ASAN errors in Query_arena::free_items upon ANALYZE on spider table

INSTALL SONAME 'ha_spider';

SET spider_same_server_link= ON;

--eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);

--echo # Creating DBT3 data...

--disable_query_log

--source include/dbt3_s001.inc

--enable_query_log

CREATE TABLE spider_lineitem LIKE lineitem;

ALTER TABLE spider_lineitem ENGINE=Spider WRAPPER=mysql REMOTE_TABLE=lineitem REMOTE_SERVER=s;

ANALYZE TABLE spider_lineitem PERSISTENT FOR ALL;

==1091415==ERROR: AddressSanitizer: use-after-poison on address 0x62d0012b8618 at pc 0x55a3aa5894d2 bp 0x7f9f566b4490 sp 0x7f9f566b4488

READ of size 8 at 0x62d0012b8618 thread T5

    #0 0x55a3aa5894d1 in Query_arena::free_items() /data/bld/11.8-asan-ubsan/sql/sql_class.cc:4108

    #1 0x55a3aa5982b0 in THD::cleanup_after_query() /data/bld/11.8-asan-ubsan/sql/sql_class.cc:2469

    #2 0x55a3aa8858c7 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:7930

    #3 0x55a3aa88e39e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:1902

    #4 0x55a3aa89b2ac in do_command(THD*, bool) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:1415

    #5 0x55a3ab0dd363 in do_handle_one_connection(CONNECT*, bool) /data/bld/11.8-asan-ubsan/sql/sql_connect.cc:1415

    #6 0x55a3ab0de4cc in handle_one_connection /data/bld/11.8-asan-ubsan/sql/sql_connect.cc:1327

    #7 0x55a3acb7114b in pfs_spawn_thread /data/bld/11.8-asan-ubsan/storage/perfschema/pfs.cc:2198

    #8 0x7f9f630a81c3 in start_thread nptl/pthread_create.c:442

    #9 0x7f9f6312885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x62d0012b8618 is located 8728 bytes inside of 32760-byte region [0x62d0012b6400,0x62d0012be3f8)

allocated by thread T5 here:

    #0 0x7f9f638b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x55a3adde091d in my_malloc /data/bld/11.8-asan-ubsan/mysys/my_malloc.c:93

    #2 0x55a3addb3b4e in root_alloc /data/bld/11.8-asan-ubsan/mysys/my_alloc.c:66

    #3 0x55a3addb514c in alloc_root /data/bld/11.8-asan-ubsan/mysys/my_alloc.c:336

    #4 0x55a3aad243d0 in Index_prefix_calc::Prefix_calc_state* Query_arena::alloc<Index_prefix_calc::Prefix_calc_state>(unsigned long) const /data/bld/11.8-asan-ubsan/sql/sql_class.h:1287

    #5 0x55a3aad243d0 in Index_prefix_calc::Index_prefix_calc(THD*, TABLE*, st_key*) /data/bld/11.8-asan-ubsan/sql/sql_statistics.cc:1990

    #6 0x55a3aad02d8f in collect_statistics_for_index /data/bld/11.8-asan-ubsan/sql/sql_statistics.cc:2659

    #7 0x55a3aad0513b in collect_statistics_for_table(THD*, TABLE*) /data/bld/11.8-asan-ubsan/sql/sql_statistics.cc:2862

    #8 0x55a3ab14aebc in mysql_admin_table /data/bld/11.8-asan-ubsan/sql/sql_admin.cc:1093

    #9 0x55a3ab1533ac in Sql_cmd_analyze_table::execute(THD*) /data/bld/11.8-asan-ubsan/sql/sql_admin.cc:1620

    #10 0x55a3aa880634 in mysql_execute_command(THD*, bool) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:5886

    #11 0x55a3aa885088 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:7906

    #12 0x55a3aa88e39e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:1902

    #13 0x55a3aa89b2ac in do_command(THD*, bool) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:1415

    #14 0x55a3ab0dd363 in do_handle_one_connection(CONNECT*, bool) /data/bld/11.8-asan-ubsan/sql/sql_connect.cc:1415

    #15 0x55a3ab0de4cc in handle_one_connection /data/bld/11.8-asan-ubsan/sql/sql_connect.cc:1327

    #16 0x55a3acb7114b in pfs_spawn_thread /data/bld/11.8-asan-ubsan/storage/perfschema/pfs.cc:2198

    #17 0x7f9f630a81c3 in start_thread nptl/pthread_create.c:442

Thread T5 created by T0 here:

    #0 0x7f9f63849726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x55a3acb6d107 in my_thread_create /data/bld/11.8-asan-ubsan/storage/perfschema/my_thread.h:38

    #2 0x55a3acb715c8 in pfs_spawn_thread_v1 /data/bld/11.8-asan-ubsan/storage/perfschema/pfs.cc:2249

    #3 0x55a3aa0e19c9 in inline_mysql_thread_create /data/bld/11.8-asan-ubsan/include/mysql/psi/mysql_thread.h:1139

    #4 0x55a3aa0e19c9 in create_thread_to_handle_connection(CONNECT*) /data/bld/11.8-asan-ubsan/sql/mysqld.cc:6264

    #5 0x55a3aa0f4487 in create_new_thread(CONNECT*) /data/bld/11.8-asan-ubsan/sql/mysqld.cc:6326

    #6 0x55a3aa0f46af in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/11.8-asan-ubsan/sql/mysqld.cc:6388

    #7 0x55a3aa0f52f0 in handle_connections_sockets() /data/bld/11.8-asan-ubsan/sql/mysqld.cc:6500

    #8 0x55a3aa0f579c in run_main_loop /data/bld/11.8-asan-ubsan/sql/mysqld.cc:5742

    #9 0x55a3aa0f6d50 in mysqld_main(int, char**) /data/bld/11.8-asan-ubsan/sql/mysqld.cc:6165

    #10 0x55a3aa0c7d11 in main /data/bld/11.8-asan-ubsan/sql/main.cc:34

    #11 0x7f9f63046249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison /data/bld/11.8-asan-ubsan/sql/sql_class.cc:4108 in Query_arena::free_items()

Shadow bytes around the buggy address:

  0x0c5a8024f070: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5a8024f080: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5a8024f090: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5a8024f0a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5a8024f0b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

=>0x0c5a8024f0c0: f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5a8024f0d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5a8024f0e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5a8024f0f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5a8024f100: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c5a8024f110: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==1091415==ABORTING

commit 9f2adffccae1e155647e48f65aa7932fc833f723

Author: Sergei Golubchik

Date:   Thu Sep 26 11:52:05 2024 +0200

    memroot improvement: fix savepoint support