Server crash in JOIN::transform_in_predicates_into_in_subq on 2nd execution of PS with a mix of collations

CREATE TABLE t1 (a INT, b VARCHAR(1), c VARCHAR(1)) CHARACTER SET eucjpms;

CREATE TABLE t2 (d VARCHAR(1)) CHARACTER SET latin1;

CREATE TABLE t3 (e VARCHAR(1), f INT) CHARACTER SET utf8;

# Optional, also fails with empty tables

INSERT INTO t1 VALUES (1,'x','x'),(2,'x','x');

INSERT INTO t2 VALUES ('x'),('x');

INSERT INTO t3 VALUES ('x',1),('x',2);

PREPARE stmt FROM 'SELECT * FROM t1 WHERE t1.c IN (SELECT d FROM t2) AND t1.b IN (SELECT e FROM t3 WHERE f = t1.a)';

--error ER_CANT_AGGREGATE_2COLLATIONS

EXECUTE stmt;

--error ER_CANT_AGGREGATE_2COLLATIONS

EXECUTE stmt;

# Cleanup

DROP TABLE t1, t2, t3;

==2739158==ERROR: AddressSanitizer: use-after-poison on address 0x62b0000a2588 at pc 0x561c19672376 bp 0x7f25e2674330 sp 0x7f25e2674328

READ of size 8 at 0x62b0000a2588 thread T27

    #0 0x561c19672375 in JOIN::transform_in_predicates_into_in_subq(THD*) /data/bld/10.4-asan/sql/sql_tvc.cc:1117

    #1 0x561c1956ade5 in convert_join_subqueries_to_semijoins(JOIN*) /data/bld/10.4-asan/sql/opt_subselect.cc:1138

    #2 0x561c19152c6e in JOIN::optimize_inner() /data/bld/10.4-asan/sql/sql_select.cc:1987

    #3 0x561c1915053a in JOIN::optimize() /data/bld/10.4-asan/sql/sql_select.cc:1731

    #4 0x561c19171406 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/bld/10.4-asan/sql/sql_select.cc:4832

    #5 0x561c19141eda in handle_select(THD*, LEX*, select_result*, unsigned long) /data/bld/10.4-asan/sql/sql_select.cc:442

    #6 0x561c190ac77b in execute_sqlcom_select /data/bld/10.4-asan/sql/sql_parse.cc:6521

    #7 0x561c19099b41 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:3978

    #8 0x561c19109b52 in Prepared_statement::execute(String*, bool) /data/bld/10.4-asan/sql/sql_prepare.cc:5025

    #9 0x561c19105192 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/bld/10.4-asan/sql/sql_prepare.cc:4472

    #10 0x561c190feed6 in mysql_sql_stmt_execute(THD*) /data/bld/10.4-asan/sql/sql_prepare.cc:3531

    #11 0x561c19099b86 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:3994

    #12 0x561c190b5a6a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:8060

    #13 0x561c1908bae1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:1857

    #14 0x561c19088650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378

    #15 0x561c1948ed14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419

    #16 0x561c1948e62b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323

    #17 0x7f26044a8043 in start_thread nptl/pthread_create.c:442

    #18 0x7f260452861b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x62b0000a2588 is located 5000 bytes inside of 24608-byte region [0x62b0000a1200,0x62b0000a7220)

allocated by thread T27 here:

    #0 0x7f2604ab89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x561c1ac2efd2 in my_malloc /data/bld/10.4-asan/mysys/my_malloc.c:101

    #2 0x561c1ac0b7da in reset_root_defaults /data/bld/10.4-asan/mysys/my_alloc.c:155

    #3 0x561c18f6fa1c in THD::init_for_queries() /data/bld/10.4-asan/sql/sql_class.cc:1385

    #4 0x561c1948df47 in prepare_new_connection_state(THD*) /data/bld/10.4-asan/sql/sql_connect.cc:1253

    #5 0x561c1948e671 in thd_prepare_connection(THD*) /data/bld/10.4-asan/sql/sql_connect.cc:1338

    #6 0x561c1948ec73 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1409

    #7 0x561c1948e62b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323

    #8 0x7f26044a8043 in start_thread nptl/pthread_create.c:442

Thread T27 created by T0 here:

    #0 0x7f2604a49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x561c1ac8fa28 in spawn_thread_noop /data/bld/10.4-asan/mysys/psi_noop.c:187

    #2 0x561c18d8ff89 in inline_mysql_thread_create /data/bld/10.4-asan/include/mysql/psi/mysql_thread.h:1275

    #3 0x561c18da7714 in create_thread_to_handle_connection(CONNECT*) /data/bld/10.4-asan/sql/mysqld.cc:6296

    #4 0x561c18da7e5f in create_new_thread(CONNECT*) /data/bld/10.4-asan/sql/mysqld.cc:6366

    #5 0x561c18da832d in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.4-asan/sql/mysqld.cc:6464

    #6 0x561c18da91d9 in handle_connections_sockets() /data/bld/10.4-asan/sql/mysqld.cc:6622

    #7 0x561c18da6e77 in mysqld_main(int, char**) /data/bld/10.4-asan/sql/mysqld.cc:5954

    #8 0x561c18d8e0b8 in main /data/bld/10.4-asan/sql/main.cc:25

    #9 0x7f26044461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison /data/bld/10.4-asan/sql/sql_tvc.cc:1117 in JOIN::transform_in_predicates_into_in_subq(THD*)

Shadow bytes around the buggy address:

  0x0c568000c460: 00 00 f7 00 00 f7 00 00 00 00 00 00 00 00 00 00

  0x0c568000c470: 00 00 00 00 00 00 00 00 f7 00 00 f7 f7 f7 f7 f7

  0x0c568000c480: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c568000c490: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c568000c4a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

=>0x0c568000c4b0: f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c568000c4c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c568000c4d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c568000c4e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c568000c4f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c568000c500: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==2739158==ABORTING