ASAN unknown-crash in hp_rec_hashnr after replace into partition +invisible columns and runtime error: load of value 25264, which is not a valid value for type 'geometry_type' in make_empty_rec

--source include/have_partition.inc

CREATE  TABLE  t1 (i1 int, i2 int NOT NULL, KEY (i2)) ENGINE = MEMORY;

SET  debug_dbug="+d,test_completely_invisible";

ALTER  TABLE t1 PARTITION BY RANGE (i1) (PARTITION p0 VALUES LESS THAN (100), PARTITION p1 VALUES LESS THAN MAXVALUE);

SET  debug_dbug="";

ALTER  TABLE t1 DROP PARTITION p1;

REPLACE  INTO t1  PARTITION (p0)  (i1, i2) VALUES (8, 8), (2, 8);

Version: '10.3.26-MariaDB-debug-log'  socket: '/git/10.3/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution

=================================================================

==2649==ERROR: AddressSanitizer: unknown-crash on address 0x61900008f841 at pc 0x55dad3adb3ab bp 0x7f64529d59c0 sp 0x7f64529d59b8

READ of size 1 at 0x61900008f841 thread T5

    #0 0x55dad3adb3aa in hp_rec_hashnr /git/10.3/storage/heap/hp_hash.c:341

    #1 0x55dad3aeaf29 in hp_write_key /git/10.3/storage/heap/hp_write.c:349

    #2 0x55dad3ae90a1 in heap_write /git/10.3/storage/heap/hp_write.c:52

    #3 0x55dad3ad093c in ha_heap::write_row(unsigned char*) /git/10.3/storage/heap/ha_heap.cc:235

    #4 0x55dad358c2a9 in handler::ha_write_row(unsigned char*) /git/10.3/sql/handler.cc:6467

    #5 0x55dad4952598 in ha_partition::write_row(unsigned char*) /git/10.3/sql/ha_partition.cc:4343

    #6 0x55dad358c173 in handler::ha_write_row(unsigned char*) /git/10.3/sql/handler.cc:6467

    #7 0x55dad2d158e6 in write_record(THD*, TABLE*, st_copy_info*) /git/10.3/sql/sql_insert.cc:1712

    #8 0x55dad2d10468 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /git/10.3/sql/sql_insert.cc:1072

    #9 0x55dad2dbc149 in mysql_execute_command(THD*) /git/10.3/sql/sql_parse.cc:4450

    #10 0x55dad2dd4b44 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.3/sql/sql_parse.cc:7811

    #11 0x55dad2dab472 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.3/sql/sql_parse.cc:1851

    #12 0x55dad2da7bad in do_command(THD*) /git/10.3/sql/sql_parse.cc:1397

    #13 0x55dad31971d6 in do_handle_one_connection(CONNECT*) /git/10.3/sql/sql_connect.cc:1403

    #14 0x55dad3196a8e in handle_one_connection /git/10.3/sql/sql_connect.cc:1308

    #15 0x55dad48f8e18 in pfs_spawn_thread /git/10.3/storage/perfschema/pfs.cc:1869

    #16 0x7f645d2cdfa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486

    #17 0x7f645cc514ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce)

0x61900008f841 is located 193 bytes inside of 1100-byte region [0x61900008f780,0x61900008fbcc)

allocated by thread T5 here:

    #0 0x7f645d3d0330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330)

    #1 0x55dad4b0d5cb in sf_malloc /git/10.3/mysys/safemalloc.c:118

    #2 0x55dad4adcb05 in my_malloc /git/10.3/mysys/my_malloc.c:101

    #3 0x55dad4ab986a in alloc_root /git/10.3/mysys/my_alloc.c:251

    #4 0x55dad4abaf8a in strmake_root /git/10.3/mysys/my_alloc.c:481

    #5 0x55dad30c15c3 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /git/10.3/sql/table.cc:3230

    #6 0x55dad2c36faf in open_table(THD*, TABLE_LIST*, Open_table_context*) /git/10.3/sql/sql_base.cc:1992

    #7 0x55dad2c403e3 in open_and_process_table /git/10.3/sql/sql_base.cc:3730

    #8 0x55dad2c42cb1 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /git/10.3/sql/sql_base.cc:4199

    #9 0x55dad2c48766 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /git/10.3/sql/sql_base.cc:5096

    #10 0x55dad2ba23f4 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /git/10.3/sql/sql_base.h:503

    #11 0x55dad2d0db20 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /git/10.3/sql/sql_insert.cc:760

    #12 0x55dad2dbc149 in mysql_execute_command(THD*) /git/10.3/sql/sql_parse.cc:4450

    #13 0x55dad2dd4b44 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.3/sql/sql_parse.cc:7811

    #14 0x55dad2dab472 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.3/sql/sql_parse.cc:1851

    #15 0x55dad2da7bad in do_command(THD*) /git/10.3/sql/sql_parse.cc:1397

    #16 0x55dad31971d6 in do_handle_one_connection(CONNECT*) /git/10.3/sql/sql_connect.cc:1403

    #17 0x55dad3196a8e in handle_one_connection /git/10.3/sql/sql_connect.cc:1308

    #18 0x55dad48f8e18 in pfs_spawn_thread /git/10.3/storage/perfschema/pfs.cc:1869

    #19 0x7f645d2cdfa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486

Thread T5 created by T0 here:

    #0 0x7f645d337db0 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x50db0)

    #1 0x55dad48f9254 in spawn_thread_v1 /git/10.3/storage/perfschema/pfs.cc:1919

    #2 0x55dad2abb6f4 in inline_mysql_thread_create /git/10.3/include/mysql/psi/mysql_thread.h:1275

    #3 0x55dad2ad4ba8 in create_thread_to_handle_connection(CONNECT*) /git/10.3/sql/mysqld.cc:6609

    #4 0x55dad2ad52fd in create_new_thread /git/10.3/sql/mysqld.cc:6679

    #5 0x55dad2ad647e in handle_connections_sockets() /git/10.3/sql/mysqld.cc:6937

    #6 0x55dad2ad3f1c in mysqld_main(int, char**) /git/10.3/sql/mysqld.cc:6231

    #7 0x55dad2ab9df4 in main /git/10.3/sql/main.cc:25

    #8 0x7f645cb7c09a in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: unknown-crash /git/10.3/storage/heap/hp_hash.c:341 in hp_rec_hashnr

Shadow bytes around the buggy address:

  0x0c3280009eb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c3280009ec0: 00 00 00 f7 00 03 f7 04 f7 f7 f7 f7 f7 f7 f7 f7

  0x0c3280009ed0: f7 f7 f7 f7 f7 f7 f7 f7 f7 04 fa fa fa fa fa fa

  0x0c3280009ee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c3280009ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0c3280009f00: 00 f7 03 f7 00 00 f7 00[01]00 01 f7 00 00 00 f7

  0x0c3280009f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c3280009f20: 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00

  0x0c3280009f30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0c3280009f40: 00 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00

  0x0c3280009f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==2649==ABORTING

----------SERVER LOG END-------------