BF abort of a SP causes a write-after-free error

BF abort of a stored procedure, causes a write-after-free error.

For a repro, see PXC-2684 (and send the update on node2 when running the SP).

=================================================================
==28816==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000fb5490 at pc 0x555557498e39 bp 0x7fffca7336e0 sp 0x7fffca7336d0
READ of size 4 at 0x606000fb5490 thread T36
#0 0x555557498e38 in Protocol_text::store(char const*, unsigned long, charset_info_st const*, charset_info_st const*) /home/kennt/dev/pxc/sql/protocol_classic.cc:1297
#1 0x5555574990c3 in Protocol_text::store(char const*, unsigned long, charset_info_st const*) /home/kennt/dev/pxc/sql/protocol_classic.h:222
#2 0x555556427574 in Item::send(Protocol*, String*) /home/kennt/dev/pxc/sql/item.cc:7534
#3 0x5555575f8fb7 in THD::send_result_set_row(List<Item>*) /home/kennt/dev/pxc/sql/sql_class.cc:5420
#4 0x5555575f9521 in Query_result_send::send_data(List<Item>&) /home/kennt/dev/pxc/sql/sql_class.cc:3321
#5 0x55555763713b in JOIN::exec() /home/kennt/dev/pxc/sql/sql_executor.cc:158
#6 0x5555577f7d2d in handle_query(THD*, LEX*, Query_result*, unsigned long long, unsigned long long) /home/kennt/dev/pxc/sql/sql_select.cc:185
#7 0x5555576f2685 in execute_sqlcom_select /home/kennt/dev/pxc/sql/sql_parse.cc:6422
#8 0x555557706582 in mysql_execute_command(THD*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:3460
#9 0x55555750e3fc in sp_instr_stmt::exec_core(THD*, unsigned int*) /home/kennt/dev/pxc/sql/sp_instr.cc:1057
#10 0x555557513a22 in sp_lex_instr::reset_lex_and_exec_core(THD*, unsigned int*, bool) /home/kennt/dev/pxc/sql/sp_instr.cc:446
#11 0x555557516650 in sp_lex_instr::validate_lex_and_execute_core(THD*, unsigned int*, bool) /home/kennt/dev/pxc/sql/sp_instr.cc:748
#12 0x555557519ea1 in sp_instr_stmt::execute(THD*, unsigned int*) /home/kennt/dev/pxc/sql/sp_instr.cc:944
#13 0x5555574fa2f5 in sp_head::execute(THD*, bool) /home/kennt/dev/pxc/sql/sp_head.cc:803
#14 0x55555750b6da in sp_head::execute_procedure(THD*, List<Item>*) /home/kennt/dev/pxc/sql/sp_head.cc:1577
#15 0x55555771ca74 in mysql_execute_command(THD*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:5665
#16 0x555557724441 in mysql_parse(THD*, Parser_state*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:6874
#17 0x55555772496d in wsrep_mysql_parse /home/kennt/dev/pxc/sql/sql_parse.cc:7869
#18 0x55555772b4a5 in dispatch_command(THD*, COM_DATA const*, enum_server_command) /home/kennt/dev/pxc/sql/sql_parse.cc:1857
#19 0x555557732b0f in do_command(THD*) /home/kennt/dev/pxc/sql/sql_parse.cc:1186
#20 0x555557a47212 in handle_connection /home/kennt/dev/pxc/sql/conn_handler/connection_handler_per_thread.cc:318
#21 0x55555801a2b3 in pfs_spawn_thread /home/kennt/dev/pxc/storage/perfschema/pfs.cc:2190
#22 0x7ffff583c6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
#23 0x7ffff4c2688e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

0x606000fb5490 is located 48 bytes inside of 64-byte region [0x606000fb5460,0x606000fb54a0)
freed by thread T36 here:
#0 0x7ffff6ef87b8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7b8)
#1 0x555557fc15d9 in my_raw_free /home/kennt/dev/pxc/mysys/my_malloc.c:290
#2 0x555557fc15d9 in my_free /home/kennt/dev/pxc/mysys/my_malloc.c:133
#3 0x555557fb1ce1 in free_root /home/kennt/dev/pxc/mysys/my_alloc.c:451
#4 0x5555574fafc9 in sp_head::execute(THD*, bool) /home/kennt/dev/pxc/sql/sp_head.cc:859
#5 0x55555750b6da in sp_head::execute_procedure(THD*, List<Item>*) /home/kennt/dev/pxc/sql/sp_head.cc:1577
#6 0x55555771ca74 in mysql_execute_command(THD*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:5665
#7 0x555557724441 in mysql_parse(THD*, Parser_state*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:6874
#8 0x55555772496d in wsrep_mysql_parse /home/kennt/dev/pxc/sql/sql_parse.cc:7869
#9 0x55555772b4a5 in dispatch_command(THD*, COM_DATA const*, enum_server_command) /home/kennt/dev/pxc/sql/sql_parse.cc:1857
#10 0x555557732b0f in do_command(THD*) /home/kennt/dev/pxc/sql/sql_parse.cc:1186
#11 0x555557a47212 in handle_connection /home/kennt/dev/pxc/sql/conn_handler/connection_handler_per_thread.cc:318
#12 0x55555801a2b3 in pfs_spawn_thread /home/kennt/dev/pxc/storage/perfschema/pfs.cc:2190
#13 0x7ffff583c6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

previously allocated by thread T36 here:
#0 0x7ffff6ef8b50 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb50)
#1 0x555557fc0fd0 in my_raw_malloc /home/kennt/dev/pxc/mysys/my_malloc.c:191
#2 0x555557fc0fd0 in my_malloc /home/kennt/dev/pxc/mysys/my_malloc.c:54
#3 0x555557fb0f31 in alloc_root /home/kennt/dev/pxc/mysys/my_alloc.c:217
#4 0x5555579d8bb6 in sql_alloc(unsigned long) /home/kennt/dev/pxc/sql/thr_malloc.cc:39
#5 0x5555564dc60a in Sql_alloc::operator new(unsigned long) /home/kennt/dev/pxc/sql/sql_alloc.h:30
#6 0x5555564dc60a in base_list::push_back(void*) /home/kennt/dev/pxc/sql/sql_list.h:195
#7 0x5555564dc60a in List<Item>::push_back(Item*) /home/kennt/dev/pxc/sql/sql_list.h:545
#8 0x5555564dc60a in Item_cond::copy_andor_arguments(THD*, Item_cond*) /home/kennt/dev/pxc/sql/item_cmpfunc.cc:5792
#9 0x5555564f9b5d in Item_cond_and::copy_andor_structure(THD*) (/home/kennt/dev/pxc/build/usr/local/Percona-XtraDB-Cluster-5.7.27-rel30-31.39-debug.1.Linux.x86_64/bin/mysqld+0xfa5b5d)
#10 0x55555767a3c6 in st_select_lex::get_optimizable_conditions(THD*, Item*, Item*) /home/kennt/dev/pxc/sql/sql_lex.cc:4484
#11 0x555557923656 in mysql_update(THD*, List<Item>&, List<Item>&, unsigned long long, enum_duplicates, unsigned long long*, unsigned long long*) /home/kennt/dev/pxc/sql/sql_update.cc:298
#12 0x555557930f05 in Sql_cmd_update::try_single_table_update(THD*, bool*) /home/kennt/dev/pxc/sql/sql_update.cc:2930
#13 0x555557931a11 in Sql_cmd_update::execute(THD*) /home/kennt/dev/pxc/sql/sql_update.cc:3057
#14 0x555557712287 in mysql_execute_command(THD*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:4368
#15 0x55555750e3fc in sp_instr_stmt::exec_core(THD*, unsigned int*) /home/kennt/dev/pxc/sql/sp_instr.cc:1057
#16 0x555557513a22 in sp_lex_instr::reset_lex_and_exec_core(THD*, unsigned int*, bool) /home/kennt/dev/pxc/sql/sp_instr.cc:446
#17 0x555557516650 in sp_lex_instr::validate_lex_and_execute_core(THD*, unsigned int*, bool) /home/kennt/dev/pxc/sql/sp_instr.cc:748
#18 0x555557519ea1 in sp_instr_stmt::execute(THD*, unsigned int*) /home/kennt/dev/pxc/sql/sp_instr.cc:944
#19 0x5555574fa2f5 in sp_head::execute(THD*, bool) /home/kennt/dev/pxc/sql/sp_head.cc:803
#20 0x55555750b6da in sp_head::execute_procedure(THD*, List<Item>*) /home/kennt/dev/pxc/sql/sp_head.cc:1577
#21 0x55555771ca74 in mysql_execute_command(THD*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:5665
#22 0x555557724441 in mysql_parse(THD*, Parser_state*, bool) /home/kennt/dev/pxc/sql/sql_parse.cc:6874
#23 0x55555772496d in wsrep_mysql_parse /home/kennt/dev/pxc/sql/sql_parse.cc:7869
#24 0x55555772b4a5 in dispatch_command(THD*, COM_DATA const*, enum_server_command) /home/kennt/dev/pxc/sql/sql_parse.cc:1857
#25 0x555557732b0f in do_command(THD*) /home/kennt/dev/pxc/sql/sql_parse.cc:1186
#26 0x555557a47212 in handle_connection /home/kennt/dev/pxc/sql/conn_handler/connection_handler_per_thread.cc:318
#27 0x55555801a2b3 in pfs_spawn_thread /home/kennt/dev/pxc/storage/perfschema/pfs.cc:2190
#28 0x7ffff583c6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

Thread T36 created by T0 here:
#0 0x7ffff6e51d2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
#1 0x555557fe4666 in my_thread_create /home/kennt/dev/pxc/mysys/my_thread.c:92
#2 0x555558021ceb in pfs_spawn_thread_v1 /home/kennt/dev/pxc/storage/perfschema/pfs.cc:2241
#3 0x555557a48c05 in inline_mysql_thread_create /home/kennt/dev/pxc/include/mysql/psi/mysql_thread.h:1297
#4 0x555557a48c05 in Per_thread_connection_handler::add_connection(Channel_info*) /home/kennt/dev/pxc/sql/conn_handler/connection_handler_per_thread.cc:433
#5 0x5555563188e6 in Connection_handler_manager::process_new_connection(Channel_info*) /home/kennt/dev/pxc/sql/conn_handler/connection_handler_manager.cc:315
#6 0x5555562043ec in Connection_acceptor<Mysqld_socket_listener>::connection_event_loop() /home/kennt/dev/pxc/sql/conn_handler/connection_acceptor.h:68
#7 0x5555562043ec in mysqld_main(int, char**) /home/kennt/dev/pxc/sql/mysqld.cc:6328
#8 0x5555561e1ab2 in main /home/kennt/dev/pxc/sql/main.cc:25
#9 0x7ffff4b26b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-use-after-free /home/kennt/dev/pxc/sql/protocol_classic.cc:1297 in Protocol_text::store(char const*, unsigned long, charset_info_st const*, charset_info_st const*)
Shadow bytes around the buggy address:
0x0c0c801eea40: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
0x0c0c801eea50: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
0x0c0c801eea60: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fa
0x0c0c801eea70: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x0c0c801eea80: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
=>0x0c0c801eea90: fd fd[fd]fd fa fa fa fa fd fd fd fd fd fd fd fd
0x0c0c801eeaa0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
0x0c0c801eeab0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x0c0c801eeac0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fa
0x0c0c801eead0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
0x0c0c801eeae0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb