added a comment - Thank you for the report!
I repeated as described on 10.6-10.11,11.0 with InnoDB, not Myisam, no crash on MariaDB 10.3-10.5.
mariadbd: /10.6/src/storage/innobase/include/rem0rec.h:604: ulint rec_offs_n_fields(const rec_offs*): Assertion `offsets' failed.
230316 14:38:22 [ERROR] mysqld got signal 6 ;
Server version: 10.6.13-MariaDB-debug-log source revision: 49e2b50d594dfee462505b8fab2d8ba875dcf6e0
??:0(gsignal)[0x7ff2bf3c900b]
??:0(abort)[0x7ff2bf3a8859]
/lib/x86_64-linux-gnu/libc.so.6(+0x22729)[0x7ff2bf3a8729]
??:0(__assert_fail)[0x7ff2bf3b9fd6]
include/rem0rec.h:605(rec_offs_n_fields(unsigned short const*))[0x563cc1d21ec9]
rem/rem0rec.cc:519(rec_offs_validate(unsigned char const*, dict_index_t const*, unsigned short const*))[0x563cc1f5063a]
include/rem0rec.h:688(rec_offs_comp(unsigned short const*))[0x563cc1e0afbd]
gis/gis0rtree.cc:226(rtr_update_mbr_field(btr_cur_t*, unsigned short*, btr_cur_t*, unsigned char*, rtr_mbr*, unsigned char*, mtr_t*))[0x563cc242edf5]
gis/gis0rtree.cc:591(rtr_adjust_upper_level(btr_cur_t*, unsigned long, buf_block_t*, buf_block_t*, rtr_mbr*, rtr_mbr*, mtr_t*))[0x563cc24311c9]
gis/gis0rtree.cc:1161(rtr_page_split_and_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t const*, unsigned long, mtr_t*, dberr_t*))[0x563cc243458f]
btr/btr0btr.cc:2970(btr_page_split_and_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t const*, unsigned long, mtr_t*, dberr_t*))[0x563cc21aea79]
btr/btr0cur.cc:2615(btr_cur_pessimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*))[0x563cc21f393a]
row/row0ins.cc:3175(row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t*, mem_block_info_t*, mem_block_info_t*, dtuple_t*, unsigned long, que_thr_t*))[0x563cc1fc23ff]
row/row0ins.cc:3351(row_ins_sec_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, bool))[0x563cc1fc34c6]
row/row0ins.cc:3399(row_ins_index_entry(dict_index_t*, dtuple_t*, que_thr_t*))[0x563cc1fc38a5]
row/row0ins.cc:3565(row_ins_index_entry_step(ins_node_t*, que_thr_t*))[0x563cc1fc4a22]
row/row0ins.cc:3690(row_ins(ins_node_t*, que_thr_t*))[0x563cc1fc54b4]
row/row0ins.cc:3819(row_ins_step(que_thr_t*))[0x563cc1fc6409]
row/row0mysql.cc:1310(row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t))[0x563cc200a81c]
handler/ha_innodb.cc:7910(ha_innobase::write_row(unsigned char const*))[0x563cc1c4ec6b]
sql/handler.cc:7614(handler::ha_write_row(unsigned char const*))[0x563cc122f5ff]
sql/sql_insert.cc:2156(write_record(THD*, TABLE*, st_copy_info*, select_result*))[0x563cc08b73ce]
sql/sql_insert.cc:1128(mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*))[0x563cc08aeb80]
sql/sql_parse.cc:4570(mysql_execute_command(THD*, bool))[0x563cc097b5be]
sql/sql_parse.cc:8021(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x563cc0993cd3]
sql/sql_parse.cc:1898(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x563cc0969e60]
sql/sql_parse.cc:1409(do_command(THD*, bool))[0x563cc0966bb7]
sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x563cc0dd7f27]
sql/sql_connect.cc:1320(handle_one_connection)[0x563cc0dd7884]
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x563cc1a53b20]
nptl/pthread_create.c:478(start_thread)[0x7ff2bf8d4609]
230316 13:34:21 [ERROR] mysqld got signal 11 ;
Server version: 10.6.12-MariaDB source revision: 4c79e15cc3716f69c044d4287ad2160da8101cdc
sql/signal_handler.cc:238(handle_fatal_signal)[0x55de623fcff7]
sigaction.c:0(__restore_rt)[0x7f66191d5420]
include/rem0rec.h:689(rtr_update_mbr_field(btr_cur_t*, unsigned short*, btr_cur_t*, unsigned char*, rtr_mbr*, unsigned char*, mtr_t*))[0x55de62930c83]
gis/gis0rtree.cc:595(rtr_page_split_and_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t const*, unsigned long, mtr_t*, dberr_t*))[0x55de62934a5c]
btr/btr0btr.cc:2971(btr_page_split_and_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t const*, unsigned long, mtr_t*, dberr_t*))[0x55de6285d19e]
btr/btr0cur.cc:2616(btr_cur_pessimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*))[0x55de62874cbb]
row/row0ins.cc:3179(row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t*, mem_block_info_t*, mem_block_info_t*, dtuple_t*, unsigned long, que_thr_t*))[0x55de627ca922]
row/row0ins.cc:3354(row_ins_sec_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, bool))[0x55de627cda22]
row/row0ins.cc:3399(row_ins_step(que_thr_t*))[0x55de627cdf85]
row/row0mysql.cc:1312(row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t))[0x55de627de82a]
handler/ha_innodb.cc:7917(ha_innobase::write_row(unsigned char const*))[0x55de6271fabe]
sql/handler.cc:7614(handler::ha_write_row(unsigned char const*))[0x55de6240a99f]
sql/sql_insert.cc:2156(write_record(THD*, TABLE*, st_copy_info*, select_result*))[0x55de621a237d]
sql/sql_insert.cc:1128(mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*))[0x55de621aa86e]
sql/sql_parse.cc:4573(mysql_execute_command(THD*, bool))[0x55de621dede6]
sql/sql_parse.cc:8022(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55de621e13fb]
sql/sql_parse.cc:1955(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55de621e35ba]
sql/sql_parse.cc:1411(do_command(THD*, bool))[0x55de621e4ca3]
sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x55de622db1a7]
sql/sql_connect.cc:1324(handle_one_connection)[0x55de622db444]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x55de6266bc2c]
nptl/pthread_create.c:478(start_thread)[0x7f66191c9609]
Thank you for the report!
I repeated as described on 10.6-10.11,11.0 with InnoDB, not Myisam, no crash on MariaDB 10.3-10.5.
mariadbd: /10.6/src/storage/innobase/include/rem0rec.h:604: ulint rec_offs_n_fields(const rec_offs*): Assertion `offsets' failed.
230316 14:38:22 [ERROR] mysqld got signal 6 ;
Server version: 10.6.13-MariaDB-debug-log source revision: 49e2b50d594dfee462505b8fab2d8ba875dcf6e0
??:0(gsignal)[0x7ff2bf3c900b]
??:0(abort)[0x7ff2bf3a8859]
/lib/x86_64-linux-gnu/libc.so.6(+0x22729)[0x7ff2bf3a8729]
??:0(__assert_fail)[0x7ff2bf3b9fd6]
include/rem0rec.h:605(rec_offs_n_fields(unsigned short const*))[0x563cc1d21ec9]
rem/rem0rec.cc:519(rec_offs_validate(unsigned char const*, dict_index_t const*, unsigned short const*))[0x563cc1f5063a]
include/rem0rec.h:688(rec_offs_comp(unsigned short const*))[0x563cc1e0afbd]
gis/gis0rtree.cc:226(rtr_update_mbr_field(btr_cur_t*, unsigned short*, btr_cur_t*, unsigned char*, rtr_mbr*, unsigned char*, mtr_t*))[0x563cc242edf5]
gis/gis0rtree.cc:591(rtr_adjust_upper_level(btr_cur_t*, unsigned long, buf_block_t*, buf_block_t*, rtr_mbr*, rtr_mbr*, mtr_t*))[0x563cc24311c9]
gis/gis0rtree.cc:1161(rtr_page_split_and_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t const*, unsigned long, mtr_t*, dberr_t*))[0x563cc243458f]
btr/btr0btr.cc:2970(btr_page_split_and_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t const*, unsigned long, mtr_t*, dberr_t*))[0x563cc21aea79]
btr/btr0cur.cc:2615(btr_cur_pessimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*))[0x563cc21f393a]
row/row0ins.cc:3175(row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t*, mem_block_info_t*, mem_block_info_t*, dtuple_t*, unsigned long, que_thr_t*))[0x563cc1fc23ff]
row/row0ins.cc:3351(row_ins_sec_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, bool))[0x563cc1fc34c6]
row/row0ins.cc:3399(row_ins_index_entry(dict_index_t*, dtuple_t*, que_thr_t*))[0x563cc1fc38a5]
row/row0ins.cc:3565(row_ins_index_entry_step(ins_node_t*, que_thr_t*))[0x563cc1fc4a22]
row/row0ins.cc:3690(row_ins(ins_node_t*, que_thr_t*))[0x563cc1fc54b4]
row/row0ins.cc:3819(row_ins_step(que_thr_t*))[0x563cc1fc6409]
row/row0mysql.cc:1310(row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t))[0x563cc200a81c]
handler/ha_innodb.cc:7910(ha_innobase::write_row(unsigned char const*))[0x563cc1c4ec6b]
sql/handler.cc:7614(handler::ha_write_row(unsigned char const*))[0x563cc122f5ff]
sql/sql_insert.cc:2156(write_record(THD*, TABLE*, st_copy_info*, select_result*))[0x563cc08b73ce]
sql/sql_insert.cc:1128(mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*))[0x563cc08aeb80]
sql/sql_parse.cc:4570(mysql_execute_command(THD*, bool))[0x563cc097b5be]
sql/sql_parse.cc:8021(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x563cc0993cd3]
sql/sql_parse.cc:1898(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x563cc0969e60]
sql/sql_parse.cc:1409(do_command(THD*, bool))[0x563cc0966bb7]
sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x563cc0dd7f27]
sql/sql_connect.cc:1320(handle_one_connection)[0x563cc0dd7884]
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x563cc1a53b20]
nptl/pthread_create.c:478(start_thread)[0x7ff2bf8d4609]
230316 13:34:21 [ERROR] mysqld got signal 11 ;
Server version: 10.6.12-MariaDB source revision: 4c79e15cc3716f69c044d4287ad2160da8101cdc
sql/signal_handler.cc:238(handle_fatal_signal)[0x55de623fcff7]
sigaction.c:0(__restore_rt)[0x7f66191d5420]
include/rem0rec.h:689(rtr_update_mbr_field(btr_cur_t*, unsigned short*, btr_cur_t*, unsigned char*, rtr_mbr*, unsigned char*, mtr_t*))[0x55de62930c83]
gis/gis0rtree.cc:595(rtr_page_split_and_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t const*, unsigned long, mtr_t*, dberr_t*))[0x55de62934a5c]
btr/btr0btr.cc:2971(btr_page_split_and_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t const*, unsigned long, mtr_t*, dberr_t*))[0x55de6285d19e]
btr/btr0cur.cc:2616(btr_cur_pessimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*))[0x55de62874cbb]
row/row0ins.cc:3179(row_ins_sec_index_entry_low(unsigned long, btr_latch_mode, dict_index_t*, mem_block_info_t*, mem_block_info_t*, dtuple_t*, unsigned long, que_thr_t*))[0x55de627ca922]
row/row0ins.cc:3354(row_ins_sec_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, bool))[0x55de627cda22]
row/row0ins.cc:3399(row_ins_step(que_thr_t*))[0x55de627cdf85]
row/row0mysql.cc:1312(row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t))[0x55de627de82a]
handler/ha_innodb.cc:7917(ha_innobase::write_row(unsigned char const*))[0x55de6271fabe]
sql/handler.cc:7614(handler::ha_write_row(unsigned char const*))[0x55de6240a99f]
sql/sql_insert.cc:2156(write_record(THD*, TABLE*, st_copy_info*, select_result*))[0x55de621a237d]
sql/sql_insert.cc:1128(mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*))[0x55de621aa86e]
sql/sql_parse.cc:4573(mysql_execute_command(THD*, bool))[0x55de621dede6]
sql/sql_parse.cc:8022(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55de621e13fb]
sql/sql_parse.cc:1955(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55de621e35ba]
sql/sql_parse.cc:1411(do_command(THD*, bool))[0x55de621e4ca3]
sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x55de622db1a7]
sql/sql_connect.cc:1324(handle_one_connection)[0x55de622db444]
perfschema/pfs.cc:2204(pfs_spawn_thread)[0x55de6266bc2c]
nptl/pthread_create.c:478(start_thread)[0x7f66191c9609]