mysqld crash when running REPLACE update

We found this in production - but I've managed to narrow this down to:

• innodb
• table with 296 columns or more
• table has primary key with auto_increment
• table has a second index
• mariadb 10.4.13 and 10.3.23

Its easy to reproduce -

mysql -u ... -p... dbname < createtable
mysql -u ... -p... dbname < populatetable
mysql -u ... -p... dbname < populatetable (this one will crash).

The log at crash gives...

Thread pointer: 0x7f820c000a88
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f826832be70 thread_stack 0x49000
/usr/local/mysql/bin/mysqld(my_print_stacktrace+0x2e)[0x55ab034c7e2e]
mysys/stacktrace.c:270(my_print_stacktrace)[0x55ab02ed8b3f]
sigaction.c:0(__restore_rt)[0x7f826ee12630]
:0(__memmove_ssse3_back)[0x7f826dd42a46]
/usr/local/mysql/bin/mysqld(+0xb70ffc)[0x55ab0311fffc]
rem/rem0rec.cc:1685(rec_convert_dtuple_to_rec_comp<false>)[0x55ab031a8919]
trx/trx0rec.cc:2490(trx_undo_prev_version_build(unsigned char const*, mtr_t*, unsigned char const*, dict_index_t*, unsigned short*, mem_block_info_t*, unsigned char*, mem_block_info_t, dtuple_t**, unsigned long))[0x55ab031789b7]
row/row0vers.cc:196(row_vers_impl_x_locked_low)[0x55ab030c9350]
lock/lock0lock.cc:1233(lock_sec_rec_some_has_impl)[0x55ab030cdbdc]
lock/lock0lock.cc:5757(lock_sec_rec_read_check_and_lock(unsigned long, buf_block_t const*, unsigned char const*, dict_index_t*, unsigned short const*, lock_mode, unsigned long, que_thr_t*))[0x55ab03139989]
row/row0ins.cc:2160(row_ins_scan_sec_index_for_duplicate)[0x55ab0313a833]
row/row0ins.cc:3285(row_ins_sec_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, bool))[0x55ab0313ad03]
row/row0ins.cc:3329(row_ins_index_entry)[0x55ab0314b17d]
row/row0mysql.cc:1467(row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t))[0x55ab0308a685]
handler/ha_innodb.cc:8039(ha_innobase::write_row(unsigned char const*))[0x55ab02ee40bf]
sql/handler.cc:6706(handler::ha_write_row(unsigned char const*))[0x55ab02c9be40]
sql/sql_insert.cc:1732(write_record(THD*, TABLE*, st_copy_info*))[0x55ab02ca263b]
sql/sql_insert.cc:1078(mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool))[0x55ab02cd1677]
sql/sql_parse.cc:4530(mysql_execute_command(THD*))[0x55ab02cd6f7c]
sql/sql_audit.h:169(mysql_audit_general)[0x55ab02cd94ee]
sql/sql_parse.cc:1360(do_command(THD*))[0x55ab02cdad79]
sql/sql_connect.cc:1412(do_handle_one_connection(CONNECT*))[0x55ab02db9c8a]
sql/sql_connect.cc:1318(handle_one_connection)[0x55ab02db9d6d]
pthread_create.c:0(start_thread)[0x7f826ee0aea5]
/lib64/libc.so.6(clone+0x6d)[0x7f826dce58dd]