From 106c785e2d3357a6f6711907f9e20b04c6ec7f96 Mon Sep 17 00:00:00 2001
From: Sergei Petrunia <psergey@askmonty.org>
Date: Tue, 2 Nov 2021 15:18:50 +0300
Subject: [PATCH] MDEV-26911: Unexpected ER_DUP_KEY, ASAN errors, double free
 detected in ...

When loading the histogram, use table->field[N], not table->s->field[N].

When we used the latter we would corrupt the fields's default value. One
of the consequences of that would be that AUTO_INCREMENT fields would
stop working correctly.
---
 mysql-test/main/statistics_json.result | 13 +++++++++++++
 mysql-test/main/statistics_json.test   | 15 ++++++++++++++-
 sql/sql_statistics.cc                  | 13 ++++++++++++-
 3 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/mysql-test/main/statistics_json.result b/mysql-test/main/statistics_json.result
index 48b6bc77390..99373c93166 100644
--- a/mysql-test/main/statistics_json.result
+++ b/mysql-test/main/statistics_json.result
@@ -7645,3 +7645,16 @@ a
 foo
 ?
 drop table t1;
+#
+# MDEV-26911: Unexpected ER_DUP_KEY, ASAN errors, double free detected in tcache with JSON_HB histogram
+#
+SET histogram_type= JSON_HB;
+CREATE TABLE t1 (pk INT AUTO_INCREMENT, f VARCHAR(8), PRIMARY KEY (pk));
+INSERT INTO t1 (f) VALUES ('foo');
+ANALYZE TABLE t1 PERSISTENT FOR ALL;
+Table	Op	Msg_type	Msg_text
+test.t1	analyze	status	Engine-independent statistics collected
+test.t1	analyze	status	OK
+ALTER TABLE t1 MODIFY f TEXT, ORDER BY pk;
+INSERT INTO t1 (f) VALUES ('bar');
+DROP TABLE t1;
diff --git a/mysql-test/main/statistics_json.test b/mysql-test/main/statistics_json.test
index b0f54e08ff2..c0c88895f05 100644
--- a/mysql-test/main/statistics_json.test
+++ b/mysql-test/main/statistics_json.test
@@ -5,6 +5,7 @@
 let $histogram_type_override='JSON_HB';
 --source statistics.test
 
+--source include/have_innodb.inc
 --source include/have_stat_tables.inc
 --source include/have_sequence.inc
 --source include/analyze-format.inc
@@ -325,5 +326,17 @@ insert into t1 values ('foo'),(unhex('9C'));
 analyze table t1 persistent for all;
 
 select * from t1;
-
 drop table t1;
+
+--echo #
+--echo # MDEV-26911: Unexpected ER_DUP_KEY, ASAN errors, double free detected in tcache with JSON_HB histogram
+--echo #
+
+SET histogram_type= JSON_HB;
+ 
+CREATE TABLE t1 (pk INT AUTO_INCREMENT, f VARCHAR(8), PRIMARY KEY (pk));
+INSERT INTO t1 (f) VALUES ('foo');
+ANALYZE TABLE t1 PERSISTENT FOR ALL;
+ALTER TABLE t1 MODIFY f TEXT, ORDER BY pk;
+INSERT INTO t1 (f) VALUES ('bar');
+DROP TABLE t1;
diff --git a/sql/sql_statistics.cc b/sql/sql_statistics.cc
index c87330316f4..8d08875e183 100644
--- a/sql/sql_statistics.cc
+++ b/sql/sql_statistics.cc
@@ -1232,7 +1232,8 @@ public:
       Histogram_base *hist;
       if (!(hist= create_histogram(mem_root, hist_type, NULL)))
         return NULL;
-      if (!hist->parse(mem_root, table_field, hist_type,
+      Field *field= table->field[table_field->field_index];
+      if (!hist->parse(mem_root, field, hist_type,
                        val.ptr(), val.length()))
       {
         table_field->read_stats->histogram= hist;
@@ -3178,6 +3179,14 @@ int read_histograms_for_table(THD *thd, TABLE *table, TABLE_LIST *stat_tables)
   if (stats_cb->start_histograms_load())
   {
     Column_stat column_stat(stat_tables[COLUMN_STAT].table, table);
+
+    /*
+      The process of histogram loading makes use of the field it is for. Mark
+      all fields as readable/writable in order to allow that.
+    */
+    MY_BITMAP *old_sets[2];
+    dbug_tmp_use_all_columns(table, old_sets, &table->read_set, &table->write_set);
+
     for (Field **field_ptr= table->s->field; *field_ptr; field_ptr++)
     {
       Field *table_field= *field_ptr;
@@ -3189,6 +3198,8 @@ int read_histograms_for_table(THD *thd, TABLE *table, TABLE_LIST *stat_tables)
       }
     }
     stats_cb->end_histograms_load();
+
+    dbug_tmp_restore_column_maps(&table->read_set, &table->write_set, old_sets);
   }
   table->histograms_are_read= true;
   DBUG_RETURN(0);