Heap-Use-After-Free at /mariadb-11.3.0/sql/sql_select.cc:15810

Run these queries in debug build:

CREATE TABLE x ( x TEXT ) ;
INSERT INTO x ( x ) VALUES ( 1 ) ;
UPDATE x SET x = ( SELECT 1.000000 WHERE - 'x' >= x IS NOT NULL = ( CASE x IN ( SELECT x FROM x WHERE x BETWEEN 1 AND 1 GROUP BY x , x HAVING CASE WHEN - 'x' >= x IS NOT NULL = ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1 - x FROM x INTERSECT SELECT * FROM x ) SELECT x FROM x WHERE 1 = x ) < x AND x < 'x' ) THEN 'x' ELSE x END ) WHEN x < ( WITH x ( x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x , x ) AS ( WITH x AS ( SELECT ( SELECT x FROM x WHERE 1 = x ) AS x FROM x GROUP BY - CASE x WHEN CASE 1 WHEN 1 THEN 1 / 1 WHEN 1 THEN 1 ELSE 1 / ( WITH x ( x ) AS ( WITH x ( x ) AS ( SELECT 1 UNION SELECT 1 - x FROM x ) SELECT 1 UNION SELECT x + 1 FROM x ) SELECT DISTINCT * FROM x UNION SELECT * FROM x ORDER BY x ) END THEN FALSE < ( WITH x ( x ) AS ( SELECT 1 EXCEPT SELECT x + 1 FROM x ) SELECT * FROM x WHERE x > 1 AND x = CASE WHEN x >= 1 THEN ( - ( SELECT 1.000000 BETWEEN ( x = 1 AND x < ( WITH x ( x ) AS ( WITH x AS ( SELECT 'x' AS x ) SELECT 1 UNION SELECT 1 - x FROM x ) SELECT * FROM x WHERE ( x , x ) NOT IN ( SELECT TRUE , x FROM x ) ) ) AND 1 FROM x WHERE 1 = x ) >= x IS NOT NULL = ( 1 < x AND x < 'x' ) IS NOT NULL ) ELSE x END NOT LIKE 1 + 1 + 1 + 1 + 1 + 1 + 1 + ( SELECT ( SELECT x FROM x WHERE 1 = x ) AS x FROM x WHERE ( SELECT 1 FROM x ORDER BY x < 1 OR ( x > 1 AND CASE WHEN 1 = 1 THEN 1 / 1 WHEN 1 = 1 THEN 1 ELSE 1 / 1 END < 1 ) ) != ( x IN ( SELECT DISTINCT x AS x FROM x WHERE x = x + 1 ORDER BY ( WITH x ( x ) AS ( SELECT 1 UNION SELECT 1 - x FROM x WHERE ( x = 1 ) OR ( x = 1 ) OR ( x BETWEEN 1 AND 1 ) OR ( x = 1 ) ) SELECT x ORDER BY 1 ) ) ) >= 1 WINDOW x AS ( PARTITION BY x ORDER BY x DESC ) ) UNION SELECT * FROM x ) BETWEEN 1 AND 1 ELSE CASE WHEN x % 1 != 1 THEN x END END > 1 WINDOW x AS ( PARTITION BY x ORDER BY x DESC ) ) SELECT ( SELECT 1.000000 FROM ( SELECT x FROM x GROUP BY x ) AS x WHERE - 'x' >= x IS NOT NULL = ( x IN ( x NOT LIKE ( SELECT x ) + x IS NOT NULL ) AND x NOT IN ( 1 , 1 ) ) ) IS NULL FROM x ) SELECT 1 FROM x ) THEN 'x' WHEN 1 >= x LIKE ( SELECT x FROM ( SELECT ( SELECT x FROM x WHERE 1 = x ) AS x FROM x WINDOW x AS ( PARTITION BY x ORDER BY x DESC ) ORDER BY x , x ) AS x WHERE ( x = 'x' OR x = 'x' ) AND x IS NOT NULL GROUP BY x ) THEN 1 END < x AND x < 'x' ) ) WHERE x = 1 ;

Will trigger heap-use-after-free.
ASAN info:
=================================================================
==105373==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f0000524b8 at pc 0x000000c70740 bp 0x7fffd242aa70 sp 0x7fffd242aa68
READ of size 8 at 0x61f0000524b8 thread T15
#0 0xc7073f in st_join_table::cleanup() /home/wx/mariadb-11.3.0/sql/sql_select.cc:15810:15
#1 0xc48292 in JOIN::cleanup(bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:16335:16
#2 0xc47951 in JOIN::destroy() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4970:3
#3 0xdeee11 in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2905:18
#4 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#5 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#6 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#7 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#8 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#9 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#10 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#11 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#12 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#13 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#14 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#15 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#16 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#17 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#18 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#19 0xdeef6b in st_select_lex::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2916:52
#20 0xde4577 in st_select_lex_unit::cleanup() /home/wx/mariadb-11.3.0/sql/sql_union.cc:2711:17
#21 0xcc3bee in Sql_cmd_dml::prepare(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc
#22 0xcc3eba in Sql_cmd_dml::execute(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33318:9
#23 0xb2ce81 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4361:27
#24 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#25 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#26 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#27 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#28 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#29 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#30 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#31 0x7ffff770f132 in clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x61f0000524b8 is located 56 bytes inside of 3136-byte region [0x61f000052480,0x61f0000530c0)
freed by thread T15 here:
#0 0x7ca37d in free (/usr/local/mysql/bin/mariadbd+0x7ca37d)
#1 0x22909f4 in root_free /home/wx/mariadb-11.3.0/mysys/my_alloc.c:83:5
#2 0x22909f4 in free_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:509:7
#3 0xc3da3d in free_tmp_table(THD*, TABLE*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:22713:3
#4 0x9b7233 in close_thread_tables(THD*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:882:7
#5 0x9cbb0d in open_tables_for_query(THD*, TABLE_LIST*, unsigned int*, unsigned int, DML_prelocking_strategy*) /home/wx/mariadb-11.3.0/sql/sql_base.cc:5750:5
#6 0xcc3b6a in Sql_cmd_dml::prepare(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33256:7
#7 0xcc3eba in Sql_cmd_dml::execute(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:33318:9
#8 0xb2ce81 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4361:27
#9 0xb1fe78 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734:18
#10 0xb19068 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893:7
#11 0xb20b70 in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406:17
#12 0xf03475 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445:11
#13 0xf02eb8 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347:5
#14 0x1a00c1a in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201:3
#15 0x7ffff79f7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8

previously allocated by thread T15 here:
#0 0x7ca5fd in malloc (/usr/local/mysql/bin/mariadbd+0x7ca5fd)
#1 0x22a6308 in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89:29
#2 0x228fff9 in root_alloc /home/wx/mariadb-11.3.0/mysys/my_alloc.c:71:10
#3 0x228fff9 in alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:339:29
#4 0x229068a in multi_alloc_root /home/wx/mariadb-11.3.0/mysys/my_alloc.c:412:24
#5 0xc8ae29 in Create_tmp_table::start(THD*, TMP_TABLE_PARAM*, st_mysql_const_lex_string const*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21053:8
#6 0xc36773 in create_tmp_table(THD*, TMP_TABLE_PARAM*, List<Item>&, st_order*, bool, bool, unsigned long long, unsigned long long, st_mysql_const_lex_string const*, bool, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:21919:22
#7 0xde6e5c in select_unit::create_result_table(THD*, List<Item>, bool, unsigned long long, st_mysql_const_lex_string const, bool, bool, bool, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_union.cc:354:17
#8 0xa53691 in mysql_derived_prepare(THD*, LEX*, TABLE_LIST*) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:876:32
#9 0xa57cc1 in mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_derived.cc:200:15
#10 0xe7cf8c in TABLE_LIST::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/table.cc:9651:9
#11 0xab86cb in LEX::handle_list_of_derived(TABLE_LIST*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.h:4579:43
#12 0xab86cb in st_select_lex::handle_derived(LEX*, unsigned int) /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4989:15
#13 0xbf2a77 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:1439:19
#14 0x15d5c2f in subselect_single_select_engine::prepare(THD*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3943:13
#15 0x15b1a8d in Item_subselect::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:296:22
#16 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#17 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#18 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#19 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#20 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#21 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#22 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#23 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#24 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#25 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#26 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#27 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#28 0x13c2a9e in Item_func_case::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:3148:24
#29 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#30 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#31 0x13e04eb in Item_func_like::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5879:24
#32 0x145937f in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#33 0x145937f in Item_func::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_func.cc:349:19
#34 0x13d7fdb in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#35 0x13d7fdb in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1156:12
#36 0x13d7fdb in Item::fix_fields_if_needed_for_bool(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1160:12
#37 0x13d7fdb in Item_cond::fix_fields(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:4941:15
#38 0x9d70b2 in Item::fix_fields_if_needed(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1147:30
#39 0x9d70b2 in Item::fix_fields_if_needed_for_scalar(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1156:12
#40 0x9d70b2 in Item::fix_fields_if_needed_for_bool(THD*, Item**) /home/wx/mariadb-11.3.0/sql/item.h:1160:12
#41 0x9d70b2 in setup_conds(THD*, TABLE_LIST*, List<TABLE_LIST>&, Item**) /home/wx/mariadb-11.3.0/sql/sql_base.cc:8888:19
#42 0xbf3348 in setup_without_group(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<TABLE_LIST>&, List<Item>&, List<Item>&, Item*, st_order, st_order*, List<Window_spec>&, List<Item_window_func>&, bool*, unsigned int*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:931:8
#43 0xbf3348 in JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:1531:7
#44 0xdec229 in st_select_lex_unit::prepare_join(THD*, st_select_lex*, select_result*, unsigned long long, bool) /home/wx/mariadb-11.3.0/sql/sql_union.cc:1103:22
#45 0xde1742 in st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_union.cc:1659:14
#46 0x15d5e56 in subselect_union_engine::prepare(THD*) /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3961:16

Thread T15 created by T0 here:
#0 0x7b502a in pthread_create (/usr/local/mysql/bin/mariadbd+0x7b502a)
#1 0x1a00edd in my_thread_create(unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52:10
#2 0x1a00edd in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252:15
#3 0x80e649 in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (void*), void*) /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139:11
#4 0x80e649 in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150:19
#5 0x80f608 in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212:3
#6 0x80f608 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274:5
#7 0x80caa8 in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398:9
#8 0x8051de in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045:3
#9 0x7ffff7614082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/sql/sql_select.cc:15810:15 in st_join_table::cleanup()
Shadow bytes around the buggy address:
0x0c3e80002440: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e80002450: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
0x0c3e80002460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3e80002470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3e80002480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c3e80002490: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd
0x0c3e800024a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e800024b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e800024c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e800024d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3e800024e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==105373==ABORTING