spider/bugfix.mdev_31338 'innodb'        [ fail ]

        Test ended at 2023-11-27 19:45:27

==3166715==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e0000229dc at pc 0x7f99290bc3c5 bp 0x7f9929e81b10 sp 0x7f9929e81b08

READ of size 4 at 0x61e0000229dc thread T29

    #0 0x7f99290bc3c4 in ha_spider::external_lock(THD*, int) /data/bld/10.4-asan/storage/spider/ha_spider.cc:1394

    #1 0x55cca107672e in handler::ha_external_lock(THD*, int) /data/bld/10.4-asan/sql/handler.cc:6562

    #2 0x55cca136d094 in unlock_external /data/bld/10.4-asan/sql/lock.cc:713

    #3 0x55cca136aadd in mysql_unlock_tables(THD*, st_mysql_lock*, bool) /data/bld/10.4-asan/sql/lock.cc:434

    #4 0x55cca136a921 in mysql_unlock_tables(THD*, st_mysql_lock*) /data/bld/10.4-asan/sql/lock.cc:418

    #5 0x55cca070225a in close_thread_tables(THD*) /data/bld/10.4-asan/sql/sql_base.cc:1027

    #6 0x55cca08ae916 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:6329

    #7 0x55cca08b9a6a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:8060

    #8 0x55cca088fae1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:1857

    #9 0x55cca088c650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378

    #10 0x55cca0c92d14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419

    #11 0x55cca0c9262b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323

    #12 0x7f993d0a8043 in start_thread nptl/pthread_create.c:442

    #13 0x7f993d12861b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x61e0000229dc is located 348 bytes inside of 2632-byte region [0x61e000022880,0x61e0000232c8)

freed by thread T29 here:

    #0 0x7f993d6b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52

    #1 0x55cca2433b71 in my_free /data/bld/10.4-asan/mysys/my_malloc.c:222

    #2 0x7f992908b10c in spider_free_mem(st_spider_transaction*, void*, unsigned long) /data/bld/10.4-asan/storage/spider/spd_malloc.cc:188

    #3 0x7f9928fbe276 in spider_free_conn(st_spider_conn*) /data/bld/10.4-asan/storage/spider/spd_conn.cc:1261

    #4 0x7f9928fb7691 in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /data/bld/10.4-asan/storage/spider/spd_conn.cc:315

    #5 0x7f9928f00488 in spider_free_trx_conn(st_spider_transaction*, bool) /data/bld/10.4-asan/storage/spider/spd_trx.cc:117

    #6 0x7f9928f1b407 in spider_commit(handlerton*, THD*, bool) /data/bld/10.4-asan/storage/spider/spd_trx.cc:3439

    #7 0x55cca1050516 in commit_one_phase_2 /data/bld/10.4-asan/sql/handler.cc:1835

    #8 0x55cca1050243 in ha_commit_one_phase(THD*, bool) /data/bld/10.4-asan/sql/handler.cc:1814

    #9 0x55cca104e92d in ha_commit_trans(THD*, bool) /data/bld/10.4-asan/sql/handler.cc:1620

    #10 0x55cca0cd015c in trans_commit_stmt(THD*) /data/bld/10.4-asan/sql/transaction.cc:437

    #11 0x55cca08ae8d7 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:6322

    #12 0x55cca08b9a6a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:8060

    #13 0x55cca088fae1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:1857

    #14 0x55cca088c650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378

    #15 0x55cca0c92d14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419

    #16 0x55cca0c9262b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323

    #17 0x7f993d0a8043 in start_thread nptl/pthread_create.c:442

previously allocated by thread T29 here:

    #0 0x7f993d6b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x55cca2432fd2 in my_malloc /data/bld/10.4-asan/mysys/my_malloc.c:101

    #2 0x7f992908b814 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /data/bld/10.4-asan/storage/spider/spd_malloc.cc:236

    #3 0x7f9928fb82cd in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /data/bld/10.4-asan/storage/spider/spd_conn.cc:478

    #4 0x7f9928fbd167 in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/bld/10.4-asan/storage/spider/spd_conn.cc:1087

    #5 0x7f9929021200 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/bld/10.4-asan/storage/spider/spd_table.cc:4836

    #6 0x7f99290b0c81 in ha_spider::open(char const*, int, unsigned int) /data/bld/10.4-asan/storage/spider/ha_spider.cc:360

    #7 0x55cca1057b03 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/bld/10.4-asan/sql/handler.cc:2824

    #8 0x55cca0bc2b59 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/bld/10.4-asan/sql/table.cc:4137

    #9 0x55cca0707df9 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/bld/10.4-asan/sql/sql_base.cc:2114

    #10 0x55cca071144f in open_and_process_table /data/bld/10.4-asan/sql/sql_base.cc:3915

    #11 0x55cca0713f0b in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/bld/10.4-asan/sql/sql_base.cc:4397

    #12 0x55cca0719026 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/bld/10.4-asan/sql/sql_base.cc:5344

    #13 0x55cca0672da3 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/bld/10.4-asan/sql/sql_base.h:503

    #14 0x55cca08afcfb in execute_sqlcom_select /data/bld/10.4-asan/sql/sql_parse.cc:6442

    #15 0x55cca089db41 in mysql_execute_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:3978

    #16 0x55cca08b9a6a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:8060

    #17 0x55cca088fae1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/bld/10.4-asan/sql/sql_parse.cc:1857

    #18 0x55cca088c650 in do_command(THD*) /data/bld/10.4-asan/sql/sql_parse.cc:1378

    #19 0x55cca0c92d14 in do_handle_one_connection(CONNECT*) /data/bld/10.4-asan/sql/sql_connect.cc:1419

    #20 0x55cca0c9262b in handle_one_connection /data/bld/10.4-asan/sql/sql_connect.cc:1323

    #21 0x7f993d0a8043 in start_thread nptl/pthread_create.c:442

Thread T29 created by T0 here:

    #0 0x7f993d649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x55cca2493a28 in spawn_thread_noop /data/bld/10.4-asan/mysys/psi_noop.c:187

    #2 0x55cca0593f89 in inline_mysql_thread_create /data/bld/10.4-asan/include/mysql/psi/mysql_thread.h:1275

    #3 0x55cca05ab714 in create_thread_to_handle_connection(CONNECT*) /data/bld/10.4-asan/sql/mysqld.cc:6296

    #4 0x55cca05abe5f in create_new_thread(CONNECT*) /data/bld/10.4-asan/sql/mysqld.cc:6366

    #5 0x55cca05ac32d in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.4-asan/sql/mysqld.cc:6464

    #6 0x55cca05ad1d9 in handle_connections_sockets() /data/bld/10.4-asan/sql/mysqld.cc:6622

    #7 0x55cca05aae77 in mysqld_main(int, char**) /data/bld/10.4-asan/sql/mysqld.cc:5954

    #8 0x55cca05920b8 in main /data/bld/10.4-asan/sql/main.cc:25

    #9 0x7f993d0461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /data/bld/10.4-asan/storage/spider/ha_spider.cc:1394 in ha_spider::external_lock(THD*, int)

Shadow bytes around the buggy address:

  0x0c3c7fffc4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c3c7fffc4f0: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3c7fffc500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3c7fffc510: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffc520: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c3c7fffc530: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd

  0x0c3c7fffc540: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffc550: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffc560: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffc570: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c3c7fffc580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==3166715==ABORTING

commit 0381197855c58e339ab5034b871ea9c0c2d61522

Author: Yuchen Pei <ycp@mariadb.com>

Date:   Fri Oct 20 18:05:54 2023 +1100

    MDEV-30014 Spider should not second guess server when locking / unlocking