Heap-Use-Sfter-Free at /mariadb-11.3.0/sql/item_sum.cc:2958

Run these queries in debug build:

CREATE TEMPORARY TABLE t0 ( c0 TEXT NOT NULL , INDEX i0 ( c0 ( 12 ) ) ) ;
INSERT INTO t0 VALUES ( 46 ) , ( -31 ) ;
ALTER TABLE t0 ADD COLUMN c52 INT AFTER c0 ;
INSERT INTO t0 VALUES ( 118 , 46 ) , ( 36 , -108 ) ;
SELECT t0 . c0 AS c50 FROM ( SELECT c0 AS c12 FROM t0 ) AS t1 JOIN t0 ON ( SELECT ORD ( + EXISTS ( SELECT 85 AS c32 UNION SELECT + BIT_OR( c12 ) | LENGTH ( '?jdAo8jPdoQm>(' ) AS c1 FROM t0 WHERE c52 < -89 AND c52 < -89 AND c12 < -118 GROUP BY c0 ) ) << VARIANCE( c12 ) AS c20 FROM t0 GROUP BY c52 LIMIT 1 ) * CONCAT ( -1358122777483577874 , IF ( -33 , 11 = PI ( ) - UNHEX ( -54 ) IN ( SELECT RAND ( ) = TRIM( TRAILING FROM 110 ) SOUNDS LIKE CONVERT ( t1 . c12 , UNSIGNED ) >> PI ( ) AS c52 FROM t0 ) OR CONVERT ( -112 , NCHAR ) IN ( 72 , 3657980581521146874 , -40 NOT LIKE LOWER ( 5582244788592061653 ) ) , 29 ) & CONVERT ( -41 , FLOAT ) % RTRIM ( -85 REGEXP CONVERT ( 9 , CHAR ) ) ) ^ DEGREES ( 108 ) + RAND ( ) = t0 . c52 ;

Will trigger heap-use-after-free.
ASAN info:
=================================================================
==81210==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190001042c0 at pc 0x000001604d41 bp 0x7fffd2429540 sp 0x7fffd2429538
READ of size 8 at 0x6190001042c0 thread T15
#0 0x1604d40 in Item_sum_bit::update_field() /home/wx/mariadb-11.3.0/sql/item_sum.cc:2958:28
#1 0xc986ff in update_tmptable_sum_func(Item_sum*, TABLE) /home/wx/mariadb-11.3.0/sql/sql_select.cc:28775:11
#2 0xc986ff in end_update(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:25082:5
#3 0xc9e283 in evaluate_join_record(JOIN*, st_join_table*, int) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677:11
#4 0xbe340e in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481:9
#5 0xc45120 in do_select(JOIN*, Procedure*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961:14
#6 0xc45120 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941:50
#7 0xc428e8 in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718:8
#8 0x15d8105 in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159:23
#9 0x15b3edb in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812:21
#10 0x15b9772 in Item_singlerow_subselect::val_int() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1462:8
#11 0x1376611 in Item_cache_int::cache_value() /home/wx/mariadb-11.3.0/sql/item.cc:10161:19
#12 0x136aa6b in Item_cache_wrapper::cache() /home/wx/mariadb-11.3.0/sql/item.cc:8915:15
#13 0x136aa6b in Item_cache_wrapper::val_int() /home/wx/mariadb-11.3.0/sql/item.cc:8969:3
#14 0x1464416 in Item_func_mul::int_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:1380:24
#15 0x145ddc5 in Item_func_hybrid_field_type::val_real_from_int_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:827:20
#16 0x1461dd3 in Item_func_plus::real_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:1103:26
#17 0x13b08fc in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:845:15
#18 0x13b5ea1 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104:33
#19 0x13b5ea1 in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780:18
#20 0xf99b3f in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914:13
#21 0xf99b3f in JOIN_CACHE::check_match(unsigned char*) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2560:45
#22 0xf8f7d8 in JOIN_CACHE::generate_full_extensions(unsigned char*) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2503:7
#23 0xf8f321 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2403:13
#24 0xf8e694 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158:9
#25 0xc9da16 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192:16
#26 0xc4536b in do_select(JOIN*, Procedure*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963:14
#27 0xc4536b in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941:50
#28 0xc428e8 in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718:8
#29 0xbe5127 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249:21
#30 0xbe4595 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628:10
#31 0xb3df17 in execute_sqlcom_select(THD*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013:12
#32 0xb2cd50 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912:12
#33 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#34 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#35 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#36 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#37 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#38 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#39 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#40 0x7ffff770f132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x6190001042c0 is located 576 bytes inside of 1040-byte region [0x619000104080,0x619000104490)
freed by thread T15 here:
#0 0x7ca37d in free (/usr/local/mysql/bin/mariadbd+0x7ca37d)
#1 0x2290b64 in root_free /home/wx/mariadb-11.3.0/mysys/my_alloc.c:83:5
#2 0x2290b64 in free_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:515:7
#3 0xc3da3d in free_tmp_table(THD*, TABLE*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22713:3
#4 0xff1235 in Expression_cache_tmptable::disable_cache() /home/wx/mariadb-11.3.0/sql/sql_expression_cache.cc:62:3
#5 0xff1235 in Expression_cache_tmptable::init() /home/wx/mariadb-11.3.0/sql/sql_expression_cache.cc:176:3
#6 0x136b52a in Item_cache_wrapper::init_on_demand() /home/wx/mariadb-11.3.0/sql/item.cc:8775:19
#7 0x136b52a in Item_cache_wrapper::check_cache() /home/wx/mariadb-11.3.0/sql/item.cc:8899:5
#8 0x136b52a in Item_cache_wrapper::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.cc:9017:22
#9 0x1479db3 in Item_func_ord::val_int() /home/wx/mariadb-11.3.0/sql/item_func.cc:3283:24
#10 0x14c39f5 in Item::to_longlong_null() /home/wx/mariadb-11.3.0/sql/item.h:1452:18
#11 0x14c39f5 in Func_handler_shift_left_int_to_ulonglong::to_longlong_null(Item_handled_func*) const /home/wx/mariadb-11.3.0/sql/item_func.cc:2189:34
#12 0x1413061 in Item_handled_func::Handler_int::val_int(Item_handled_func*) const /home/wx/mariadb-11.3.0/sql/item_func.h:696:26
#13 0x13552b7 in Item::save_int_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6843:16
#14 0x13554a8 in Item::save_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6853:30
#15 0xc98531 in copy_funcs(Item*, THD const) /home/wx/mariadb-11.3.0/sql/sql_select.cc:28843:11
#16 0xc98531 in end_update(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:25093:7
#17 0xc9e283 in evaluate_join_record(JOIN*, st_join_table*, int) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677:11
#18 0xbe3395 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444:9
#19 0xc45120 in do_select(JOIN*, Procedure*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961:14
#20 0xc45120 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941:50
#21 0xc428e8 in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718:8
#22 0x15d8105 in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159:23
#23 0x15b3edb in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812:21
#24 0x15b9772 in Item_singlerow_subselect::val_int() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1462:8
#25 0x1376611 in Item_cache_int::cache_value() /home/wx/mariadb-11.3.0/sql/item.cc:10161:19
#26 0x136aa6b in Item_cache_wrapper::cache() /home/wx/mariadb-11.3.0/sql/item.cc:8915:15
#27 0x136aa6b in Item_cache_wrapper::val_int() /home/wx/mariadb-11.3.0/sql/item.cc:8969:3
#28 0x1464416 in Item_func_mul::int_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:1380:24
#29 0x145ddc5 in Item_func_hybrid_field_type::val_real_from_int_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:827:20
#30 0x1461dd3 in Item_func_plus::real_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:1103:26
#31 0x13b08fc in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:845:15
#32 0x13b5ea1 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104:33
#33 0x13b5ea1 in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780:18
#34 0xf99b3f in SQL_SELECT::skip_record(THD*) /home/wx/mariadb-11.3.0/sql/opt_range.h:1914:13
#35 0xf99b3f in JOIN_CACHE::check_match(unsigned char*) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2560:45
#36 0xf8f7d8 in JOIN_CACHE::generate_full_extensions(unsigned char*) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2503:7
#37 0xf8f321 in JOIN_CACHE::join_matching_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2403:13
#38 0xf8e694 in JOIN_CACHE::join_records(bool) /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158:9
#39 0xc9da16 in sub_select_cache(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192:16

previously allocated by thread T15 here:
#0 0x7ca5fd in malloc (/usr/local/mysql/bin/mariadbd+0x7ca5fd)
#1 0x22a6308 in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89:29
#2 0x228fff9 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71:10
#3 0x228fff9 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339:29
#4 0x10f83ec in Field::operator new(unsigned long, st_mem_root*) /home/wx/mariadb-11.3.0/sql/field.h:771:12
#5 0x10f83ec in Type_handler_long::make_table_field_from_def(TABLE_SHARE*, st_mem_root*, st_mysql_const_lex_string const*, Record_addr const&, Bit_addr const&, Column_definition_attributes const*, unsigned int) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:8134:10
#6 0x10cac4a in Type_handler_int_result::make_table_field(st_mem_root*, st_mysql_const_lex_string const*, Record_addr const&, Type_all_attributes const&, TABLE_SHARE*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:3573:10
#7 0x110c447 in Type_handler::make_and_init_table_field(st_mem_root*, st_mysql_const_lex_string const*, Record_addr const&, Type_all_attributes const&, TABLE*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:3558:17
#8 0x110c447 in Item::tmp_table_field_from_field_type(st_mem_root*, TABLE*) /home/wx/mariadb-11.3.0/sql/item.h:914:15
#9 0x110c447 in Item::create_tmp_field_ex_simple(st_mem_root*, TABLE*, Tmp_field_src*, Tmp_field_param const*) /home/wx/mariadb-11.3.0/sql/item.h:935:12
#10 0x110c447 in Item_cache::create_tmp_field_ex(st_mem_root*, TABLE*, Tmp_field_src*, Tmp_field_param const*) /home/wx/mariadb-11.3.0/sql/item.h:7119:12
#11 0xc8940f in create_tmp_field(TABLE*, Item*, Item**, Field, Field*, bool, bool, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:20823:24
#12 0xc8c548 in Create_tmp_table::add_fields(THD*, TABLE*, TMP_TABLE_PARAM*, List<Item>&) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21261:9
#13 0xc36790 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21920:13
#14 0xff0d1e in Expression_cache_tmptable::init() /home/wx/mariadb-11.3.0/sql/sql_expression_cache.cc:121:22
#15 0x136b52a in Item_cache_wrapper::init_on_demand() /home/wx/mariadb-11.3.0/sql/item.cc:8775:19
#16 0x136b52a in Item_cache_wrapper::check_cache() /home/wx/mariadb-11.3.0/sql/item.cc:8899:5
#17 0x136b52a in Item_cache_wrapper::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.cc:9017:22
#18 0x1479db3 in Item_func_ord::val_int() /home/wx/mariadb-11.3.0/sql/item_func.cc:3283:24
#19 0x14c39f5 in Item::to_longlong_null() /home/wx/mariadb-11.3.0/sql/item.h:1452:18
#20 0x14c39f5 in Func_handler_shift_left_int_to_ulonglong::to_longlong_null(Item_handled_func*) const /home/wx/mariadb-11.3.0/sql/item_func.cc:2189:34
#21 0x1413061 in Item_handled_func::Handler_int::val_int(Item_handled_func*) const /home/wx/mariadb-11.3.0/sql/item_func.h:696:26
#22 0x13552b7 in Item::save_int_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6843:16
#23 0x13554a8 in Item::save_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6853:30
#24 0xc98531 in copy_funcs(Item*, THD const) /home/wx/mariadb-11.3.0/sql/sql_select.cc:28843:11
#25 0xc98531 in end_update(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:25093:7
#26 0xc9e283 in evaluate_join_record(JOIN*, st_join_table*, int) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677:11
#27 0xbe3395 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444:9
#28 0xc45120 in do_select(JOIN*, Procedure*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961:14
#29 0xc45120 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941:50
#30 0xc428e8 in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718:8
#31 0x15d8105 in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159:23
#32 0x15b3edb in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812:21
#33 0x15b9772 in Item_singlerow_subselect::val_int() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1462:8
#34 0x1376611 in Item_cache_int::cache_value() /home/wx/mariadb-11.3.0/sql/item.cc:10161:19
#35 0x136aa6b in Item_cache_wrapper::cache() /home/wx/mariadb-11.3.0/sql/item.cc:8915:15
#36 0x136aa6b in Item_cache_wrapper::val_int() /home/wx/mariadb-11.3.0/sql/item.cc:8969:3
#37 0x1464416 in Item_func_mul::int_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:1380:24
#38 0x145ddc5 in Item_func_hybrid_field_type::val_real_from_int_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:827:20
#39 0x1461dd3 in Item_func_plus::real_op() /home/wx/mariadb-11.3.0/sql/item_func.cc:1103:26
#40 0x13b08fc in Arg_comparator::compare_real() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:845:15

Thread T15 created by T0 here:
#0 0x7b502a in pthread_create (/usr/local/mysql/bin/mariadbd+0x7b502a)
#1 0x1a00edd in my_thread_create(unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52:10
#2 0x1a00edd in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252:15
#3 0x80e649 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139:11
#4 0x80e649 in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150:19
#5 0x80f608 in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212:3
#6 0x80f608 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274:5
#7 0x80caa8 in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398:9
#8 0x8051de in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045:3
#9 0x7ffff7614082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/sql/item_sum.cc:2958:28 in Item_sum_bit::update_field()
Shadow bytes around the buggy address:
0x0c3280018800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3280018810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3280018820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3280018830: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3280018840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3280018850: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd
0x0c3280018860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3280018870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3280018880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3280018890: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c32800188a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==81210==ABORTING

And will randomly trigger Segmentation fault in release build.
GDB info:
Thread 17 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe011a700 (LWP 45912)]
0x00005555560be206 in Item_sum_bit::update_field (this=0x7fff98048780)
at /home/wx/mariadb-11.3.0/sql/item_sum.cc:2959
2959 bits= uint8korr(res);

#0 0x00005555560be206 in Item_sum_bit::update_field (this=0x7fff98048780)
at /home/wx/mariadb-11.3.0/sql/item_sum.cc:2959
#1 0x0000555555ddb4e5 in update_tmptable_sum_func (tmp_table=<optimized out>,
func_ptr=0x7fff980946e0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:28775
#2 end_update (join=0x7fff9801f7f0, join_tab=0x7fff980a0598, end_of_records=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:25082
#3 0x0000555555dad6d4 in evaluate_join_record (join=join@entry=0x7fff9801f7f0,
join_tab=join_tab@entry=0x7fff980a0120, error=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#4 0x0000555555dbf874 in sub_select (join=0x7fff9801f7f0, join_tab=0x7fff980a0120,
end_of_records=false) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
#5 0x0000555555df19b2 in do_select (procedure=<optimized out>, join=0x7fff9801f7f0)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#6 JOIN::exec_inner (this=this@entry=0x7fff9801f7f0)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#7 0x0000555555df1d78 in JOIN::exec (this=0x7fff9801f7f0)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#8 0x00005555560b1422 in subselect_single_select_engine::exec (this=0x7fff9804ba10)
at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159
#9 0x00005555560b040c in Item_subselect::exec (this=0x7fff9804b880)
at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#10 0x00005555560afd03 in Item_singlerow_subselect::val_int (this=0x7fff9804b880)
at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1462
#11 0x0000555555fefb79 in Item_cache_int::cache_value (this=0x7fff980a51f8)
at /home/wx/mariadb-11.3.0/sql/item.cc:10161
#12 0x00005555560052ac in Item_cache_wrapper::cache (this=0x7fff980a5150)
at /home/wx/mariadb-11.3.0/sql/item.cc:8915
#13 Item_cache_wrapper::val_int (this=0x7fff980a5150)
at /home/wx/mariadb-11.3.0/sql/item.cc:8969
#14 Item_cache_wrapper::val_int (this=0x7fff980a5150)
at /home/wx/mariadb-11.3.0/sql/item.cc:8952
#15 0x000055555604b9ce in Item_func_mul::int_op (this=0x7fff9801c740)
at /home/wx/mariadb-11.3.0/sql/item_func.cc:1380
#16 0x000055555604e139 in Item_func_hybrid_field_type::val_real_from_int_op (
this=0x7fff9801c740) at /home/wx/mariadb-11.3.0/sql/item_func.cc:827
#17 0x000055555604afe1 in Item_func_plus::real_op (this=0x7fff9801c8c0)
at /home/wx/mariadb-11.3.0/sql/item_func.cc:1103
#18 0x000055555601036f in Arg_comparator::compare_real (this=0x7fff9801cb60)
at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:845
#19 0x0000555556010caf in Arg_comparator::compare (this=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#20 Item_func_eq::val_int (this=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#21 0x0000555555ec7e3c in SQL_SELECT::skip_record (this=<optimized out>, thd=0x7fff98000c58)
at /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
#22 JOIN_CACHE::check_match (rec_ptr=0x7fff980544b8 "\002", this=0x7fff9809adb0)
at /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2560
#23 JOIN_CACHE::generate_full_extensions (this=0x7fff9809adb0, rec_ptr=0x7fff980544b8 "\002")
at /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2503
#24 0x0000555555ec8297 in JOIN_CACHE::join_matching_records (this=0x7fff9809adb0,
skip_last=false) at /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2403
#25 0x0000555555ec7bf3 in JOIN_CACHE::join_records (this=this@entry=0x7fff9809adb0,
skip_last=skip_last@entry=false) at /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
#26 0x0000555555dbfcba in sub_select_cache (join=0x7fff9801de00, join_tab=0x7fff9809a048,
end_of_records=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
#27 0x0000555555df1814 in do_select (procedure=<optimized out>, join=0x7fff9801de00)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#28 JOIN::exec_inner (this=this@entry=0x7fff9801de00)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#29 0x0000555555df1d78 in JOIN::exec (this=this@entry=0x7fff9801de00)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#30 0x0000555555defe1c in mysql_select (thd=thd@entry=0x7fff98000c58, tables=0x7fff98014e48,
fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0,
select_options=<optimized out>, result=0x7fff9801ddd8, unit=0x7fff98004ee8,
select_lex=0x7fff98013248) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
#31 0x0000555555df0607 in handle_select (thd=thd@entry=0x7fff98000c58,
lex=lex@entry=0x7fff98004e08, result=result@entry=0x7fff9801ddd8,
setup_tables_done_option=setup_tables_done_option@entry=0)
at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#32 0x0000555555d6de41 in execute_sqlcom_select (thd=thd@entry=0x7fff98000c58,
all_tables=0x7fff98014e48) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#33 0x0000555555d7c2aa in mysql_execute_command (thd=thd@entry=0x7fff98000c58,
is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)
at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#34 0x0000555555d68c27 in mysql_parse (thd=0x7fff98000c58, rawbuf=<optimized out>,
length=<optimized out>, parser_state=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#35 0x0000555555d74fdd in dispatch_command (command=command@entry=COM_QUERY,
thd=thd@entry=0x7fff98000c58, packet=packet@entry=0x7fff98008509 "",
packet_length=packet_length@entry=723, blocking=blocking@entry=true)
at /home/wx/mariadb-11.3.0/sql/sql_class.h:251
#36 0x0000555555d7721e in do_command (thd=0x7fff98000c58, blocking=blocking@entry=true)
at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#37 0x0000555555e9a617 in do_handle_one_connection (connect=<optimized out>,
connect@entry=0x555557e0d2b8, put_in_cache=put_in_cache@entry=true)
at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#38 0x0000555555e9a94d in handle_one_connection (arg=arg@entry=0x555557e0d2b8)
at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#39 0x00005555561e658d in pfs_spawn_thread (arg=0x555557db6858)
at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#40 0x00007ffff7b48609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#41 0x00007ffff7719133 in clone () from /lib/x86_64-linux-gnu/libc.so.6