malloc(): unaligned [tcache|fastbin] chunk detected, ASAN heap-use-after-free on CoR GTT

CREATE GLOBAL TEMPORARY TABLE t (c INT) ON COMMIT DELETE ROWS;

SET pseudo_slave_mode=1;

LOCK TABLES t WRITE;

INSERT INTO t VALUES (1);

TRUNCATE t;

CREATE OR REPLACE GLOBAL TEMPORARY TABLE t (t TEXT);

2025-12-29 16:31:23 0 [Note] /test/MDEV-35915_v9_MD271225-mariadb-12.2.0-linux-x86_64-opt/bin/mariadbd: ready for connections.

Version: '12.2.0-MariaDB'  socket: '/test/MDEV-35915_v9_MD271225-mariadb-12.2.0-linux-x86_64-opt/socket.sock'  port: 12222  MariaDB Server

malloc(): unaligned tcache chunk detected

Core was generated by `/test/MDEV-35915_v9_MD271225-mariadb-12.2.0-linux-x86_64-opt/bin/mariadbd --no-'.

Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 2036764)]

(gdb) bt

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

#1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78

#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89

#3  0x0000730e3fc4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26

#4  0x0000730e3fc288ff in __GI_abort () at ./stdlib/abort.c:79

#5  0x0000730e3fc297b6 in __libc_message_impl (fmt=fmt@entry=0x730e3fdce8d7 "%s\n") at ../sysdeps/posix/libc_fatal.c:132

#6  0x0000730e3fca8fe5 in malloc_printerr (str=str@entry=0x730e3fdd1eb8 "malloc(): unaligned tcache chunk detected")at ./malloc/malloc.c:5772

#7  0x0000730e3fcad93c in tcache_get_n (ep=<optimized out>, tc_idx=<optimized out>) at ./malloc/malloc.c:3183

#8  tcache_get (tc_idx=<optimized out>) at ./malloc/malloc.c:3199

#9  __GI___libc_malloc (bytes=88) at ./malloc/malloc.c:3320

#10 0x0000730e400bb5dc in operator new (sz=88)at ../../../../src/libstdc++-v3/libsupc++/new_op.cc:50

#11 0x0000730e400bb60d in operator new (sz=<optimized out>)at ../../../../src/libstdc++-v3/libsupc++/new_opnt.cc:39

#12 0x0000638cebc25e78 in MDL_context::try_acquire_lock_impl (this=0x730d10000e78, mdl_request=0x730e3c9fb600, out_ticket=0x730e3c9fb550)at /test/bb-12.2-nikita-global-tmp_opt/sql/mdl.cc:2735

#13 0x0000638cebc261dd in MDL_context::acquire_lock (this=0x1f118f, mdl_request=0x1f141c, lock_wait_timeout=86400)at /test/bb-12.2-nikita-global-tmp_opt/sql/mdl.cc:2895

#14 0x0000638cebeaeaaa in dict_stats::open (this=0x730e3c9fb800, thd=<optimized out>)at /test/bb-12.2-nikita-global-tmp_opt/storage/innobase/dict/dict0dict.cc:1107

#15 0x0000638cebe7f9e8 in ha_innobase::delete_table (this=<optimized out>, name=<optimized out>)at /test/bb-12.2-nikita-global-tmp_opt/storage/innobase/handler/ha_innodb.cc:13637

#16 0x0000638ceb7ff0da in hton_drop_table (hton=<optimized out>, path=0x730e3c9fcb30 "./test/t")at /test/bb-12.2-nikita-global-tmp_opt/sql/handler.cc:580

#17 0x0000638ceb802add in ha_delete_table (thd=thd@entry=0x730d10000c68, hton=hton@entry=0x638cee50a9d8, path=path@entry=0x730e3c9fcb30 "./test/t", db=db@entry=0x730e3c9fc800, alias=alias@entry=0x730e3c9fc7d0, generate_warning=false)at /test/bb-12.2-nikita-global-tmp_opt/sql/handler.cc:3339

#18 0x0000638cebb8eb00 in mysql_rm_table_no_locks (thd=thd@entry=0x730d10000c68, tables=tables@entry=0x730e3c9fcde0, current_db=current_db@entry=0x730d10000d08, ddl_log_state=ddl_log_state@entry=0x730e3c9fd940, if_exists=<optimized out>, drop_temporary=false, drop_view=<optimized out>, drop_sequence=<optimized out>, dont_log_query=<optimized out>, dont_free_locks=<optimized out>)at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_table.cc:1737

#19 0x0000638cebb947be in create_table_impl (thd=thd@entry=0x730d10000c68, ddl_log_state_create=ddl_log_state_create@entry=0x730e3c9fd920, ddl_log_state_rm=ddl_log_state_rm@entry=0x730e3c9fd940, orig_db=@0x730d100177d8: {<Lex_ident_fs> = {<Lex_ident<Compare_table_names>> = {<Lex_cstring> = {<st_mysql_const_lex_string> = {str = 0x730d100177b0 "test", length = 4}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, orig_table_name=@0x730d100177e8: {<Lex_ident_fs> = {<Lex_ident<Compare_table_names>> = {<Lex_cstring> = {<st_mysql_const_lex_string> = {str = 0x730d10017780 "t", length = 1}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, db=@0x730d100177d8: {<Lex_ident_fs> = {<Lex_ident<Compare_table_names>> = {<Lex_cstring> = {<st_mysql_const_lex_string> = {str = 0x730d100177b0 "test", length = 4}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, table_name=@0x730d100177e8: {<Lex_ident_fs> = {<Lex_ident<Compare_table_names>> = {<Lex_cstring> = {<st_mysql_const_lex_string> = {str = 0x730d10017780 "t", length = 1}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, path=@0x730e3c9fd5c0: {str = 0x730e3c9fd620 "./test/t", length = 8}, options={m_options = DDL_options_st::OPT_OR_REPLACE}, create_info=0x730e3c9fdba0, alter_info=0x730e3c9fda28, create_table_mode=0, is_trans=0x730e3c9fd9a7, key_info=0x730e3c9fd5b8, key_count=0x730e3c9fd5ec, frm=0x730e3c9fd5d0)at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_table.cc:4859

#20 0x0000638cebb93de4 in mysql_create_table_no_lock (thd=thd@entry=0x730d10000c68, ddl_log_state_create=ddl_log_state_create@entry=0x730e3c9fd920, ddl_log_state_rm=ddl_log_state_rm@entry=0x730e3c9fd940, create_info=create_info@entry=0x730e3c9fdba0, alter_info=alter_info@entry=0x730e3c9fda28, is_trans=is_trans@entry=0x730e3c9fd9a7, create_table_mode=0, table_list=0x730d100177c0)at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_table.cc:5100

#21 0x0000638cebba5f81 in mysql_create_table (thd=thd@entry=0x730d10000c68, create_table=create_table@entry=0x730d100177c0, create_info=create_info@entry=0x730e3c9fdba0, alter_info=alter_info@entry=0x730e3c9fda28)at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_table.cc:5346

#22 0x0000638cebba4e00 in Sql_cmd_create_table_like::execute (this=<optimized out>, thd=0x730d10000c68)at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_table.cc:14033

#23 0x0000638cebaca29c in mysql_execute_command (thd=thd@entry=0x730d10000c68, is_called_from_prepared_stmt=false)at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_parse.cc:5878

#24 0x0000638cebac5524 in mysql_parse (thd=thd@entry=0x730d10000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x730e3c9fe420)at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_parse.cc:7911

#25 0x0000638cebac3cbd in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x730d10000c68, packet=packet@entry=0x730d100089f9 "CREATE OR REPLACE GLOBAL TEMPORARY TABLE t (t TEXT)", packet_length=packet_length@entry=51, blocking=true)at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_parse.cc:1898

#26 0x0000638cebac59a1 in do_command (thd=thd@entry=0x730d10000c68, blocking=true) at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_parse.cc:1437

#27 0x0000638cebc1ba5d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x638ceee23b48, put_in_cache=true)at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_connect.cc:1414

#28 0x0000638cebc1b81f in handle_one_connection (arg=arg@entry=0x638ceee23b48)at /test/bb-12.2-nikita-global-tmp_opt/sql/sql_connect.cc:1326

#29 0x0000638cebde07c9 in pfs_spawn_thread (arg=0x638ceedc6b08)at /test/bb-12.2-nikita-global-tmp_opt/storage/perfschema/pfs.cc:2198

#30 0x0000730e3fc9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#31 0x0000730e3fd29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

==2189908==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c314cb12ad8 at pc 0x5e0abf178810 bp 0x79e0600ffe20 sp 0x79e0600ffe18

READ of size 8 at 0x7c314cb12ad8 thread T12

    #0 0x5e0abf17880f in wait_while_table_is_used(THD*, TABLE*, ha_extra_function, unsigned long long) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_base.cc:1501:13

    #1 0x5e0abfb4ac1c in wait_while_table_is_used(THD*, TABLE*, ha_extra_function) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_base.h:247:10

    #2 0x5e0abfb4ac1c in mysql_rm_table_no_locks(THD*, TABLE_LIST*, st_mysql_const_lex_string const*, st_ddl_log_state*, bool, bool, bool, bool, bool, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_table.cc:1695:13

    #3 0x5e0abfb6e960 in create_table_impl(THD*, st_ddl_log_state*, st_ddl_log_state*, Lex_ident_db const&, Lex_ident_table const&, Lex_ident_db const&, Lex_ident_table const&, st_mysql_const_lex_string const&, DDL_options_st, HA_CREATE_INFO*, Alter_info*, int, bool*, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_table.cc:4859:13

    #4 0x5e0abfb6c2aa in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_table.cc:5100:8

    #5 0x5e0abfbeaab4 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_table.cc:5346:7

    #6 0x5e0abfbe45bf in Sql_cmd_create_table_like::execute(THD*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_table.cc:14033:12

    #7 0x5e0abf6850ef in mysql_execute_command(THD*, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:5878:26

    #8 0x5e0abf6687e5 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:7911:18

    #9 0x5e0abf6609ad in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:1898:7

    #10 0x5e0abf66a720 in do_command(THD*, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:1437:17

    #11 0x5e0abfe951bc in do_handle_one_connection(CONNECT*, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_connect.cc:1414:11

    #12 0x5e0abfe94cd6 in handle_one_connection /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_connect.cc:1326:5

    #13 0x5e0abe648aca in asan_thread_start(void*) crtstuff.c

    #14 0x7de14dc9ca93 in start_thread nptl/pthread_create.c:447:8

    #15 0x7de14dd29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x7c314cb12ad8 is located 472 bytes inside of 8184-byte region [0x7c314cb12900,0x7c314cb148f8)

freed by thread T12 here:

    #0 0x5e0abe64afaa in free (/test/MDEV-35915_v9_UBASAN_MD271225-mariadb-12.2.0-linux-x86_64-opt/bin/mariadbd+0x2fcefaa) (BuildId: 36fa81a16067ba38044d96ac0e7bc8372d20deb9)

    #1 0x5e0ac15cd997 in root_free /test/bb-12.2-nikita-global-tmp_opt_san/mysys/my_alloc.c:77:5

    #2 0x5e0ac15cd997 in free_root /test/bb-12.2-nikita-global-tmp_opt_san/mysys/my_alloc.c:517:7

    #3 0x5e0abfccf227 in TABLE_SHARE::destroy() /test/bb-12.2-nikita-global-tmp_opt_san/sql/table.cc:554:3

    #4 0x5e0abfb4a3d9 in mysql_rm_table_no_locks(THD*, TABLE_LIST*, st_mysql_const_lex_string const*, st_ddl_log_state*, bool, bool, bool, bool, bool, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_table.cc:1609:7

    #5 0x5e0abfb6e960 in create_table_impl(THD*, st_ddl_log_state*, st_ddl_log_state*, Lex_ident_db const&, Lex_ident_table const&, Lex_ident_db const&, Lex_ident_table const&, st_mysql_const_lex_string const&, DDL_options_st, HA_CREATE_INFO*, Alter_info*, int, bool*, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_table.cc:4859:13

    #6 0x5e0abfb6c2aa in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_table.cc:5100:8

    #7 0x5e0abfbeaab4 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_table.cc:5346:7

    #8 0x5e0abfbe45bf in Sql_cmd_create_table_like::execute(THD*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_table.cc:14033:12

    #9 0x5e0abf6850ef in mysql_execute_command(THD*, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:5878:26

    #10 0x5e0abf6687e5 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:7911:18

    #11 0x5e0abf6609ad in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:1898:7

    #12 0x5e0abf66a720 in do_command(THD*, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:1437:17

    #13 0x5e0abfe951bc in do_handle_one_connection(CONNECT*, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_connect.cc:1414:11

    #14 0x5e0abfe94cd6 in handle_one_connection /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_connect.cc:1326:5

    #15 0x5e0abe648aca in asan_thread_start(void*) crtstuff.c

previously allocated by thread T12 here:

    #0 0x5e0abe64b248 in malloc (/test/MDEV-35915_v9_UBASAN_MD271225-mariadb-12.2.0-linux-x86_64-opt/bin/mariadbd+0x2fcf248) (BuildId: 36fa81a16067ba38044d96ac0e7bc8372d20deb9)

    #1 0x5e0ac15fc385 in my_malloc /test/bb-12.2-nikita-global-tmp_opt_san/mysys/my_malloc.c:93:29

    #2 0x5e0ac15c935e in init_alloc_root /test/bb-12.2-nikita-global-tmp_opt_san/mysys/my_alloc.c:178:22

    #3 0x5e0abfd5de79 in init_sql_alloc(unsigned int, st_mem_root*, unsigned int, unsigned int, unsigned long) /test/bb-12.2-nikita-global-tmp_opt_san/sql/thr_malloc.cc:64:3

    #4 0x5e0abfccce48 in alloc_table_share(char const*, char const*, char const*, unsigned int) /test/bb-12.2-nikita-global-tmp_opt_san/sql/table.cc:366:3

    #5 0x5e0ac02ef59f in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /test/bb-12.2-nikita-global-tmp_opt_san/sql/table_cache.cc:848:18

    #6 0x5e0abf17e0bb in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_base.cc:2183:10

    #7 0x5e0abf191d43 in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_base.cc:4293:14

    #8 0x5e0abf191d43 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_base.cc:4776:14

    #9 0x5e0abf6a6b1f in open_tables(THD*, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_base.h:282:10

    #10 0x5e0abf6a6b1f in lock_tables_open_and_lock_tables(THD*, TABLE_LIST*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:2910:7

    #11 0x5e0abf68d4ee in mysql_execute_command(THD*, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:4966:10

    #12 0x5e0abf6687e5 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:7911:18

    #13 0x5e0abf6609ad in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:1898:7

    #14 0x5e0abf66a720 in do_command(THD*, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_parse.cc:1437:17

    #15 0x5e0abfe951bc in do_handle_one_connection(CONNECT*, bool) /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_connect.cc:1414:11

    #16 0x5e0abfe94cd6 in handle_one_connection /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_connect.cc:1326:5

    #17 0x5e0abe648aca in asan_thread_start(void*) crtstuff.c

Thread T12 created by T0 here:

    #0 0x5e0abe62f1c5 in pthread_create (/test/MDEV-35915_v9_UBASAN_MD271225-mariadb-12.2.0-linux-x86_64-opt/bin/mariadbd+0x2fb31c5) (BuildId: 36fa81a16067ba38044d96ac0e7bc8372d20deb9)

    #1 0x5e0abe6a17f9 in create_thread_to_handle_connection(CONNECT*) /test/bb-12.2-nikita-global-tmp_opt_san/sql/mysqld.cc:6272:19

    #2 0x5e0abe6a2b3a in handle_connections_sockets() /test/bb-12.2-nikita-global-tmp_opt_san/sql/mysqld.cc:6508:9

    #3 0x5e0abe6a0f40 in run_main_loop() /test/bb-12.2-nikita-global-tmp_opt_san/sql/mysqld.cc:5750:3

    #4 0x5e0abe697a7e in mysqld_main(int, char**) /test/bb-12.2-nikita-global-tmp_opt_san/sql/mysqld.cc:6173:3

    #5 0x7de14dc2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

    #6 0x7de14dc2a28a in __libc_start_main csu/../csu/libc-start.c:360:3

    #7 0x5e0abe5a5ad4 in _start (/test/MDEV-35915_v9_UBASAN_MD271225-mariadb-12.2.0-linux-x86_64-opt/bin/mariadbd+0x2f29ad4) (BuildId: 36fa81a16067ba38044d96ac0e7bc8372d20deb9)

SUMMARY: AddressSanitizer: heap-use-after-free /test/bb-12.2-nikita-global-tmp_opt_san/sql/sql_base.cc:1501:13 in wait_while_table_is_used(THD*, TABLE*, ha_extra_function, unsigned long long)

Shadow bytes around the buggy address:

  0x7c314cb12800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x7c314cb12880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x7c314cb12900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x7c314cb12980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x7c314cb12a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x7c314cb12a80: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd

  0x7c314cb12b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x7c314cb12b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x7c314cb12c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x7c314cb12c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x7c314cb12d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==2189908==ABORTING