innodb.truncate_recover crashes in recovery due to out-of-bounds page read

innodb.undo_truncate_recover '2,4k,innodb' w3 [ fail ]

        Test ended at 2018-11-20 12:27:24

CURRENT_TEST: innodb.undo_truncate_recover

…

2018-11-20 12:27:24 0 [Note] InnoDB: Starting final batch to recover 2983 pages from redo log.

2018-11-20 12:27:24 0 [ERROR] [FATAL] InnoDB: Trying to read page number 2165 in space 1, space name innodb_undo001, which is outside the tablespace bounds. Byte offset 0, len 4096

…

#7  0x0000000000d28620 in fil_io (type=..., sync=<optimized out>, 

    page_id=..., page_size=..., byte_offset=0, len=4096, buf=0x7f6ba54fb000, 

    message=0x7f6ba4dbd6a0, ignore_missing_space=false)

    at /mariadb/10.4/storage/innobase/fil/fil0fil.cc:4350

(gdb) p *space

$1 = {name = 0x3cf9120 "innodb_undo001", id = 1, max_lsn = 0, 

  stop_new_ops = false, is_being_truncated = false, redo_skipped_count = 0, 

  purpose = FIL_TYPE_TABLESPACE, chain = {count = 1, start = 0x3cf9240, 

    end = 0x3cf9240, node = &fil_node_t::chain, init = 51966}, size = 1792, 

  size_in_header = 3584, free_len = 9, free_limit = 2560, recv_size = 0, 

  flags = 192, n_reserved_extents = 0, n_pending_flushes = 0, 

…

2018-11-20 12:42:37 0 [Note] InnoDB: Read redo log up to LSN=23183360

recv_group_scan_log_recs: ib_log: scan 23080787: multi-log rec MLOG_FILE_CREATE2 len 21 page 1:640

…

2018-11-20 12:42:48 0 [Note] InnoDB: Starting final batch to recover 2983 pages from redo log.

recv_addr_trim: ib_log: discarding log beyond end of tablespace [page id: space=1, page number=640] before LSN 23080787

…

recv_addr_trim: ib_log: Discarding MLOG_4BYTES for page 1:2165 at 22948721

recv_addr_trim: ib_log: Discarding MLOG_2BYTES for page 1:2165 at 22948728

…

2018-11-20 12:42:57 0 [Note] InnoDB: To recover: 1268 pages from log

2018-11-20 12:42:57 0 [ERROR] [FATAL] InnoDB: Trying to read page number 2165 in space 1, space name innodb_undo001, which is outside the tablespace bounds. Byte offset 0, len 4096