SIGSEGV in Item::save_decimal_in_field on UPDATE

CREATE TABLE t (c INT) ENGINE=InnoDB;

INSERT INTO t (c) VALUES (1);

UPDATE t SET c=1 WHERE c IN (SELECT 1 IN (SELECT 1) AS d FROM t ORDER BY 1 + AVG(c) OVER (ORDER BY c));

Core was generated by `/test/MD310522-mariadb-10.3.36-linux-x86_64-opt/bin/mysqld --no-defaults --core'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  Item::save_decimal_in_field (this=0x14c1bc012788, field=0x0, 

    no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:6995

[Current thread is 1 (Thread 0x14c21c157700 (LWP 172503))]

(gdb) bt

#0  Item::save_decimal_in_field (this=0x14c1bc012788, field=0x0, no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:6995

#1  0x000055fa50605a87 in Item::save_in_field (this=0x14c1bc012788, field=0x0, no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:7012

#2  0x000055fa50556392 in save_window_function_values (rowid_buf=0x14c1bc01ea68 "\370\366\002\274\301\024", tbl=0x14c1bc027200, window_functions=@0x14c1bc0241f8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14c1bc024218, last = 0x14c1bc024218, elements = 1}, <No data fields>}) at /test/10.3_opt/sql/sql_window.cc:2769

#3  compute_window_func (thd=0x14c1bc000c48, window_functions=@0x14c1bc0241f8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14c1bc024218, last = 0x14c1bc024218, elements = 1}, <No data fields>}, cursor_managers=@0x14c21c154940: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14c1bc02c718, last = 0x14c1bc02c718, elements = 1}, <No data fields>}, tbl=0x14c1bc027200, filesort_result=<optimized out>) at /test/10.3_opt/sql/sql_window.cc:2921

#4  0x000055fa50556765 in Window_func_runner::exec (this=this@entry=0x14c1bc0241f0, thd=thd@entry=0x14c1bc000c48, tbl=0x14c1bc027200, filesort_result=0x14c1bc018e50) at /test/10.3_opt/sql/sql_window.cc:3024

#5  0x000055fa50556896 in Window_funcs_sort::exec (this=0x14c1bc0241e8, join=join@entry=0x14c1bc013580, keep_filesort_result=<optimized out>) at /test/10.3_opt/sql/sql_window.cc:3052

#6  0x000055fa50557375 in Window_funcs_computation::exec (this=0x14c1bc0241c8, join=join@entry=0x14c1bc013580, keep_last_filesort_result=keep_last_filesort_result@entry=true) at /test/10.3_opt/sql/sql_window.cc:3179

#7  0x000055fa5046b16e in AGGR_OP::end_send (this=0x14c1bc023f68) at /test/10.3_opt/sql/sql_select.cc:28035

#8  0x000055fa5046b4a0 in sub_select_postjoin_aggr (join=0x14c1bc013580, join_tab=0x14c1bc023380, end_of_records=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:19601

#9  0x000055fa50470536 in do_select (procedure=<optimized out>, join=0x14c1bc013580) at /test/10.3_opt/sql/sql_select.cc:19425

#10 JOIN::exec_inner (this=this@entry=0x14c1bc013580) at /test/10.3_opt/sql/sql_select.cc:4151

#11 0x000055fa504709d6 in JOIN::exec (this=0x14c1bc013580) at /test/10.3_opt/sql/sql_select.cc:3945

#12 0x000055fa505305da in join_tab_execution_startup (tab=tab@entry=0x14c1bc02aa88) at /test/10.3_opt/sql/opt_subselect.cc:5421

#13 0x000055fa504474d5 in sub_select (end_of_records=false, join_tab=0x14c1bc02aa88, join=0x14c1bc012eb0) at /test/10.3_opt/sql/sql_select.cc:19873

#14 sub_select (join=0x14c1bc012eb0, join_tab=0x14c1bc02aa88, end_of_records=false) at /test/10.3_opt/sql/sql_select.cc:19820

#15 0x000055fa504396c3 in evaluate_join_record (join=join@entry=0x14c1bc012eb0, join_tab=join_tab@entry=0x14c1bc02a6f8, error=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:20112

#16 0x000055fa50447513 in sub_select (end_of_records=false, join_tab=0x14c1bc02a6f8, join=0x14c1bc012eb0) at /test/10.3_opt/sql/sql_select.cc:19885

#17 sub_select (join=0x14c1bc012eb0, join_tab=0x14c1bc02a6f8, end_of_records=false) at /test/10.3_opt/sql/sql_select.cc:19820

#18 0x000055fa50470655 in do_select (procedure=<optimized out>, join=0x14c1bc012eb0) at /test/10.3_opt/sql/sql_select.cc:19423

#19 JOIN::exec_inner (this=this@entry=0x14c1bc012eb0) at /test/10.3_opt/sql/sql_select.cc:4151

#20 0x000055fa504709d6 in JOIN::exec (this=this@entry=0x14c1bc012eb0) at /test/10.3_opt/sql/sql_select.cc:3945

#21 0x000055fa50470b72 in mysql_select (thd=thd@entry=0x14c1bc000c48, tables=tables@entry=0x14c1bc00f640, wild_num=0, fields=@0x14c21c154d70: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55fa5127c910 <end_of_list>, last = 0x14c21c154d70, elements = 0}, <No data fields>}, conds=conds@entry=0x14c1bc012990, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x14c1bc012da0, unit=0x14c1bc0047a0, select_lex=0x14c1bc004f38) at /test/10.3_opt/sql/sql_select.cc:4354

#22 0x000055fa504bef55 in mysql_multi_update (thd=thd@entry=0x14c1bc000c48, table_list=0x14c1bc00f640, fields=fields@entry=0x14c1bc005060, values=values@entry=0x14c1bc005590, conds=0x14c1bc012990, options=0, handle_duplicates=DUP_ERROR, ignore=false, unit=0x14c1bc0047a0, select_lex=0x14c1bc004f38, result=0x14c21c154f40) at /test/10.3_opt/sql/sql_update.cc:1824

#23 0x000055fa50411250 in mysql_execute_command (thd=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:4419

#24 0x000055fa50416a82 in mysql_parse (thd=0x14c1bc000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:7870

#25 0x000055fa5041885d in dispatch_command (command=COM_QUERY, thd=0x14c1bc000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_class.h:1152

#26 0x000055fa5041a21d in do_command (thd=0x14c1bc000c48) at /test/10.3_opt/sql/sql_parse.cc:1398

#27 0x000055fa504f836e in do_handle_one_connection (connect=<optimized out>) at /test/10.3_opt/sql/sql_connect.cc:1403

#28 0x000055fa504f83ed in handle_one_connection (arg=<optimized out>) at /test/10.3_opt/sql/sql_connect.cc:1308

#29 0x000014c21f059609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#30 0x000014c21ef7e133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Core was generated by `/test/MD310522-mariadb-10.3.36-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  Item::save_decimal_in_field (this=0x147ccc012788, field=0x0, 

    no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:6995

[Current thread is 1 (Thread 0x147d0810a700 (LWP 172298))]

(gdb) bt

#0  Item::save_decimal_in_field (this=0x147ccc012788, field=0x0, no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:6995

#1  0x00005592e906ea87 in Item::save_in_field (this=0x147ccc012788, field=0x0, no_conversions=<optimized out>) at /test/10.3_opt/sql/item.cc:7012

#2  0x00005592e8fbf392 in save_window_function_values (rowid_buf=0x147ccc016e58 "\370\366\002\314|\024", tbl=0x147ccc027200, window_functions=@0x147ccc0241f8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x147ccc024218, last = 0x147ccc024218, elements = 1}, <No data fields>}) at /test/10.3_opt/sql/sql_window.cc:2769

#3  compute_window_func (thd=0x147ccc000c48, window_functions=@0x147ccc0241f8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x147ccc024218, last = 0x147ccc024218, elements = 1}, <No data fields>}, cursor_managers=@0x147d08107940: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x147ccc02c718, last = 0x147ccc02c718, elements = 1}, <No data fields>}, tbl=0x147ccc027200, filesort_result=<optimized out>) at /test/10.3_opt/sql/sql_window.cc:2921

#4  0x00005592e8fbf765 in Window_func_runner::exec (this=this@entry=0x147ccc0241f0, thd=thd@entry=0x147ccc000c48, tbl=0x147ccc027200, filesort_result=0x147ccc018e50) at /test/10.3_opt/sql/sql_window.cc:3024

#5  0x00005592e8fbf896 in Window_funcs_sort::exec (this=0x147ccc0241e8, join=join@entry=0x147ccc013580, keep_filesort_result=<optimized out>) at /test/10.3_opt/sql/sql_window.cc:3052

#6  0x00005592e8fc0375 in Window_funcs_computation::exec (this=0x147ccc0241c8, join=join@entry=0x147ccc013580, keep_last_filesort_result=keep_last_filesort_result@entry=true) at /test/10.3_opt/sql/sql_window.cc:3179

#7  0x00005592e8ed416e in AGGR_OP::end_send (this=0x147ccc023f68) at /test/10.3_opt/sql/sql_select.cc:28035

#8  0x00005592e8ed44a0 in sub_select_postjoin_aggr (join=0x147ccc013580, join_tab=0x147ccc023380, end_of_records=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:19601

#9  0x00005592e8ed9536 in do_select (procedure=<optimized out>, join=0x147ccc013580) at /test/10.3_opt/sql/sql_select.cc:19425

#10 JOIN::exec_inner (this=this@entry=0x147ccc013580) at /test/10.3_opt/sql/sql_select.cc:4151

#11 0x00005592e8ed99d6 in JOIN::exec (this=0x147ccc013580) at /test/10.3_opt/sql/sql_select.cc:3945

#12 0x00005592e8f995da in join_tab_execution_startup (tab=tab@entry=0x147ccc02aa88) at /test/10.3_opt/sql/opt_subselect.cc:5421

#13 0x00005592e8eb04d5 in sub_select (end_of_records=false, join_tab=0x147ccc02aa88, join=0x147ccc012eb0) at /test/10.3_opt/sql/sql_select.cc:19873

#14 sub_select (join=0x147ccc012eb0, join_tab=0x147ccc02aa88, end_of_records=false) at /test/10.3_opt/sql/sql_select.cc:19820

#15 0x00005592e8ea26c3 in evaluate_join_record (join=join@entry=0x147ccc012eb0, join_tab=join_tab@entry=0x147ccc02a6f8, error=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:20112

#16 0x00005592e8eb0513 in sub_select (end_of_records=false, join_tab=0x147ccc02a6f8, join=0x147ccc012eb0) at /test/10.3_opt/sql/sql_select.cc:19885

#17 sub_select (join=0x147ccc012eb0, join_tab=0x147ccc02a6f8, end_of_records=false) at /test/10.3_opt/sql/sql_select.cc:19820

#18 0x00005592e8ed9655 in do_select (procedure=<optimized out>, join=0x147ccc012eb0) at /test/10.3_opt/sql/sql_select.cc:19423

#19 JOIN::exec_inner (this=this@entry=0x147ccc012eb0) at /test/10.3_opt/sql/sql_select.cc:4151

#20 0x00005592e8ed99d6 in JOIN::exec (this=this@entry=0x147ccc012eb0) at /test/10.3_opt/sql/sql_select.cc:3945

#21 0x00005592e8ed9b72 in mysql_select (thd=thd@entry=0x147ccc000c48, tables=tables@entry=0x147ccc00f640, wild_num=0, fields=@0x147d08107d70: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5592e9ce5910 <end_of_list>, last = 0x147d08107d70, elements = 0}, <No data fields>}, conds=conds@entry=0x147ccc012990, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x147ccc012da0, unit=0x147ccc0047a0, select_lex=0x147ccc004f38) at /test/10.3_opt/sql/sql_select.cc:4354

#22 0x00005592e8f27f55 in mysql_multi_update (thd=thd@entry=0x147ccc000c48, table_list=0x147ccc00f640, fields=fields@entry=0x147ccc005060, values=values@entry=0x147ccc005590, conds=0x147ccc012990, options=0, handle_duplicates=DUP_ERROR, ignore=false, unit=0x147ccc0047a0, select_lex=0x147ccc004f38, result=0x147d08107f40) at /test/10.3_opt/sql/sql_update.cc:1824

#23 0x00005592e8e7a250 in mysql_execute_command (thd=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:4419

#24 0x00005592e8e7fa82 in mysql_parse (thd=0x147ccc000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:7870

#25 0x00005592e8e8185d in dispatch_command (command=COM_QUERY, thd=0x147ccc000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_class.h:1152

#26 0x00005592e8e8321d in do_command (thd=0x147ccc000c48) at /test/10.3_opt/sql/sql_parse.cc:1398

#27 0x00005592e8f6136e in do_handle_one_connection (connect=<optimized out>) at /test/10.3_opt/sql/sql_connect.cc:1403

#28 0x00005592e8f613ed in handle_one_connection (arg=<optimized out>) at /test/10.3_opt/sql/sql_connect.cc:1308

#29 0x0000147d2e8b0609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#30 0x0000147d2e7d5133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

SIGSEGV|Item::save_decimal_in_field|Item::save_in_field|save_window_function_values|compute_window_func