SIGSEGV in json_get_path_next | Item_func_json_extract::read_json

CREATE TABLE t (id CHAR AS (JSON_COMPACT (JSON_EXTRACT(doc,"$._id"))) UNIQUE KEY,doc JSON,CONSTRAINT notnu CHECK (id IS NOT NULL));

INSERT INTO t (doc) VALUES ('{ "_id" : { "$oid" : "0ca0b0f0" },"a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" :0} ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] }');

Core was generated by `/test/GAL_MD230523-mariadb-10.4.30-linux-x86_64-dbg/bin/mariadbd --no-defaults'.

Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

[Current thread is 1 (Thread 0x153f00088700 (LWP 3414440))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x000055da0a4b603d in my_write_core (sig=sig@entry=6) at /test/10.4_dbg/mysys/stacktrace.c:386

#2  0x000055da09cc5472 in handle_fatal_signal (sig=6) at /test/10.4_dbg/sql/signal_handler.cc:372

#3  <signal handler called>

#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

#5  0x0000153f1a5c5859 in __GI_abort () at abort.c:79

#6  0x0000153f1a5c5729 in __assert_fail_base (fmt=0x153f1a75b588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55da0a62bb58 "field_max_length <= m_return_field_def.length || m_return_field_def.type_handler()->cmp_type() == INT_RESULT || (_current_thd()->stmt_arena->is_stmt_execute() && m_return_field_def.length == 8 && (m_r"..., file=0x55da0a62afa6 "/test/10.4_dbg/sql/sp_head.cc", line=913, function=<optimized out>) at assert.c:92

#7  0x0000153f1a5d6fd6 in __GI___assert_fail (assertion=assertion@entry=0x55da0a62bb58 "field_max_length <= m_return_field_def.length || m_return_field_def.type_handler()->cmp_type() == INT_RESULT || (_current_thd()->stmt_arena->is_stmt_execute() && m_return_field_def.length == 8 && (m_r"..., file=file@entry=0x55da0a62afa6 "/test/10.4_dbg/sql/sp_head.cc", line=line@entry=913, function=function@entry=0x55da0a62bb08 "Field* sp_head::create_result_field(uint, const LEX_CSTRING*, TABLE*) const") at assert.c:101

#8  0x000055da09997a36 in sp_head::create_result_field (this=0x153eb0067810, field_max_length=field_max_length@entry=4294967295, field_name=field_name@entry=0x153eb00341f8, table=0x153eb0054610) at /test/10.4_dbg/sql/sql_class.h:1107

#9  0x000055da09cf193e in Item_sp::init_result_field (this=this@entry=0x153eb0034268, thd=thd@entry=0x153eb0000d28, max_length=4294967295, maybe_null=1, null_value=null_value@entry=0x153eb003421e, name=name@entry=0x153eb00341f8) at /test/10.4_dbg/sql/item.cc:2908

#10 0x000055da09d732d8 in Item_func_sp::fix_fields (this=0x153eb00341a8, thd=0x153eb0000d28, ref=0x153eb00343c0) at /test/10.4_dbg/sql/item_func.cc:6632

#11 0x000055da09d5a5d9 in Item::fix_fields_if_needed (ref=0x153eb00343c0, thd=0x153eb0000d28, this=0x153eb00341a8) at /test/10.4_dbg/sql/item.h:966

#12 Item_func::fix_fields (this=this@entry=0x153eb0034330, thd=thd@entry=0x153eb0000d28, ref=ref@entry=0x0) at /test/10.4_dbg/sql/item_func.cc:355

#13 0x000055da09d73dd8 in Item_func_set_user_var::fix_fields (this=0x153eb0034330, thd=0x153eb0000d28, ref=0x0) at /test/10.4_dbg/sql/item_func.cc:4631

#14 0x000055da09979d1d in set_var_user::check (this=0x153eb0034498, thd=<optimized out>) at /test/10.4_dbg/sql/set_var.cc:873

#15 0x000055da0997bdd1 in sql_set_variables (thd=thd@entry=0x153eb0000d28, var_list=var_list@entry=0x153eb0053678, free=free@entry=true) at /test/10.4_dbg/sql/set_var.cc:733

#16 0x000055da09a4b403 in mysql_execute_command (thd=0x153eb0000d28) at /test/10.4_dbg/sql/sql_parse.cc:5045

#17 0x000055da09992bd7 in sp_instr_stmt::exec_core (this=0x153eb00344b8, thd=<optimized out>, nextp=0x153f00085164) at /test/10.4_dbg/sql/sp_head.cc:3694

#18 0x000055da0999f474 in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x153eb0034500, thd=thd@entry=0x153eb0000d28, nextp=nextp@entry=0x153f00085164, open_tables=open_tables@entry=false, instr=instr@entry=0x153eb00344b8) at /test/10.4_dbg/sql/sp_head.cc:3424

#19 0x000055da0999fbb5 in sp_instr_stmt::execute (this=0x153eb00344b8, thd=0x153eb0000d28, nextp=0x153f00085164) at /test/10.4_dbg/sql/sp_head.cc:3600

#20 0x000055da09998266 in sp_head::execute (this=this@entry=0x153eb00332a0, thd=thd@entry=0x153eb0000d28, merge_da_on_success=merge_da_on_success@entry=false) at /test/10.4_dbg/sql/sp_head.cc:1365

#21 0x000055da099997cc in sp_head::execute_trigger (this=0x153eb00332a0, thd=thd@entry=0x153eb0000d28, db_name=0x153eb0059638, table_name=0x153eb0059648, grant_info=grant_info@entry=0x153eb0066fd0) at /test/10.4_dbg/sql/sp_head.cc:1838

#22 0x000055da09b1378e in Table_triggers_list::process_triggers (this=this@entry=0x153eb005a0c0, thd=thd@entry=0x153eb0000d28, event=event@entry=TRG_EVENT_INSERT, time_type=time_type@entry=TRG_ACTION_BEFORE, old_row_is_record1=old_row_is_record1@entry=true) at /test/10.4_dbg/sql/sql_trigger.cc:2247

#23 0x000055da099e1462 in fill_record_n_invoke_before_triggers (thd=thd@entry=0x153eb0000d28, table=table@entry=0x153eb005a498, ptr=0x153eb0064b68, values=@0x153eb0013140: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x153eb00131f0, last = 0x153eb00131f0, elements = 1}, <No data fields>}, ignore_errors=ignore_errors@entry=false, event=event@entry=TRG_EVENT_INSERT) at /test/10.4_dbg/sql/sql_base.cc:8990

#24 0x000055da09a16d8c in mysql_insert (thd=thd@entry=0x153eb0000d28, table_list=<optimized out>, fields=@0x153eb0005a00: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55da0aec0ab0 <end_of_list>, last = 0x153eb0005a00, elements = 0}, <No data fields>}, values_list=@0x153eb0005a48: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x153eb0013200, last = 0x153eb0013200, elements = 1}, <No data fields>}, update_fields=@0x153eb0005a30: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55da0aec0ab0 <end_of_list>, last = 0x153eb0005a30, elements = 0}, <No data fields>}, update_values=@0x153eb0005a18: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55da0aec0ab0 <end_of_list>, last = 0x153eb0005a18, elements = 0}, <No data fields>}, duplic=<optimized out>, ignore=<optimized out>) at /test/10.4_dbg/sql/sql_insert.cc:1027

#25 0x000055da09a4a04c in mysql_execute_command (thd=thd@entry=0x153eb0000d28) at /test/10.4_dbg/sql/sql_parse.cc:4613

#26 0x000055da09a513f9 in mysql_parse (thd=thd@entry=0x153eb0000d28, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x153f000873b0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:8008

#27 0x000055da09a53f76 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x153eb0000d28, packet=packet@entry=0x153eb0019509 "insert INTO t values(1)", packet_length=packet_length@entry=23, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_class.h:1231

#28 0x000055da09a5680a in do_command (thd=0x153eb0000d28) at /test/10.4_dbg/sql/sql_parse.cc:1378

#29 0x000055da09b752b6 in do_handle_one_connection (connect=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1420

#30 0x000055da09b75372 in handle_one_connection (arg=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1324

#31 0x0000153f1aad6609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#32 0x0000153f1a6c2133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95