SIGSEGV in sortlength (optimized builds)

USE test;

SET SQL_MODE='';

SET optimizer_switch='subquery_cache=off';

CREATE TABLE t1 (a INT,b INT);

INSERT INTO t1 VALUES (0,0),(0,0);

SELECT (SELECT DISTINCT 1 FROM t1 t1i GROUP BY t1i.a ORDER BY MAX(t1o.b)) FROM t1 AS t1o;

CREATE PROCEDURE p1(min INT,max INT) BEGIN DECLARE DONE INT DEFAULT FALSE;

Core was generated by `/test/MD060620-mariadb-10.5.4-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

[Current thread is 1 (Thread 0x149441c34700 (LWP 1577152))]

(gdb) bt

(gdb) (gdb) #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

#1  0x0000564e46369927 in my_write_core (sig=sig@entry=11) at /test/10.5_opt/mysys/stacktrace.c:518

#2  0x0000564e45d3533a in handle_fatal_signal (sig=11) at /test/10.5_opt/sql/signal_handler.cc:330

#3  <signal handler called>

#4  0x0000564e45d329a4 in sortlength (allow_packing_for_sortkeys=<synthetic pointer>, sort_keys=0x14941e0d3568, thd=0x14941e012018) at /test/10.5_opt/sql/filesort.cc:2232

#5  filesort (thd=thd@entry=0x14941e012018, table=table@entry=0x14941e16a030, filesort=filesort@entry=0x14941e04cfc8, tracker=0x14941e0d2838, join=join@entry=0x14941e04a820, first_table_bit=<optimized out>) at /test/10.5_opt/sql/filesort.cc:250

#6  0x0000564e45b88cb5 in create_sort_index (thd=0x14941e012018, join=0x14941e04a820, tab=tab@entry=0x14941e0d1e48, fsort=0x14941e04cfc8, fsort@entry=0x0) at /test/10.5_opt/sql/sql_select.cc:23884

#7  0x0000564e45b88f6e in st_join_table::sort_table (this=this@entry=0x14941e0d1e48) at /test/10.5_opt/sql/sql_select.cc:21613

#8  0x0000564e45b88ffa in join_init_read_record (tab=0x14941e0d1e48) at /test/10.5_opt/sql/sql_select.cc:21552

#9  0x0000564e45b94bc3 in AGGR_OP::end_send (this=0x14941e04cf88) at /test/10.5_opt/sql/sql_select.cc:28906

#10 0x0000564e45b94d8e in sub_select_postjoin_aggr (join=0x14941e04a820, join_tab=0x14941e0d1e48, end_of_records=<optimized out>) at /test/10.5_opt/sql/sql_select.cc:20339

#11 0x0000564e45b9c51d in do_select (procedure=<optimized out>, join=0x14941e04a820) at /test/10.5_opt/sql/sql_select.cc:20165

#12 JOIN::exec_inner (this=this@entry=0x14941e04a820) at /test/10.5_opt/sql/sql_select.cc:4475

#13 0x0000564e45b9c927 in JOIN::exec (this=0x14941e04a820) at /test/10.5_opt/sql/sql_select.cc:4256

#14 0x0000564e45de1cc5 in subselect_single_select_engine::exec (this=0x14941e0490c8) at /test/10.5_opt/sql/item_subselect.cc:3939

#15 0x0000564e45de14bd in Item_subselect::exec (this=0x14941e048f20) at /test/10.5_opt/sql/item_subselect.cc:748

#16 0x0000564e45de0fbe in Item_singlerow_subselect::val_int (this=0x14941e048f20) at /test/10.5_opt/sql/item_subselect.cc:1341

#17 0x0000564e45c9a499 in Type_handler::Item_send_long (this=<optimized out>, item=0x14941e048f20, protocol=0x14941e012558, buf=<optimized out>) at /test/10.5_opt/sql/sql_type.cc:7170

#18 0x0000564e45a86618 in Protocol::send_result_set_row (this=this@entry=0x14941e012558, row_items=row_items@entry=0x14941e04a578) at /test/10.5_opt/sql/protocol.cc:1082

#19 0x0000564e45af3862 in select_send::send_data (this=0x14941e04a198, items=@0x14941e04a578: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14941e0d2ea0, last = 0x14941e0d2ea0, elements = 1}, <No data fields>}) at /test/10.5_opt/sql/sql_class.cc:3002

#20 0x0000564e45b8f8ee in select_result_sink::send_data_with_check (sent=<optimized out>, u=<optimized out>, items=@0x14941e04a578: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14941e0d2ea0, last = 0x14941e0d2ea0, elements = 1}, <No data fields>}, this=<optimized out>) at /test/10.5_opt/sql/sql_class.h:5284

#21 end_send_group (join=0x14941e04a1c0, join_tab=<optimized out>, end_of_records=<optimized out>) at /test/10.5_opt/sql/sql_select.cc:21971

#22 0x0000564e45b9c51d in do_select (procedure=<optimized out>, join=0x14941e04a1c0) at /test/10.5_opt/sql/sql_select.cc:20165

#23 JOIN::exec_inner (this=this@entry=0x14941e04a1c0) at /test/10.5_opt/sql/sql_select.cc:4475

#24 0x0000564e45b9c927 in JOIN::exec (this=this@entry=0x14941e04a1c0) at /test/10.5_opt/sql/sql_select.cc:4256

#25 0x0000564e45b9ac72 in mysql_select (thd=thd@entry=0x14941e012018, tables=0x14941e0491a8, fields=@0x14941e047298: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14941e049108, last = 0x14941e049108, elements = 1}, <No data fields>}, conds=0x0, og_num=<optimized out>, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x14941e04a198, unit=0x14941e015e70, select_lex=0x14941e047148) at /test/10.5_opt/sql/sql_select.cc:4680

#26 0x0000564e45b9b631 in handle_select (thd=thd@entry=0x14941e012018, lex=lex@entry=0x14941e015da8, result=result@entry=0x14941e04a198, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.5_opt/sql/sql_select.cc:417

#27 0x0000564e45b42081 in execute_sqlcom_select (thd=thd@entry=0x14941e012018, all_tables=0x14941e0491a8) at /test/10.5_opt/sql/sql_parse.cc:6208

#28 0x0000564e45b3e7b1 in mysql_execute_command (thd=thd@entry=0x14941e012018) at /test/10.5_opt/sql/sql_parse.cc:3939

#29 0x0000564e45b4519c in mysql_parse (thd=0x14941e012018, rawbuf=<optimized out>, length=88, parser_state=0x149441c33430, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:7992

#30 0x0000564e45b3a485 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14941e012018, packet=packet@entry=0x14941e03a019 "", packet_length=packet_length@entry=88, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_opt/sql/sql_parse.cc:1874

#31 0x0000564e45b38874 in do_command (thd=0x14941e012018) at /test/10.5_opt/sql/sql_parse.cc:1355

#32 0x0000564e45c2de51 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x14943e833958, put_in_cache=put_in_cache@entry=true) at /test/10.5_opt/sql/sql_connect.cc:1411

#33 0x0000564e45c2e1b4 in handle_one_connection (arg=arg@entry=0x14943e833958) at /test/10.5_opt/sql/sql_connect.cc:1313

#34 0x0000564e45f9b8ca in pfs_spawn_thread (arg=0x14943e84e818) at /test/10.5_opt/storage/perfschema/pfs.cc:2201

#35 0x0000149440bad6db in start_thread (arg=0x149441c34700) at pthread_create.c:463

#36 0x000014943ffab88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95