SIGSEGV in row_merge_tuple_sort and Assertion `data_size < srv_sort_buf_size' failed in row_merge_bulk_buf_add on INSERT with unique_checks and foreign_key_checks disabled

SET SESSION unique_checks=0,SESSION foreign_key_checks=0;

CREATE TABLE t (f MEDIUMTEXT) ENGINE=InnoDB;

INSERT INTO t VALUES (REPEAT(1,8459264));

Core was generated by `/test/MD121221-mariadb-10.7.2-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x0000564b0e36cc4c in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, 

    tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0)

    at /test/10.7_opt/storage/innobase/row/row0merge.cc:1023

1023	{

[Current thread is 1 (Thread 0x14fbadbfe700 (LWP 2435169))]

(gdb) bt

#0  0x0000564b0e36cc4c in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1023

#1  0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027

#2  0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027

#3  0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027

...

#990 0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027

#991 0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027

#992 0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027

mysqld: /test/10.8_dbg/storage/innobase/row/row0merge.cc:506: ulint row_merge_bulk_buf_add(row_merge_buf_t*, const dict_table_t&, const dtuple_t&): Assertion `data_size < srv_sort_buf_size' failed.

Core was generated by `/test/MD121221-mariadb-10.8.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGABRT, Aborted.

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

[Current thread is 1 (Thread 0x152d28637700 (LWP 2435869))]

(gdb) bt

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

#1  0x0000152d3389b859 in __GI_abort () at abort.c:79

#2  0x0000152d3389b729 in __assert_fail_base (fmt=0x152d33a31588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x5565ac7518e0 "data_size < srv_sort_buf_size", file=0x5565ac751cf8 "/test/10.8_dbg/storage/innobase/row/row0merge.cc", line=506, function=<optimized out>) at assert.c:92

#3  0x0000152d338acf36 in __GI___assert_fail (assertion=assertion@entry=0x5565ac7518e0 "data_size < srv_sort_buf_size", file=file@entry=0x5565ac751cf8 "/test/10.8_dbg/storage/innobase/row/row0merge.cc", line=line@entry=506, function=function@entry=0x5565ac752b68 "ulint row_merge_bulk_buf_add(row_merge_buf_t*, const dict_table_t&, const dtuple_t&)") at assert.c:101

#4  0x00005565ac0220bc in row_merge_bulk_buf_add (row=@0x152cc4023828: {info_bits = 0, n_fields = 4, n_fields_cmp = 1, fields = 0x152cc4023860, n_v_fields = 0, v_fields = 0x0, magic_n = 65478679}, table=<optimized out>, buf=0x152cc5091158) at /test/10.8_dbg/storage/innobase/row/row0merge.cc:506

#5  row_merge_bulk_t::bulk_insert_buffered (this=0x152cc50910d0, row=@0x152cc4023828: {info_bits = 0, n_fields = 4, n_fields_cmp = 1, fields = 0x152cc4023860, n_v_fields = 0, v_fields = 0x0, magic_n = 65478679}, ind=@0x152cc4023dd8: {static MAX_N_FIELDS = 1023, id = 23, heap = 0x152cc4023c48, name = {m_name = 0x152cc4023f78 "GEN_CLUST_INDEX"}, table = 0x152cc40215b8, page = 3, merge_threshold = 50, type = 1, trx_id_offset = 6, n_user_defined_cols = 0, nulls_equal = 0, n_uniq = 1, n_def = 4, n_fields = 4, n_nullable = 1, n_core_fields = 4, n_core_null_bytes = 1, static NO_CORE_NULL_BYTES = 255, static DICT_INDEXES_ID = 3, cached = 1, to_be_dropped = 0, online_status = 0, uncommitted = 0, is_dummy = false, in_instant_init = false, magic_n = 76789786, fields = 0x152cc4024048, parser = 0x0, new_vcol_info = 0x0, indexes = {prev = 0x0, next = 0x0}, search_info = 0x152cc40240c8, online_log = 0x0, stat_n_diff_key_vals = 0x152cc40240b0, stat_n_sample_sizes = 0x152cc40240b8, stat_n_non_null_key_vals = 0x152cc40240c0, stat_index_size = 1, stat_n_leaf_pages = 1, stats_error_printed = false, stat_defrag_modified_counter = 0, stat_defrag_n_pages_freed = 0, stat_defrag_n_page_split = 0, stat_defrag_data_size_sample = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, stat_defrag_sample_next_slot = 0, rtr_ssn = {m = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}}, rtr_track = 0x0, trx_id = 15, zip_pad = {mutex = {<std::__mutex_base> = {_M_mutex = pthread_mutex_t = {

              Type = Normal,

              Status = Not acquired,

              Robust = No,

              Shared = No,

              Protocol = None

            }}, <No data fields>}, pad = {m = {<std::__atomic_base<unsigned long>> = {static _S_alignment = 8, _M_i = 0}, <No data fields>}}, success = 0, failure = 0, n_rounds = 0}, lock = {lock = {pfs_psi = 0x0, lock = {writer = {lock = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static HOLDER = 2147483648}, readers = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static WRITER = 2147483648}}, recursive = 0, writer = {<std::__atomic_base<unsigned long>> = {static _S_alignment = 8, _M_i = 0}, <No data fields>}, static FOR_IO = 18446744073709551615, readers_lock = {lock = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static HOLDER = 2147483648}, readers = {_M_b = {_M_p = 0x152cc4025b20}}, static RECURSIVE_X = 1, static RECURSIVE_U = 65536, static RECURSIVE_MAX = 65535}}, trx=trx@entry=0x152d2a6cf1e0) at /test/10.8_dbg/storage/innobase/row/row0merge.cc:5125

#6  0x00005565ac0c7a24 in trx_mod_table_time_t::bulk_insert_buffered (trx=0x152d2a6cf1e0, index=@0x152cc4023dd8: {static MAX_N_FIELDS = 1023, id = 23, heap = 0x152cc4023c48, name = {m_name = 0x152cc4023f78 "GEN_CLUST_INDEX"}, table = 0x152cc40215b8, page = 3, merge_threshold = 50, type = 1, trx_id_offset = 6, n_user_defined_cols = 0, nulls_equal = 0, n_uniq = 1, n_def = 4, n_fields = 4, n_nullable = 1, n_core_fields = 4, n_core_null_bytes = 1, static NO_CORE_NULL_BYTES = 255, static DICT_INDEXES_ID = 3, cached = 1, to_be_dropped = 0, online_status = 0, uncommitted = 0, is_dummy = false, in_instant_init = false, magic_n = 76789786, fields = 0x152cc4024048, parser = 0x0, new_vcol_info = 0x0, indexes = {prev = 0x0, next = 0x0}, search_info = 0x152cc40240c8, online_log = 0x0, stat_n_diff_key_vals = 0x152cc40240b0, stat_n_sample_sizes = 0x152cc40240b8, stat_n_non_null_key_vals = 0x152cc40240c0, stat_index_size = 1, stat_n_leaf_pages = 1, stats_error_printed = false, stat_defrag_modified_counter = 0, stat_defrag_n_pages_freed = 0, stat_defrag_n_page_split = 0, stat_defrag_data_size_sample = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, stat_defrag_sample_next_slot = 0, rtr_ssn = {m = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}}, rtr_track = 0x0, trx_id = 15, zip_pad = {mutex = {<std::__mutex_base> = {_M_mutex = pthread_mutex_t = {

              Type = Normal,

              Status = Not acquired,

              Robust = No,

              Shared = No,

              Protocol = None

            }}, <No data fields>}, pad = {m = {<std::__atomic_base<unsigned long>> = {static _S_alignment = 8, _M_i = 0}, <No data fields>}}, success = 0, failure = 0, n_rounds = 0}, lock = {lock = {pfs_psi = 0x0, lock = {writer = {lock = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static HOLDER = 2147483648}, readers = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static WRITER = 2147483648}}, recursive = 0, writer = {<std::__atomic_base<unsigned long>> = {static _S_alignment = 8, _M_i = 0}, <No data fields>}, static FOR_IO = 18446744073709551615, readers_lock = {lock = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static HOLDER = 2147483648}, readers = {_M_b = {_M_p = 0x152cc4025b20}}, static RECURSIVE_X = 1, static RECURSIVE_U = 65536, static RECURSIVE_MAX = 65535}}, entry=@0x152cc4023828: {info_bits = 0, n_fields = 4, n_fields_cmp = 1, fields = 0x152cc4023860, n_v_fields = 0, v_fields = 0x0, magic_n = 65478679}, this=0x152cc4023650) at /test/10.8_dbg/storage/innobase/include/trx0trx.h:510

#7  trx_undo_report_row_operation (thr=thr@entry=0x152cc4029848, index=index@entry=0x152cc4023dd8, clust_entry=clust_entry@entry=0x152cc4023828, update=update@entry=0x0, cmpl_info=cmpl_info@entry=0, rec=rec@entry=0x0, offsets=0x0, roll_ptr=0x0) at /test/10.8_dbg/storage/innobase/trx/trx0rec.cc:2061

#8  0x00005565ac00ae27 in row_ins_clust_index_entry_low (flags=flags@entry=0, mode=<optimized out>, mode@entry=2, index=index@entry=0x152cc4023dd8, n_uniq=n_uniq@entry=0, entry=entry@entry=0x152cc4023828, n_ext=n_ext@entry=0, thr=<optimized out>) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:2674

#9  0x00005565ac00cf20 in row_ins_clust_index_entry (index=index@entry=0x152cc4023dd8, entry=entry@entry=0x152cc4023828, thr=thr@entry=0x152cc4029848, n_ext=n_ext@entry=0) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:3246

#10 0x00005565ac011d2d in row_ins_index_entry (thr=0x152cc4029848, entry=0x152cc4023828, index=0x152cc4023dd8) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:3380

#11 row_ins_index_entry_step (thr=0x152cc4029848, node=0x152cc4029628) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:3548

#12 row_ins (thr=0x152cc4029848, node=0x152cc4029628) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:3694

#13 row_ins_step (thr=thr@entry=0x152cc4029848) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:3840

#14 0x00005565ac035b32 in row_insert_for_mysql (mysql_rec=mysql_rec@entry=0x152cc4028458 "\376", prebuilt=0x152cc4029138, ins_mode=ROW_INS_NORMAL) at /test/10.8_dbg/storage/innobase/row/row0mysql.cc:1318

#15 0x00005565abeb12b7 in ha_innobase::write_row (this=0x152cc40288e0, record=0x152cc4028458 "\376") at /test/10.8_dbg/storage/innobase/handler/ha_innodb.cc:7823

#16 0x00005565abb017d7 in handler::ha_write_row (this=0x152cc40288e0, buf=0x152cc4028458 "\376") at /test/10.8_dbg/sql/handler.cc:7516

#17 0x00005565ab7a006a in write_record (thd=thd@entry=0x152cc4000db8, table=table@entry=0x152cc4028008, info=info@entry=0x152d28635ca0, sink=sink@entry=0x0) at /test/10.8_dbg/sql/sql_insert.cc:2156

#18 0x00005565ab7abcd9 in mysql_insert (thd=thd@entry=0x152cc4000db8, table_list=0x152cc4013ec8, fields=@0x152cc4006078: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5565ace26b00 <end_of_list>, last = 0x152cc4006078, elements = 0}, <No data fields>}, values_list=@0x152cc40060c0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152cc4014c50, last = 0x152cc4014c50, elements = 1}, <No data fields>}, update_fields=@0x152cc40060a8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5565ace26b00 <end_of_list>, last = 0x152cc40060a8, elements = 0}, <No data fields>}, update_values=@0x152cc4006090: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5565ace26b00 <end_of_list>, last = 0x152cc4006090, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.8_dbg/sql/sql_insert.cc:1127

#19 0x00005565ab7f23d3 in mysql_execute_command (thd=thd@entry=0x152cc4000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.8_dbg/sql/sql_parse.cc:4563

#20 0x00005565ab7dce0f in mysql_parse (thd=thd@entry=0x152cc4000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152d28636400) at /test/10.8_dbg/sql/sql_parse.cc:8028

#21 0x00005565ab7ebaab in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152cc4000db8, packet=packet@entry=0x152cc400b879 "INSERT INTO t VALUES (REPEAT(1,8459264))", packet_length=packet_length@entry=40, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_class.h:1360

#22 0x00005565ab7eeeea in do_command (thd=0x152cc4000db8, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_parse.cc:1402

#23 0x00005565ab96889c in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5565afa5ba08, put_in_cache=put_in_cache@entry=true) at /test/10.8_dbg/sql/sql_connect.cc:1418

#24 0x00005565ab968ea1 in handle_one_connection (arg=arg@entry=0x5565afa5ba08) at /test/10.8_dbg/sql/sql_connect.cc:1312

#25 0x00005565abdea442 in pfs_spawn_thread (arg=0x5565af96d608) at /test/10.8_dbg/storage/perfschema/pfs.cc:2201

#26 0x0000152d33daa609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#27 0x0000152d33998293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95