Server crashes in row_upd or in row_upd_del_mark_clust_rec upon DELETE HISTORY from table with system and application periods

--source include/have_innodb.inc

CREATE OR REPLACE TABLE t1 (

  s DATE,

  e DATE,

  PERIOD FOR app(s,e),

  row_start BIGINT UNSIGNED AS ROW START,

  row_end BIGINT UNSIGNED AS ROW END,

  PERIOD FOR SYSTEM_TIME(row_start,row_end)

) ENGINE=InnoDB WITH SYSTEM VERSIONING;

INSERT INTO t1 (s,e) VALUES 

  ('2020-08-03','2025-01-05'),('2019-03-05','2019-03-13'),

  ('2020-08-03','2025-01-05'),('2019-03-05','2019-03-13'),

  ('2019-11-30','2021-10-17');

DELETE FROM t1 FOR PORTION OF app FROM '2019-02-10' TO '2021-09-29';

DELETE FROM t1;

DELETE HISTORY FROM t1;

# Cleanup

DROP TABLE t1;

#3  <signal handler called>

#4  0x000056233cfeed94 in row_upd (node=0x7f14001518a8, thr=0x7f1400151c10) at /data/src/10.4/storage/innobase/row/row0upd.cc:3266

#5  0x000056233cfef442 in row_upd_step (thr=0x7f1400151c10) at /data/src/10.4/storage/innobase/row/row0upd.cc:3437

#6  0x000056233cf9d2f3 in row_update_for_mysql (prebuilt=0x7f1400150d28) at /data/src/10.4/storage/innobase/row/row0mysql.cc:1890

#7  0x000056233ce38c96 in ha_innobase::delete_row (this=0x7f140000d7e8, record=0x7f14001a2190 "\377=\313\017Q\313\017'") at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9025

#8  0x000056233cb03784 in handler::ha_delete_row (this=0x7f140000d7e8, buf=0x7f14001a2190 "\377=\313\017Q\313\017'") at /data/src/10.4/sql/handler.cc:6810

#9  0x000056233ccadf79 in TABLE::delete_row (this=0x7f140000c980) at /data/src/10.4/sql/sql_delete.cc:297

#10 0x000056233ccaaedc in mysql_delete (thd=0x7f1400000b00, table_list=0x7f14000155a0, conds=0x0, order_list=0x7f1400005498, limit=18446744073709551608, options=0, result=0x0) at /data/src/10.4/sql/sql_delete.cc:843

#11 0x000056233c7b0c11 in mysql_execute_command (thd=0x7f1400000b00) at /data/src/10.4/sql/sql_parse.cc:5032

#12 0x000056233c7bbb63 in mysql_parse (thd=0x7f1400000b00, rawbuf=0x7f14000154c8 "DELETE HISTORY FROM t1", length=22, parser_state=0x7f14500d9180, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8204

#13 0x000056233c7a71a5 in dispatch_command (command=COM_QUERY, thd=0x7f1400000b00, packet=0x7f1400139ff1 "DELETE HISTORY FROM t1", packet_length=22, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1829

#14 0x000056233c7a598b in do_command (thd=0x7f1400000b00) at /data/src/10.4/sql/sql_parse.cc:1358

#15 0x000056233c91f703 in do_handle_one_connection (connect=0x5623409ee160) at /data/src/10.4/sql/sql_connect.cc:1399

#16 0x000056233c91f474 in handle_one_connection (arg=0x5623409ee160) at /data/src/10.4/sql/sql_connect.cc:1302

#17 0x000056233ce15031 in pfs_spawn_thread (arg=0x562340a33fd0) at /data/src/10.4/storage/perfschema/pfs.cc:1862

#18 0x00007f1458a87494 in start_thread (arg=0x7f14500da700) at pthread_create.c:333

#19 0x00007f1456e6d93f in clone () from /lib/x86_64-linux-gnu/libc.so.6

==1049==ERROR: AddressSanitizer: SEGV on unknown address 0x01013fff8aea (pc 0x5578e153e48a sp 0x7f69e3426700 bp 0x7f69e34267c0 T27)

    #0 0x5578e153e489 in row_upd /data/src/10.4/storage/innobase/row/row0upd.cc:3266

    #1 0x5578e153f622 in row_upd_step(que_thr_t*) /data/src/10.4/storage/innobase/row/row0upd.cc:3437

    #2 0x5578e14a5f15 in row_update_for_mysql(row_prebuilt_t*) /data/src/10.4/storage/innobase/row/row0mysql.cc:1890

    #3 0x5578e11f6baf in ha_innobase::delete_row(unsigned char const*) /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9025

    #4 0x5578e0a22839 in handler::ha_delete_row(unsigned char const*) /data/src/10.4/sql/handler.cc:6810

    #5 0x5578e0e1c601 in TABLE::delete_row() /data/src/10.4/sql/sql_delete.cc:297

    #6 0x5578e0e14e7c in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /data/src/10.4/sql/sql_delete.cc:843

    #7 0x5578e0261f3a in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:5032

    #8 0x5578e0276f8a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:8204

    #9 0x5578e024ef07 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1829

    #10 0x5578e024bd58 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1358

    #11 0x5578e05df921 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1399

    #12 0x5578e05df31a in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1302

    #13 0x5578e11a6888 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862

    #14 0x7f69eee00493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

    #15 0x7f69ed1e693e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

AddressSanitizer can not provide additional info.

SUMMARY: AddressSanitizer: SEGV /data/src/10.4/storage/innobase/row/row0upd.cc:3266 row_upd

Thread T27 created by T0 here:

    #0 0x7f69ef039bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)

    #1 0x5578e11a6e50 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912

    #2 0x5578dff97476 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268

    #3 0x5578dffac6ed in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6141

    #4 0x5578dffacdf2 in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6211

    #5 0x5578dffad182 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6309

    #6 0x5578dffaddce in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6467

    #7 0x5578dffabf28 in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5799

    #8 0x5578dff952ff in main /data/src/10.4/sql/main.cc:25

    #9 0x7f69ed11e2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

==1049==ABORTING

#2  <signal handler called>

#3  row_upd_del_mark_clust_rec (mtr=0x7f07875cab80, foreign=<optimized out>, referenced=0, thr=0x7f07340cc730, offsets=0x7f07875ca860, index=0x7f07340843b0, node=0x7f07340cc3d8) at /data/src/10.4/storage/innobase/row/row0upd.cc:2981

#4  row_upd_clust_step (node=node@entry=0x7f07340cc3d8, thr=thr@entry=0x7f07340cc730) at /data/src/10.4/storage/innobase/row/row0upd.cc:3171

#5  0x00005612ccca464f in row_upd (thr=0x7f07340cc730, node=0x7f07340cc3d8) at /data/src/10.4/storage/innobase/row/row0upd.cc:3293

#6  row_upd_step (thr=thr@entry=0x7f07340cc730) at /data/src/10.4/storage/innobase/row/row0upd.cc:3437

#7  0x00005612ccc7e09c in row_update_for_mysql (prebuilt=0x7f07340cb890) at /data/src/10.4/storage/innobase/row/row0mysql.cc:1890

#8  0x00005612ccbc8b81 in ha_innobase::delete_row (this=0x7f0734083bf0, record=0x7f0734083808 "\377=\313\017Q\313\017'") at /data/src/10.4/storage/innobase/handler/ha_innodb.cc:9025

#9  0x00005612cc9b0806 in handler::ha_delete_row (this=0x7f0734083bf0, buf=0x7f0734083808 "\377=\313\017Q\313\017'") at /data/src/10.4/sql/handler.cc:6810

#10 0x00005612ccaca857 in mysql_delete (thd=thd@entry=0x7f07340009a8, table_list=0x7f0734011f98, conds=0x0, order_list=order_list@entry=0x7f0734005180, limit=18446744073709551608, options=<optimized out>, result=0x0) at /data/src/10.4/sql/sql_delete.cc:843

#11 0x00005612cc7a5639 in mysql_execute_command (thd=thd@entry=0x7f07340009a8) at /data/src/10.4/sql/sql_parse.cc:5032

#12 0x00005612cc7a9cd1 in mysql_parse (thd=thd@entry=0x7f07340009a8, rawbuf=<optimized out>, length=22, parser_state=parser_state@entry=0x7f07875ce1d0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/src/10.4/sql/sql_parse.cc:8204

#13 0x00005612cc7ac5a2 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f07340009a8, packet=packet@entry=0x7f0734009b59 "DELETE HISTORY FROM t1", packet_length=packet_length@entry=22, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/src/10.4/sql/sql_parse.cc:1829

#14 0x00005612cc7ad9f7 in do_command (thd=0x7f07340009a8) at /data/src/10.4/sql/sql_parse.cc:1358

#15 0x00005612cc887f9c in do_handle_one_connection (connect=connect@entry=0x5612d01e9ca8) at /data/src/10.4/sql/sql_connect.cc:1399

#16 0x00005612cc888104 in handle_one_connection (arg=arg@entry=0x5612d01e9ca8) at /data/src/10.4/sql/sql_connect.cc:1302

#17 0x00005612ccba47b4 in pfs_spawn_thread (arg=0x5612d021e0a8) at /data/src/10.4/storage/perfschema/pfs.cc:1862

#18 0x00007f0793f84494 in start_thread (arg=0x7f07875cf700) at pthread_create.c:333

#19 0x00007f079236a93f in clone () from /lib/x86_64-linux-gnu/libc.so.6