Partitioning changes the query result: HANDLER READ NEXT after a read by key misses rows or returns them out of index order

--source include/have_partition.inc

CREATE TABLE t1 (a INT, b INT, KEY k(b, a)) PARTITION BY RANGE (a) (PARTITION p0 VALUES LESS THAN (10), PARTITION p1 VALUES LESS THAN (20));

INSERT INTO t1 VALUES (5,1),(12,1);

HANDLER t1 OPEN;

HANDLER t1 READ k = (1);

--let $a= query_get_value(HANDLER t1 READ k NEXT, a, 1)

if ($a != 12)

{

  --die HANDLER READ NEXT gives $a, not the row 12 in the next partition

}

HANDLER t1 CLOSE;

INSERT INTO t1 VALUES (7,2);

HANDLER t1 OPEN;

HANDLER t1 READ k = (1);

--let $a= query_get_value(HANDLER t1 READ k NEXT, a, 1)

if ($a != 12)

{

  --die HANDLER READ NEXT gives $a, not 12, the next row in index order

}

HANDLER t1 CLOSE;

DROP TABLE t1;

mysqltest: At line 10: HANDLER READ NEXT gives No such row, not the row 12 in the next partition

mysqltest: At line 19: HANDLER READ NEXT gives 7, not 12, the next row in index order

==1641578==ERROR: AddressSanitizer: use-after-poison on address 0x77ad968daf20 at pc 0x62beb65614b9 bp 0x74dd74537fd0 sp 0x74dd74537fc8

READ of size 1 at 0x77ad968daf20 thread T6

    #0 0x62beb65614b8 in _mi_pack_key /test/13.1_dbg_san/storage/myisam/mi_key.c:244:30

    #1 0x62beb66587e4 in mi_rkey /test/13.1_dbg_san/storage/myisam/mi_rkey.c:62:21

    #2 0x62beb34c4db1 in handler::ha_index_read_map(unsigned char*, unsigned char const*, unsigned long, ha_rkey_function) /test/13.1_dbg_san/sql/handler.cc:4138:15

    #3 0x62beb5736cbd in ha_partition::handle_unordered_scan_next_partition(unsigned char*, bool) /test/13.1_dbg_san/sql/ha_partition.cc:8064:20

    #4 0x62beb34c65f0 in handler::ha_index_next(unsigned char*) /test/13.1_dbg_san/sql/handler.cc:4201:15

    #5 0x62beb43345df in mysql_ha_read(THD*, TABLE_LIST*, enum_ha_read_modes, char const*, List<Item>*, ha_rkey_function, Item*, unsigned long long, unsigned long long) /test/13.1_dbg_san/sql/sql_handler.cc:903:31

    #6 0x62beb44c0c60 in mysql_execute_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:5536:10

    #7 0x62beb449fc9a in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/13.1_dbg_san/sql/sql_parse.cc:7968:18

    #8 0x62beb4497c7e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1903:7

    #9 0x62beb44a2086 in do_command(THD*, bool) /test/13.1_dbg_san/sql/sql_parse.cc:1437:17

    #10 0x62beb4ce209c in do_handle_one_connection(CONNECT*, bool) /test/13.1_dbg_san/sql/sql_connect.cc:1514:11

    #11 0x62beb4ce1bc5 in handle_one_connection /test/13.1_dbg_san/sql/sql_connect.cc:1426:5

    #12 0x78dd97f48e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28

    #13 0x78dd9769cb83 in start_thread nptl/pthread_create.c:447:8

    #14 0x78dd97729ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x77ad968daf20 is located 2848 bytes inside of 32768-byte region [0x77ad968da400,0x77ad968e2400)

allocated by thread T6 here:

    #0 0x78dd97f4b594 in malloc /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3

    #1 0x62beb67366fc in my_malloc /test/13.1_dbg_san/mysys/my_malloc.c:93:29

    #2 0x62beb66e59d6 in reset_root_defaults /test/13.1_dbg_san/mysys/my_alloc.c:249:30

    #3 0x62beb402970a in THD::init_for_queries() /test/13.1_dbg_san/sql/sql_class.cc:1563:3

    #4 0x62beb4ce0c25 in prepare_new_connection_state(THD*) /test/13.1_dbg_san/sql/sql_connect.cc:1352:8

    #5 0x62beb4ce3eef in thd_prepare_connection(THD*) /test/13.1_dbg_san/sql/sql_connect.cc:1447:3

    #6 0x62beb4ce207c in do_handle_one_connection(CONNECT*, bool) /test/13.1_dbg_san/sql/sql_connect.cc:1504:9

    #7 0x62beb4ce1bc5 in handle_one_connection /test/13.1_dbg_san/sql/sql_connect.cc:1426:5

    #8 0x78dd97f48e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28

Thread T6 created by T0 here:

    #0 0x78dd97f2eae1 in pthread_create /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:257:3

    #1 0x62beb33c4aec in create_thread_to_handle_connection(CONNECT*) /test/13.1_dbg_san/sql/mysqld.cc:6523:19

    #2 0x62beb33c5b62 in handle_connections_sockets() /test/13.1_dbg_san/sql/mysqld.cc:6759:9

    #3 0x62beb33c40ea in run_main_loop() /test/13.1_dbg_san/sql/mysqld.cc:5993:3

    #4 0x62beb33b82ff in mysqld_main(int, char**) /test/13.1_dbg_san/sql/mysqld.cc:6419:3

    #5 0x78dd9762a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

    #6 0x78dd9762a28a in __libc_start_main csu/../csu/libc-start.c:360:3

    #7 0x62beb33afab4 in _start (/tmp/c5d_part/san/UBASAN_MD180826-mariadb-13.1.0-linux-x86_64-dbg/bin/mariadbd+0x414cab4)

SUMMARY: AddressSanitizer: use-after-poison /test/13.1_dbg_san/storage/myisam/mi_key.c:244:30 in _mi_pack_key

Shadow bytes around the buggy address:

  0x77ad968dac80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x77ad968dad00: 00 00 00 00 00 00 00 00 00 00 00 00 f7 02 f7 f7

  0x77ad968dad80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x77ad968dae00: 00 00 f7 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x77ad968dae80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

=>0x77ad968daf00: f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x77ad968daf80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x77ad968db000: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x77ad968db080: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x77ad968db100: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

  0x77ad968db180: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

NOTE: the stack trace above identifies the code that *accessed* the poisoned memory.

To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=<size>.

==1641578==ABORTING