Use-After-Poison at /mariadb-11.3.0/sql/sql_derived.cc:924

CREATE TABLE x ( x INT ) ;

INSERT INTO x ( x ) VALUES ( 1 ) ;

UPDATE x SET x = 1 IN ( WITH RECURSIVE x ( x ) AS ( WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT x + 1 FROM x WHERE x = 1 AND ( x = 1 OR x = 1 OR x = 1 ) WINDOW x AS ( ORDER BY x ) , x AS ( ORDER BY x ) ) SELECT 1 UNION SELECT x FROM x WHERE x IN ( 1 , 1 , 1 ) ) SELECT 1 ) WHERE x = 1 ;

==91329==ERROR: AddressSanitizer: use-after-poison on address 0x6290000b5278 at pc 0x000000a5448a bp 0x7fffd242a790 sp 0x7fffd242a788

READ of size 8 at 0x6290000b5278 thread T15

    #0 0xa54489 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:924:7

    #1 0xa578e4 in mysql_handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:123:7

    #2 0xe1e19e in Multiupdate_prelocking_strategy::handle_end(THD*) /home/wx/mariadb-11.3.0/sql/sql_update.cc:1549:7

    #3 0x9c648f in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:4747:38

    #4 0x9cbaf7 in open_tables(THD*, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.h:267:10

    #5 0x9cbaf7 in open_tables_for_query(THD*, TABLE_LIST*, unsigned int*, unsigned int, DML_prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:5746:7

    #6 0xcc3b6a in Sql_cmd_dml::prepare(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33256:7

    #7 0xcc3eba in Sql_cmd_dml::execute(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33318:9

    #8 0xb2ce81 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4361:27

    #9 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18

    #10 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7

    #11 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17

    #12 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11

    #13 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5

    #14 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3

    #15 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8

    #16 0x7ffff770f132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x6290000b5278 is located 4216 bytes inside of 16400-byte region [0x6290000b4200,0x6290000b8210)

allocated by thread T15 here:

    #0 0x7ca5fd in malloc (/usr/local/mysql/bin/mariadbd+0x7ca5fd)

    #1 0x22a6308 in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89:29

    #2 0x228fff9 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71:10

    #3 0x228fff9 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339:29

    #4 0x11cc2c7 in Sql_alloc::operator new(unsigned long, st_mem_root*) /home/wx/mariadb-11.3.0/sql/sql_alloc.h:37:12

    #5 0x11cc2c7 in base_list::push_back(void*, st_mem_root*) /home/wx/mariadb-11.3.0/sql/sql_list.h:195:18

    #6 0x11cc2c7 in List<Item>::push_back(Item*, st_mem_root*) /home/wx/mariadb-11.3.0/sql/sql_list.h:505:23

    #7 0x11cc2c7 in add_value_to_list(THD*, Item*) /home/wx/mariadb-11.3.0/sql/sql_class.h:7520:31

    #8 0x11cc2c7 in MYSQLparse(THD*) /home/wx/mariadb-11.3.0/sql/sql_yacc.yy:13486:60

    #9 0xb47377 in parse_sql(THD*, Parser_state*, Object_creation_ctx*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:10109:46

    #10 0xb1fb8a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7686:15

    #11 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7

    #12 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17

    #13 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11

    #14 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5

    #15 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3

    #16 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8

Thread T15 created by T0 here:

    #0 0x7b502a in pthread_create (/usr/local/mysql/bin/mariadbd+0x7b502a)

    #1 0x1a00edd in my_thread_create(unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52:10

    #2 0x1a00edd in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252:15

    #3 0x80e649 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139:11

    #4 0x80e649 in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150:19

    #5 0x80f608 in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212:3

    #6 0x80f608 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274:5

    #7 0x80caa8 in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398:9

    #8 0x8051de in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045:3

    #9 0x7ffff7614082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: use-after-poison /home/wx/mariadb-11.3.0/sql/sql_derived.cc:924:7 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*)

Shadow bytes around the buggy address:

  0x0c528000e9f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c528000ea00: 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00 00

  0x0c528000ea10: 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00

  0x0c528000ea20: 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00

  0x0c528000ea30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0c528000ea40: 00 00 00 00 00 00 00 00 00 f7 00 f7 00 00 f7[f7]

  0x0c528000ea50: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c528000ea60: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c528000ea70: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c528000ea80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 00

  0x0c528000ea90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==91329==ABORTING