Server crashes in handler::check_duplicate_long_entry_key after ALTER

--source include/have_innodb.inc

CREATE TABLE t1 (k varchar(10), c varchar(10), a1 linestring, KEY (k(10)), KEY (c)) engine=innodb;

INSERT INTO t1 VALUES('','j',''), ('','','');

ALTER TABLE t1 change COLUMN IF EXISTS n a1 SERIAL;

220120 15:38:39 [ERROR] mysqld got signal 11 ;

Server version: 10.8.0-MariaDB-debug-log

sigaction.c:0(__restore_rt)[0x7f60841fb3c0]

sql/handler.cc:7173(handler::check_duplicate_long_entry_key(unsigned char const*, unsigned int))[0x560caf4e7a82]

sql/handler.cc:7248(handler::check_duplicate_long_entries(unsigned char const*))[0x560caf4e912f]

sql/handler.cc:7509(handler::ha_write_row(unsigned char const*))[0x560caf4eb31c]

sql/sql_table.cc:11553(copy_data_between_tables(THD*, TABLE*, TABLE*, List<Create_field>&, bool, unsigned int, st_order*, unsigned long long*, unsigned long long*, Alter_info::enum_enable_or_disable, Alter_table_ctx*))[0x560caeef9daf]

sql/sql_table.cc:10800(mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool))[0x560caeef36ba]

sql/sql_alter.cc:543(Sql_cmd_alter_table::execute(THD*))[0x560caf0b1c1b]

sql/sql_parse.cc:5989(mysql_execute_command(THD*, bool))[0x560caec0f27e]

sql/sql_parse.cc:8028(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x560caec1caae]

sql/sql_parse.cc:1896(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x560caebf2b88]

sql/sql_parse.cc:1402(do_command(THD*, bool))[0x560caebef8ac]

sql/sql_connect.cc:1418(do_handle_one_connection(CONNECT*, bool))[0x560caf093e4d]

sql/sql_connect.cc:1314(handle_one_connection)[0x560caf0936d9]

perfschema/pfs.cc:2203(pfs_spawn_thread)[0x560cafd43d3d]

nptl/pthread_create.c:478(start_thread)[0x7f60841ef609]

??:0(clone)[0x7f6083dc2293]

Query (0x6290003072a8): ALTER TABLE t1 change COLUMN IF EXISTS n a1 SERIAL

=================================================================

==620238==ERROR: AddressSanitizer: use-after-poison on address 0x61a00015b203 at pc 0x5643040f8338 bp 0x7faf7f5c3150 sp 0x7faf7f5c3140

READ of size 1 at 0x61a00015b203 thread T16

    #0 0x5643040f8337 in key_copy(unsigned char*, unsigned char const*, st_key const*, unsigned int, bool) /10.8/sql/key.cc:127

    #1 0x564303df77e0 in handler::check_duplicate_long_entry_key(unsigned char const*, unsigned int) /10.8/sql/handler.cc:7161

    #2 0x564303df912e in handler::check_duplicate_long_entries(unsigned char const*) /10.8/sql/handler.cc:7248

    #3 0x564303dfb31b in handler::ha_write_row(unsigned char const*) /10.8/sql/handler.cc:7509

    #4 0x564303809dae in copy_data_between_tables /10.8/sql/sql_table.cc:11553

    #5 0x5643038036b9 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.8/sql/sql_table.cc:10800

    #6 0x5643039c1c1a in Sql_cmd_alter_table::execute(THD*) /10.8/sql/sql_alter.cc:543

    #7 0x56430351f27d in mysql_execute_command(THD*, bool) /10.8/sql/sql_parse.cc:5989

    #8 0x56430352caad in mysql_parse(THD*, char*, unsigned int, Parser_state*) /10.8/sql/sql_parse.cc:8028

    #9 0x564303502b87 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /10.8/sql/sql_parse.cc:1894

    #10 0x5643034ff8ab in do_command(THD*, bool) /10.8/sql/sql_parse.cc:1402

    #11 0x5643039a3e4c in do_handle_one_connection(CONNECT*, bool) /10.8/sql/sql_connect.cc:1418

    #12 0x5643039a36d8 in handle_one_connection /10.8/sql/sql_connect.cc:1312

    #13 0x564304653d3c in pfs_spawn_thread /10.8/storage/perfschema/pfs.cc:2201

    #14 0x7faf8ed03608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

    #15 0x7faf8e8d6292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x61a00015b203 is located 899 bytes inside of 1156-byte region [0x61a00015ae80,0x61a00015b304)

allocated by thread T16 here:

    #0 0x7faf8f1febc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)

    #1 0x5643052b1e4d in sf_malloc /10.8/mysys/safemalloc.c:126

    #2 0x56430527f073 in my_malloc /10.8/mysys/my_malloc.c:90

    #3 0x564305259d0f in root_alloc /10.8/mysys/my_alloc.c:66

    #4 0x56430525b4c5 in alloc_root /10.8/mysys/my_alloc.c:332

    #5 0x56430525bcb2 in multi_alloc_root /10.8/mysys/my_alloc.c:402

    #6 0x5643038bfde6 in copy_keys_from_share(TABLE*, st_mem_root*) /10.8/sql/table.cc:3925

    #7 0x5643038c1bde in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /10.8/sql/table.cc:4140

    #8 0x564303c0b31c in THD::open_temporary_table(TMP_TABLE_SHARE*, char const*) /10.8/sql/temporary_tables.cc:1126

    #9 0x564303c04676 in THD::create_and_open_tmp_table(st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, bool) /10.8/sql/temporary_tables.cc:74

    #10 0x564303802d60 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.8/sql/sql_table.cc:10727

    #11 0x5643039c1c1a in Sql_cmd_alter_table::execute(THD*) /10.8/sql/sql_alter.cc:543

    #12 0x56430351f27d in mysql_execute_command(THD*, bool) /10.8/sql/sql_parse.cc:5989

    #13 0x56430352caad in mysql_parse(THD*, char*, unsigned int, Parser_state*) /10.8/sql/sql_parse.cc:8028

    #14 0x564303502b87 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /10.8/sql/sql_parse.cc:1894

    #15 0x5643034ff8ab in do_command(THD*, bool) /10.8/sql/sql_parse.cc:1402

    #16 0x5643039a3e4c in do_handle_one_connection(CONNECT*, bool) /10.8/sql/sql_connect.cc:1418

    #17 0x5643039a36d8 in handle_one_connection /10.8/sql/sql_connect.cc:1312

    #18 0x564304653d3c in pfs_spawn_thread /10.8/storage/perfschema/pfs.cc:2201

    #19 0x7faf8ed03608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

Thread T16 created by T0 here:

    #0 0x7faf8f12b805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)

    #1 0x56430464ecf2 in my_thread_create /10.8/storage/perfschema/my_thread.h:48

    #2 0x56430465412f in pfs_spawn_thread_v1 /10.8/storage/perfschema/pfs.cc:2252

    #3 0x564303147b68 in inline_mysql_thread_create /10.8/include/mysql/psi/mysql_thread.h:1139

    #4 0x56430315f8d0 in create_thread_to_handle_connection(CONNECT*) /10.8/sql/mysqld.cc:5969

    #5 0x56430315ff4c in create_new_thread(CONNECT*) /10.8/sql/mysqld.cc:6028

    #6 0x5643031602b9 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.8/sql/mysqld.cc:6090

    #7 0x564303160c8e in handle_connections_sockets() /10.8/sql/mysqld.cc:6214

    #8 0x56430315f0dd in mysqld_main(int, char**) /10.8/sql/mysqld.cc:5864

    #9 0x564303146e8c in main /10.8/sql/main.cc:34

    #10 0x7faf8e7db0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: use-after-poison /10.8/sql/key.cc:127 in key_copy(unsigned char*, unsigned char const*, st_key const*, unsigned int, bool)