heap-use-after-free during REPLACE on table with persistent generated JSON UNIQUE column

--source include/have_innodb.inc

SET sql_mode='';

CREATE TABLE t1 (c1 VARCHAR(1) KEY,c2 JSON AS(c1) PERSISTENT,UNIQUE(c2)) ENGINE=InnoDB;

INSERT INTO t1(c1) VALUES (1);

REPLACE INTO t1 SELECT * FROM t1;

Version: '10.11.17-MariaDB-asan-debug'  socket: '/test/UBASAN_MD100526-mariadb-10.11.17-linux-x86_64-dbg/socket.sock'  port: 11953  MariaDB Server

=================================================================

==175506==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000014428 at pc 0x61843b8af19c bp 0x6cca81132520 sp 0x6cca81131cc8

READ of size 1 at 0x503000014428 thread T11

    #0 0x61843b8af19b in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) crtstuff.c

    #1 0x61843b8af700 in bcmp (/test/UBASAN_MD100526-mariadb-10.11.17-linux-x86_64-dbg/bin/mariadbd+0x30d8700) (BuildId: a50d645c891ed15c)

    #2 0x61843e382a70 in dfield_data_is_binary_equal(dfield_t const*, unsigned long, unsigned char const*) /test/10.11_dbg_san/storage/innobase/include/data0data.inl:217:10

    #3 0x61843e383222 in row_upd_build_difference_binary(dict_index_t*, dtuple_t const*, unsigned char const*, unsigned short const*, bool, bool, trx_t*, mem_block_info_t*, TABLE*, dberr_t*) /test/10.11_dbg_san/storage/innobase/row/row0upd.cc:609:11

    #4 0x61843e259ea2 in row_ins_clust_index_entry_by_modify(btr_pcur_t*, unsigned long, unsigned long, unsigned short**, mem_block_info_t**, mem_block_info_t*, dtuple_t const*, que_thr_t*, mtr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:312:11

    #5 0x61843e259ea2 in row_ins_clust_index_entry_low(unsigned long, btr_latch_mode, dict_index_t*, unsigned long, dtuple_t*, unsigned long, que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:2937:9

    #6 0x61843e263b71 in row_ins_clust_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, unsigned long) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3357:8

    #7 0x61843e2684fc in row_ins_index_entry(dict_index_t*, dtuple_t*, que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3502:10

    #8 0x61843e2684fc in row_ins_index_entry_step(ins_node_t*, que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3668:8

    #9 0x61843e2684fc in row_ins(ins_node_t*, que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3793:28

    #10 0x61843e2684fc in row_ins_step(que_thr_t*) /test/10.11_dbg_san/storage/innobase/row/row0ins.cc:3922:8

    #11 0x61843e2b87c3 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /test/10.11_dbg_san/storage/innobase/row/row0mysql.cc:1296:2

    #12 0x61843db403a7 in ha_innobase::write_row(unsigned char const*) /test/10.11_dbg_san/storage/innobase/handler/ha_innodb.cc:7776:10

    #13 0x61843ba9e483 in handler::ha_write_row(unsigned char const*) /test/10.11_dbg_san/sql/handler.cc:7808:3

    #14 0x61843c93d61a in Write_record::replace_row(unsigned long long*, unsigned long long*) /test/10.11_dbg_san/sql/sql_insert.cc:2110:10

    #15 0x61843c935dcf in Write_record::write_record() /test/10.11_dbg_san/sql/sql_insert.cc:2368:10

    #16 0x61843c95f742 in select_insert::send_data(List<Item>&) /test/10.11_dbg_san/sql/sql_insert.cc:4450:17

    #17 0x61843cc5cf22 in end_send(JOIN*, st_join_table*, bool) /test/10.11_dbg_san/sql/sql_select.cc:24366:9

    #18 0x61843cd0c7f8 in evaluate_join_record(JOIN*, st_join_table*, int) /test/10.11_dbg_san/sql/sql_select.cc:23307:11

    #19 0x61843cd0a376 in AGGR_OP::end_send() /test/10.11_dbg_san/sql/sql_select.cc:32349:11

    #20 0x61843cc60ef2 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /test/10.11_dbg_san/sql/sql_select.cc:22765:15

    #21 0x61843cbe86fb in sub_select(JOIN*, st_join_table*, bool) /test/10.11_dbg_san/sql/sql_select.cc:23018:7

    #22 0x61843cc76bee in do_select(JOIN*, Procedure*) /test/10.11_dbg_san/sql/sql_select.cc:22602:14

    #23 0x61843cc7346a in JOIN::exec_inner() /test/10.11_dbg_san/sql/sql_select.cc:5023:50

    #24 0x61843cc70f62 in JOIN::exec() /test/10.11_dbg_san/sql/sql_select.cc:4807:3

    #25 0x61843cbec9ff in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_dbg_san/sql/sql_select.cc:5285:9

    #26 0x61843cbeb4ed in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/10.11_dbg_san/sql/sql_select.cc:601:10

    #27 0x61843caaf764 in mysql_execute_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:4860:16

    #28 0x61843ca6f634 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_dbg_san/sql/sql_parse.cc:8223:18

    #29 0x61843ca686d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1924:7

    #30 0x61843ca70dc8 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1434:17

    #31 0x61843d1be76c in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1475:11

    #32 0x61843d1be041 in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1387:5

    #33 0x61843b92b37c in asan_thread_start(void*) crtstuff.c

    #34 0x74cb3329caa3 in start_thread nptl/pthread_create.c:447:8

    #35 0x74cb33329c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x503000014428 is located 24 bytes inside of 32-byte region [0x503000014410,0x503000014430)

freed by thread T11 here:

    #0 0x61843b92d5fa in free (/test/UBASAN_MD100526-mariadb-10.11.17-linux-x86_64-dbg/bin/mariadbd+0x31565fa) (BuildId: a50d645c891ed15c)

    #1 0x61843bb4551b in Binary_string::free_buffer() /test/10.11_dbg_san/sql/sql_string.h:308:7

    #2 0x61843bb4551b in Binary_string::set(char const*, unsigned long) /test/10.11_dbg_san/sql/sql_string.h:536:5

    #3 0x61843bb4551b in String::set(char const*, unsigned long, charset_info_st const*) /test/10.11_dbg_san/sql/sql_string.h:896:20

    #4 0x61843bb4551b in Field_varstring::val_str(String*, String*) /test/10.11_dbg_san/sql/field.cc:8053:12

previously allocated by thread T11 here:

    #0 0x61843b92d893 in malloc (/test/UBASAN_MD100526-mariadb-10.11.17-linux-x86_64-dbg/bin/mariadbd+0x3156893) (BuildId: a50d645c891ed15c)

    #1 0x61843e67040b in my_malloc /test/10.11_dbg_san/mysys/my_malloc.c:92:29

Thread T11 created by T0 here:

    #0 0x61843b913205 in pthread_create (/test/UBASAN_MD100526-mariadb-10.11.17-linux-x86_64-dbg/bin/mariadbd+0x313c205) (BuildId: a50d645c891ed15c)

    #1 0x61843b97fa6a in create_thread_to_handle_connection(CONNECT*) /test/10.11_dbg_san/sql/mysqld.cc:6214:19

    #2 0x61843b9809f5 in handle_connections_sockets() /test/10.11_dbg_san/sql/mysqld.cc:6458:9

    #3 0x61843b97ecd7 in run_main_loop() /test/10.11_dbg_san/sql/mysqld.cc:5712:3

    #4 0x74cb3322a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

    #5 0x74cb3322a28a in __libc_start_main csu/../csu/libc-start.c:360:3

    #6 0x61843b892a44 in _start (/test/UBASAN_MD100526-mariadb-10.11.17-linux-x86_64-dbg/bin/mariadbd+0x30bba44) (BuildId: a50d645c891ed15c)

SUMMARY: AddressSanitizer: heap-use-after-free crtstuff.c in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)

Shadow bytes around the buggy address:

  0x503000014180: 00 00 fa fa fd fd fd fd fa fa fd fd fd fd fa fa

  0x503000014200: 00 00 00 00 fa fa fd fd fd fd fa fa fd fd fd fd

  0x503000014280: fa fa 00 00 00 00 fa fa fd fd fd fd fa fa fd fd

  0x503000014300: fd fd fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa

  0x503000014380: 00 00 00 00 fa fa fd fd fd fd fa fa 00 00 00 00

=>0x503000014400: fa fa fd fd fd[fd]fa fa 00 00 00 00 fa fa 00 00

  0x503000014480: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x503000014500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x503000014580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x503000014600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x503000014680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==175506==ABORTING

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1

    Rel    o/d  Build   Commit                                    UniqueID observed             

CS  10.6   dbg  100526  d37e50c6d04c7c27362f1668ae86fa592b94fb23  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  10.6   opt  100526  d37e50c6d04c7c27362f1668ae86fa592b94fb23  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  10.11  dbg  100526  8721a00dd38dc0aa1514a3b5ca8c95c6e94af1c9  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  10.11  opt  100526  8721a00dd38dc0aa1514a3b5ca8c95c6e94af1c9  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  11.4   dbg  100526  f279551013d1319f27344080e2c0758f3959cebf  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  11.4   opt  100526  f279551013d1319f27344080e2c0758f3959cebf  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  11.8   dbg  100526  04e09010773caf0b302b2933fff3fe95381a5e13  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  11.8   opt  100526  04e09010773caf0b302b2933fff3fe95381a5e13  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  12.3   dbg  100526  4c371e30f003b601e7485533476208ae27d51937  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  12.3   opt  100526  4c371e30f003b601e7485533476208ae27d51937  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  13.0   dbg  100526  96b3dd0c34427e9338dda1375575a0e05a7cd267  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

CS  13.0   opt  100526  96b3dd0c34427e9338dda1375575a0e05a7cd267  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

ES  10.6   dbg  100526  55cfada6c54d1b08f2372adc1369a5e5e76f472d  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

ES  10.6   opt  100526  55cfada6c54d1b08f2372adc1369a5e5e76f472d  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

ES  11.4   dbg  100526  90f707057d44f1b5c013a0c3672fd12f32ea7085  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

ES  11.4   opt  100526  90f707057d44f1b5c013a0c3672fd12f32ea7085  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

ES  11.8   dbg  100526  d4fbd664a4514441bb3d9042c0089842ee6fc3c8  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

ES  11.8   opt  100526  d4fbd664a4514441bb3d9042c0089842ee6fc3c8  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

ES  12.3   dbg  100526  4063148254974421994024b7cc94f6f2a850177d  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary

ES  12.3   opt  100526  4063148254974421994024b7cc94f6f2a850177d  ASAN|heap-use-after-free|crtstuff.c|MemcmpInterceptorCommon|bcmp|dfield_data_is_binary_equal|row_upd_build_difference_binary