ASAN errors in copy_data_between_tables

CREATE TABLE t (

  a TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,

  b TIMESTAMP ON UPDATE CURRENT_TIMESTAMP

);

ALTER TABLE t MODIFY b DATETIME;

DROP TABLE t;

==3209936==ERROR: AddressSanitizer: use-after-poison on address 0x62500026cbe8 at pc 0x55ae2d8368e5 bp 0x7f543bf20230 sp 0x7f543bf20228

WRITE of size 8 at 0x62500026cbe8 thread T5

    #0 0x55ae2d8368e4 in copy_data_between_tables /data/bld/main-asan-ubsan/sql/sql_table.cc:13063

    #1 0x55ae2d847d5e in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /data/bld/main-asan-ubsan/sql/sql_table.cc:11963

    #2 0x55ae2dc72291 in Sql_cmd_alter_table::execute(THD*) /data/bld/main-asan-ubsan/sql/sql_alter.cc:695

    #3 0x55ae2d257ae5 in mysql_execute_command(THD*, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:5901

    #4 0x55ae2d25c7bc in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/main-asan-ubsan/sql/sql_parse.cc:7940

    #5 0x55ae2d2658b1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:1896

    #6 0x55ae2d272a23 in do_command(THD*, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:1432

    #7 0x55ae2dc21fe1 in do_handle_one_connection(CONNECT*, bool) /data/bld/main-asan-ubsan/sql/sql_connect.cc:1503

    #8 0x55ae2dc2314a in handle_one_connection /data/bld/main-asan-ubsan/sql/sql_connect.cc:1415

    #9 0x55ae2fbb481c in pfs_spawn_thread /data/bld/main-asan-ubsan/storage/perfschema/pfs.cc:2198

    #10 0x7f5448ca81c3 in start_thread nptl/pthread_create.c:442

    #11 0x7f5448d2885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x62500026cbe8 is located 2792 bytes inside of 8184-byte region [0x62500026c100,0x62500026e0f8)

allocated by thread T5 here:

    #0 0x7f544a0b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

    #1 0x55ae31240b4d in my_malloc /data/bld/main-asan-ubsan/mysys/my_malloc.c:93

    #2 0x55ae31212e11 in root_alloc /data/bld/main-asan-ubsan/mysys/my_alloc.c:66

    #3 0x55ae312133c4 in init_alloc_root /data/bld/main-asan-ubsan/mysys/my_alloc.c:178

    #4 0x55ae2da3da29 in init_sql_alloc(unsigned int, st_mem_root*, unsigned int, unsigned int, unsigned long) /data/bld/main-asan-ubsan/sql/thr_malloc.cc:64

    #5 0x55ae2da04961 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/bld/main-asan-ubsan/sql/table.cc:4411

    #6 0x55ae2e40b261 in THD::open_temporary_table(TMP_TABLE_SHARE*, Lex_ident_table const&) /data/bld/main-asan-ubsan/sql/temporary_tables.cc:1231

    #7 0x55ae2e4191cb in THD::create_and_open_tmp_table(st_mysql_const_unsigned_lex_string*, char const*, Lex_ident_db const&, Lex_ident_table const&, bool) /data/bld/main-asan-ubsan/sql/temporary_tables.cc:124

    #8 0x55ae2d845fa4 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /data/bld/main-asan-ubsan/sql/sql_table.cc:11849

    #9 0x55ae2dc72291 in Sql_cmd_alter_table::execute(THD*) /data/bld/main-asan-ubsan/sql/sql_alter.cc:695

    #10 0x55ae2d257ae5 in mysql_execute_command(THD*, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:5901

    #11 0x55ae2d25c7bc in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/main-asan-ubsan/sql/sql_parse.cc:7940

    #12 0x55ae2d2658b1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:1896

    #13 0x55ae2d272a23 in do_command(THD*, bool) /data/bld/main-asan-ubsan/sql/sql_parse.cc:1432

    #14 0x55ae2dc21fe1 in do_handle_one_connection(CONNECT*, bool) /data/bld/main-asan-ubsan/sql/sql_connect.cc:1503

    #15 0x55ae2dc2314a in handle_one_connection /data/bld/main-asan-ubsan/sql/sql_connect.cc:1415

    #16 0x55ae2fbb481c in pfs_spawn_thread /data/bld/main-asan-ubsan/storage/perfschema/pfs.cc:2198

    #17 0x7f5448ca81c3 in start_thread nptl/pthread_create.c:442

Thread T5 created by T0 here:

    #0 0x7f544a049726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x55ae2fbb07d8 in my_thread_create /data/bld/main-asan-ubsan/storage/perfschema/my_thread.h:38

    #2 0x55ae2fbb4c99 in pfs_spawn_thread_v1 /data/bld/main-asan-ubsan/storage/perfschema/pfs.cc:2249

    #3 0x55ae2c90e5ba in inline_mysql_thread_create /data/bld/main-asan-ubsan/include/mysql/psi/mysql_thread.h:1139

    #4 0x55ae2c90e5ba in create_thread_to_handle_connection(CONNECT*) /data/bld/main-asan-ubsan/sql/mysqld.cc:6473

    #5 0x55ae2c921b77 in create_new_thread(CONNECT*) /data/bld/main-asan-ubsan/sql/mysqld.cc:6535

    #6 0x55ae2c921d9f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/main-asan-ubsan/sql/mysqld.cc:6597

    #7 0x55ae2c9229e0 in handle_connections_sockets() /data/bld/main-asan-ubsan/sql/mysqld.cc:6709

    #8 0x55ae2c922e8c in run_main_loop /data/bld/main-asan-ubsan/sql/mysqld.cc:5951

    #9 0x55ae2c9244b5 in mysqld_main(int, char**) /data/bld/main-asan-ubsan/sql/mysqld.cc:6374

    #10 0x55ae2c8f3ee1 in main /data/bld/main-asan-ubsan/sql/main.cc:34

    #11 0x7f5448c46249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: use-after-poison /data/bld/main-asan-ubsan/sql/sql_table.cc:13063 in copy_data_between_tables

Shadow bytes around the buggy address:

  0x0c4a80045920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a80045930: 00 00 00 00 f7 00 02 00 02 f7 00 00 00 f7 f7 f7

  0x0c4a80045940: f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c4a80045950: 00 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00

  0x0c4a80045960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0c4a80045970: 00 00 00 00 00 00 00 00 f7 00 f7 00 00[f7]00 f7

  0x0c4a80045980: f7 00 00 00 00 00 f7 00 00 00 00 00 00 00 f7 00

  0x0c4a80045990: 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a800459a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a800459b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c4a800459c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==3209936==ABORTING

commit fa36b269f139252b81d4384fbed07b167855cabb (origin/main-MDEV-38716)

Commit:     Brandon Nesterenko

CommitDate: Wed Feb 4 14:36:13 2026 -0700

    MDEV-38716: Server crashes in TABLE::evaluate_update_default_function