#4  0x000055b111c9fd5e in String::ptr (this=0x0) at /10.2/sql/sql_string.h:202

#5  0x000055b1121d0e72 in report_json_error_ex (js=0x0, je=0x7f32147abe90, fname=0x55b112914ec2 "json_merge_patch", n_param=0, lv=Sql_condition::WARN_LEVEL_WARN) at /10.2/sql/item_jsonfunc.cc:258

#6  0x000055b1121d8412 in Item_func_json_merge_patch::val_str (this=0x7f31d0012e20, str=0x7f32147ac0a0) at /10.2/sql/item_jsonfunc.cc:2469

#7  0x000055b111fa10f2 in Item_str_func::update_null_value (this=0x7f31d0012e20) at /10.2/sql/item_strfunc.h:74

#8  0x000055b111d311db in Item_func::is_null (this=0x7f31d0012e20) at /10.2/sql/item_func.h:180

#9  0x000055b1121915fe in mysql_do (thd=0x7f31d0000b00, values=...) at /10.2/sql/sql_do.cc:35

#10 0x000055b111d6c84e in mysql_execute_command (thd=0x7f31d0000b00) at /10.2/sql/sql_parse.cc:3561

#11 0x000055b111d79c09 in mysql_parse (thd=0x7f31d0000b00, rawbuf=0x7f31d00125b0 "do json_merge_patch((null ) ,concat_ws('','$',''),'[]' ,from_unixtime(1537014395))", length=82, parser_state=0x7f32147ad080, is_com_multi=false, is_next_command=false) at /10.2/sql/sql_parse.cc:7759

#12 0x000055b111d67ecc in dispatch_command (command=COM_QUERY, thd=0x7f31d0000b00, packet=0x7f31d00961e1 "do json_merge_patch((null ) ,concat_ws('','$',''),'[]' ,from_unixtime(1537014395))", packet_length=82, is_com_multi=false, is_next_command=false) at /10.2/sql/sql_parse.cc:1831

#13 0x000055b111d667e0 in do_command (thd=0x7f31d0000b00) at /10.2/sql/sql_parse.cc:1385

#14 0x000055b111ebc749 in do_handle_one_connection (connect=0x55b11567cd50) at /10.2/sql/sql_connect.cc:1336

#15 0x000055b111ebc4b4 in handle_one_connection (arg=0x55b11567cd50) at /10.2/sql/sql_connect.cc:1241

#16 0x000055b1126e9196 in pfs_spawn_thread (arg=0x55b115687b40) at /10.2/storage/perfschema/pfs.cc:1862

#17 0x00007f3224db46ba in start_thread (arg=0x7f32147ae700) at pthread_create.c:333

#18 0x00007f322424941d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

select json_merge_patch(null,';. .*c *');

ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000063905d bp 0x7fb33f1ef910 sp 0x7fb33f1ef900 T5)

    #0 0x63905c in String::ptr() const /10.2/sql/sql_string.h:202

    #1 0x127690c in report_json_error_ex(String*, st_json_engine_t*, char const*, int, Sql_condition::enum_warning_level) /10.2/sql/item_jsonfunc.cc:258

    #2 0x1287840 in Item_func_json_merge_patch::val_str(String*) /10.2/sql/item_jsonfunc.cc:2469

    #3 0xe4f989 in Item::send(Protocol*, String*) /10.2/sql/item.cc:6918

    #4 0x63ebd3 in Protocol::send_result_set_row(List<Item>*) /10.2/sql/protocol.cc:990

    #5 0x75de98 in select_send::send_data(List<Item>&) /10.2/sql/sql_class.cc:2725

    #6 0x8b68fe in JOIN::exec_inner() /10.2/sql/sql_select.cc:3505

    #7 0x8b581d in JOIN::exec() /10.2/sql/sql_select.cc:3424

    #8 0x8b8c32 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.2/sql/sql_select.cc:3824

    #9 0x897d8f in handle_select(THD*, LEX*, select_result*, unsigned long) /10.2/sql/sql_select.cc:373

    #10 0x81c264 in execute_sqlcom_select /10.2/sql/sql_parse.cc:6225

    #11 0x80aa77 in mysql_execute_command(THD*) /10.2/sql/sql_parse.cc:3532

    #12 0x824d1a in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.2/sql/sql_parse.cc:7740

    #13 0x801381 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.2/sql/sql_parse.cc:1831

    #14 0x7fe477 in do_command(THD*) /10.2/sql/sql_parse.cc:1385

    #15 0xb3809c in do_handle_one_connection(CONNECT*) /10.2/sql/sql_connect.cc:1336

    #16 0xb37a80 in handle_one_connection /10.2/sql/sql_connect.cc:1241

    #17 0x1d27d11 in pfs_spawn_thread /10.2/storage/perfschema/pfs.cc:1862

    #18 0x7fb34a8026b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

    #19 0x7fb349c9741c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

SELECT JSON_MERGE_PATCH(NULL,'a');

Core was generated by `/test/MD060620-mariadb-10.5.4-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

[Current thread is 1 (Thread 0x1519b4cba700 (LWP 211719))]

(gdb) bt

(gdb) (gdb) #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

#1  0x000055f53c1af927 in my_write_core (sig=sig@entry=11) at /test/10.5_opt/mysys/stacktrace.c:518

#2  0x000055f53bb7b33a in handle_fatal_signal (sig=11) at /test/10.5_opt/sql/signal_handler.cc:330

#3  <signal handler called>

#4  0x000055f53bcf35d2 in report_json_error_ex (js=js@entry=0x0, je=je@entry=0x1519b4cb8220, fname=0x55f53c46acfa "json_merge_patch", n_param=n_param@entry=0, lv=lv@entry=Sql_state_errno_level::WARN_LEVEL_WARN) at /test/10.5_opt/sql/item_jsonfunc.cc:258

#5  0x000055f53bcf4f08 in Item_func_json_merge_patch::val_str (this=0x151991047838, str=<optimized out>) at /test/10.5_opt/sql/item_jsonfunc.cc:2504

#6  0x000055f53bae039c in Type_handler::Item_send_str (this=<optimized out>, item=<optimized out>, protocol=0x151991012558, buf=<optimized out>) at /test/10.5_opt/sql/sql_type.cc:7137

#7  0x000055f53b8cc618 in Protocol::send_result_set_row (this=this@entry=0x151991012558, row_items=row_items@entry=0x151991047388) at /test/10.5_opt/sql/protocol.cc:1082

#8  0x000055f53b939862 in select_send::send_data (this=0x151991048258, items=@0x151991047388: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151991047968, last = 0x151991047968, elements = 1}, <No data fields>}) at /test/10.5_opt/sql/sql_class.cc:3002

#9  0x000055f53b9e2792 in select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/10.5_opt/sql/sql_class.h:5284

#10 JOIN::exec_inner (this=this@entry=0x151991048280) at /test/10.5_opt/sql/sql_select.cc:4343

#11 0x000055f53b9e2927 in JOIN::exec (this=this@entry=0x151991048280) at /test/10.5_opt/sql/sql_select.cc:4256

#12 0x000055f53b9e0c72 in mysql_select (thd=thd@entry=0x151991012018, tables=0x0, fields=@0x151991047388: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x151991047968, last = 0x151991047968, elements = 1}, <No data fields>}, conds=0x0, og_num=<optimized out>, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x151991048258, unit=0x151991015e70, select_lex=0x151991047238) at /test/10.5_opt/sql/sql_select.cc:4680

#13 0x000055f53b9e1631 in handle_select (thd=thd@entry=0x151991012018, lex=lex@entry=0x151991015da8, result=result@entry=0x151991048258, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.5_opt/sql/sql_select.cc:417

#14 0x000055f53b988081 in execute_sqlcom_select (thd=thd@entry=0x151991012018, all_tables=0x0) at /test/10.5_opt/sql/sql_parse.cc:6208

#15 0x000055f53b9847b1 in mysql_execute_command (thd=thd@entry=0x151991012018) at /test/10.5_opt/sql/sql_parse.cc:3939

#16 0x000055f53b98b19c in mysql_parse (thd=0x151991012018, rawbuf=<optimized out>, length=33, parser_state=0x1519b4cb9430, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:7992

#17 0x000055f53b980485 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x151991012018, packet=packet@entry=0x15199103a019 "", packet_length=packet_length@entry=33, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_opt/sql/sql_parse.cc:1874

#18 0x000055f53b97e874 in do_command (thd=0x151991012018) at /test/10.5_opt/sql/sql_parse.cc:1355

#19 0x000055f53ba73e51 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1519b1833958, put_in_cache=put_in_cache@entry=true) at /test/10.5_opt/sql/sql_connect.cc:1411

#20 0x000055f53ba741b4 in handle_one_connection (arg=arg@entry=0x1519b1833958) at /test/10.5_opt/sql/sql_connect.cc:1313

#21 0x000055f53bde18ca in pfs_spawn_thread (arg=0x1519b184e818) at /test/10.5_opt/storage/perfschema/pfs.cc:2201

#22 0x00001519b3c336db in start_thread (arg=0x1519b4cba700) at pthread_create.c:463

#23 0x00001519b303188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

SET NAMES swe7;

SELECT JSON_MERGE_PATCH(NULL,'a');

Core was generated by `/test/MD060620-mariadb-10.5.4-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

[Current thread is 1 (Thread 0x1554ae12e700 (LWP 250100))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

#1  0x00005608bf8aa927 in my_write_core (sig=sig@entry=11) at /test/10.5_opt/mysys/stacktrace.c:518

#2  0x00005608bf27633a in handle_fatal_signal (sig=11) at /test/10.5_opt/sql/signal_handler.cc:330

#3  <signal handler called>

#4  0x00005608bf3ee5d2 in report_json_error_ex (js=js@entry=0x0, je=je@entry=0x1554ae12c220, fname=0x5608bfb65cfa "json_merge_patch", n_param=n_param@entry=0, lv=lv@entry=Sql_state_errno_level::WARN_LEVEL_WARN) at /test/10.5_opt/sql/item_jsonfunc.cc:258

#5  0x00005608bf3eff08 in Item_func_json_merge_patch::val_str (this=0x1554890476e8, str=<optimized out>) at /test/10.5_opt/sql/item_jsonfunc.cc:2504

#6  0x00005608bf1db39c in Type_handler::Item_send_str (this=<optimized out>, item=<optimized out>, protocol=0x155489012558, buf=<optimized out>) at /test/10.5_opt/sql/sql_type.cc:7137

#7  0x00005608befc7618 in Protocol::send_result_set_row (this=this@entry=0x155489012558, row_items=row_items@entry=0x155489047228) at /test/10.5_opt/sql/protocol.cc:1082

#8  0x00005608bf034862 in select_send::send_data (this=0x155489048138, items=@0x155489047228: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x155489047818, last = 0x155489047818, elements = 1}, <No data fields>}) at /test/10.5_opt/sql/sql_class.cc:3002

#9  0x00005608bf0dd792 in select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/10.5_opt/sql/sql_class.h:5284

#10 JOIN::exec_inner (this=this@entry=0x155489048160) at /test/10.5_opt/sql/sql_select.cc:4343

#11 0x00005608bf0dd927 in JOIN::exec (this=this@entry=0x155489048160) at /test/10.5_opt/sql/sql_select.cc:4256

#12 0x00005608bf0dbc72 in mysql_select (thd=thd@entry=0x155489012018, tables=0x0, fields=@0x155489047228: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x155489047818, last = 0x155489047818, elements = 1}, <No data fields>}, conds=0x0, og_num=<optimized out>, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x155489048138, unit=0x155489015e70, select_lex=0x1554890470d8) at /test/10.5_opt/sql/sql_select.cc:4680

#13 0x00005608bf0dc631 in handle_select (thd=thd@entry=0x155489012018, lex=lex@entry=0x155489015da8, result=result@entry=0x155489048138, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.5_opt/sql/sql_select.cc:417

#14 0x00005608bf083081 in execute_sqlcom_select (thd=thd@entry=0x155489012018, all_tables=0x0) at /test/10.5_opt/sql/sql_parse.cc:6208

#15 0x00005608bf07f7b1 in mysql_execute_command (thd=thd@entry=0x155489012018) at /test/10.5_opt/sql/sql_parse.cc:3939

#16 0x00005608bf08619c in mysql_parse (thd=0x155489012018, rawbuf=<optimized out>, length=33, parser_state=0x1554ae12d430, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:7992

#17 0x00005608bf07b485 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x155489012018, packet=packet@entry=0x15548903a019 "", packet_length=packet_length@entry=33, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_opt/sql/sql_parse.cc:1874

#18 0x00005608bf079874 in do_command (thd=0x155489012018) at /test/10.5_opt/sql/sql_parse.cc:1355

#19 0x00005608bf16ee51 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1554ab033958, put_in_cache=put_in_cache@entry=true) at /test/10.5_opt/sql/sql_connect.cc:1411

#20 0x00005608bf16f1b4 in handle_one_connection (arg=arg@entry=0x1554ab033958) at /test/10.5_opt/sql/sql_connect.cc:1313

#21 0x00005608bf4dc8ca in pfs_spawn_thread (arg=0x1554ab04e818) at /test/10.5_opt/storage/perfschema/pfs.cc:2201

#22 0x00001554ad0a76db in start_thread (arg=0x1554ae12e700) at pthread_create.c:463

#23 0x00001554ac4a588f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

SET NAMES swe7;

SELECT t2.id, t3.id, t4.id, t5.x FROM t1 , t3, t4, t1 WHERE (t2.id >= 1) AND (t2.id < t5.x) OR (t3.id <= 4) AND (t3.id < t5.id) OR (t4.x < 6) AND (t4.x < t5.x) OR (t5.id IN (5001, 5002, 5005, 5008, 5010, 5050, 6000)) FOR UPDATE NOWAIT;

SELECT JSON_MERGE_PATCH(NULL, 'abcdefghijklmnopqrstuvwxyz');

SET @@character_set_client=swe7;

SELECT json_merge_patch(NULL, 'a');

Core was generated by `/test/MD211020-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

[Current thread is 1 (Thread 0x14a974071700 (LWP 397758))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x0000559108068021 in my_write_core (sig=sig@entry=11) at /test/10.6_dbg/mysys/stacktrace.c:424

#2  0x00005591077af321 in handle_fatal_signal (sig=11) at /test/10.6_dbg/sql/signal_handler.cc:330

#3  <signal handler called>

#4  0x00005591079e7cd8 in report_json_error_ex (js=js@entry=0x0, je=je@entry=0x14a97406f040, fname=0x559108391e1a "json_merge_patch", n_param=n_param@entry=0, lv=lv@entry=Sql_state_errno_level::WARN_LEVEL_WARN) at /test/10.6_dbg/sql/sql_string.h:223

#5  0x00005591079e95ea in Item_func_json_merge_patch::val_str (this=0x14a914012d38, str=<optimized out>) at /test/10.6_dbg/sql/item_jsonfunc.cc:2539

#6  0x00005591076e2854 in Type_handler::Item_send_str (this=<optimized out>, item=0x14a914012d38, protocol=0x14a914001380, buf=<optimized out>) at /test/10.6_dbg/sql/sql_type.cc:7343

#7  0x000055910762c41f in Type_handler_string_result::Item_send (this=<optimized out>, item=<optimized out>, protocol=<optimized out>, buf=<optimized out>) at /test/10.6_dbg/sql/sql_type.h:5336

#8  0x00005591073e531a in Item::send (this=0x14a914012d38, protocol=0x14a914001380, buffer=0x14a97406f310) at /test/10.6_dbg/sql/item.h:1060

#9  0x00005591073e281c in Protocol::send_result_set_row (this=this@entry=0x14a914001380, row_items=row_items@entry=0x14a914012870) at /test/10.6_dbg/sql/protocol.cc:1080

#10 0x000055910747befd in select_send::send_data (this=0x14a914013788, items=@0x14a914012870: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14a914012e68, last = 0x14a914012e68, elements = 1}, <No data fields>}) at /test/10.6_dbg/sql/sql_class.cc:3024

#11 0x000055910756d84c in select_result_sink::send_data_with_check (sent=0, u=<optimized out>, items=<optimized out>, this=<optimized out>) at /test/10.6_dbg/sql/sql_class.h:5309

#12 JOIN::exec_inner (this=this@entry=0x14a9140137b0) at /test/10.6_dbg/sql/sql_select.cc:4333

#13 0x000055910756e733 in JOIN::exec (this=this@entry=0x14a9140137b0) at /test/10.6_dbg/sql/sql_select.cc:4246

#14 0x000055910756c944 in mysql_select (thd=thd@entry=0x14a914000db8, tables=0x0, fields=@0x14a914012870: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14a914012e68, last = 0x14a914012e68, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x14a914013788, unit=0x14a914004f40, select_lex=0x14a914012720) at /test/10.6_dbg/sql/sql_select.cc:4673

#15 0x000055910756cc72 in handle_select (thd=thd@entry=0x14a914000db8, lex=lex@entry=0x14a914004e78, result=result@entry=0x14a914013788, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_dbg/sql/sql_select.cc:417

#16 0x00005591074e038e in execute_sqlcom_select (thd=thd@entry=0x14a914000db8, all_tables=0x0) at /test/10.6_dbg/sql/sql_parse.cc:6062

#17 0x00005591074ecaea in mysql_execute_command (thd=thd@entry=0x14a914000db8) at /test/10.6_dbg/sql/sql_parse.cc:3784

#18 0x00005591074d8fd2 in mysql_parse (thd=thd@entry=0x14a914000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14a9740703d0) at /test/10.6_dbg/sql/sql_parse.cc:7833

#19 0x00005591074e70c7 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14a914000db8, packet=packet@entry=0x14a914008ce9 "", packet_length=packet_length@entry=34) at /test/10.6_dbg/sql/sql_class.h:1253

#20 0x00005591074ea3d2 in do_command (thd=0x14a914000db8) at /test/10.6_dbg/sql/sql_parse.cc:1343

#21 0x0000559107644994 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55910ac20808, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410

#22 0x000055910764509b in handle_one_connection (arg=arg@entry=0x55910ac20808) at /test/10.6_dbg/sql/sql_connect.cc:1312

#23 0x0000559107af8abb in pfs_spawn_thread (arg=0x55910ab48418) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201

#24 0x000014a977141609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#25 0x000014a976d30293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95