALL SONAME 'ha_archive';

==1705773==ERROR: AddressSanitizer: use-after-poison on address 0x62100009119a at pc 0x7f63a56aa270 bp 0x7f639d1ed7c0 sp 0x7f639d1ecf70

READ of size 10 at 0x62100009119a thread T5

    #0 0x7f63a56aa26f in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:860

    #1 0x7f63a56aa908 in __interceptor_memcmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:892

    #2 0x7f63a56aa908 in __interceptor_memcmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:887

    #3 0x55b00bc4189f in Field_new_decimal::cmp(unsigned char const*, unsigned char const*) /data/src/10.4/sql/field.cc:3480

    #4 0x55b00bc9383f in Field::key_cmp(unsigned char const*, unsigned char const*) /data/src/10.4/sql/field.h:1122

    #5 0x55b00c085d90 in SEL_ARG::sel_cmp(Field*, unsigned char*, unsigned char*, unsigned char, unsigned char) /data/src/10.4/sql/opt_range.cc:2144

    #6 0x55b00c0e83b9 in SEL_ARG::cmp_max_to_min(SEL_ARG const*) const /data/src/10.4/sql/opt_range.h:327

    #7 0x55b00c0bc1df in key_or /data/src/10.4/sql/opt_range.cc:10200

    #8 0x55b00c0b97c9 in tree_or /data/src/10.4/sql/opt_range.cc:9738

    #9 0x55b00c0aa3d2 in Item_bool_func::get_ne_mm_tree(RANGE_OPT_PARAM*, Field*, Item*, Item*) /data/src/10.4/sql/opt_range.cc:7724

    #10 0x55b00c0aa579 in Item_func_ne::get_func_mm_tree(RANGE_OPT_PARAM*, Field*, Item*) /data/src/10.4/sql/opt_range.cc:7741

    #11 0x55b00c0adff6 in Item_bool_func::get_full_func_mm_tree(RANGE_OPT_PARAM*, Item_field*, Item*) /data/src/10.4/sql/opt_range.cc:8285

    #12 0x55b00b3c7fea in Item_bool_func::get_full_func_mm_tree_for_args(RANGE_OPT_PARAM*, Item*, Item*) /data/src/10.4/sql/item_cmpfunc.h:209

    #13 0x55b00b3c8d91 in Item_bool_func2_with_rev::get_mm_tree(RANGE_OPT_PARAM*, Item**) /data/src/10.4/sql/item_cmpfunc.h:495

    #14 0x55b00c08f119 in calculate_cond_selectivity_for_table(THD*, TABLE*, Item**) /data/src/10.4/sql/opt_range.cc:3495

    #15 0x55b00b600abb in make_join_statistics /data/src/10.4/sql/sql_select.cc:5616

    #16 0x55b00b5df23d in JOIN::optimize_inner() /data/src/10.4/sql/sql_select.cc:2368

    #17 0x55b00b5d81f4 in JOIN::optimize() /data/src/10.4/sql/sql_select.cc:1711

    #18 0x55b00b5f90c0 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4812

    #19 0x55b00b5c9e16 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442

    #20 0x55b00b539338 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475

    #21 0x55b00b52684d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978

    #22 0x55b00b542588 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012

    #23 0x55b00b518817 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857

    #24 0x55b00b515386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378

    #25 0x55b00b914dd1 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420

    #26 0x55b00b9146e8 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324

    #27 0x55b00c5860ed in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869

    #28 0x7f63a4fc8fd3 in start_thread nptl/pthread_create.c:442

    #29 0x7f63a50495bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x62100009119a is located 154 bytes inside of 4064-byte region [0x621000091100,0x6210000920e0)

allocated by thread T5 here:

    #0 0x7f63a56b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x55b00d0cfc14 in my_malloc /data/src/10.4/mysys/my_malloc.c:101

    #2 0x55b00d0ac63a in alloc_root /data/src/10.4/mysys/my_alloc.c:258

    #3 0x55b00c08c6b0 in create_key_parts_for_pseudo_indexes /data/src/10.4/sql/opt_range.cc:3118

    #4 0x55b00c08ee53 in calculate_cond_selectivity_for_table(THD*, TABLE*, Item**) /data/src/10.4/sql/opt_range.cc:3483

    #5 0x55b00b600abb in make_join_statistics /data/src/10.4/sql/sql_select.cc:5616

    #6 0x55b00b5df23d in JOIN::optimize_inner() /data/src/10.4/sql/sql_select.cc:2368

    #7 0x55b00b5d81f4 in JOIN::optimize() /data/src/10.4/sql/sql_select.cc:1711

    #8 0x55b00b5f90c0 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4812

    #9 0x55b00b5c9e16 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:442

    #10 0x55b00b539338 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6475

    #11 0x55b00b52684d in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978

    #12 0x55b00b542588 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8012

    #13 0x55b00b518817 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1857

    #14 0x55b00b515386 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1378

    #15 0x55b00b914dd1 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1420

    #16 0x55b00b9146e8 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1324

    #17 0x55b00c5860ed in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869

    #18 0x7f63a4fc8fd3 in start_thread nptl/pthread_create.c:442

Thread T5 created by T0 here:

    #0 0x7f63a5649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x55b00c5864da in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919

    #2 0x55b00b21ff89 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275

    #3 0x55b00b2376b6 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6289

    #4 0x55b00b237e01 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6359

    #5 0x55b00b2382cf in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6457

    #6 0x55b00b23917b in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6615

    #7 0x55b00b236e19 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5947

    #8 0x55b00b21e0b8 in main /data/src/10.4/sql/main.cc:25

    #9 0x7f63a4f67189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:860 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)

Shadow bytes around the buggy address:

  0x0c428000a1e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c428000a1f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c428000a200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c428000a210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c428000a220: 00 00 00 00 f7 00 00 00 00 f7 00 02 f7 00 02 f7

=>0x0c428000a230: 00 f7 00[02]f7 00 00 00 00 00 00 00 00 00 00 00

  0x0c428000a240: 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c428000a250: 00 00 f7 00 f7 00 02 f7 00 00 00 00 00 00 00 00

  0x0c428000a260: 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c428000a270: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c428000a280: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==1705773==ABORTING