Server crashes in _ma_rec_pack / _ma_write_blob_record with DEFAULT() on BLOB

CREATE TABLE t1 (id INT, f MEDIUMTEXT NOT NULL DEFAULT '');

INSERT INTO t1 VALUES (1,'foo'),(2,'bar');

SELECT f FROM t1 GROUP BY id ORDER BY DEFAULT(f);

# Cleanup

DROP TABLE t1;

#3  <signal handler called>

#4  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383

#5  0x00005609089bade2 in _ma_rec_pack (info=0x7f4b50098af0, to=0x7f4b501951de '\245' <repeats 200 times>..., from=0x7f4b5003b1c5 '\245' <repeats 11 times>, "\003") at /data/src/10.3/storage/maria/ma_dynrec.c:1005

#6  0x00005609089b801d in _ma_write_blob_record (info=0x7f4b50098af0, record=0x7f4b5003b1c0 "\376\001") at /data/src/10.3/storage/maria/ma_dynrec.c:262

#7  0x0000560908a4b735 in maria_write (info=0x7f4b50098af0, record=0x7f4b5003b1c0 "\376\001") at /data/src/10.3/storage/maria/ma_write.c:284

#8  0x00005609089c7b3d in ha_maria::write_row (this=0x7f4b5003b2f8, buf=0x7f4b5003b1c0 "\376\001") at /data/src/10.3/storage/maria/ha_maria.cc:1211

#9  0x000056090808ebb8 in handler::ha_write_tmp_row (this=0x7f4b5003b2f8, buf=0x7f4b5003b1c0 "\376\001") at /data/src/10.3/sql/sql_class.h:6481

#10 0x0000560908077d4d in end_write (join=0x7f4b50013850, join_tab=0x7f4b50014fc0, end_of_records=false) at /data/src/10.3/sql/sql_select.cc:21130

#11 0x000056090808a270 in AGGR_OP::put_record (this=0x7f4b50015ca8, end_of_records=false) at /data/src/10.3/sql/sql_select.cc:27757

#12 0x000056090808fb2b in AGGR_OP::put_record (this=0x7f4b50015ca8) at /data/src/10.3/sql/sql_select.h:1024

#13 0x0000560908073ad3 in sub_select_postjoin_aggr (join=0x7f4b50013850, join_tab=0x7f4b50014fc0, end_of_records=false) at /data/src/10.3/sql/sql_select.cc:19433

#14 0x000056090807477b in evaluate_join_record (join=0x7f4b50013850, join_tab=0x7f4b50014c30, error=0) at /data/src/10.3/sql/sql_select.cc:19931

#15 0x0000560908074035 in sub_select (join=0x7f4b50013850, join_tab=0x7f4b50014c30, end_of_records=false) at /data/src/10.3/sql/sql_select.cc:19711

#16 0x0000560908073507 in do_select (join=0x7f4b50013850, procedure=0x0) at /data/src/10.3/sql/sql_select.cc:19251

#17 0x000056090804a4cf in JOIN::exec_inner (this=0x7f4b50013850) at /data/src/10.3/sql/sql_select.cc:4124

#18 0x000056090804988e in JOIN::exec (this=0x7f4b50013850) at /data/src/10.3/sql/sql_select.cc:3918

#19 0x000056090804abab in mysql_select (thd=0x7f4b50000d90, tables=0x7f4b50012ce8, wild_num=0, fields=..., conds=0x0, og_num=2, order=0x7f4b50013700, group=0x7f4b50013470, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f4b50013828, unit=0x7f4b50004c58, select_lex=0x7f4b500053e0) at /data/src/10.3/sql/sql_select.cc:4323

#20 0x000056090803c13e in handle_select (thd=0x7f4b50000d90, lex=0x7f4b50004b98, result=0x7f4b50013828, setup_tables_done_option=0) at /data/src/10.3/sql/sql_select.cc:370

#21 0x0000560908002804 in execute_sqlcom_select (thd=0x7f4b50000d90, all_tables=0x7f4b50012ce8) at /data/src/10.3/sql/sql_parse.cc:6316

#22 0x0000560907ff9011 in mysql_execute_command (thd=0x7f4b50000d90) at /data/src/10.3/sql/sql_parse.cc:3847

#23 0x0000560908006b88 in mysql_parse (thd=0x7f4b50000d90, rawbuf=0x7f4b50012ab8 "SELECT f FROM t1 GROUP BY id ORDER BY DEFAULT(f)", length=48, parser_state=0x7f4b60e9d5c0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7840

#24 0x0000560907ff32ec in dispatch_command (command=COM_QUERY, thd=0x7f4b50000d90, packet=0x7f4b50008f11 "", packet_length=48, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1852

#25 0x0000560907ff1c8c in do_command (thd=0x7f4b50000d90) at /data/src/10.3/sql/sql_parse.cc:1398

#26 0x0000560908170295 in do_handle_one_connection (connect=0x56090b6f9090) at /data/src/10.3/sql/sql_connect.cc:1403

#27 0x000056090816fff1 in handle_one_connection (arg=0x56090b6f9090) at /data/src/10.3/sql/sql_connect.cc:1308

#28 0x0000560908b3c073 in pfs_spawn_thread (arg=0x56090b6dc460) at /data/src/10.3/storage/perfschema/pfs.cc:1869

#29 0x00007f4b67388609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#30 0x00007f4b66f64293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

commit 8db5274dce7f8710b25ca954559843c9cd812ac5 (origin/10.3, 10.3)

Author: Monty

Date:   Sun Feb 21 20:38:32 2021 +0200

    MDEV-22703 DEFAULT() on a BLOB column can overwrite the default record