ASAN: use-after-poison in get_hash_symbol

SET optimizer_trace= 'enabled=on';

PREPARE stmt FROM 'SELECT tbl.x509_subject AS fld FROM mysql.user AS tbl GROUP BY fld HAVING 0 AND fld != 1';

EXECUTE stmt;

EXECUTE stmt;

==3144494==ERROR: AddressSanitizer: use-after-poison on address 0x62b0000652e0 at pc 0x564cf30f57b0 bp 0x7f085f258a10 sp 0x7f085f258a00

READ of size 1 at 0x62b0000652e0 thread T5

    #0 0x564cf30f57af in get_hash_symbol /dev/shm/tmp_build/sql/lex_hash.h:7870

    #1 0x564cf30faf2c in is_keyword(char const*, unsigned int) /data/src/10.4/sql/sql_lex.cc:921

    #2 0x564cf332df50 in get_quote_char_for_identifier(THD*, char const*, unsigned long) /data/src/10.4/sql/sql_show.cc:1725

    #3 0x564cf332db0b in append_identifier(THD*, String*, char const*, unsigned long) /data/src/10.4/sql/sql_show.cc:1647

    #4 0x564cf39c6fab in append_identifier /data/src/10.4/sql/sql_show.h:88

    #5 0x564cf3a0b2df in Item_ref::print(String*, enum_query_type) /data/src/10.4/sql/item.cc:8098

    #6 0x564cf39cae46 in Item::print_parenthesised(String*, enum_query_type, precedence) /data/src/10.4/sql/item.cc:487

    #7 0x564cf3ad01b5 in Item_func::print_op(String*, enum_query_type) /data/src/10.4/sql/item_func.cc:619

    #8 0x564cf3a863be in Item_bool_rowready_func2::print(String*, enum_query_type) /data/src/10.4/sql/item_cmpfunc.h:521

    #9 0x564cf39cae46 in Item::print_parenthesised(String*, enum_query_type, precedence) /data/src/10.4/sql/item.cc:487

    #10 0x564cf3a6f41a in Item_cond::print(String*, enum_query_type) /data/src/10.4/sql/item_cmpfunc.cc:5170

    #11 0x564cf32f8aca in st_select_lex::print(THD*, String*, enum_query_type) /data/src/10.4/sql/sql_select.cc:27658

    #12 0x564cf37496b8 in opt_trace_print_expanded_query(THD*, st_select_lex*, Json_writer_object*) /data/src/10.4/sql/opt_trace.cc:115

    #13 0x564cf322d23e in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/src/10.4/sql/sql_select.cc:1496

    #14 0x564cf324f5dc in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.4/sql/sql_select.cc:4670

    #15 0x564cf3220eaf in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.4/sql/sql_select.cc:410

    #16 0x564cf3190996 in execute_sqlcom_select /data/src/10.4/sql/sql_parse.cc:6443

    #17 0x564cf317e6a0 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3962

    #18 0x564cf31ed226 in Prepared_statement::execute(String*, bool) /data/src/10.4/sql/sql_prepare.cc:4996

    #19 0x564cf31e86e6 in Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*) /data/src/10.4/sql/sql_prepare.cc:4465

    #20 0x564cf31e25f5 in mysql_sql_stmt_execute(THD*) /data/src/10.4/sql/sql_prepare.cc:3566

    #21 0x564cf317e6e5 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:3978

    #22 0x564cf3199e42 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7989

    #23 0x564cf3170a15 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1855

    #24 0x564cf316d4c4 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1373

    #25 0x564cf35605ec in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412

    #26 0x564cf355fe90 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316

    #27 0x564cf4c25d74 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869

    #28 0x7f086928d608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

    #29 0x7f0868af8292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x62b0000652e0 is located 12512 bytes inside of 24716-byte region [0x62b000062200,0x62b00006828c)

allocated by thread T5 here:

    #0 0x7f08694e7bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)

    #1 0x564cf4d74314 in sf_malloc /data/src/10.4/mysys/safemalloc.c:118

    #2 0x564cf4d42178 in my_malloc /data/src/10.4/mysys/my_malloc.c:101

    #3 0x564cf4d1d395 in reset_root_defaults /data/src/10.4/mysys/my_alloc.c:152

    #4 0x564cf3057873 in THD::init_for_queries() /data/src/10.4/sql/sql_class.cc:1395

    #5 0x564cf355f7fa in prepare_new_connection_state(THD*) /data/src/10.4/sql/sql_connect.cc:1247

    #6 0x564cf355feda in thd_prepare_connection(THD*) /data/src/10.4/sql/sql_connect.cc:1331

    #7 0x564cf3560517 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1402

    #8 0x564cf355fe90 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316

    #9 0x564cf4c25d74 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1869

    #10 0x7f086928d608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

Thread T5 created by T0 here:

    #0 0x7f0869414805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)

    #1 0x564cf4c26165 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1919

    #2 0x564cf2e76b1f in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1275

    #3 0x564cf2e8e843 in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6243

    #4 0x564cf2e8efde in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6313

    #5 0x564cf2e8f4c4 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6411

    #6 0x564cf2e9035d in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6569

    #7 0x564cf2e8df48 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5901

    #8 0x564cf2e74d6c in main /data/src/10.4/sql/main.cc:25

    #9 0x7f08689fd0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: use-after-poison /dev/shm/tmp_build/sql/lex_hash.h:7870 in get_hash_symbol

Shadow bytes around the buggy address:

  0x0c5680004a00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004a10: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004a20: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004a30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004a40: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

=>0x0c5680004a50: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7 f7 f7

  0x0c5680004a60: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004a70: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004a80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004a90: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5680004aa0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==3144494==ABORTING

210325  0:45:13 [ERROR] mysqld got signal 6 ;

This could be because you hit a bug. It is also possible that this binary

or one of the libraries it was linked against is corrupt, improperly built,

or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help

diagnose the problem, but since we have already crashed, 

something is definitely wrong and this may fail.

Server version: 10.4.19-MariaDB-debug-log

key_buffer_size=1048576

read_buffer_size=131072

max_used_connections=1

max_threads=153

thread_count=1

It is possible that mysqld could use up to 

key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63647 K  bytes of memory

Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x62b00005b270

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x7f085f25e990 thread_stack 0x5fc00

/lib/x86_64-linux-gnu/libasan.so.5(+0x6cd30)[0x7f0869446d30]

mysys/stacktrace.c:174(my_print_stacktrace)[0x564cf4d5201a]

sql/signal_handler.cc:210(handle_fatal_signal)[0x564cf3978cab]

sigaction.c:0(__restore_rt)[0x7f08692993c0]

/lib/x86_64-linux-gnu/libc.so.6(gsignal+0xcb)[0x7f0868a1c18b]

/lib/x86_64-linux-gnu/libc.so.6(abort+0x12b)[0x7f08689fb859]

/lib/x86_64-linux-gnu/libasan.so.5(+0x12b6a2)[0x7f08695056a2]

/lib/x86_64-linux-gnu/libasan.so.5(+0x13624c)[0x7f086951024c]

/lib/x86_64-linux-gnu/libasan.so.5(+0x1178ec)[0x7f08694f18ec]

/lib/x86_64-linux-gnu/libasan.so.5(+0x117363)[0x7f08694f1363]

/lib/x86_64-linux-gnu/libasan.so.5(__asan_report_load1+0x3b)[0x7f08694f1e4b]

sql/lex_hash.h:7870(get_hash_symbol(char const*, unsigned int, bool))[0x564cf30f57b0]

sql/sql_lex.cc:921(is_keyword(char const*, unsigned int))[0x564cf30faf2d]

sql/sql_show.cc:1725(get_quote_char_for_identifier(THD*, char const*, unsigned long))[0x564cf332df51]

sql/sql_show.cc:1647(append_identifier(THD*, String*, char const*, unsigned long))[0x564cf332db0c]

sql/sql_show.h:89(append_identifier(THD*, String*, st_mysql_const_lex_string const*))[0x564cf39c6fac]

sql/item.cc:8105(Item_ref::print(String*, enum_query_type))[0x564cf3a0b2e0]

sql/item.cc:488(Item::print_parenthesised(String*, enum_query_type, precedence))[0x564cf39cae47]

sql/item_func.cc:620(Item_func::print_op(String*, enum_query_type))[0x564cf3ad01b6]

sql/item_cmpfunc.h:522(Item_bool_rowready_func2::print(String*, enum_query_type))[0x564cf3a863bf]

sql/item.cc:488(Item::print_parenthesised(String*, enum_query_type, precedence))[0x564cf39cae47]

sql/item_cmpfunc.cc:5165(Item_cond::print(String*, enum_query_type))[0x564cf3a6f41b]

sql/sql_select.cc:27658(st_select_lex::print(THD*, String*, enum_query_type))[0x564cf32f8acb]

sql/opt_trace.cc:120(opt_trace_print_expanded_query(THD*, st_select_lex*, Json_writer_object*))[0x564cf37496b9]

sql/sql_select.cc:1495(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x564cf322d23f]

sql/sql_select.cc:4670(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x564cf324f5dd]

sql/sql_select.cc:410(handle_select(THD*, LEX*, select_result*, unsigned long))[0x564cf3220eb0]

sql/sql_parse.cc:6443(execute_sqlcom_select(THD*, TABLE_LIST*))[0x564cf3190997]

sql/sql_parse.cc:3962(mysql_execute_command(THD*))[0x564cf317e6a1]

sql/sql_prepare.cc:4996(Prepared_statement::execute(String*, bool))[0x564cf31ed227]

sql/sql_prepare.cc:4465(Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*))[0x564cf31e86e7]

sql/sql_prepare.cc:3567(mysql_sql_stmt_execute(THD*))[0x564cf31e25f6]

sql/sql_parse.cc:3979(mysql_execute_command(THD*))[0x564cf317e6e6]

sql/sql_parse.cc:7989(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x564cf3199e43]

sql/sql_parse.cc:1858(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x564cf3170a16]

sql/sql_parse.cc:1373(do_command(THD*))[0x564cf316d4c5]

sql/sql_connect.cc:1412(do_handle_one_connection(CONNECT*))[0x564cf35605ed]

sql/sql_connect.cc:1317(handle_one_connection)[0x564cf355fe91]

perfschema/pfs.cc:1871(pfs_spawn_thread)[0x564cf4c25d75]

nptl/pthread_create.c:478(start_thread)[0x7f086928d609]

/lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f0868af8293]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x62b000062328): SELECT tbl.x509_subject AS fld FROM mysql.user AS tbl GROUP BY fld HAVING 0 AND fld != 1

Connection ID (thread ID): 4

Status: NOT_KILLED

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on

The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains

information that should help you find out what is causing the crash.

Writing a core file...

Working directory at /dev/shm/var_auto_hdYz/mysqld.1/data

Resource Limits:

Limit                     Soft Limit           Hard Limit           Units     

Max cpu time              unlimited            unlimited            seconds   

Max file size             unlimited            unlimited            bytes     

Max data size             unlimited            unlimited            bytes     

Max stack size            8388608              unlimited            bytes     

Max core file size        unlimited            unlimited            bytes     

Max resident set          unlimited            unlimited            bytes     

Max processes             385874               385874               processes 

Max open files            1024                 1024                 files     

Max locked memory         67108864             67108864             bytes     

Max address space         unlimited            unlimited            bytes     

Max file locks            unlimited            unlimited            locks     

Max pending signals       385874               385874               signals   

Max msgqueue size         819200               819200               bytes     

Max nice priority         0                    0                    

Max realtime priority     0                    0                    

Max realtime timeout      unlimited            unlimited            us        

Core pattern: |/usr/share/apport/apport %p %s %c %d %P %E

----------SERVER LOG END-------------

 - found 'core' (0/5)

Trying 'dbx' to get a backtrace

Trying 'gdb' to get a backtrace from coredump /mnt-hd8t/bld/10.4-asan-nightly/mysql-test/var/log/bug.hash2/mysqld.1/data/core

Core generated by '/mnt-hd8t/bld/10.4-asan-nightly/bin/mysqld'

Output from gdb follows. The first stack trace is from the failing thread.

The following stack traces are from all threads (so the failing one is

duplicated).

--------------------------

[New LWP 3144501]

[New LWP 3144494]

[New LWP 3144495]

[New LWP 3144498]

[New LWP 3144496]

[New LWP 3144497]

[Thread debugging using libthread_db enabled]

Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Core was generated by `/mnt-hd8t/bld/10.4-asan-nightly/bin/mysqld --defaults-group-suffix=.1 --default'.

Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

56	../sysdeps/unix/sysv/linux/pthread_kill.c: No such file or directory.

[Current thread is 1 (Thread 0x7f085f25f300 (LWP 3144501))]

#0  __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x0000564cf4d5219c in my_write_core (sig=6) at /data/src/10.4/mysys/stacktrace.c:386

#2  0x0000564cf39792a2 in handle_fatal_signal (sig=6) at /data/src/10.4/sql/signal_handler.cc:344

#3  <signal handler called>

#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

#5  0x00007f08689fb859 in __GI_abort () at abort.c:79

#6  0x00007f08695056a2 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5

#7  0x00007f086951024c in ?? () from /lib/x86_64-linux-gnu/libasan.so.5

#8  0x00007f08694f18ec in ?? () from /lib/x86_64-linux-gnu/libasan.so.5

#9  0x00007f08694f1363 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5

#10 0x00007f08694f1e4b in __asan_report_load1 () from /lib/x86_64-linux-gnu/libasan.so.5

#11 0x0000564cf30f57b0 in get_hash_symbol (s=0x62b0000652e0 "fld", len=3, function=false) at /dev/shm/tmp_build/sql/lex_hash.h:7870

#12 0x0000564cf30faf2d in is_keyword (name=0x62b0000652e0 "fld", len=3) at /data/src/10.4/sql/sql_lex.cc:921

#13 0x0000564cf332df51 in get_quote_char_for_identifier (thd=0x62b00005b270, name=0x62b0000652e0 "fld", length=3) at /data/src/10.4/sql/sql_show.cc:1725

#14 0x0000564cf332db0c in append_identifier (thd=0x62b00005b270, packet=0x7f085f258f30, name=0x62b0000652e0 "fld", length=3) at /data/src/10.4/sql/sql_show.cc:1647

#15 0x0000564cf39c6fac in append_identifier (thd=0x62b00005b270, packet=0x7f085f258f30, name=0x62d0001af670) at /data/src/10.4/sql/sql_show.h:88

#16 0x0000564cf3a0b2e0 in Item_ref::print (this=0x62b00008eed8, str=0x7f085f258f30, query_type=1037) at /data/src/10.4/sql/item.cc:8098

#17 0x0000564cf39cae47 in Item::print_parenthesised (this=0x62b00008eed8, str=0x7f085f258f30, query_type=1037, parent_prec=CMP_PRECEDENCE) at /data/src/10.4/sql/item.cc:487

#18 0x0000564cf3ad01b6 in Item_func::print_op (this=0x62b00008f088, str=0x7f085f258f30, query_type=1037) at /data/src/10.4/sql/item_func.cc:619

#19 0x0000564cf3a863bf in Item_bool_rowready_func2::print (this=0x62b00008f088, str=0x7f085f258f30, query_type=1037) at /data/src/10.4/sql/item_cmpfunc.h:521

#20 0x0000564cf39cae47 in Item::print_parenthesised (this=0x62b00008f088, str=0x7f085f258f30, query_type=1037, parent_prec=AND_PRECEDENCE) at /data/src/10.4/sql/item.cc:487

#21 0x0000564cf3a6f41b in Item_cond::print (this=0x62b0000623e0, str=0x7f085f258f30, query_type=1037) at /data/src/10.4/sql/item_cmpfunc.cc:5170

#22 0x0000564cf32f8acb in st_select_lex::print (this=0x62b00008df30, thd=0x62b00005b270, str=0x7f085f258f30, query_type=1037) at /data/src/10.4/sql/sql_select.cc:27658

#23 0x0000564cf37496b9 in opt_trace_print_expanded_query (thd=0x62b00005b270, select_lex=0x62b00008df30, writer=0x7f085f259650) at /data/src/10.4/sql/opt_trace.cc:115

#24 0x0000564cf322d23f in JOIN::prepare (this=0x62b000062648, tables_init=0x62b00008e5b8, wild_num=0, conds_init=0x0, og_num=1, order_init=0x0, skip_order_by=false, group_init=0x62b00008edc0, having_init=0x62b0000623e0, proc_param_init=0x0, select_lex_arg=0x62b00008df30, unit_arg=0x62b00008c360) at /data/src/10.4/sql/sql_select.cc:1496

#25 0x0000564cf324f5dd in mysql_select (thd=0x62b00005b270, tables=0x62b00008e5b8, wild_num=0, fields=..., conds=0x0, og_num=1, order=0x0, group=0x62b00008edc0, having=0x62b0000623e0, proc_param=0x0, select_options=2416184064, result=0x62b00008fc48, unit=0x62b00008c360, select_lex=0x62b00008df30) at /data/src/10.4/sql/sql_select.cc:4670

#26 0x0000564cf3220eb0 in handle_select (thd=0x62b00005b270, lex=0x62b00008c2a0, result=0x62b00008fc48, setup_tables_done_option=0) at /data/src/10.4/sql/sql_select.cc:410

#27 0x0000564cf3190997 in execute_sqlcom_select (thd=0x62b00005b270, all_tables=0x62b00008e5b8) at /data/src/10.4/sql/sql_parse.cc:6443

#28 0x0000564cf317e6a1 in mysql_execute_command (thd=0x62b00005b270) at /data/src/10.4/sql/sql_parse.cc:3962

#29 0x0000564cf31ed227 in Prepared_statement::execute (this=0x61900008a2f0, expanded_query=0x7f085f25bbe0, open_cursor=false) at /data/src/10.4/sql/sql_prepare.cc:4996

#30 0x0000564cf31e86e7 in Prepared_statement::execute_loop (this=0x61900008a2f0, expanded_query=0x7f085f25bbe0, open_cursor=false, packet=0x0, packet_end=0x0) at /data/src/10.4/sql/sql_prepare.cc:4465

#31 0x0000564cf31e25f6 in mysql_sql_stmt_execute (thd=0x62b00005b270) at /data/src/10.4/sql/sql_prepare.cc:3566

#32 0x0000564cf317e6e6 in mysql_execute_command (thd=0x62b00005b270) at /data/src/10.4/sql/sql_parse.cc:3978

#33 0x0000564cf3199e43 in mysql_parse (thd=0x62b00005b270, rawbuf=0x62b000062290 "EXECUTE stmt", length=12, parser_state=0x7f085f25d810, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:7989

#34 0x0000564cf3170a16 in dispatch_command (command=COM_QUERY, thd=0x62b00005b270, packet=0x62900023f271 "EXECUTE stmt", packet_length=12, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1855

#35 0x0000564cf316d4c5 in do_command (thd=0x62b00005b270) at /data/src/10.4/sql/sql_parse.cc:1373

#36 0x0000564cf35605ed in do_handle_one_connection (connect=0x6110000087b0) at /data/src/10.4/sql/sql_connect.cc:1412

#37 0x0000564cf355fe91 in handle_one_connection (arg=0x6110000087b0) at /data/src/10.4/sql/sql_connect.cc:1316

#38 0x0000564cf4c25d75 in pfs_spawn_thread (arg=0x61600000b7f0) at /data/src/10.4/storage/perfschema/pfs.cc:1869

#39 0x00007f086928d609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#40 0x00007f0868af8293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 6 (Thread 0x7f085f36f300 (LWP 3144497)):

#0  0x00007f0868a1d322 in __GI___sigtimedwait (set=0x7f085f36e930, info=0x7f085f36e760, timeout=0x0) at ../sysdeps/unix/sysv/linux/sigtimedwait.c:29

#1  0x00007f0869461111 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5

#2  0x0000564cf2e74e69 in my_sigwait (set=0x7f085f36e930, sig=0x7f085f36e8a0, code=0x7f085f36e8b0) at /data/src/10.4/include/my_pthread.h:196

#3  0x0000564cf2e84ac8 in signal_hand (arg=0x0) at /data/src/10.4/sql/mysqld.cc:3224

#4  0x0000564cf4c25d75 in pfs_spawn_thread (arg=0x6160000087f0) at /data/src/10.4/storage/perfschema/pfs.cc:1869

#5  0x00007f086928d609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#6  0x00007f0868af8293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 5 (Thread 0x7f085fb96700 (LWP 3144496)):

#0  futex_abstimed_wait_cancelable (private=<optimized out>, abstime=0x7f085fb95c80, clockid=<optimized out>, expected=0, futex_word=0x564cf707dac8 <COND_checkpoint+40>) at ../sysdeps/nptl/futex-internal.h:320

#1  __pthread_cond_wait_common (abstime=0x7f085fb95c80, clockid=<optimized out>, mutex=0x564cf707d9e8 <LOCK_checkpoint+40>, cond=0x564cf707daa0 <COND_checkpoint>) at pthread_cond_wait.c:520

#2  __pthread_cond_timedwait (cond=0x564cf707daa0 <COND_checkpoint>, mutex=0x564cf707d9e8 <LOCK_checkpoint+40>, abstime=0x7f085fb95c80) at pthread_cond_wait.c:656

#3  0x0000564cf4d60c9c in safe_cond_timedwait (cond=0x564cf707daa0 <COND_checkpoint>, mp=0x564cf707d9c0 <LOCK_checkpoint>, abstime=0x7f085fb95c80, file=0x564cf5846120 "/data/src/10.4/include/mysql/psi/mysql_thread.h", line=1211) at /data/src/10.4/mysys/thr_mutex.c:546

#4  0x0000564cf48d0933 in inline_mysql_cond_timedwait (that=0x564cf707daa0 <COND_checkpoint>, mutex=0x564cf707d9c0 <LOCK_checkpoint>, abstime=0x7f085fb95c80, src_file=0x564cf58461a0 "/data/src/10.4/storage/maria/ma_servicethread.c", src_line=115) at /data/src/10.4/include/mysql/psi/mysql_thread.h:1211

#5  0x0000564cf48d180e in my_service_thread_sleep (control=0x564cf64c2e20 <checkpoint_control>, sleep_time=29000000000) at /data/src/10.4/storage/maria/ma_servicethread.c:115

#6  0x0000564cf48b32f2 in ma_checkpoint_background (arg=0x1e) at /data/src/10.4/storage/maria/ma_checkpoint.c:707

#7  0x0000564cf4c25d75 in pfs_spawn_thread (arg=0x6160000066f0) at /data/src/10.4/storage/perfschema/pfs.cc:1869

#8  0x00007f086928d609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#9  0x00007f0868af8293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 4 (Thread 0x7f085f2d7300 (LWP 3144498)):

#0  futex_wait_cancelable (private=<optimized out>, expected=0, futex_word=0x564cf67ae348 <COND_manager+40>) at ../sysdeps/nptl/futex-internal.h:183

#1  __pthread_cond_wait_common (abstime=0x0, clockid=0, mutex=0x564cf67ae268 <LOCK_manager+40>, cond=0x564cf67ae320 <COND_manager>) at pthread_cond_wait.c:508

#2  __pthread_cond_wait (cond=0x564cf67ae320 <COND_manager>, mutex=0x564cf67ae268 <LOCK_manager+40>) at pthread_cond_wait.c:638

#3  0x0000564cf4d60363 in safe_cond_wait (cond=0x564cf67ae320 <COND_manager>, mp=0x564cf67ae240 <LOCK_manager>, file=0x564cf4fb25a0 "/data/src/10.4/include/mysql/psi/mysql_thread.h", line=1174) at /data/src/10.4/mysys/thr_mutex.c:492

#4  0x0000564cf3162532 in inline_mysql_cond_wait (that=0x564cf67ae320 <COND_manager>, mutex=0x564cf67ae240 <LOCK_manager>, src_file=0x564cf4fb2fe0 "/data/src/10.4/sql/sql_manager.cc", src_line=102) at /data/src/10.4/include/mysql/psi/mysql_thread.h:1174

#5  0x0000564cf3163018 in handle_manager (arg=0x0) at /data/src/10.4/sql/sql_manager.cc:102

#6  0x0000564cf4c25d75 in pfs_spawn_thread (arg=0x616000009ff0) at /data/src/10.4/storage/perfschema/pfs.cc:1869

#7  0x00007f086928d609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#8  0x00007f0868af8293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 3 (Thread 0x7f08612b0700 (LWP 3144495)):

#0  futex_abstimed_wait_cancelable (private=<optimized out>, abstime=0x7f08612afdd0, clockid=<optimized out>, expected=0, futex_word=0x564cf70a43c8 <COND_timer+40>) at ../sysdeps/nptl/futex-internal.h:320

#1  __pthread_cond_wait_common (abstime=0x7f08612afdd0, clockid=<optimized out>, mutex=0x564cf70a42e8 <LOCK_timer+40>, cond=0x564cf70a43a0 <COND_timer>) at pthread_cond_wait.c:520

#2  __pthread_cond_timedwait (cond=0x564cf70a43a0 <COND_timer>, mutex=0x564cf70a42e8 <LOCK_timer+40>, abstime=0x7f08612afdd0) at pthread_cond_wait.c:656

#3  0x0000564cf4d60c9c in safe_cond_timedwait (cond=0x564cf70a43a0 <COND_timer>, mp=0x564cf70a42c0 <LOCK_timer>, abstime=0x7f08612afdd0, file=0x564cf5940520 "/data/src/10.4/include/mysql/psi/mysql_thread.h", line=1211) at /data/src/10.4/mysys/thr_mutex.c:546

#4  0x0000564cf4d63ae9 in inline_mysql_cond_timedwait (that=0x564cf70a43a0 <COND_timer>, mutex=0x564cf70a42c0 <LOCK_timer>, abstime=0x7f08612afdd0, src_file=0x564cf59405c0 "/data/src/10.4/mysys/thr_timer.c", src_line=292) at /data/src/10.4/include/mysql/psi/mysql_thread.h:1211

#5  0x0000564cf4d65a6d in timer_handler (arg=0x0) at /data/src/10.4/mysys/thr_timer.c:292

#6  0x0000564cf4c25d75 in pfs_spawn_thread (arg=0x616000001ef0) at /data/src/10.4/storage/perfschema/pfs.cc:1869

#7  0x00007f086928d609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#8  0x00007f0868af8293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 2 (Thread 0x7f08689c8480 (LWP 3144494)):

#0  0x00007f0868aebaff in __GI___poll (fds=0x7ffc109a6030, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29

#1  0x00007f08694165ba in poll () from /lib/x86_64-linux-gnu/libasan.so.5

#2  0x0000564cf2e8fc1e in handle_connections_sockets () at /data/src/10.4/sql/mysqld.cc:6465

#3  0x0000564cf2e8df49 in mysqld_main (argc=<error reading variable: Cannot access memory at address 0x3d60>, argv=<error reading variable: Cannot access memory at address 0x3d70>) at /data/src/10.4/sql/mysqld.cc:5901

#4  0x0000564cf2e74d6d in main (argc=6, argv=0x7ffc109a6478) at /data/src/10.4/sql/main.cc:25

Thread 1 (Thread 0x7f085f25f300 (LWP 3144501)):

#0  __pthread_kill (threadid=<optimized out>, signo=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x0000564cf4d5219c in my_write_core (sig=6) at /data/src/10.4/mysys/stacktrace.c:386

#2  0x0000564cf39792a2 in handle_fatal_signal (sig=6) at /data/src/10.4/sql/signal_handler.cc:344

#3  <signal handler called>

#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

#5  0x00007f08689fb859 in __GI_abort () at abort.c:79

#6  0x00007f08695056a2 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5

#7  0x00007f086951024c in ?? () from /lib/x86_64-linux-gnu/libasan.so.5

#8  0x00007f08694f18ec in ?? () from /lib/x86_64-linux-gnu/libasan.so.5

#9  0x00007f08694f1363 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5

#10 0x00007f08694f1e4b in __asan_report_load1 () from /lib/x86_64-linux-gnu/libasan.so.5

#11 0x0000564cf30f57b0 in get_hash_symbol (s=0x62b0000652e0 "fld", len=3, function=false) at /dev/shm/tmp_build/sql/lex_hash.h:7870

#12 0x0000564cf30faf2d in is_keyword (name=0x62b0000652e0 "fld", len=3) at /data/src/10.4/sql/sql_lex.cc:921

#13 0x0000564cf332df51 in get_quote_char_for_identifier (thd=0x62b00005b270, name=0x62b0000652e0 "fld", length=3) at /data/src/10.4/sql/sql_show.cc:1725

#14 0x0000564cf332db0c in append_identifier (thd=0x62b00005b270, packet=0x7f085f258f30, name=0x62b0000652e0 "fld", length=3) at /data/src/10.4/sql/sql_show.cc:1647

#15 0x0000564cf39c6fac in append_identifier (thd=0x62b00005b270, packet=0x7f085f258f30, name=0x62d0001af670) at /data/src/10.4/sql/sql_show.h:88

#16 0x0000564cf3a0b2e0 in Item_ref::print (this=0x62b00008eed8, str=0x7f085f258f30, query_type=1037) at /data/src/10.4/sql/item.cc:8098

#17 0x0000564cf39cae47 in Item::print_parenthesised (this=0x62b00008eed8, str=0x7f085f258f30, query_type=1037, parent_prec=CMP_PRECEDENCE) at /data/src/10.4/sql/item.cc:487

#18 0x0000564cf3ad01b6 in Item_func::print_op (this=0x62b00008f088, str=0x7f085f258f30, query_type=1037) at /data/src/10.4/sql/item_func.cc:619

#19 0x0000564cf3a863bf in Item_bool_rowready_func2::print (this=0x62b00008f088, str=0x7f085f258f30, query_type=1037) at /data/src/10.4/sql/item_cmpfunc.h:521

#20 0x0000564cf39cae47 in Item::print_parenthesised (this=0x62b00008f088, str=0x7f085f258f30, query_type=1037, parent_prec=AND_PRECEDENCE) at /data/src/10.4/sql/item.cc:487

#21 0x0000564cf3a6f41b in Item_cond::print (this=0x62b0000623e0, str=0x7f085f258f30, query_type=1037) at /data/src/10.4/sql/item_cmpfunc.cc:5170

#22 0x0000564cf32f8acb in st_select_lex::print (this=0x62b00008df30, thd=0x62b00005b270, str=0x7f085f258f30, query_type=1037) at /data/src/10.4/sql/sql_select.cc:27658

#23 0x0000564cf37496b9 in opt_trace_print_expanded_query (thd=0x62b00005b270, select_lex=0x62b00008df30, writer=0x7f085f259650) at /data/src/10.4/sql/opt_trace.cc:115

#24 0x0000564cf322d23f in JOIN::prepare (this=0x62b000062648, tables_init=0x62b00008e5b8, wild_num=0, conds_init=0x0, og_num=1, order_init=0x0, skip_order_by=false, group_init=0x62b00008edc0, having_init=0x62b0000623e0, proc_param_init=0x0, select_lex_arg=0x62b00008df30, unit_arg=0x62b00008c360) at /data/src/10.4/sql/sql_select.cc:1496

#25 0x0000564cf324f5dd in mysql_select (thd=0x62b00005b270, tables=0x62b00008e5b8, wild_num=0, fields=..., conds=0x0, og_num=1, order=0x0, group=0x62b00008edc0, having=0x62b0000623e0, proc_param=0x0, select_options=2416184064, result=0x62b00008fc48, unit=0x62b00008c360, select_lex=0x62b00008df30) at /data/src/10.4/sql/sql_select.cc:4670

#26 0x0000564cf3220eb0 in handle_select (thd=0x62b00005b270, lex=0x62b00008c2a0, result=0x62b00008fc48, setup_tables_done_option=0) at /data/src/10.4/sql/sql_select.cc:410

#27 0x0000564cf3190997 in execute_sqlcom_select (thd=0x62b00005b270, all_tables=0x62b00008e5b8) at /data/src/10.4/sql/sql_parse.cc:6443

#28 0x0000564cf317e6a1 in mysql_execute_command (thd=0x62b00005b270) at /data/src/10.4/sql/sql_parse.cc:3962

#29 0x0000564cf31ed227 in Prepared_statement::execute (this=0x61900008a2f0, expanded_query=0x7f085f25bbe0, open_cursor=false) at /data/src/10.4/sql/sql_prepare.cc:4996

#30 0x0000564cf31e86e7 in Prepared_statement::execute_loop (this=0x61900008a2f0, expanded_query=0x7f085f25bbe0, open_cursor=false, packet=0x0, packet_end=0x0) at /data/src/10.4/sql/sql_prepare.cc:4465

#31 0x0000564cf31e25f6 in mysql_sql_stmt_execute (thd=0x62b00005b270) at /data/src/10.4/sql/sql_prepare.cc:3566

#32 0x0000564cf317e6e6 in mysql_execute_command (thd=0x62b00005b270) at /data/src/10.4/sql/sql_parse.cc:3978

#33 0x0000564cf3199e43 in mysql_parse (thd=0x62b00005b270, rawbuf=0x62b000062290 "EXECUTE stmt", length=12, parser_state=0x7f085f25d810, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:7989

#34 0x0000564cf3170a16 in dispatch_command (command=COM_QUERY, thd=0x62b00005b270, packet=0x62900023f271 "EXECUTE stmt", packet_length=12, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1855

#35 0x0000564cf316d4c5 in do_command (thd=0x62b00005b270) at /data/src/10.4/sql/sql_parse.cc:1373

#36 0x0000564cf35605ed in do_handle_one_connection (connect=0x6110000087b0) at /data/src/10.4/sql/sql_connect.cc:1412

#37 0x0000564cf355fe91 in handle_one_connection (arg=0x6110000087b0) at /data/src/10.4/sql/sql_connect.cc:1316

#38 0x0000564cf4c25d75 in pfs_spawn_thread (arg=0x61600000b7f0) at /data/src/10.4/storage/perfschema/pfs.cc:1869

#39 0x00007f086928d609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#40 0x00007f0868af8293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95