MSAN: use-of-uninitialized-value in my_strnncoll_binary() when executing UNION on temporary HEAP table

CREATE TABLE t1 (c1 DATETIME,c2 JSON);

CREATE TABLE t2 AS SELECT c1,VEC_FROMTEXT('a') c2 FROM t1;

INSERT IGNORE INTO t1 (c1,c2) VALUES (1,1),(1,1);

SELECT c1,c2 FROM t2 UNION SELECT c1,c2 FROM t1;

==2386342==WARNING: MemorySanitizer: use-of-uninitialized-value

    #0 0x55555675aeb0 in memcmp (/test/MSAN_MD160726-mariadb-12.3.3-linux-x86_64-dbg/bin/mariadbd+0x1206eb0) (BuildId: 9d40eceeb3695a14d66d6e8c5c2d807df4ddb65e)

    #1 0x555558a3ac93 in my_strnncoll_binary /test/12.3_dbg_msan/strings/ctype-bin.c:89:18

    #2 0x555558a3ac93 in my_strnncollsp_binary /test/12.3_dbg_msan/strings/ctype-bin.c:140:10

    #3 0x555557f58b20 in my_ci_strnncollsp /test/12.3_dbg_msan/include/m_ctype.h:1493:10

    #4 0x555557f58b20 in hp_rec_key_cmp /test/12.3_dbg_msan/storage/heap/hp_hash.c:449:11

    #5 0x555557f60ca5 in hp_write_key /test/12.3_dbg_msan/storage/heap/hp_write.c:388:15

    #6 0x555557f5f087 in heap_write /test/12.3_dbg_msan/storage/heap/hp_write.c:52:9

    #7 0x555557f4ba01 in ha_heap::write_row(unsigned char const*) /test/12.3_dbg_msan/storage/heap/ha_heap.cc:296:8

    #8 0x55555770f491 in handler::ha_write_tmp_row(unsigned char*) /test/12.3_dbg_msan/sql/sql_class.h:8147:3

    #9 0x55555770f491 in select_unit::write_record() /test/12.3_dbg_msan/sql/sql_union.cc:417:7

    #10 0x55555770eb53 in select_unit::send_data(List<Item>&) /test/12.3_dbg_msan/sql/sql_union.cc:161:9

    #11 0x5555570ba1c8 in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/12.3_dbg_msan/sql/sql_class.cc:3309:11

    #12 0x5555574c7a60 in end_send(JOIN*, st_join_table*, bool) /test/12.3_dbg_msan/sql/sql_select.cc:25955:9

    #13 0x55555754f305 in evaluate_join_record(JOIN*, st_join_table*, int) /test/12.3_dbg_msan/sql/sql_select.cc:24828:11

    #14 0x55555745dcdb in sub_select(JOIN*, st_join_table*, bool) /test/12.3_dbg_msan/sql/sql_select.cc:24632:9

    #15 0x5555574d9a0a in do_select(JOIN*, Procedure*) /test/12.3_dbg_msan/sql/sql_select.cc:24106:14

    #16 0x5555574d78a8 in JOIN::exec_inner() /test/12.3_dbg_msan/sql/sql_select.cc:5125:50

    #17 0x5555574d57e3 in JOIN::exec() /test/12.3_dbg_msan/sql/sql_select.cc:4913:8

    #18 0x55555771d24e in st_select_lex_unit::exec_inner() /test/12.3_dbg_msan/sql/sql_union.cc:2454:27

    #19 0x555557706e1d in mysql_union(THD*, LEX*, select_result*, st_select_lex_unit*, unsigned long long) /test/12.3_dbg_msan/sql/sql_union.cc:45:16

    #20 0x55555745ed4c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/12.3_dbg_msan/sql/sql_select.cc:626:10

    #21 0x555557396807 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/12.3_dbg_msan/sql/sql_parse.cc:6219:12

    #22 0x5555573873d6 in mysql_execute_command(THD*, bool) /test/12.3_dbg_msan/sql/sql_parse.cc:3992:12

    #23 0x55555737b5a2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/12.3_dbg_msan/sql/sql_parse.cc:7947:18

    #24 0x555557374d87 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/12.3_dbg_msan/sql/sql_parse.cc:1903:7

    #25 0x55555737c05e in do_command(THD*, bool) /test/12.3_dbg_msan/sql/sql_parse.cc:1437:17

    #26 0x555557896b8c in do_handle_one_connection(CONNECT*, bool) /test/12.3_dbg_msan/sql/sql_connect.cc:1510:11

    #27 0x555557896522 in handle_one_connection /test/12.3_dbg_msan/sql/sql_connect.cc:1422:5

    #28 0x7fffe689caa3 in start_thread nptl/pthread_create.c:447:8

    #29 0x7fffe6929c6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

  Memory was marked as uninitialized

    #0 0x5555567566a1 in __msan_allocated_memory (/test/MSAN_MD160726-mariadb-12.3.3-linux-x86_64-dbg/bin/mariadbd+0x12026a1) (BuildId: 9d40eceeb3695a14d66d6e8c5c2d807df4ddb65e)

    #1 0x5555589c89d1 in my_malloc /test/12.3_dbg_msan/mysys/my_malloc.c:117:7

SUMMARY: MemorySanitizer: use-of-uninitialized-value (/test/MSAN_MD160726-mariadb-12.3.3-linux-x86_64-dbg/bin/mariadbd+0x1206eb0) (BuildId: 9d40eceeb3695a14d66d6e8c5c2d807df4ddb65e) in memcmp

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:

    -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)

Set before execution:

    export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0

    Rel    o/d  Build   Commit                                    UniqueID observed             

CS  10.6   dbg  170726  85ab366da3fc5d13b61d9e491e63e2b62c017cf4  No bug found                  

CS  10.6   opt  170726  85ab366da3fc5d13b61d9e491e63e2b62c017cf4  No bug found                  

CS  10.11  dbg  170726  50faece416f0642b57a515d546f20cefd9062379  No bug found                  

CS  10.11  opt  170726  50faece416f0642b57a515d546f20cefd9062379  No bug found                  

CS  11.4   dbg  200726  17fe060a549d2bfa56f6efb82456b20146ac569f  No bug found                  

CS  11.4   opt  200726  17fe060a549d2bfa56f6efb82456b20146ac569f  No bug found                  

CS  11.8   dbg  170726  bf58d4cb5fccd4078ec91c065a2de86be3b46281  No bug found                  

CS  11.8   opt  170726  bf58d4cb5fccd4078ec91c065a2de86be3b46281  No bug found                  

CS  12.3   dbg  160726  f9d797f1ccb8bbdbad0b50005644f29cd6125a6c  MSAN|use-of-uninitialized-value|strings/ctype-bin.c|memcmp|my_strnncoll_binary|my_strnncollsp_binary|my_ci_strnncollsp

CS  12.3   opt  160726  f9d797f1ccb8bbdbad0b50005644f29cd6125a6c  MSAN|use-of-uninitialized-value|strings/ctype-bin.c|memcmp|my_strnncoll_binary|my_strnncollsp_binary|my_ci_strnncollsp

CS  13.0   dbg  160726  84c246ca5387c0611f75097136ff4f4bea092aa3  MSAN|use-of-uninitialized-value|strings/ctype-bin.c|memcmp|my_strnncoll_binary|my_strnncollsp_binary|my_ci_strnncollsp

CS  13.0   opt  160726  84c246ca5387c0611f75097136ff4f4bea092aa3  MSAN|use-of-uninitialized-value|strings/ctype-bin.c|memcmp|my_strnncoll_binary|my_strnncollsp_binary|my_ci_strnncollsp

CS  13.1   dbg  160726  7322a6656a5357b4574b7413493c76ba2fc41f84  MSAN|use-of-uninitialized-value|strings/ctype-bin.c|memcmp|my_strnncoll_binary|my_strnncollsp_binary|my_ci_strnncollsp

CS  13.1   opt  160726  7322a6656a5357b4574b7413493c76ba2fc41f84  MSAN|use-of-uninitialized-value|strings/ctype-bin.c|memcmp|my_strnncoll_binary|my_strnncollsp_binary|my_ci_strnncollsp

ES  10.6   dbg  170726  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  

ES  10.6   opt  170726  fcecb2620f25965723d640decede7c018bcb1dcc  No bug found                  

ES  11.4   dbg  170726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  

ES  11.4   opt  170726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  

ES  11.8   dbg  170726  4694e931d10fecf733c34f83ea2146d31b708eb3  MSAN|use-of-uninitialized-value|strings/ctype-bin.c|memcmp|my_strnncoll_binary|my_strnncollsp_binary|my_ci_strnncollsp

ES  11.8   opt  170726  4694e931d10fecf733c34f83ea2146d31b708eb3  MSAN|use-of-uninitialized-value|strings/ctype-bin.c|memcmp|my_strnncoll_binary|my_strnncollsp_binary|my_ci_strnncollsp

ES  12.3   dbg  160726  9d8abb61e913bec023cd8caeccad4b42717151cb  MSAN|use-of-uninitialized-value|strings/ctype-bin.c|memcmp|my_strnncoll_binary|my_strnncollsp_binary|my_ci_strnncollsp

ES  12.3   opt  160726  9d8abb61e913bec023cd8caeccad4b42717151cb  MSAN|use-of-uninitialized-value|strings/ctype-bin.c|memcmp|my_strnncoll_binary|my_strnncollsp_binary|my_ci_strnncollsp