RBR crashes upon DML after CONVERT PARTITION

--source include/have_partition.inc

--source include/have_binlog_format_row.inc

--source include/master-slave.inc

CREATE TABLE t (a INT, b INT, KEY(a)) PARTITION BY RANGE (b) (PARTITION p1 VALUES LESS THAN (10), PARTITION pn VALUES LESS THAN (MAXVALUE));

ALTER TABLE t CONVERT PARTITION p1 TO TABLE offspring;

INSERT INTO t VALUES (1,5),(2,100);

DELETE FROM t;

--sync_slave_with_master

--connection master

DROP TABLE t, offspring;

--source include/rpl_end.inc

#2  <signal handler called>

#3  0x0000559388a17992 in Field::ptr_in_record (record=0x7f027403eed8 "\371\001", this=0x4954495452415020) at /data/bld/10.11-rel/sql/field.h:1188

#4  key_copy (to_key=0x7f027402668e "", from_record=0x7f027403eed8 "\371\001", key_info=0x7f027403f0d8, key_length=3, key_length@entry=0, with_zerofill=with_zerofill@entry=false) at /data/bld/10.11-rel/sql/key.cc:144

#5  0x0000559388a50209 in Rows_log_event::find_row (this=this@entry=0x7f027402ae28, rgi=rgi@entry=0x7f0274000c50) at /data/bld/10.11-rel/sql/log_event_server.cc:8487

#6  0x0000559388a5093e in Delete_rows_log_event::do_exec_row (this=0x7f027402ae28, rgi=<optimized out>) at /data/bld/10.11-rel/sql/log_event_server.cc:8750

#7  0x0000559388a42d74 in Rows_log_event::do_apply_event (this=0x7f027402ae28, rgi=0x7f0274000c50) at /data/bld/10.11-rel/sql/log_event_server.cc:6214

#8  0x0000559388a3afed in Log_event::apply_event (this=this@entry=0x7f027402ae28, rgi=rgi@entry=0x7f0274000c50) at /data/bld/10.11-rel/sql/log_event.cc:4255

#9  0x00005593885da786 in apply_event_and_update_pos_apply (reason=0, rgi=0x7f0274000c50, thd=0x7f02740015a8, ev=0x7f027402ae28) at /data/bld/10.11-rel/sql/slave.cc:3968

#10 apply_event_and_update_pos (ev=ev@entry=0x7f027402ae28, thd=thd@entry=0x7f02740015a8, rgi=rgi@entry=0x7f0274000c50) at /data/bld/10.11-rel/sql/slave.cc:4144

#11 0x00005593885dc744 in exec_relay_log_event (serial_rgi=0x7f0274000c50, rli=0x5593b352c340, thd=0x7f02740015a8) at /data/bld/10.11-rel/sql/slave.cc:4570

#12 handle_slave_sql (arg=arg@entry=0x5593b352a680) at /data/bld/10.11-rel/sql/slave.cc:5825

#13 0x0000559388b64447 in pfs_spawn_thread (arg=0x7f027c152aa8) at /data/bld/10.11-rel/storage/perfschema/pfs.cc:2201

#14 0x00007f02bbfc91c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#15 0x00007f02bc04985c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

==881051==ERROR: AddressSanitizer: use-after-poison on address 0x6250002f1d1c at pc 0x5612df6a3297 bp 0x7f4ad3b304c0 sp 0x7f4ad3b304b8

READ of size 4 at 0x6250002f1d1c thread T14

    #0 0x5612df6a3296 in key_copy(unsigned char*, unsigned char const*, st_key const*, unsigned int, bool) /data/bld/10.11-asan-ubsan/sql/key.cc:129

    #1 0x5612df841bff in Rows_log_event::find_row(rpl_group_info*) /data/bld/10.11-asan-ubsan/sql/log_event_server.cc:8487

    #2 0x5612df844645 in Delete_rows_log_event::do_exec_row(rpl_group_info*) /data/bld/10.11-asan-ubsan/sql/log_event_server.cc:8750

    #3 0x5612df82b6cb in Rows_log_event::do_apply_event(rpl_group_info*) /data/bld/10.11-asan-ubsan/sql/log_event_server.cc:6214

    #4 0x5612df78e4a2 in Log_event::apply_event(rpl_group_info*) /data/bld/10.11-asan-ubsan/sql/log_event.cc:4255

    #5 0x5612dd68557d in apply_event_and_update_pos_apply /data/bld/10.11-asan-ubsan/sql/slave.cc:3968

    #6 0x5612dd6b01a7 in apply_event_and_update_pos(Log_event*, THD*, rpl_group_info*) /data/bld/10.11-asan-ubsan/sql/slave.cc:4144

    #7 0x5612dd6b39c1 in exec_relay_log_event /data/bld/10.11-asan-ubsan/sql/slave.cc:4570

    #8 0x5612dd6bd0dd in handle_slave_sql /data/bld/10.11-asan-ubsan/sql/slave.cc:5825

    #9 0x5612dfd900da in pfs_spawn_thread /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201

    #10 0x7f4ae64a81c3 in start_thread nptl/pthread_create.c:442

    #11 0x7f4ae652885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x6250002f1d1c is located 5148 bytes inside of 8184-byte region [0x6250002f0900,0x6250002f28f8)

allocated by thread T14 here:

    #0 0x7f4ae78b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x5612e0fed0a1 in my_malloc /data/bld/10.11-asan-ubsan/mysys/my_malloc.c:92

    #2 0x5612e0fc0fb7 in root_alloc /data/bld/10.11-asan-ubsan/mysys/my_alloc.c:66

    #3 0x5612e0fc156a in init_alloc_root /data/bld/10.11-asan-ubsan/mysys/my_alloc.c:178

    #4 0x5612de2f7df0 in init_sql_alloc(unsigned int, st_mem_root*, unsigned int, unsigned int, unsigned long) /data/bld/10.11-asan-ubsan/sql/thr_malloc.cc:64

    #5 0x5612de2cc18b in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/bld/10.11-asan-ubsan/sql/table.cc:4196

    #6 0x5612dd87a099 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/bld/10.11-asan-ubsan/sql/sql_base.cc:2277

    #7 0x5612dd881847 in open_and_process_table /data/bld/10.11-asan-ubsan/sql/sql_base.cc:4210

    #8 0x5612dd8b4c07 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/bld/10.11-asan-ubsan/sql/sql_base.cc:4698

    #9 0x5612dd8b8352 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/bld/10.11-asan-ubsan/sql/sql_base.cc:5689

    #10 0x5612dd769cd3 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/bld/10.11-asan-ubsan/sql/sql_base.h:519

    #11 0x5612df825e46 in Rows_log_event::do_apply_event(rpl_group_info*) /data/bld/10.11-asan-ubsan/sql/log_event_server.cc:5964

    #12 0x5612df78e4a2 in Log_event::apply_event(rpl_group_info*) /data/bld/10.11-asan-ubsan/sql/log_event.cc:4255

    #13 0x5612dd68557d in apply_event_and_update_pos_apply /data/bld/10.11-asan-ubsan/sql/slave.cc:3968

    #14 0x5612dd6b01a7 in apply_event_and_update_pos(Log_event*, THD*, rpl_group_info*) /data/bld/10.11-asan-ubsan/sql/slave.cc:4144

    #15 0x5612dd6b39c1 in exec_relay_log_event /data/bld/10.11-asan-ubsan/sql/slave.cc:4570

    #16 0x5612dd6bd0dd in handle_slave_sql /data/bld/10.11-asan-ubsan/sql/slave.cc:5825

    #17 0x5612dfd900da in pfs_spawn_thread /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201

    #18 0x7f4ae64a81c3 in start_thread nptl/pthread_create.c:442

Thread T14 created by T12 here:

    #0 0x7f4ae7849726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x5612dfd859a6 in my_thread_create /data/bld/10.11-asan-ubsan/storage/perfschema/my_thread.h:52

    #2 0x5612dfd8d2ce in pfs_spawn_thread_v1 /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2252

    #3 0x5612dd6965b9 in inline_mysql_thread_create /data/bld/10.11-asan-ubsan/include/mysql/psi/mysql_thread.h:1139

    #4 0x5612dd6965b9 in start_slave_thread(unsigned int, void* (*)(void*), st_mysql_mutex*, st_mysql_mutex*, st_mysql_cond*, unsigned int volatile*, unsigned long volatile*, Master_info*) /data/bld/10.11-asan-ubsan/sql/slave.cc:1151

    #5 0x5612dd697577 in start_slave_threads(THD*, bool, bool, Master_info*, char const*, char const*, int) /data/bld/10.11-asan-ubsan/sql/slave.cc:1277

    #6 0x5612ddd62a7b in start_slave(THD*, Master_info*, bool) /data/bld/10.11-asan-ubsan/sql/sql_repl.cc:3271

    #7 0x5612ddc0d161 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:4314

    #8 0x5612ddc2c706 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:8179

    #9 0x5612ddc359da in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1905

    #10 0x5612ddc42616 in do_command(THD*, bool) /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1418

    #11 0x5612de432f59 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1386

    #12 0x5612de4340b6 in handle_one_connection /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1298

    #13 0x5612dfd900da in pfs_spawn_thread /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201

    #14 0x7f4ae64a81c3 in start_thread nptl/pthread_create.c:442

Thread T12 created by T0 here:

    #0 0x7f4ae7849726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x5612dfd859a6 in my_thread_create /data/bld/10.11-asan-ubsan/storage/perfschema/my_thread.h:52

    #2 0x5612dfd8d2ce in pfs_spawn_thread_v1 /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2252

    #3 0x5612dd49cf9a in inline_mysql_thread_create /data/bld/10.11-asan-ubsan/include/mysql/psi/mysql_thread.h:1139

    #4 0x5612dd49cf9a in create_thread_to_handle_connection(CONNECT*) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6139

    #5 0x5612dd4aeced in create_new_thread(CONNECT*) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6198

    #6 0x5612dd4aef0b in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6260

    #7 0x5612dd4afb4c in handle_connections_sockets() /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6383

    #8 0x5612dd4afff8 in run_main_loop /data/bld/10.11-asan-ubsan/sql/mysqld.cc:5639

    #9 0x5612dd4b13be in mysqld_main(int, char**) /data/bld/10.11-asan-ubsan/sql/mysqld.cc:6040

    #10 0x5612dd484951 in main /data/bld/10.11-asan-ubsan/sql/main.cc:34

    #11 0x7f4ae6446249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison /data/bld/10.11-asan-ubsan/sql/key.cc:129 in key_copy(unsigned char*, unsigned char const*, st_key const*, unsigned int, bool)

Shadow bytes around the buggy address:

  0x0c4a80056350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a80056360: 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00 00

  0x0c4a80056370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a80056380: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a80056390: 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 00 00

=>0x0c4a800563a0: 00 00 f7[f7]00 00 00 00 00 00 00 00 00 00 05 f7

  0x0c4a800563b0: 00 00 00 00 00 f7 02 f7 00 00 00 00 00 00 00 00

  0x0c4a800563c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a800563d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a800563e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a800563f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==881051==ABORTING

commit e69f8cae1a15e15b9e4f5e0f8497e1f17bdc81a4

Merge: 04595175621 066e8d6aeab

Author: Sergei Golubchik

Date:   Thu Jan 30 11:55:13 2025 +0100

    Merge branch '10.6' into 10.11