UBSAN signed integer overflow: -X - Y cannot be represented in type 'int' in Item_nodeset_func_elementbyindex::val_native

SET sql_mode='';

CREATE TABLE t (c INT,c2 INT);

INSERT INTO t VALUES ('-9223372036854775808',0),(0,0);

SELECT * FROM t WHERE c2=IF(@i:=c,EXTRACTVALUE ('<a><b>b1</b><b>b2</b></a>','//b[$@i]'),0);

/test/server_dbg_san/sql/item_xmlfunc.cc:817:45: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'

    #0 0x55aeb839a89e in Item_nodeset_func_elementbyindex::val_native(THD*, Native*) /test/server_dbg_san/sql/item_xmlfunc.cc:817

    #1 0x55aeb841a066 in Item_nodeset_func::val_str(String*) /test/server_dbg_san/sql/item_xmlfunc.cc:161

    #2 0x55aeb83d4981 in Item_func_xml_extractvalue::val_str(String*) /test/server_dbg_san/sql/item_xmlfunc.cc:3010

    #3 0x55aeb6d4510a in Item::val_str_from_item(Item*, String*) /test/server_dbg_san/sql/item.h:871

    #4 0x55aeb6d4510a in Item_func_case_abbreviation2_switch::str_op(String*) /test/server_dbg_san/sql/item_cmpfunc.h:1203

    #5 0x55aeb77a22f5 in Item_func_hybrid_field_type::str_op_with_null_check(String*) /test/server_dbg_san/sql/item_func.h:884

    #6 0x55aeb77a22f5 in Item_func_hybrid_field_type::val_decimal_from_str_op(my_decimal*) /test/server_dbg_san/sql/item_func.cc:980

    #7 0x55aeb688e707 in Type_handler_string_result::Item_func_hybrid_field_type_val_decimal(Item_func_hybrid_field_type*, my_decimal*) const /test/server_dbg_san/sql/sql_type.cc:5670

    #8 0x55aeb5a871b6 in Item_func_hybrid_field_type::val_decimal(my_decimal*) /test/server_dbg_san/sql/item_func.h:959

    #9 0x55aeb69023ae in VDec::VDec(Item*) /test/server_dbg_san/sql/sql_type.cc:301

    #10 0x55aeb7488078 in Arg_comparator::compare_decimal() /test/server_dbg_san/sql/item_cmpfunc.cc:870

    #11 0x55aeb744556e in Arg_comparator::compare() /test/server_dbg_san/sql/item_cmpfunc.h:117

    #12 0x55aeb744556e in Item_func_eq::val_int() /test/server_dbg_san/sql/item_cmpfunc.cc:1806

    #13 0x55aeb5ca555e in evaluate_join_record /test/server_dbg_san/sql/sql_select.cc:21312

    #14 0x55aeb5d44fa9 in sub_select(JOIN*, st_join_table*, bool) /test/server_dbg_san/sql/sql_select.cc:21214

    #15 0x55aeb5f2a50c in do_select /test/server_dbg_san/sql/sql_select.cc:20731

    #16 0x55aeb5f2a50c in JOIN::exec_inner() /test/server_dbg_san/sql/sql_select.cc:4625

    #17 0x55aeb5f2bda0 in JOIN::exec() /test/server_dbg_san/sql/sql_select.cc:4405

    #18 0x55aeb5f19a31 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/server_dbg_san/sql/sql_select.cc:4882

    #19 0x55aeb5f1f0d6 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/server_dbg_san/sql/sql_select.cc:449

    #20 0x55aeb5b17ffc in execute_sqlcom_select /test/server_dbg_san/sql/sql_parse.cc:6417

    #21 0x55aeb5b7a540 in mysql_execute_command(THD*) /test/server_dbg_san/sql/sql_parse.cc:4022

    #22 0x55aeb5ae1cd1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/server_dbg_san/sql/sql_parse.cc:8196

    #23 0x55aeb5b5550a in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/server_dbg_san/sql/sql_parse.cc:1891

    #24 0x55aeb5b67350 in do_command(THD*) /test/server_dbg_san/sql/sql_parse.cc:1375

    #25 0x55aeb651a3d3 in do_handle_one_connection(CONNECT*, bool) /test/server_dbg_san/sql/sql_connect.cc:1415

    #26 0x55aeb651cb4d in handle_one_connection /test/server_dbg_san/sql/sql_connect.cc:1317

    #27 0x154ddabdd608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477

    #28 0x154dd9e52132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)

grep: /test/UBASAN_MD270224-mariadb-10.5.25-linux-x86_64-opt/log/master.err: No such file or directory

Compiled with GCC >=7.5.0 (I use GCC 11.4.0) and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1