CREATE TABLE t (

  id int(11) NOT NULL,

  a varchar(16),

  s point NOT NULL DEFAULT point(0,0),

  d date,

  PRIMARY KEY (id),

  KEY (a,s,id,d),

  SPATIAL KEY (s)

) ENGINE=Aria;

INSERT INTO t (id,a) VALUES

  (1,'m'),(2,'n'),(3,NULL),(4,'i'),(5,'147'),(6,NULL),(7,'closely'),

  (92,NULL),(184,NULL),(185,NULL),(186,'gender'),(187,NULL),(188,'room'),

  (189,'118'),(190,'meal'),(191,NULL),(22,NULL),(0,NULL);

--error ER_CANT_CREATE_GEOMETRY_OBJECT

UPDATE t SET s = '' ORDER BY a;

# Cleanup

DROP TABLE t;

==819741==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7f6b945a58fc at pc 0x7f6b9c848061 bp 0x7f6b945a2d10 sp 0x7f6b945a24c0

WRITE of size 196 at 0x7f6b945a58fc thread T5

    #0 0x7f6b9c848060 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827

    #1 0x5632d0e39635 in _ma_seq_search /data/src/10.5/storage/maria/ma_search.c:405

    #2 0x5632d0ec1241 in w_search /data/src/10.5/storage/maria/ma_write.c:646

    #3 0x5632d0ebfc38 in _ma_ck_real_write_btree /data/src/10.5/storage/maria/ma_write.c:532

    #4 0x5632d0ebf856 in _ma_ck_write_btree_with_log /data/src/10.5/storage/maria/ma_write.c:498

    #5 0x5632d0ebf281 in _ma_ck_write_btree /data/src/10.5/storage/maria/ma_write.c:456

    #6 0x5632d0ebefce in _ma_ck_write /data/src/10.5/storage/maria/ma_write.c:441

    #7 0x5632d0eba5e6 in maria_update /data/src/10.5/storage/maria/ma_update.c:133

    #8 0x5632d0d62297 in ha_maria::update_row(unsigned char const*, unsigned char const*) /data/src/10.5/storage/maria/ha_maria.cc:2416

    #9 0x5632d07b5b38 in handler::ha_update_row(unsigned char const*, unsigned char const*) /data/src/10.5/sql/handler.cc:7313

    #10 0x5632d027aec1 in mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*) /data/src/10.5/sql/sql_update.cc:1085

    #11 0x5632cff7022f in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4472

    #12 0x5632cff897e6 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8106

    #13 0x5632cff5f377 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891

    #14 0x5632cff5bd14 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375

    #15 0x5632d03a8fea in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1416

    #16 0x5632d03a89b2 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1318

    #17 0x5632d0ff870b in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201

    #18 0x7f6b9bca7fd3 in start_thread nptl/pthread_create.c:442

    #19 0x7f6b9bd285bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Address 0x7f6b945a58fc is located in stack of thread T5 at offset 11132 in frame

    #0 0x5632d0e38ea1 in _ma_seq_search /data/src/10.5/storage/maria/ma_search.c:367

  This frame has 5 object(s):

    [48, 56) 'not_used' (line 369)

    [80, 88) 'page' (line 371)

    [112, 144) 'tmp_key' (line 374)

    [176, 208) '_db_stack_frame_' (line 375)

    [240, 2455) 't_buff' (line 370) <== Memory access at offset 11132 overflows this variable

HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork

      (longjmp and C++ exceptions *are* supported)

Thread T5 created by T0 here:

    #0 0x7f6b9c849726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207

    #1 0x5632d0ff443e in my_thread_create /data/src/10.5/storage/perfschema/my_thread.h:52

    #2 0x5632d0ff8afa in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252

    #3 0x5632cfc52f1b in inline_mysql_thread_create /data/src/10.5/include/mysql/psi/mysql_thread.h:1323

    #4 0x5632cfc68c8d in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6060

    #5 0x5632cfc6929e in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6119

    #6 0x5632cfc69571 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6184

    #7 0x5632cfc6a162 in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6311

    #8 0x5632cfc6850a in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5706

    #9 0x5632cfc51928 in main /data/src/10.5/sql/main.cc:25

    #10 0x7f6b9bc46189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy

Shadow bytes around the buggy address:

  0x0fedf28acac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0fedf28acad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0fedf28acae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0fedf28acaf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0fedf28acb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

=>0x0fedf28acb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[04]

  0x0fedf28acb20: cb cb cb cb 00 00 00 00 00 00 00 00 00 00 00 00

  0x0fedf28acb30: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1

  0x0fedf28acb40: f1 f1 01 f2 00 f2 f2 f2 f8 f2 f2 f2 00 f2 f2 f2

  0x0fedf28acb50: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2

  0x0fedf28acb60: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 f3

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==819741==ABORTING

230514 17:27:12 [ERROR] mysqld got signal 6 ;

This could be because you hit a bug. It is also possible that this binary

or one of the libraries it was linked against is corrupt, improperly built,

or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help

diagnose the problem, but since we have already crashed, 

something is definitely wrong and this may fail.

Server version: 10.5.21-MariaDB-debug-log source revision: 279d0120f5769462c3418fb32387c3e3b7f0ce4b

key_buffer_size=1048576

read_buffer_size=131072

max_used_connections=1

max_threads=153

thread_count=1

It is possible that mysqld could use up to 

key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63762 K  bytes of memory

Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x62b000069218

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x7f6b945a9c50 thread_stack 0x100000

sanitizer_common/sanitizer_common_interceptors.inc:4277(__interceptor_backtrace.part.0)[0x7f6b9c851f31]

mysys/stacktrace.c:212(my_print_stacktrace)[0x5632d1c59771]

sql/signal_handler.cc:241(handle_fatal_signal)[0x5632d0774f47]

libc_sigaction.c:0(__restore_rt)[0x7f6b9bc5af90]

nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7f6b9bca9ccc]

posix/raise.c:27(__GI_raise)[0x7f6b9bc5aef2]

stdlib/abort.c:81(__GI_abort)[0x7f6b9bc45472]

sanitizer_common/sanitizer_posix_libcdep.cpp:137(__sanitizer::Abort())[0x7f6b9c8d650f]

sanitizer_common/sanitizer_termination.cpp:59(__sanitizer::Die())[0x7f6b9c8e2ba1]

asan/asan_report.cpp:190(__asan::ScopedInErrorReport::~ScopedInErrorReport())[0x7f6b9c8c1f5e]

asan/asan_report.cpp:479(__asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool))[0x7f6b9c8c14c6]

sanitizer_common/sanitizer_common_interceptors.inc:827(memcpy)[0x7f6b9c84807f]

maria/ma_search.c:406(_ma_seq_search)[0x5632d0e39636]

maria/ma_write.c:646(w_search)[0x5632d0ec1242]

maria/ma_write.c:532(_ma_ck_real_write_btree)[0x5632d0ebfc39]

maria/ma_write.c:498(_ma_ck_write_btree_with_log)[0x5632d0ebf857]

maria/ma_write.c:456(_ma_ck_write_btree)[0x5632d0ebf282]

maria/ma_write.c:441(_ma_ck_write)[0x5632d0ebefcf]

maria/ma_update.c:133(maria_update)[0x5632d0eba5e7]

maria/ha_maria.cc:2416(ha_maria::update_row(unsigned char const*, unsigned char const*))[0x5632d0d62298]

sql/handler.cc:7313(handler::ha_update_row(unsigned char const*, unsigned char const*))[0x5632d07b5b39]

sql/sql_update.cc:1085(mysql_update(THD*, TABLE_LIST*, List<Item>&, List<Item>&, Item*, unsigned int, st_order*, unsigned long long, bool, unsigned long long*, unsigned long long*))[0x5632d027aec2]

sql/sql_parse.cc:4472(mysql_execute_command(THD*))[0x5632cff70230]

sql/sql_parse.cc:8106(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x5632cff897e7]

sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5632cff5f378]

sql/sql_parse.cc:1375(do_command(THD*))[0x5632cff5bd15]

sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x5632d03a8feb]

sql/sql_connect.cc:1320(handle_one_connection)[0x5632d03a89b3]

perfschema/pfs.cc:2203(pfs_spawn_thread)[0x5632d0ff870c]

nptl/pthread_create.c:442(start_thread)[0x7f6b9bca7fd4]

x86_64/clone3.S:83(clone3)[0x7f6b9bd285bc]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x62b000038238): UPDATE t SET s = '' ORDER BY a

Connection ID (thread ID): 4

Status: NOT_KILLED

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off

The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mysqld/ contains

information that should help you find out what is causing the crash.

Writing a core file...

Working directory at /dev/shm/var_auto_o2H6/mysqld.1/data

Resource Limits:

Limit                     Soft Limit           Hard Limit           Units     

Max cpu time              unlimited            unlimited            seconds   

Max file size             unlimited            unlimited            bytes     

Max data size             unlimited            unlimited            bytes     

Max stack size            8388608              unlimited            bytes     

Max core file size        unlimited            unlimited            bytes     

Max resident set          unlimited            unlimited            bytes     

Max processes             385793               385793               processes 

Max open files            1024                 1024                 files     

Max locked memory         12649951232          12649951232          bytes     

Max address space         unlimited            unlimited            bytes     

Max file locks            unlimited            unlimited            locks     

Max pending signals       385793               385793               signals   

Max msgqueue size         819200               819200               bytes     

Max nice priority         0                    0                    

Max realtime priority     0                    0                    

Max realtime timeout      unlimited            unlimited            us        

mysqltest: At line 17: query 'UPDATE t SET s = '' ORDER BY a' failed with wrong errno 1034: 'Index for table 't' is corrupt; try to repair it', instead of 1416...

CREATE TABLE t (

  a varchar(16),

  s point NOT NULL DEFAULT point(0,0),

  KEY (a,s),

  SPATIAL KEY (s)

) ENGINE=Aria;

INSERT INTO t (a) VALUES ('m'),(NULL);

--error ER_CANT_CREATE_GEOMETRY_OBJECT

UPDATE t SET s = '' ORDER BY a;

# Cleanup

DROP TABLE t;

mysqltest: At line 11: query 'UPDATE t SET s = '' ORDER BY a' failed with wrong errno HA_ERR_CRASHED (126): 'Got error '126 "Index is corrupted"' for './test/t.MAI'', instead of ER_CANT_CREATE_GEOMETRY_OBJECT (1416)...