SIGSEGV in mysql_ha_flush on SHOW CREATE TABLE after HANDLER OPEN GTT

--source include/have_innodb.inc

CREATE GLOBAL TEMPORARY TABLE t (c INT) ENGINE=InnoDB ON COMMIT DELETE ROWS;    # or/and with ENGINE=MyISAM

--error 1180

HANDLER t OPEN AS a;

SHOW CREATE TABLE t;

Core was generated by `/test/MDEV-35915_4_MD120925-mariadb-12.0.1-linux-x86_64-opt/bin/mariadbd --no-d'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x00005cfb580a1a05 in mysql_ha_flush (thd=thd@entry=0x7b4730000c68)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_handler.cc:1199

1199	         (!hash_tables->table->s->tmp_table &&

[Current thread is 1 (LWP 2356715)]

(gdb) bt

#0  0x00005cfb580a1a05 in mysql_ha_flush (thd=thd@entry=0x7b4730000c68)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_handler.cc:1199

#1  0x00005cfb58015e1d in open_tables (thd=thd@entry=0x7b4730000c68, options=@0x7b4730006664: {m_options = DDL_options_st::OPT_NONE}, start=start@entry=0x7b4859affbf8, counter=counter@entry=0x7b4859affbd4, flags=flags@entry=1024, prelocking_strategy=prelocking_strategy@entry=0x7b4859affc08)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_base.cc:4717

#2  0x00005cfb5816eb5f in open_tables (thd=0x7b4730000c68, tables=0x7b4859affbf8, counter=0x7b4859affbd4, flags=1024)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_base.h:514

#3  mysqld_show_create_get_fields (thd=thd@entry=0x7b4730000c68, table_list=0x7b47300177c8, field_list=field_list@entry=0x7b4859b00608, buffer=buffer@entry=0x7b4859affea0)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_show.cc:1268

#4  0x00005cfb5816f8f2 in mysqld_show_create (thd=0x0, thd@entry=0x7b4730000c68, table_list=0x0, table_list@entry=0x7b47300177c8)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_show.cc:1375

#5  0x00005cfb580e45dc in mysql_execute_command (thd=thd@entry=0x7b4730000c68, is_called_from_prepared_stmt=false)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:4383

#6  0x00005cfb580de914 in mysql_parse (thd=thd@entry=0x7b4730000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7b4859b01420)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:7893

#7  0x00005cfb580dd0bd in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7b4730000c68, packet=packet@entry=0x7b4730008a69 "SHOW CREATE TABLE t", packet_length=packet_length@entry=19, blocking=true)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:1881

#8  0x00005cfb580ded91 in do_command (thd=thd@entry=0x7b4730000c68, blocking=true) at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:1420

#9  0x00005cfb582342fd in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5cfb5ae60bf8, put_in_cache=true)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_connect.cc:1414

#10 0x00005cfb582340bf in handle_one_connection (arg=arg@entry=0x5cfb5ae60bf8)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_connect.cc:1326

#11 0x00005cfb583f28f9 in pfs_spawn_thread (arg=0x5cfb5ae107e8)at /test/bb-12.0-nikita-global-tmp_opt/storage/perfschema/pfs.cc:2198

#12 0x00007b485c89ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#13 0x00007b485c929c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Core was generated by `/test/MDEV-35915_4_MD120925-mariadb-12.0.1-linux-x86_64-dbg/bin/mariadbd --no-d'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  MDL_ticket::has_pending_conflicting_lock (this=0x8f8f8f8f8f8f8f8f)at /test/bb-12.0-nikita-global-tmp_dbg/sql/mdl.cc:3126

3126	  return m_lock->has_pending_conflicting_lock(m_type);

[Current thread is 1 (LWP 2350761)]

(gdb) bt

#0  MDL_ticket::has_pending_conflicting_lock (this=0x8f8f8f8f8f8f8f8f)at /test/bb-12.0-nikita-global-tmp_dbg/sql/mdl.cc:3126

#1  0x0000639185ebb315 in mysql_ha_flush (thd=0x728f5c000d58)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_handler.cc:1198

#2  0x0000639185dc6b8b in open_tables (thd=0x728f5c000d58, options=@0x728f5c00672c: {m_options = DDL_options_st::OPT_NONE}, start=0x72902432efd8, counter=0x72902432efac, flags=1024, prelocking_strategy=0x72902432ed98)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_base.cc:4717

#3  0x0000639185dba368 in open_tables (thd=0x728f5c000d58, tables=0x72902432efd8, counter=0x72902432efac, flags=1024)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_base.h:514

#4  0x0000639185fe8850 in mysqld_show_create_get_fields (thd=0x728f5c000d58, table_list=0x728f5c019fc8, field_list=0x72902432fa28, buffer=0x72902432f2b8)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_show.cc:1268

#5  0x0000639185fe99d1 in mysqld_show_create (thd=0x728f5c000d58, table_list=0x728f5c019fc8)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_show.cc:1375

#6  0x0000639185f1d5f8 in mysql_execute_command (thd=0x728f5c000d58, is_called_from_prepared_stmt=false)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_parse.cc:4383

#7  0x0000639185f14e08 in mysql_parse (thd=0x728f5c000d58, rawbuf=0x728f5c019ef0 "SHOW CREATE TABLE t", length=19, parser_state=0x729024331a10)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_parse.cc:7893

#8  0x0000639185f125e9 in dispatch_command (command=COM_QUERY, thd=0x728f5c000d58, packet=0x728f5c00b269 "SHOW CREATE TABLE t", packet_length=19, blocking=true)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_parse.cc:1881

#9  0x0000639185f1588a in do_command (thd=0x728f5c000d58, blocking=true)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_parse.cc:1420

#10 0x0000639186106bce in do_handle_one_connection (connect=0x63918835f028, put_in_cache=true)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_connect.cc:1414

#11 0x00006391861069b1 in handle_one_connection (arg=0x6391882877b8)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_connect.cc:1326

#12 0x000072902749ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#13 0x0000729027529c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

==2355358==ERROR: AddressSanitizer: heap-use-after-free on address 0x6e47b9273b50 at pc 0x5a710623ec29 bp 0x6cb6cc9001a0 sp 0x6cb6cc900198

READ of size 8 at 0x6e47b9273b50 thread T12

    #0 0x5a710623ec28 in mysql_ha_flush(THD*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_handler.cc:1197:31

    #1 0x5a7105ec3c01 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_base.cc:4717:5

    #2 0x5a7105e97337 in open_tables(THD*, TABLE_LIST**, unsigned int*, unsigned int) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_base.h:514:10

    #3 0x5a7106719735 in mysqld_show_create_get_fields(THD*, TABLE_LIST*, List<Item>*, String*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_show.cc:1268:7

    #4 0x5a710671e186 in mysqld_show_create(THD*, TABLE_LIST*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_show.cc:1375:7

    #5 0x5a71063a3fcc in mysql_execute_command(THD*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:4383:12

    #6 0x5a7106383e4f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:7893:18

    #7 0x5a710637c008 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:1881:7

    #8 0x5a7106385db0 in do_command(THD*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:1420:17

    #9 0x5a7106ba69bc in do_handle_one_connection(CONNECT*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_connect.cc:1414:11

    #10 0x5a7106ba64d6 in handle_one_connection /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_connect.cc:1326:5

    #11 0x5a710538588a in asan_thread_start(void*) crtstuff.c

    #12 0x70b7ba49ca93 in start_thread nptl/pthread_create.c:447:8

    #13 0x70b7ba529c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x6e47b9273b50 is located 976 bytes inside of 1064-byte region [0x6e47b9273780,0x6e47b9273ba8)

freed by thread T12 here:

    #0 0x5a7105387d6a in free (/test/MDEV-35915_4_UBASAN_MD120925-mariadb-12.0.1-linux-x86_64-opt/bin/mariadbd+0x2f3cd6a) (BuildId: 73e0883e37519f1d229ef4d8f62cee15daf7f047)

    #1 0x5a710700bf7c in THD::close_temporary_table(TABLE*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/temporary_tables.cc:1430:3

    #2 0x5a710700bf7c in THD::free_temporary_table(TABLE*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/temporary_tables.cc:1790:3

    #3 0x5a710700bf7c in THD::drop_tmp_table_share(TABLE*, TMP_TABLE_SHARE*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/temporary_tables.cc:800:5

    #4 0x5a710700dce6 in THD::commit_global_tmp_tables() /test/bb-12.0-nikita-global-tmp_opt_san/sql/temporary_tables.cc:1482:26

    #5 0x5a7105492727 in commit_one_phase_2(THD*, bool, THD_TRANS*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/handler.cc:2245:17

    #6 0x5a710548fed9 in ha_commit_trans(THD*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/handler.cc:1977:12

    #7 0x5a7106c08106 in trans_commit_stmt(THD*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/transaction.cc:498:10

    #8 0x5a71063a7029 in mysql_execute_command(THD*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:5949:7

    #9 0x5a7106383e4f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:7893:18

    #10 0x5a710637c008 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:1881:7

    #11 0x5a7106385db0 in do_command(THD*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:1420:17

    #12 0x5a7106ba69bc in do_handle_one_connection(CONNECT*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_connect.cc:1414:11

    #13 0x5a7106ba64d6 in handle_one_connection /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_connect.cc:1326:5

    #14 0x5a710538588a in asan_thread_start(void*) crtstuff.c

previously allocated by thread T12 here:

    #0 0x5a7105388008 in malloc (/test/MDEV-35915_4_UBASAN_MD120925-mariadb-12.0.1-linux-x86_64-opt/bin/mariadbd+0x2f3d008) (BuildId: 73e0883e37519f1d229ef4d8f62cee15daf7f047)

    #1 0x5a71082f5d45 in my_malloc /test/bb-12.0-nikita-global-tmp_opt_san/mysys/my_malloc.c:93:29

    #2 0x5a71070032b4 in THD::open_temporary_table(TMP_TABLE_SHARE*, Lex_ident_table const&) /test/bb-12.0-nikita-global-tmp_opt_san/sql/temporary_tables.cc:1294:26

    #3 0x5a71070023cf in THD::create_and_open_tmp_table(st_mysql_const_unsigned_lex_string*, char const*, Lex_ident_db const&, Lex_ident_table const&, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/temporary_tables.cc:139:12

    #4 0x5a710688636b in create_table_impl(THD*, st_ddl_log_state*, st_ddl_log_state*, Lex_ident_db const&, Lex_ident_table const&, Lex_ident_db const&, Lex_ident_table const&, st_mysql_const_lex_string const&, DDL_options_st, HA_CREATE_INFO*, Alter_info*, int, bool*, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_table.cc:4990:24

    #5 0x5a71068834ea in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_table.cc:5078:8

    #6 0x5a710688acb5 in open_global_temporary_table(THD*, TABLE_SHARE*, TABLE_LIST*, MDL_ticket*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_table.cc:6238:14

    #7 0x5a7105eb3b2e in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_base.cc:2350:22

    #8 0x5a7105ec6318 in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_base.cc:4307:14

    #9 0x5a7105ec6318 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_base.cc:4793:14

    #10 0x5a7105e97337 in open_tables(THD*, TABLE_LIST**, unsigned int*, unsigned int) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_base.h:514:10

    #11 0x5a710622f633 in mysql_ha_open(THD*, TABLE_LIST*, SQL_HANDLER*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_handler.cc:346:11

    #12 0x5a71063a4f7f in mysql_execute_command(THD*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:5451:10

    #13 0x5a7106383e4f in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:7893:18

    #14 0x5a710637c008 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:1881:7

    #15 0x5a7106385db0 in do_command(THD*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_parse.cc:1420:17

    #16 0x5a7106ba69bc in do_handle_one_connection(CONNECT*, bool) /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_connect.cc:1414:11

    #17 0x5a7106ba64d6 in handle_one_connection /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_connect.cc:1326:5

    #18 0x5a710538588a in asan_thread_start(void*) crtstuff.c

Thread T12 created by T0 here:

    #0 0x5a710536bf85 in pthread_create (/test/MDEV-35915_4_UBASAN_MD120925-mariadb-12.0.1-linux-x86_64-opt/bin/mariadbd+0x2f20f85) (BuildId: 73e0883e37519f1d229ef4d8f62cee15daf7f047)

    #1 0x5a71053de5b9 in create_thread_to_handle_connection(CONNECT*) /test/bb-12.0-nikita-global-tmp_opt_san/sql/mysqld.cc:6272:19

    #2 0x5a71053df8fa in handle_connections_sockets() /test/bb-12.0-nikita-global-tmp_opt_san/sql/mysqld.cc:6508:9

    #3 0x5a71053ddd00 in run_main_loop() /test/bb-12.0-nikita-global-tmp_opt_san/sql/mysqld.cc:5750:3

    #4 0x5a71053d483e in mysqld_main(int, char**) /test/bb-12.0-nikita-global-tmp_opt_san/sql/mysqld.cc:6173:3

    #5 0x70b7ba42a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

    #6 0x70b7ba42a28a in __libc_start_main csu/../csu/libc-start.c:360:3

    #7 0x5a71052e2894 in _start (/test/MDEV-35915_4_UBASAN_MD120925-mariadb-12.0.1-linux-x86_64-opt/bin/mariadbd+0x2e97894) (BuildId: 73e0883e37519f1d229ef4d8f62cee15daf7f047)

SUMMARY: AddressSanitizer: heap-use-after-free /test/bb-12.0-nikita-global-tmp_opt_san/sql/sql_handler.cc:1197:31 in mysql_ha_flush(THD*)

Shadow bytes around the buggy address:

  0x6e47b9273880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x6e47b9273900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x6e47b9273980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x6e47b9273a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x6e47b9273a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x6e47b9273b00: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd

  0x6e47b9273b80: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa

  0x6e47b9273c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x6e47b9273c80: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00

  0x6e47b9273d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x6e47b9273d80: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==2355358==ABORTING