[MDEV-23896] ASAN use-after-poison or Valgrind Invalid read in same_index_prefix with index_merge_sort_intersection=on,not_null_range_scan=on Created: 2020-10-06  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: Optimizer
Affects Version/s: 10.5, 10.6, 10.7, 10.8, 10.9
Fix Version/s: 10.5, 10.6

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Sergei Petrunia
Resolution: Unresolved Votes: 0
Labels: None


 Description   

CREATE TABLE t1 (
  pk int(11), a date, b int, c int, d char(200), e binary(39),
  f varchar(550), g datetime, h datetime, PRIMARY KEY (pk),
  KEY pk (pk,f), KEY (b), KEY (f(3),d), KEY (f)
) ENGINE=MyISAM;
 
INSERT INTO t1 (pk, b, d, f) VALUES
  (1,5,'',''),(2,3,'',''),(3,1,'',''),(4,1,'',''),(5,8,'',''),(6,7,'',''),
  (7,2,'',''),(8,0,'',REPEAT('a',226)), (9,8,'',''),(10,6,'',''),
  (11,9,'',''),(12,2,'','foobar'),(13,0,'','foo'),(14,NULL,'','bar'),
  (15,3,'i','i'),(16,2,'','baz'),(17,4,'','foo'),(18,6,'','bar'),
  (19,53,'','baz'),(20,5,'',REPEAT('b',147)),(21,8,'','qux'),
  (22,9,'','foo'),(23,5,'','bar'),(24,6,'','baz'),(25,9,'','odd'),
  (26,6,'',''),(27,5,'','demon'),(28,4,'','eh'),(29,3,'','fate'),
  (30,4,REPEAT('c',119),''),(31,5,'',REPEAT('d',49)),(32,3,'','copy'),
  (33,3,'','ufo'),(34,3,'','moo'),(35,2,'xxx','xenial'),(36,2,'','leon'),
  (37,8,'','qux'),(38,4,'','boo'),(39,1,'','yay'),(40,9,'foobar','xxx'),
  (41,5,'foobar','jee'),(42,4,'foo',REPEAT('e',42)),(43,2,'bar','foobar'),
  (44,3,'','z'),(45,3,'baz','moo'),(46,9,'','b'),(47,2,'','i'),
  (48,4,'qux','qux'),(49,2,'','ouch'),(50,2,'',''),(51,1,'','huh'),
  (52,8,'','nil');
 
SET optimizer_switch= 'index_merge_sort_intersection=on,not_null_range_scan=on';
SELECT * FROM t1 WHERE f LIKE 'i%' AND b = pk AND d = 'y';

10.5 861cd4ce ASAN

==1810882==ERROR: AddressSanitizer: use-after-poison on address 0x61d0001d9a8e at pc 0x55f8de509566 bp 0x7f8f9be92510 sp 0x7f8f9be92500
READ of size 2 at 0x61d0001d9a8e thread T5
    #0 0x55f8de509565 in same_index_prefix /data/src/10.5/sql/opt_range.cc:5585
    #1 0x55f8de50e2a5 in get_best_index_intersect /data/src/10.5/sql/opt_range.cc:6413
    #2 0x55f8de4f910e in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /data/src/10.5/sql/opt_range.cc:2955
    #3 0x55f8dd9e7cfb in get_quick_record_count /data/src/10.5/sql/sql_select.cc:4695
    #4 0x55f8dd9eec37 in make_join_statistics /data/src/10.5/sql/sql_select.cc:5426
    #5 0x55f8dd9cdc1a in JOIN::optimize_inner() /data/src/10.5/sql/sql_select.cc:2247
    #6 0x55f8dd9c71fd in JOIN::optimize() /data/src/10.5/sql/sql_select.cc:1623
    #7 0x55f8dd9e740a in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.5/sql/sql_select.cc:4637
    #8 0x55f8dd9b9567 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.5/sql/sql_select.cc:417
    #9 0x55f8dd924145 in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6210
    #10 0x55f8dd913422 in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:3932
    #11 0x55f8dd92f45a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:7994
    #12 0x55f8dd905e14 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1867
    #13 0x55f8dd90275a in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1348
    #14 0x55f8ddd3dd83 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410
    #15 0x55f8ddd3d6ec in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312
    #16 0x55f8dea37ff8 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
    #17 0x7f8fa5567608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
    #18 0x7f8fa513b292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
0x61d0001d9a8e is located 2062 bytes inside of 2108-byte region [0x61d0001d9280,0x61d0001d9abc)
allocated by thread T5 here:
    #0 0x7f8fa56eabc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x55f8df6bb318 in sf_malloc /data/src/10.5/mysys/safemalloc.c:118
    #2 0x55f8df688b8c in my_malloc /data/src/10.5/mysys/my_malloc.c:88
    #3 0x55f8df664c4c in alloc_root /data/src/10.5/mysys/my_alloc.c:244
    #4 0x55f8df666340 in memdup_root /data/src/10.5/mysys/my_alloc.c:480
    #5 0x55f8de0781d2 in Field::clone(st_mem_root*, TABLE*) /data/src/10.5/sql/field.cc:2551
    #6 0x55f8ddc5c035 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.5/sql/table.cc:4013
    #7 0x55f8dd772716 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.5/sql/sql_base.cc:1991
    #8 0x55f8dd77c45f in open_and_process_table /data/src/10.5/sql/sql_base.cc:3791
    #9 0x55f8dd77efbc in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:4263
    #10 0x55f8dd784571 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:5167
    #11 0x55f8dd6dc7b1 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.5/sql/sql_base.h:507
    #12 0x55f8dd84dd44 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/src/10.5/sql/sql_insert.cc:755
    #13 0x55f8dd91722c in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4546
    #14 0x55f8dd92f45a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:7994
    #15 0x55f8dd905e14 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1867
    #16 0x55f8dd90275a in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1348
    #17 0x55f8ddd3dd83 in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1410
    #18 0x55f8ddd3d6ec in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1312
    #19 0x55f8dea37ff8 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
    #20 0x7f8fa5567608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
 
Thread T5 created by T0 here:
    #0 0x7f8fa5617805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
    #1 0x55f8dea32fec in my_thread_create /data/src/10.5/storage/perfschema/my_thread.h:38
    #2 0x55f8dea383eb in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252
    #3 0x55f8dd5fb70e in inline_mysql_thread_create /data/src/10.5/include/mysql/psi/mysql_thread.h:1321
    #4 0x55f8dd611513 in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6022
    #5 0x55f8dd611b88 in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6081
    #6 0x55f8dd611ede in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6146
    #7 0x55f8dd612aee in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6273
    #8 0x55f8dd610d3a in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5668
    #9 0x55f8dd5f9ffc in main /data/src/10.5/sql/main.cc:25
    #10 0x7f8fa50400b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
 
SUMMARY: AddressSanitizer: use-after-poison /data/src/10.5/sql/opt_range.cc:5585 in same_index_prefix
Shadow bytes around the buggy address:
  0x0c3a80033300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80033310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80033320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80033330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a80033340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
=>0x0c3a80033350: f7[f7]f7 f7 f7 f7 f7 04 fa fa fa fa fa fa fa fa
  0x0c3a80033360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80033370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80033380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80033390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800333a0: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1810882==ABORTING
201006 16:35:35 [ERROR] mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
 
To report this bug, see https://mariadb.com/kb/en/reporting-bugs
 
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed, 
something is definitely wrong and this may fail.
 
Server version: 10.5.6-MariaDB-debug-log
key_buffer_size=1048576
read_buffer_size=131072
max_used_connections=1
max_threads=153
thread_count=2
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63741 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
 
Thread pointer: 0x62b000069288
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f8f9be96950 thread_stack 0x5fc00
??:0(__interceptor_tcgetattr)[0x7f8fa5649d30]
/data/bld/10.5-asan-nightly/bin/mariadbd(my_print_stacktrace+0xec)[0x55f8df698fad]
mysys/stacktrace.c:212(my_print_stacktrace)[0x55f8de0ff93c]
sigaction.c:0(__restore_rt)[0x7f8fa55733c0]
??:0(gsignal)[0x7f8fa505f18b]
??:0(abort)[0x7f8fa503e859]
??:0(__sanitizer_set_report_fd)[0x7f8fa57086a2]
??:0(__sanitizer_get_module_and_offset_for_pc)[0x7f8fa571324c]
??:0(__sanitizer_ptr_cmp)[0x7f8fa56f48ec]
??:0(__asan_on_error)[0x7f8fa56f4363]
??:0(__asan_report_load2)[0x7f8fa56f4f6b]
/data/bld/10.5-asan-nightly/bin/mariadbd(+0x267b566)[0x55f8de509566]
sql/opt_range.cc:5585(same_index_prefix(st_key*, st_key*, unsigned int))[0x55f8de50e2a6]
sql/opt_range.cc:6413(get_best_index_intersect(PARAM*, SEL_TREE*, double))[0x55f8de4f910f]
sql/opt_range.cc:2955(SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool))[0x55f8dd9e7cfc]
sql/sql_select.cc:4695(get_quick_record_count(THD*, SQL_SELECT*, TABLE*, Bitmap<64u> const*, unsigned long long))[0x55f8dd9eec38]
sql/sql_select.cc:5426(make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*))[0x55f8dd9cdc1b]
sql/sql_select.cc:2247(JOIN::optimize_inner())[0x55f8dd9c71fe]
sql/sql_select.cc:1623(JOIN::optimize())[0x55f8dd9e740b]
sql/sql_select.cc:4637(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x55f8dd9b9568]
sql/sql_select.cc:417(handle_select(THD*, LEX*, select_result*, unsigned long))[0x55f8dd924146]
sql/sql_parse.cc:6210(execute_sqlcom_select(THD*, TABLE_LIST*))[0x55f8dd913423]
sql/sql_parse.cc:3932(mysql_execute_command(THD*))[0x55f8dd92f45b]
sql/sql_parse.cc:7994(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x55f8dd905e15]
sql/sql_parse.cc:1870(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55f8dd90275b]
sql/sql_parse.cc:1348(do_command(THD*))[0x55f8ddd3dd84]
sql/sql_connect.cc:1410(do_handle_one_connection(CONNECT*, bool))[0x55f8ddd3d6ed]
sql/sql_connect.cc:1314(handle_one_connection)[0x55f8dea37ff9]
nptl/pthread_create.c:478(start_thread)[0x7f8fa5567609]
??:0(clone)[0x7f8fa513b293]
 
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x62b0000382a8): SELECT * FROM t1 WHERE f LIKE 'i%' AND b = pk AND d = 'y'
 
Connection ID (thread ID): 4
Status: NOT_KILLED
 
Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=on,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=on
 
The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains
information that should help you find out what is causing the crash.
Writing a core file...
Working directory at /dev/shm/var_auto_KFsT/mysqld.1/data
Resource Limits:
Limit                     Soft Limit           Hard Limit           Units     
Max cpu time              unlimited            unlimited            seconds   
Max file size             unlimited            unlimited            bytes     
Max data size             unlimited            unlimited            bytes     
Max stack size            8388608              unlimited            bytes     
Max core file size        0                    0                    bytes     
Max resident set          unlimited            unlimited            bytes     
Max processes             385884               385884               processes 
Max open files            1024                 1024                 files     
Max locked memory         67108864             67108864             bytes     
Max address space         unlimited            unlimited            bytes     
Max file locks            unlimited            unlimited            locks     
Max pending signals       385884               385884               signals   
Max msgqueue size         819200               819200               bytes     
Max nice priority         0                    0                    
Max realtime priority     0                    0                    
Max realtime timeout      unlimited            unlimited            us        
Core pattern: |/usr/share/apport/apport %p %s %c %d %P %E

10.5 861cd4ce Valgrind

==1810703== Invalid read of size 2
==1810703==    at 0xF5B8D9: same_index_prefix(st_key*, st_key*, unsigned int) (opt_range.cc:5585)
==1810703==    by 0xF5D727: get_best_index_intersect(PARAM*, SEL_TREE*, double) (opt_range.cc:6413)
==1810703==    by 0xF5516D: SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) (opt_range.cc:2955)
==1810703==    by 0xA8F216: get_quick_record_count(THD*, SQL_SELECT*, TABLE*, Bitmap<64u> const*, unsigned long long) (sql_select.cc:4695)
==1810703==    by 0xA91BD2: make_join_statistics(JOIN*, List<TABLE_LIST>&, st_dynamic_array*) (sql_select.cc:5426)
==1810703==    by 0xA8608C: JOIN::optimize_inner() (sql_select.cc:2247)
==1810703==    by 0xA83B26: JOIN::optimize() (sql_select.cc:1623)
==1810703==    by 0xA8EEF5: mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) (sql_select.cc:4637)
==1810703==    by 0xA7EA70: handle_select(THD*, LEX*, select_result*, unsigned long) (sql_select.cc:417)
==1810703==    by 0xA411F6: execute_sqlcom_select(THD*, TABLE_LIST*) (sql_parse.cc:6210)
==1810703==    by 0xA3850B: mysql_execute_command(THD*) (sql_parse.cc:3932)
==1810703==    by 0xA46199: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:7994)
==1810703==    by 0xA32389: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1867)
==1810703==    by 0xA30B7D: do_command(THD*) (sql_parse.cc:1348)
==1810703==    by 0xBE393F: do_handle_one_connection(CONNECT*, bool) (sql_connect.cc:1410)
==1810703==    by 0xBE36A7: handle_one_connection (sql_connect.cc:1312)
==1810703==    by 0x115CBBE: pfs_spawn_thread (pfs.cc:2201)
==1810703==    by 0x48C6608: start_thread (pthread_create.c:477)
==1810703==    by 0x4D55292: clone (clone.S:95)
==1810703==  Address 0xbbf2106 is 22 bytes after a block of size 1,232 alloc'd
==1810703==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==1810703==    by 0x175196E: my_malloc (my_malloc.c:88)
==1810703==    by 0x1741671: alloc_root (my_alloc.c:190)
==1810703==    by 0x174189E: multi_alloc_root (my_alloc.c:317)
==1810703==    by 0xB81818: copy_keys_from_share(TABLE*, st_mem_root*) (table.cc:3812)
==1810703==    by 0xB822E1: open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) (table.cc:4026)
==1810703==    by 0x9889D5: open_table(THD*, TABLE_LIST*, Open_table_context*) (sql_base.cc:1991)
==1810703==    by 0x98C87B: open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) (sql_base.cc:3791)
==1810703==    by 0x98DB3D: open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) (sql_base.cc:4263)
==1810703==    by 0x98FCFE: open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) (sql_base.cc:5167)
==1810703==    by 0x94537A: open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) (sql_base.h:507)
==1810703==    by 0x9E547B: mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) (sql_insert.cc:755)
==1810703==    by 0xA3A573: mysql_execute_command(THD*) (sql_parse.cc:4546)
==1810703==    by 0xA46199: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:7994)
==1810703==    by 0xA32389: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1867)
==1810703==    by 0xA30B7D: do_command(THD*) (sql_parse.cc:1348)
==1810703==    by 0xBE393F: do_handle_one_connection(CONNECT*, bool) (sql_connect.cc:1410)
==1810703==    by 0xBE36A7: handle_one_connection (sql_connect.cc:1312)
==1810703==    by 0x115CBBE: pfs_spawn_thread (pfs.cc:2201)
==1810703==    by 0x48C6608: start_thread (pthread_create.c:477)

The test case is not applicable to earlier versions due to the used optimizer_switch.
Non-instrumented builds don't crash at least on my machine.

ANALYZE (on a non-ASAN non-Valgrind build):

{
  "query_block": {
    "select_id": 1,
    "r_loops": 1,
    "r_total_time_ms": 0.127782646,
    "table": {
      "table_name": "t1",
      "access_type": "index_merge",
      "possible_keys": ["f", "f_2"],
      "key_length": "207,5",
      "index_merge": {
        "sort_intersect": {
          "range": {
            "key": "f",
            "used_key_parts": ["f", "d"]
          },
          "range": {
            "key": "b",
            "used_key_parts": ["b"]
          }
        }
      },
      "r_loops": 1,
      "rows": 1,
      "r_rows": 2,
      "r_table_time_ms": 0.053414547,
      "r_other_time_ms": 0.051943595,
      "filtered": 100,
      "r_filtered": 0,
      "attached_condition": "t1.b = t1.pk and t1.d = 'y' and t1.f like 'i%'"
    }
  }
}



 Comments   
Comment by Alice Sherepa [ 2022-06-22 ]

somehow test case from the description fails on 10.5, but not on 10.6+. But bug exists there, there is a test to demonstrate it:

CREATE TABLE t1 ( x varchar(10), c_key varchar(1024), i int(11), y varchar(10), i2 int(11), pk int(11) NOT NULL, a varchar(1024), a_key varchar(1024), b varchar(10) NOT NULL, c varchar(1024), d varchar(10), UNIQUE KEY (pk ,i2), KEY (i2), KEY (pk));
 
INSERT INTO t1 VALUES
('\'cost\'','\'jsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttidrfgqeojzalslpzpwxvxgfnnzyrzkpdswrokqnrjsoldgoctlomh\'',7,'c',-1422786560,8,'\'deserve\'','\'natural\'','z','\'snviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttidrfgqeojzalslpzpwxvxgfnnzyrzkpdswrokqnrjsoldgoctlomhhofpknramzpzufhyqrwzoobicuivyxwwdycjusdoviudyphicxgawjcadnkchiaydwhjtjoiclphxwccdvylsnxpphkqdlwxbfaesrzachwlwgifgsxmvvwnpesbwrdfmtgpektguqubfvjhlwwqyykiwdizmesjvrkcfuxbhrymtbduvvtucsmvpaxtooolzwhziadyvstujimmbjzhozmklzlleqoxgrckmxtzdealnxb\'','\'nviwdkcuu'),
('\'ppleqttwe','\'pleqttweuxcdtvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttidrfgqeojzalslpzpwxvxgfnnzyrzkpdswrokqnrjsoldgoctlomhhofpknramzpzufhyqrwzoobicuivyxwwdycjusdoviudyphicxgawjcadnkchiaydwhjtjoiclphxwccdvylsnxpphkqdlwxbfaesrzachwlwgifgsxmvvwnpesbwrdfmtgpektguqubfvjhlwwqyykiwdizmesjvrkcfuxbhrymtbduvvtucsmvpaxtooolzwhziadyvstujimmbjzhozmklzlleqoxgrckmxtzdealnxbveglgrurtchdxseqyxmpqljsucrdhxmrmmhthzjaatwsjgepgdwnwewizsczotpotkambuotxfuihiwijm\'',3,'\'leqttweux',349831168,2,'\'therapist\'','\'eqttweuxcdtvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxu\'','\'versus\'','p','\'qttweuxcd'),
('\'reading\'','\'people\'',8,'\'as\'',-954859520,7,'\'qgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjx\'','\'gsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgaw\'','\'killing\'','\'sjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttidrfgqeojzalslpzpwxvxgfnnzyrzkpdswrokqnrjsoldgoctlomhhofpknramzpzufhyqrwzoobicuivyxwwdycjusdoviudyphicxgawjcadnk\'','\'sculpture'),
('\'stadium\'','\'very\'',3,'q',9,4,'\'uxcdtvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttidrfgqeojzalslpzpwxvxgfnnzyrzkpdswrokqnrjsoldgoctlomhhofpknramzpzufhyqrwzoobicuivyxwwdycjusdoviudyphicxgawjcadnkchiaydwhjtjoiclphxwccdvylsnxpphkqdlwxbfaesrzachwlwgifgsxmvvwnpesbwrdfmtgpektguqubfvjhlwwqyykiwdizmesjvrkcfuxbhrymtbduvvtucsmvpaxtooolzwhziadyvstujimmbjzhozmklzlleqoxgrckmxtzdealnxbveglgrurtchdxseqyxmpqljsucrdhxmrmmhthzjaatwsjgepgdwnwewizsczotpotkambuotxfuihiwijmkpanilhwaaakmhztbu\'','\'palestinian\'','o','\'religion\'','\'xcdtvqgsj'),
('\'viwdkcuuj','\'marry\'',0,'a',0,9,'u','\'iwdkcuujvchotjpitdrdbmxoojlp\'','\'leap\'','o','a'),
('e','\'dtvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttidrfgqeojzalslpzpwxvxgfnnzyrzkpdswrokqnrjsoldgoctlomhhofpknramzpzufhyqrwzoobicuivyxwwdycjusdoviudyphicxgawjcadnkchiaydwhjtjoiclphxwccdvylsnxpphkqdlwxbfaesrzachwlwgifgsxmvvwn\'',2,'\'meaningfu',-885325824,6,'\'tvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwz\'','\'tray\'','r','\'vqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttidrfgqeojzalslpzpwxvxgfnnzyrzkpdswrokqnrjsoldgoctlomhhofpknramzpzufhyqrwzoobicuivyxwwdycjusdoviudyphicxgawjcadnkchiaydwhjtjoiclphxwccdvylsnxpphkqdlwxbfaesrzachwlwgifgsxmvvwnpesbwrdfmtgpektguqubfvjhlwwqyykiwdizmesjvrkcfuxbhrymtbduvvtucsmvpaxtooolzwhziadyvstujimmbjzhozmklzlleqoxgrckmxtzdealnxbveglgrurtchdxseqyxmpqljsucrdhxmrmmhthzjaatwsjgepgdwnwewizsczotpotkambuotxfuihiwijmkpanilhwaaakmhztbujkdbjvopertcbdttiamokgwbaoxppdbqcsdbqzyixofxkihungtzbibxfqfvzdpxzm\'','d'),
('\'ttweuxcdt','\'tweuxcdtvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpt\'',576716800,'\'to\'',1947074560,3,'c','\'weuxcdtvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttid\'','\'euxcdtvqg','u','e'),
('d','n',-343932928,'o',-442630144,1,'\'eotwppleqttweuxcdtvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttidrfgqeojzalslpzpwxvxgfnnzyrzkpdswrokqnrjsoldgoctlomhhofpknramzpzufhyqrwzoobicuivyxwwdycjusdoviudyphicxgawjcadnkchiaydwhjtjoiclphxwccdvylsnxpphkqdlwxbfaesrzachwlwgifgsxmvvwnpesbwrdfmtgpektguqubfvjhlwwqyykiwdizmesjvrkcfuxbhrymtbduvvtucsmvpaxtooolzwhziadyvstujimm\'','\'otwppleqttweuxcdtvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbq\'','\'twppleqtt','\'wppleqttweuxcdtvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttidrfgqeojzalslpzpwxvxgfnnzyrzkpdswrokqnrjsoldgoctlomhhofpknramzpzufhyqrwzoobicuivyxwwdycjusdoviudyphicxgawjcadnkchiaydwhjtjoiclphxwccdvylsnxpp\'','k'),
('u','\'clinic\'',2,'\'sock\'',0,5,'w','\'cdtvqgsjsnviwdkcuujvchotjpitdrdbmxoojlpceobxjchwmygyxctypvqbqumetekucidifgimxssacvnygrbqixongljmyxqblapyochevlajgwxuowgsublvqmzqwtlmppgyqmayrbbhhmzmerfsogwbryufyglctrmwtaevwkoqqdujmmzymhsjjxskeebhiisivfcytjqgpqvjjbdueifwnducblouhhqnbyiatayvrglhodfpteggsmfbuzrswgcpvzqjezdmkkkanmunvkibsmsqlwzyhheytytt1bxpeabxrebmabpkpmanhdcspgbqqrjldcrxfhvcldgrbootwwdrzsznqzmrntyfgawszjyfluvotfqgviocupxeuloofbdjrkopknlgohpjkpgbudeeppysusoltvxhlaybajprgoiknpxyilkpgydwzhhgohzztfzzfhinxckzdpdniwlpskvfnaheqkgaceejqrxkvbswpwvfjczhutpbfuibhqinqcadxbnoirnodvenoxelgnfeoirxpbwfsfrttidrfgqeojzalslpzpwxvxgfnnzyrzkpdswrokqnrjsoldgoctlomhhofpknramzpzufhyqrwzoobicuivyxwwdycjusdoviudyphicxgawjcadnkchiaydwhjtjoiclphxwccdvylsnxpphkqdlwxbfaesrzachwlwgifgsxmvvwnpesbwrdfmtgpektguqubfvjhlwwqyykiwdizmesjvrkcfuxbhrymtbduvvtucsmvpaxtooolzwhziadyvstujimmbjzhozmklzlleqoxgrckmxtzdealnxbveglgrurtchdxseqyxmpqljsucrdhxmrmmhthzjaatwsjgepgdwnwewizsczotpotkambuotxfuihiwijmkpanilhwaaakmhztbujkdbjvopertcbdttiamokgwbaoxppdbqcsdbqzyixofxkih\'','d','h','x');
 
analyze table t1;
 
SET optimizer_switch= 'index_merge_sort_intersection=on';
 
SELECT pk, i FROM t1  WHERE ( pk >= 6  AND i2 IN (4, 5, 2, 161) );

10.8 2419b1733042c30414a4feed89c7

=================================================================
==1109337==ERROR: AddressSanitizer: use-after-poison on address 0x61d0002f37a2 at pc 0x5634e1f2d301 bp 0x7f280ff269b0 sp 0x7f280ff269a0
READ of size 2 at 0x61d0002f37a2 thread T11
    #0 0x5634e1f2d300 in same_index_prefix /10.8/src/sql/opt_range.cc:5634
    #1 0x5634e1f32039 in get_best_index_intersect /10.8/src/sql/opt_range.cc:6462
    #2 0x5634e1f1ca54 in SQL_SELECT::test_quick_select(THD*, Bitmap<64u>, unsigned long long, unsigned long long, bool, bool, bool, bool) /10.8/src/sql/opt_range.cc:2982
    #3 0x5634e23b40c4 in get_quick_record_count /10.8/src/sql/sql_select.cc:5062
    #4 0x5634e23baead in make_join_statistics /10.8/src/sql/sql_select.cc:5789
    #5 0x5634e23990f1 in JOIN::optimize_inner() /10.8/src/sql/sql_select.cc:2477
    #6 0x5634e239209d in JOIN::optimize() /10.8/src/sql/sql_select.cc:1819
    #7 0x5634e23b37d1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.8/src/sql/sql_select.cc:5004
    #8 0x5634e2383c76 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.8/src/sql/sql_select.cc:552
    #9 0x5634e22a9818 in execute_sqlcom_select /10.8/src/sql/sql_parse.cc:6252
    #10 0x5634e2298435 in mysql_execute_command(THD*, bool) /10.8/src/sql/sql_parse.cc:3943
    #11 0x5634e22b4a9c in mysql_parse(THD*, char*, unsigned int, Parser_state*) /10.8/src/sql/sql_parse.cc:8027
    #12 0x5634e228ad32 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /10.8/src/sql/sql_parse.cc:1894
    #13 0x5634e2287aa7 in do_command(THD*, bool) /10.8/src/sql/sql_parse.cc:1407
    #14 0x5634e273219b in do_handle_one_connection(CONNECT*, bool) /10.8/src/sql/sql_connect.cc:1418
    #15 0x5634e2731a27 in handle_one_connection /10.8/src/sql/sql_connect.cc:1312
    #16 0x5634e334d0cd in pfs_spawn_thread /10.8/src/storage/perfschema/pfs.cc:2201
    #17 0x7f281ef9d608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
    #18 0x7f281eb6e132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
 
0x61d0002f37a2 is located 1826 bytes inside of 2180-byte region [0x61d0002f3080,0x61d0002f3904)
allocated by thread T11 here:
    #0 0x7f281f529808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x5634e3f898be in sf_malloc /10.8/src/mysys/safemalloc.c:126
    #2 0x5634e3f56ae5 in my_malloc /10.8/src/mysys/my_malloc.c:90
    #3 0x5634e3f31766 in root_alloc /10.8/src/mysys/my_alloc.c:66
    #4 0x5634e3f32f1c in alloc_root /10.8/src/mysys/my_alloc.c:332
    #5 0x5634e3f34ab7 in memdup_root /10.8/src/mysys/my_alloc.c:597
    #6 0x5634e2ad47f2 in Field::clone(st_mem_root*, TABLE*) /10.8/src/sql/field.cc:2595
    #7 0x5634e264ec56 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /10.8/src/sql/table.cc:4203
    #8 0x5634e20e2387 in open_table(THD*, TABLE_LIST*, Open_table_context*) /10.8/src/sql/sql_base.cc:2016
    #9 0x5634e20ec002 in open_and_process_table /10.8/src/sql/sql_base.cc:3826
    #10 0x5634e20eec66 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /10.8/src/sql/sql_base.cc:4309
    #11 0x5634e20f3e39 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /10.8/src/sql/sql_base.cc:5282
    #12 0x5634e204c4e9 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /10.8/src/sql/sql_base.h:509
    #13 0x5634e22a8cf1 in execute_sqlcom_select /10.8/src/sql/sql_parse.cc:6173
    #14 0x5634e2298435 in mysql_execute_command(THD*, bool) /10.8/src/sql/sql_parse.cc:3943
    #15 0x5634e22b4a9c in mysql_parse(THD*, char*, unsigned int, Parser_state*) /10.8/src/sql/sql_parse.cc:8027
    #16 0x5634e228ad32 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /10.8/src/sql/sql_parse.cc:1894
    #17 0x5634e2287aa7 in do_command(THD*, bool) /10.8/src/sql/sql_parse.cc:1407
    #18 0x5634e273219b in do_handle_one_connection(CONNECT*, bool) /10.8/src/sql/sql_connect.cc:1418
    #19 0x5634e2731a27 in handle_one_connection /10.8/src/sql/sql_connect.cc:1312
    #20 0x5634e334d0cd in pfs_spawn_thread /10.8/src/storage/perfschema/pfs.cc:2201
    #21 0x7f281ef9d608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
 
Thread T11 created by T0 here:
    #0 0x7f281f456815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
    #1 0x5634e3348caa in my_thread_create /10.8/src/storage/perfschema/my_thread.h:52
    #2 0x5634e334d4c0 in pfs_spawn_thread_v1 /10.8/src/storage/perfschema/pfs.cc:2252
    #3 0x5634e1ec9c68 in inline_mysql_thread_create /10.8/src/include/mysql/psi/mysql_thread.h:1139
    #4 0x5634e1ee1c43 in create_thread_to_handle_connection(CONNECT*) /10.8/src/sql/mysqld.cc:6014
    #5 0x5634e1ee22bf in create_new_thread(CONNECT*) /10.8/src/sql/mysqld.cc:6073
    #6 0x5634e1ee262c in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.8/src/sql/mysqld.cc:6135
    #7 0x5634e1ee3001 in handle_connections_sockets() /10.8/src/sql/mysqld.cc:6259
    #8 0x5634e1ee1450 in mysqld_main(int, char**) /10.8/src/sql/mysqld.cc:5909
    #9 0x5634e1ec8f8c in main /10.8/src/sql/main.cc:34
    #10 0x7f281ea73082 in __libc_start_main ../csu/libc-start.c:308
 
SUMMARY: AddressSanitizer: use-after-poison /10.8/src/sql/opt_range.cc:5634 in same_index_prefix
Shadow bytes around the buggy address:
  0x0c3a800566a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800566b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800566c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800566d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800566e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a800566f0: 00 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a80056700: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a80056710: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c3a80056720: 04 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80056730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a80056740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1109337==ABORTING

Generated at Thu Feb 08 09:25:52 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.