UBSAN: my_thread_init stack_ends_here calculation pointer overflow

$ nice -n 19 mysql-test/mtr  --rr=--chaos --repeat 200  --mysqld=--innodb_use_native_aio=OFF --mysqld=--loose-innodb_buffer_pool_size_max=12m --view-protocol --force-restart main.innodb_mrr_cpk{,,,,,,,,,,,,,,}

main.innodb_mrr_cpk                      [ 153 fail ]  Found warnings/errors in server log file!

        Test ended at 2026-05-29 17:02:36

line

/home/dan/repos/mariadb-server-12.3/mysys/my_thr_init.c:281:37: runtime error: pointer index expression with base 0x000000330020 overflowed to 0xffffffffff830020

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/dan/repos/mariadb-server-12.3/mysys/my_thr_init.c:281:37 

^ Found warnings in /home/dan/repos/build-mariadb-server-12.3-debug/mysql-test/var/log/mysqld.1.err

CURRENT_TEST: main.innodb_mrr_cpk

$ env _RR_TRACE_DIR=/home/dan/repos/build-mariadb-server-12.3-debug/mysql-test/var/log/mysqld.1.rr rr record --chaos /home/dan/repos/build-mariadb-server-12.3-debug/sql/mariadbd --defaults-group-suffix=.1 --defaults-file=/home/dan/repos/build-mariadb-server-12.3-debug/mysql-test/var/my.cnf --log-output=file --innodb --innodb-cmpmem --innodb-cmp-per-index --innodb-trx --innodb-locks --innodb-lock-waits --innodb-metrics --innodb-buffer-pool-stats --innodb-buffer-page --innodb-buffer-page-lru --innodb-sys-columns --innodb-sys-fields --innodb-sys-foreign --innodb-sys-foreign-cols --innodb-sys-indexes --innodb-sys-tables --innodb-sys-virtual --innodb_use_native_aio=OFF --loose-innodb_buffer_pool_size_max=12m --core-file --loose-debug-sync-timeout=300 --loose-debug-gdb --loose-skip-stack-trace

2026-05-29 17:02:34 0 [Warning] Could not increase number of max_open_files to more than 1024 (request: 32185)

2026-05-29 17:02:34 0 [Warning] Changed limits: max_open_files: 1024  max_connections: 151 (was 151)  table_cache: 421 (was 2000)

/home/dan/repos/mariadb-server-12.3/mysys/my_thr_init.c:281:37: runtime error: pointer index expression with base 0x000000330020 overflowed to 0xffffffffff830020

2026-05-29 17:02:34 0 [Note] Starting MariaDB 12.3.2-MariaDB-asan-debug-log source revision ab25f2b513614bbf9f758f668062d96461e5c80d server_uid 6ZiN0y2uJCsrGhhnMESCIsdeCao= as process 2986269

2026-05-29 17:02:34 0 [Note] Help others discover MariaDB. Star it on GitHub: https://github.com/MariaDB/server

2026-05-29 17:02:34 0 [Note] InnoDB: !!!!!!!! UNIV_DEBUG switched on !!!!!!!!!

2026-05-29 17:02:34 0 [Note] InnoDB: Compressed tables use zlib 1.3.1.zlib-ng

2026-05-29 17:02:34 0 [Note] InnoDB: Number of transaction pools: 1

2026-05-29 17:02:34 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions

2026-05-29 17:02:34 0 [Note] InnoDB: innodb_buffer_pool_size_max=18m, innodb_buffer_pool_size=8m

2026-05-29 17:02:34 0 [Note] InnoDB: Initialized memory pressure event listener

2026-05-29 17:02:34 0 [Note] InnoDB: Completed initialization of buffer pool

2026-05-29 17:02:34 0 [Note] InnoDB: File system buffers for log disabled (block size=512 bytes)

2026-05-29 17:02:34 0 [Note] InnoDB: End of log at LSN=54254

    #0 0x000002c9510f in my_thread_init /home/dan/repos/mariadb-server-12.3/mysys/my_thr_init.c:281:37

    #1 0x000002caf0fd in timer_handler /home/dan/repos/mariadb-server-12.3/mysys/thr_timer.c:308:3

    #2 0x00000061dc3a in asan_thread_start(void*) asan_interceptors.cpp.o

    #3 0x648f08aa5758 in start_thread (/lib64/libc.so.6+0x73758) (BuildId: d597f1cdc38bc65e2fff68bda171301550e79d0c)

    #4 0x648f08b29733 in __clone (/lib64/libc.so.6+0xf7733) (BuildId: d597f1cdc38bc65e2fff68bda171301550e79d0c)

/home/dan/repos/mariadb-server-12.3/mysys/my_thr_init.c:281:37: runtime error: pointer index expression with base 0x000000330020 overflowed to 0xffffffffff830020

[Thread 2986269.2986270 exited]

Thread 1 received signal SIGKILL, Killed.

[Switching to Thread 2986269.2986269]

0x0000648f08af32b8 in _exit () from /lib64/libc.so.6

(rr) bt

#0  0x0000648f08af32b8 in _exit () from /lib64/libc.so.6

#1  0x0000648f08a4ed06 in __run_exit_handlers () from /lib64/libc.so.6

#2  0x0000648f08a4ee5e in exit () from /lib64/libc.so.6

#3  0x00000000006685ef in mysqld_exit (exit_code=<optimized out>) at /home/dan/repos/mariadb-server-12.3/sql/mysqld.cc:1990

#4  0x000000000066ca59 in mysqld_main (argc=<optimized out>, argv=<optimized out>) at /home/dan/repos/mariadb-server-12.3/sql/mysqld.cc:6423

#5  0x0000648f08a35681 in __libc_start_call_main () from /lib64/libc.so.6

#6  0x0000648f08a35798 in __libc_start_main_impl () from /lib64/libc.so.6

#7  0x000000000057a375 in _start ()

(rr) reverse-continue 

Continuing.

[New Thread 2986269.2986270]

[Switching to Thread 2986269.2986270]

Thread 3 hit Breakpoint 2, 0x00000000006635dc in __ubsan_handle_pointer_overflow ()

(rr) bt

#0  0x00000000006635dc in __ubsan_handle_pointer_overflow ()

#1  0x0000000002c95110 in my_thread_init () at /home/dan/repos/mariadb-server-12.3/mysys/my_thr_init.c:281

#2  0x0000000002caf0fe in timer_handler (arg=<optimized out>) at /home/dan/repos/mariadb-server-12.3/mysys/thr_timer.c:308

#3  0x000000000061dc3b in asan_thread_start(void*) ()

#4  0x0000648f08aa5759 in start_thread () from /lib64/libc.so.6

#5  0x0000648f08b29734 in clone () from /lib64/libc.so.6

(rr) up

#1  0x0000000002c95110 in my_thread_init () at /home/dan/repos/mariadb-server-12.3/mysys/my_thr_init.c:281

281	  tmp->stack_ends_here= (char*)&tmp +

(rr) list

276	  }

277	  set_mysys_var(tmp);

278	  tmp->pthread_self= pthread_self();

279	  my_thread_init_thr_mutex(tmp);

280	

281	  tmp->stack_ends_here= (char*)&tmp +

282	                         STACK_DIRECTION * (long)my_thread_stack_size;

283	

284	  mysql_mutex_lock(&THR_LOCK_threads);

285	  tmp->id= tmp->dbug_id= ++thread_id;