SIGSEGV in replace_user_table when changing mysql db tables, errno: 168 "Unknown (generic) error from engine", UBSAN: runtime error: member access within null pointer of type 'struct KEY' in replace_user_table

SET SQL_MODE='';

RENAME TABLE mysql.user TO mysql.user_old;

CREATE TABLE mysql.user (host CHAR(100), user CHAR(100)) ENGINE=MERGE;

DROP TABLE mysql.global_priv;

ALTER USER 'a' IDENTIFIED BY '';

Core was generated by `/test/MD080920-mariadb-10.5.6-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

[Current thread is 1 (Thread 0x14cafc97d700 (LWP 1840483))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

#1  0x000056163fd75c37 in my_write_core (sig=sig@entry=11) at /test/10.5_opt/mysys/stacktrace.c:424

#2  0x000056163f74512a in handle_fatal_signal (sig=11) at /test/10.5_opt/sql/signal_handler.cc:330

#3  <signal handler called>

#4  0x000056163f4c733d in replace_user_table (thd=thd@entry=0x14cad8412018, user_table=@0x14cafc97bda8: {<Grant_table_base> = {min_columns = 13, start_priv_columns = 0, end_priv_columns = 2, m_table = 0x14cadc00c018}, _vptr.User_table = 0x5616406fa1b8 <vtable for User_table_tabular+16>}, combo=0x14cad84470d8, rights=rights@entry=NO_ACL, revoke_grant=revoke_grant@entry=false, can_create_user=can_create_user@entry=false, no_auto_create=true) at /test/10.5_opt/sql/sql_acl.cc:4511

#5  0x000056163f4d68e6 in mysql_alter_user (thd=thd@entry=0x14cad8412018, users_list=<optimized out>) at /test/10.5_opt/sql/sql_acl.cc:11076

#6  0x000056163f54d0e1 in mysql_execute_command (thd=thd@entry=0x14cad8412018) at /test/10.5_opt/sql/sql_parse.cc:5320

#7  0x000056163f551acc in mysql_parse (thd=0x14cad8412018, rawbuf=<optimized out>, length=31, parser_state=0x14cafc97c430, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:7994

#8  0x000056163f546d85 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14cad8412018, packet=packet@entry=0x14cad843a019 "ALTER USER 'a' IDENTIFIED BY ''", packet_length=packet_length@entry=31, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_opt/sql/sql_parse.cc:1867

#9  0x000056163f5450a4 in do_command (thd=0x14cad8412018) at /test/10.5_opt/sql/sql_parse.cc:1348

#10 0x000056163f63bcf1 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x14caf98338f8, put_in_cache=put_in_cache@entry=true) at /test/10.5_opt/sql/sql_connect.cc:1410

#11 0x000056163f63c064 in handle_one_connection (arg=arg@entry=0x14caf98338f8) at /test/10.5_opt/sql/sql_connect.cc:1312

#12 0x000056163f9afbaa in pfs_spawn_thread (arg=0x14caf984f018) at /test/10.5_opt/storage/perfschema/pfs.cc:2201

#13 0x000014cafb8f66db in start_thread (arg=0x14cafc97d700) at pthread_create.c:463

#14 0x000014cafacf4a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95