use-of-uninitialized-value in Histogram::find_bucket(double, bool)

CREATE TABLE t2 (c1 INT);

INSERT INTO t2 VALUES (1);

SET histogram_size=1;

ANALYZE TABLE t2 PERSISTENT FOR ALL;

SELECT * FROM t2 WHERE c1>0;

==2199927==WARNING: MemorySanitizer: use-of-uninitialized-value

    #0 0x566dd0604cfd in Histogram::find_bucket(double, bool) /test/10.6_opt_msan/sql/sql_statistics.h:215:13

    #1 0x566dd05ffb27 in Histogram::range_selectivity(double, double) /test/10.6_opt_msan/sql/sql_statistics.h:286:15

    #2 0x566dd05ffb27 in get_column_range_cardinality(Field*, st_key_range*, st_key_range*, unsigned int) /test/10.6_opt_msan/sql/sql_statistics.cc:4200:20

    #3 0x566dcfee80cd in records_in_column_ranges(PARAM*, unsigned int, SEL_ARG*) /test/10.6_opt_msan/sql/opt_range.cc:3350:11

    #4 0x566dcfee80cd in calculate_cond_selectivity_for_table(THD*, TABLE*, Item**) /test/10.6_opt_msan/sql/opt_range.cc:3681:26

    #5 0x566dd0467a35 in make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*) /test/10.6_opt_msan/sql/sql_select.cc:6032:13

    #6 0x566dd04557d6 in JOIN::optimize_inner() /test/10.6_opt_msan/sql/sql_select.cc:2613:7

    #7 0x566dd0432cf9 in JOIN::optimize() /test/10.6_opt_msan/sql/sql_select.cc:1927:10

    #8 0x566dd0432cf9 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.6_opt_msan/sql/sql_select.cc:5182:19

    #9 0x566dd0431c17 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.6_opt_msan/sql/sql_select.cc:573:10

    #10 0x566dd03798c7 in execute_sqlcom_select(THD*, TABLE_LIST*) /test/10.6_opt_msan/sql/sql_parse.cc:6421:12

    #11 0x566dd036cbd4 in mysql_execute_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:4012:12

    #12 0x566dd0362d95 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_opt_msan/sql/sql_parse.cc:8199:18

    #13 0x566dd035ce4b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1911:7

    #14 0x566dd0363988 in do_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1421:17

    #15 0x566dd07fcb0c in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_msan/sql/sql_connect.cc:1393:11

    #16 0x566dd07fc432 in handle_one_connection /test/10.6_opt_msan/sql/sql_connect.cc:1305:5

    #17 0x7e4e2769cb83 in start_thread nptl/pthread_create.c:447:8

    #18 0x7e4e27729d6b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

  Memory was marked as uninitialized

    #0 0x566dcf97bf71 in __msan_allocated_memory (/test/MSAN_MD170726-mariadb-10.6.28-linux-x86_64-opt/bin/mariadbd+0xcf4f71) (BuildId: c54cd201b0905cfceb6742c33d28a95089229adb)

    #1 0x566dd15e7cd9 in my_malloc /test/10.6_opt_msan/mysys/my_malloc.c:114:7

    #2 0x566dd15c975a in alloc_root /test/10.6_opt_msan/mysys/my_alloc.c:196:28

    #3 0x566dd06098c3 in Column_stat::get_stat_values(Column_statistics*, st_mem_root*, bool) /test/10.6_opt_msan/sql/sql_statistics.cc:1230:43

    #4 0x566dd05eb658 in read_statistics_for_table(THD*, TABLE*, TABLE_LIST*, bool, bool) /test/10.6_opt_msan/sql/sql_statistics.cc:2980:25

    #5 0x566dd05eb658 in read_statistics_for_tables(THD*, TABLE_LIST*, bool) /test/10.6_opt_msan/sql/sql_statistics.cc:3239:23

    #6 0x566dd082ad02 in mysql_admin_table(THD*, TABLE_LIST*, st_ha_check_opt*, st_mysql_const_lex_string const*, thr_lock_type, bool, bool, unsigned int, int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), int (handler::*)(THD*, st_ha_check_opt*), int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), bool) /test/10.6_opt_msan/sql/sql_admin.cc:1389:9

    #7 0x566dd082eef4 in Sql_cmd_analyze_table::execute(THD*) /test/10.6_opt_msan/sql/sql_admin.cc:1566:8

    #8 0x566dd036cb83 in mysql_execute_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:6166:26

    #9 0x566dd0362d95 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.6_opt_msan/sql/sql_parse.cc:8199:18

    #10 0x566dd035ce4b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1911:7

    #11 0x566dd0363988 in do_command(THD*, bool) /test/10.6_opt_msan/sql/sql_parse.cc:1421:17

    #12 0x566dd07fcb0c in do_handle_one_connection(CONNECT*, bool) /test/10.6_opt_msan/sql/sql_connect.cc:1393:11

    #13 0x566dd07fc432 in handle_one_connection /test/10.6_opt_msan/sql/sql_connect.cc:1305:5

    #14 0x7e4e2769cb83 in start_thread nptl/pthread_create.c:447:8

SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.6_opt_msan/sql/sql_statistics.h:215:13 in Histogram::find_bucket(double, bool)

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O2 -march=native -mtune=native'" and:

    -DWITH_MSAN=ON  # Note: WITH_MSAN=ON is auto-ignored when not using clang (MDEV-20377)

Set before execution:

    export MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=0

    Rel    o/d  Build   Commit                                    UniqueID observed             

CS  10.6   dbg  170726  85ab366da3fc5d13b61d9e491e63e2b62c017cf4  i < get_width()|SIGABRT|Histogram::get_value|Histogram::find_bucket|Histogram::range_selectivity|get_column_range_cardinality

CS  10.6   opt  170726  85ab366da3fc5d13b61d9e491e63e2b62c017cf4  MSAN|use-of-uninitialized-value|sql/sql_statistics.h|Histogram::find_bucket|Histogram::range_selectivity|get_column_range_cardinality|records_in_column_ranges

CS  10.11  dbg  170726  50faece416f0642b57a515d546f20cefd9062379  i < get_width()|SIGABRT|Histogram_binary::get_value|Histogram_binary::find_bucket|Histogram_binary::range_selectivity|get_column_range_cardinality

CS  10.11  opt  170726  50faece416f0642b57a515d546f20cefd9062379  MSAN|use-of-uninitialized-value|sql/sql_statistics.h|Histogram_binary::find_bucket|Histogram_binary::range_selectivity|get_column_range_cardinality|records_in_column_ranges

CS  11.4   dbg  200726  17fe060a549d2bfa56f6efb82456b20146ac569f  No bug found                  

CS  11.4   opt  200726  17fe060a549d2bfa56f6efb82456b20146ac569f  No bug found                  

CS  11.8   dbg  170726  bf58d4cb5fccd4078ec91c065a2de86be3b46281  No bug found                  

CS  11.8   opt  170726  bf58d4cb5fccd4078ec91c065a2de86be3b46281  No bug found                  

CS  12.3   dbg  160726  f9d797f1ccb8bbdbad0b50005644f29cd6125a6c  No bug found                  

CS  12.3   opt  160726  f9d797f1ccb8bbdbad0b50005644f29cd6125a6c  No bug found                  

CS  13.0   dbg  160726  84c246ca5387c0611f75097136ff4f4bea092aa3  No bug found                  

CS  13.0   opt  160726  84c246ca5387c0611f75097136ff4f4bea092aa3  No bug found                  

CS  13.1   dbg  160726  7322a6656a5357b4574b7413493c76ba2fc41f84  No bug found                  

CS  13.1   opt  160726  7322a6656a5357b4574b7413493c76ba2fc41f84  No bug found                  

ES  10.6   dbg  170726  fcecb2620f25965723d640decede7c018bcb1dcc  i < get_width()|SIGABRT|Histogram::get_value|Histogram::find_bucket|Histogram::range_selectivity|get_column_range_cardinality

ES  10.6   opt  170726  fcecb2620f25965723d640decede7c018bcb1dcc  MSAN|use-of-uninitialized-value|sql/sql_statistics.h|Histogram::find_bucket|Histogram::range_selectivity|get_column_range_cardinality|records_in_column_ranges

ES  11.4   dbg  170726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  

ES  11.4   opt  170726  3b34189bfe675c18c4ced3ef531d016ea74c76f4  No bug found                  

ES  11.8   dbg  170726  4694e931d10fecf733c34f83ea2146d31b708eb3  No bug found                  

ES  11.8   opt  170726  4694e931d10fecf733c34f83ea2146d31b708eb3  No bug found                  

ES  12.3   dbg  160726  9d8abb61e913bec023cd8caeccad4b42717151cb  No bug found                  

ES  12.3   opt  160726  9d8abb61e913bec023cd8caeccad4b42717151cb  No bug found