Heap-Use-After-Free at /mariadb-11.3.0/strings/strcoll.inl:137

Run these queries in debug build:

CREATE TABLE t0 ( c48 DOUBLE ( 188 , 18 ) ) ;
INSERT INTO t0 VALUES ( -19 ) , ( -33 ) ;
CREATE INDEX i0 ON t0 ( c48 ) ;
INSERT INTO t0 VALUES ( -77 ) , ( 118 ) ;
SELECT t0 . c48 AS c35 FROM ( SELECT TRIM( LEADING FROM c48 ) AS c9 FROM t0 ) AS t1 JOIN t0 ON t0 . c48 = t1 . c9 IN ( SELECT CONV ( t1 . c9 = SPACE ( c9 ) = SPACE ( SQRT ( SPACE ( FLOOR ( 59 ) ) ) ) , TRIM( LEADING FROM RAND ( ) ) , MOD ( 98 , 28 ) ) AS c56 FROM t0 ) ;

Will trigger Heap-Use-After-Free.
ASAN info:
=================================================================
==6618==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000035088 at pc 0x55555902fc59 bp 0x7fffd1638b00 sp 0x7fffd1638af0
READ of size 1 at 0x615000035088 thread T15
#0 0x55555902fc58 in my_scan_weight_utf8mb4_general_ci /home/wx/mariadb-11.3.0/strings/strcoll.inl:137
#1 0x55555903098d in my_strnncollsp_utf8mb4_general_ci /home/wx/mariadb-11.3.0/strings/strcoll.inl:317
#2 0x55555745c657 in charset_info_st::strnncollsp(char const*, unsigned long, char const*, unsigned long) const /home/wx/mariadb-11.3.0/include/m_ctype.h:1021
#3 0x555557485f2d in sortcmp(Binary_string const*, Binary_string const*, charset_info_st const*) /home/wx/mariadb-11.3.0/sql/sql_string.cc:868
#4 0x555557be9d2f in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:777
#5 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#6 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#7 0x555557b6efea in Item::val_decimal_from_int(my_decimal*) /home/wx/mariadb-11.3.0/sql/item.cc:343
#8 0x555556ea8f22 in Item_int_func::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_func.h:1167
#9 0x55555789a035 in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
#10 0x555557beaf4a in Arg_comparator::compare_decimal() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:865
#11 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#12 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#13 0x555557c706e3 in Item_int_func::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_func.cc:760
#14 0x555557d2465d in Item_func_conv::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3882
#15 0x555557be9c30 in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:773
#16 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#17 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#18 0x5555578b4b6d in Type_handler_int_result::Item_val_bool(Item*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082
#19 0x555556e147f5 in Item::val_bool() /home/wx/mariadb-11.3.0/sql/item.h:1701
#20 0x555557c17d31 in Item_cond_or::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5542
#21 0x5555573b05fa in Item_func_trig_cond::val_int() (/usr/local/mysql/bin/mariadbd+0x1e5c5fa)
#22 0x555557360f51 in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23545
#23 0x5555573601c1 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
#24 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#25 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#26 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#27 0x555557dce72e in subselect_single_select_engine::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4159
#28 0x555557da9c84 in Item_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#29 0x555557dab290 in Item_in_subselect::exec() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:994
#30 0x555557db650e in Item_in_subselect::val_bool() /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1991
#31 0x555556e14cd3 in Item::val_bool_result() /home/wx/mariadb-11.3.0/sql/item.h:1797
#32 0x555557bf3f01 in Item_in_optimizer::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1664
#33 0x555557ba521e in Item::save_int_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6843
#34 0x5555578b2241 in Type_handler_int_result::Item_save_in_field(Item*, Field*, bool) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:4341
#35 0x555557ba540a in Item::save_in_field(Field*, bool) /home/wx/mariadb-11.3.0/sql/item.cc:6853
#36 0x5555573b87a9 in store_key_item::copy_inner() /home/wx/mariadb-11.3.0/sql/sql_select.h:2142
#37 0x5555573b7c68 in store_key::copy(THD*) /home/wx/mariadb-11.3.0/sql/sql_select.h:2035
#38 0x55555737ce68 in cp_buffer_from_ref(THD*, TABLE*, st_table_ref*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:27348
#39 0x555557365816 in join_read_always_key /home/wx/mariadb-11.3.0/sql/sql_select.cc:24224
#40 0x555557360005 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23441
#41 0x55555736194c in evaluate_join_record /home/wx/mariadb-11.3.0/sql/sql_select.cc:23677
#42 0x5555573601c1 in sub_select(JOIN*, st_join_table*, bool) /home/wx/mariadb-11.3.0/sql/sql_select.cc:23444
#43 0x55555735dadc in do_select /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#44 0x5555572dbfe8 in JOIN::exec_inner() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#45 0x5555572d939f in JOIN::exec() /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#46 0x5555572ddbaa in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
#47 0x5555572ad189 in handle_select(THD*, LEX*, select_result*, unsigned long long) /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#48 0x5555571ce582 in execute_sqlcom_select /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#49 0x5555571becf5 in mysql_execute_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#50 0x5555571d95e1 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#51 0x5555571b1236 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#52 0x5555571adf7b in do_command(THD*, bool) /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#53 0x55555768e556 in do_handle_one_connection(CONNECT*, bool) /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#54 0x55555768deb3 in handle_one_connection /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#55 0x5555582fa34f in pfs_spawn_thread /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#56 0x7ffff7115608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
#57 0x7ffff6ce8132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

0x615000035088 is located 136 bytes inside of 492-byte region [0x615000035000,0x6150000351ec)
freed by thread T15 here:
#0 0x7ffff769040f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x555558f38d44 in free_memory /home/wx/mariadb-11.3.0/mysys/safemalloc.c:297
#2 0x555558f38181 in sf_free /home/wx/mariadb-11.3.0/mysys/safemalloc.c:203
#3 0x555558f05c31 in my_free /home/wx/mariadb-11.3.0/mysys/my_malloc.c:217
#4 0x555556e1020b in Binary_string::free_buffer() /home/wx/mariadb-11.3.0/sql/sql_string.h:308
#5 0x555556e107ab in Binary_string::free() /home/wx/mariadb-11.3.0/sql/sql_string.h:769
#6 0x555556e10607 in Binary_string::~Binary_string() /home/wx/mariadb-11.3.0/sql/sql_string.h:352
#7 0x555556e10a2f in String::~String() /home/wx/mariadb-11.3.0/sql/sql_string.h:881
#8 0x555557ae81c3 in StringBuffer<22ul>::~StringBuffer() /home/wx/mariadb-11.3.0/sql/sql_string.h:1194
#9 0x555557d0022e in Item_str_func::val_int() /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:164
#10 0x555557bb53bc in Item_direct_ref::val_int() /home/wx/mariadb-11.3.0/sql/item.cc:8680
#11 0x555557bd2b3a in Item_direct_view_ref::val_int() /home/wx/mariadb-11.3.0/sql/item.h:6141
#12 0x555557d20f8e in Item_func_space::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3537
#13 0x555557be9c30 in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:773
#14 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#15 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#16 0x555557b6efea in Item::val_decimal_from_int(my_decimal*) /home/wx/mariadb-11.3.0/sql/item.cc:343
#17 0x555556ea8f22 in Item_int_func::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_func.h:1167
#18 0x55555789a035 in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
#19 0x555557beaf4a in Arg_comparator::compare_decimal() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:865
#20 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#21 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#22 0x555557c706e3 in Item_int_func::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_func.cc:760
#23 0x555557d2465d in Item_func_conv::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3882
#24 0x555557be9c30 in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:773
#25 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#26 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#27 0x5555578b4b6d in Type_handler_int_result::Item_val_bool(Item*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082
#28 0x555556e147f5 in Item::val_bool() /home/wx/mariadb-11.3.0/sql/item.h:1701
#29 0x555557c17d31 in Item_cond_or::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5542

previously allocated by thread T15 here:
#0 0x7ffff7690808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x555558f37b35 in sf_malloc /home/wx/mariadb-11.3.0/mysys/safemalloc.c:126
#2 0x555558f04d7e in my_malloc /home/wx/mariadb-11.3.0/mysys/my_malloc.c:89
#3 0x555557480581 in Binary_string::real_alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.cc:45
#4 0x555556eddc40 in Binary_string::alloc(unsigned long) /home/wx/mariadb-11.3.0/sql/sql_string.h:792
#5 0x555557a9c458 in Field_double::val_str(String*, String*) /home/wx/mariadb-11.3.0/sql/field.cc:5103
#6 0x555557b89713 in Item_field::val_str(String*) /home/wx/mariadb-11.3.0/sql/item.cc:3328
#7 0x555557d1549d in Item_func_ltrim::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:2352
#8 0x555557d001ed in Item_str_func::val_int() /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:165
#9 0x555557bb53bc in Item_direct_ref::val_int() /home/wx/mariadb-11.3.0/sql/item.cc:8680
#10 0x555557bd2b3a in Item_direct_view_ref::val_int() /home/wx/mariadb-11.3.0/sql/item.h:6141
#11 0x555557d20f8e in Item_func_space::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3537
#12 0x555557be9c30 in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:773
#13 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#14 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#15 0x555557b6efea in Item::val_decimal_from_int(my_decimal*) /home/wx/mariadb-11.3.0/sql/item.cc:343
#16 0x555556ea8f22 in Item_int_func::val_decimal(my_decimal*) /home/wx/mariadb-11.3.0/sql/item_func.h:1167
#17 0x55555789a035 in VDec::VDec(Item*) /home/wx/mariadb-11.3.0/sql/sql_type.cc:293
#18 0x555557beaf4a in Arg_comparator::compare_decimal() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:865
#19 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#20 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#21 0x555557c706e3 in Item_int_func::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_func.cc:760
#22 0x555557d2465d in Item_func_conv::val_str(String*) /home/wx/mariadb-11.3.0/sql/item_strfunc.cc:3882
#23 0x555557be9c30 in Arg_comparator::compare_string() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:773
#24 0x555557c2e1d3 in Arg_comparator::compare() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#25 0x555557bf5bda in Item_func_eq::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#26 0x5555578b4b6d in Type_handler_int_result::Item_val_bool(Item*) const /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082
#27 0x555556e147f5 in Item::val_bool() /home/wx/mariadb-11.3.0/sql/item.h:1701
#28 0x555557c17d31 in Item_cond_or::val_int() /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5542
#29 0x5555573b05fa in Item_func_trig_cond::val_int() (/usr/local/mysql/bin/mariadbd+0x1e5c5fa)

Thread T15 created by T0 here:
#0 0x7ffff75bd815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
#1 0x5555582f5f2c in my_thread_create /home/wx/mariadb-11.3.0/storage/perfschema/my_thread.h:52
#2 0x5555582fa742 in pfs_spawn_thread_v1 /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2252
#3 0x555556dea0f9 in inline_mysql_thread_create /home/wx/mariadb-11.3.0/include/mysql/psi/mysql_thread.h:1139
#4 0x555556e02aac in create_thread_to_handle_connection(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6150
#5 0x555556e0313c in create_new_thread(CONNECT*) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6212
#6 0x555556e034a9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6274
#7 0x555556e03e9f in handle_connections_sockets() /home/wx/mariadb-11.3.0/sql/mysqld.cc:6398
#8 0x555556e022b9 in mysqld_main(int, char**) /home/wx/mariadb-11.3.0/sql/mysqld.cc:6045
#9 0x555556de91ac in main /home/wx/mariadb-11.3.0/sql/main.cc:34
#10 0x7ffff6bed082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /home/wx/mariadb-11.3.0/strings/strcoll.inl:137 in my_scan_weight_utf8mb4_general_ci
Shadow bytes around the buggy address:
0x0c2a7fffe9c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2a7fffe9d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2a7fffe9e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa fa
0x0c2a7fffe9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2a7fffea00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c2a7fffea10: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2a7fffea20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2a7fffea30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
0x0c2a7fffea40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2a7fffea50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2a7fffea60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==6618==ABORTING