SIGSEGV in ha_innobase::update_row, UBSAN: member access within null pointer of type 'struct TABLE_LIST'

SET GLOBAL event_scheduler=1;

ALTER TABLE mysql.event ENGINE=InnoDB;

CREATE EVENT e_x2 ON SCHEDULE EVERY 1 SECOND DO DROP TABLE x_t;

Core was generated by `/test/MD080923-mariadb-11.3.0-linux-x86_64-opt/bin/mariadbd --no-defaults --cor'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  ha_innobase::update_row (this=0x14f5e802a110, 

    old_row=0x14f5e8033770 ")\374test", ' ' <repeats 188 times>, "e_x2  "..., 

    new_row=0x14f5e8032e40 "!\374test", ' ' <repeats 188 times>, "e_x2  "...)

    at /test/11.3_opt/sql/sql_trigger.h:43

[Current thread is 1 (Thread 0x14f62c0de700 (LWP 1554761))]

(gdb) bt

#0  ha_innobase::update_row (this=0x14f5e802a110, old_row=0x14f5e8033770 ")\374test", ' ' <repeats 188 times>, "e_x2  "..., new_row=0x14f5e8032e40 "!\374test", ' ' <repeats 188 times>, "e_x2  "...) at /test/11.3_opt/sql/sql_trigger.h:43

#1  0x0000555bbe85115e in handler::ha_update_row (this=0x14f5e802a110, old_data=0x14f5e8033770 ")\374test", ' ' <repeats 188 times>, "e_x2  "..., new_data=0x14f5e8032e40 "!\374test", ' ' <repeats 188 times>, "e_x2  "...) at /test/11.3_opt/sql/handler.cc:7891

#2  0x0000555bbe9b6a48 in Event_db_repository::update_timing_fields_for_event (this=<optimized out>, thd=thd@entry=0x14f5e8018db8, event_db_name=0x14f5dc000c40, event_name=0x14f5dc000c50, last_executed=last_executed@entry=1695286210, status=status@entry=1) at /test/11.3_opt/sql/event_db_repository.cc:1159

#3  0x0000555bbe9b490e in Event_queue::get_top_for_execution_if_time (this=0x555bc100e4d0, thd=thd@entry=0x14f5e8018db8, event_name=event_name@entry=0x14f62c0ddd48) at /test/11.3_opt/sql/event_queue.cc:696

#4  0x0000555bbe9b37df in Event_scheduler::run (this=this@entry=0x555bc125adc0, thd=0x14f5e8018db8) at /test/11.3_opt/sql/event_scheduler.cc:492

#5  0x0000555bbe9b38fc in event_scheduler_thread (arg=0x14f5e8017628) at /test/11.3_opt/sql/event_scheduler.cc:236

#6  0x000014f659002609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#7  0x000014f658bee133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Core was generated by `/test/MD080923-mariadb-10.4.32-linux-x86_64-opt/bin/mariadbd --no-defaults --co'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  calc_row_difference (uvect=<optimized out>, old_row=<optimized out>, 

    new_row=<optimized out>, table=0x1488ec022038, upd_buff=<optimized out>, 

    buff_len=<optimized out>, prebuilt=<optimized out>, 

    auto_inc=<optimized out>) at /test/10.4_opt/sql/sql_trigger.h:42

[Current thread is 1 (Thread 0x14890b8b2700 (LWP 1315776))]

(gdb) bt

#0  calc_row_difference (uvect=<optimized out>, old_row=<optimized out>, new_row=<optimized out>, table=0x1488ec022038, upd_buff=<optimized out>, buff_len=<optimized out>, prebuilt=<optimized out>, auto_inc=<optimized out>) at /test/10.4_opt/sql/sql_trigger.h:42

#1  0x000055d252767664 in ha_innobase::update_row (this=0x1488ec032380, old_row=0x1488ec0330a8 ")\374test", ' ' <repeats 188 times>, "e_x2  "..., new_row=0x1488ec032b10 "!\374test", ' ' <repeats 188 times>, "e_x2  "...) at /test/10.4_opt/storage/innobase/handler/ha_innodb.cc:8932

#2  0x000055d2524d7d66 in handler::ha_update_row (this=0x1488ec032380, old_data=0x1488ec0330a8 ")\374test", ' ' <repeats 188 times>, "e_x2  "..., new_data=0x1488ec032b10 "!\374test", ' ' <repeats 188 times>, "e_x2  "...) at /test/10.4_opt/sql/handler.cc:6916

#3  0x000055d25264ce00 in Event_db_repository::update_timing_fields_for_event (this=<optimized out>, thd=thd@entry=0x1488ec016f38, event_db_name=<optimized out>, event_name=0x1488e0000c50, last_executed=last_executed@entry=1695289600, status=status@entry=1) at /test/10.4_opt/sql/event_db_repository.cc:1154

#4  0x000055d25264af8e in Event_queue::get_top_for_execution_if_time (this=0x55d254c44b20, thd=thd@entry=0x1488ec016f38, event_name=event_name@entry=0x14890b8b1e08) at /test/10.4_opt/sql/event_queue.cc:690

#5  0x000055d252649e8f in Event_scheduler::run (this=this@entry=0x55d254c11da0, thd=0x1488ec016f38) at /test/10.4_opt/sql/event_scheduler.cc:478

#6  0x000055d252649fac in event_scheduler_thread (arg=0x1488ec021ed8) at /test/10.4_opt/sql/event_scheduler.cc:235

#7  0x000014894a872609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#8  0x000014894a45e133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

mariadbd: /test/10.4_dbg/sql/sql_base.cc:897: void close_thread_tables(THD*): Assertion `thd->transaction.stmt.is_empty() || thd->in_sub_stmt || (thd->state_flags & Open_tables_state::BACKUPS_AVAIL)' failed.

Core was generated by `/test/MD080923-mariadb-10.4.32-linux-x86_64-dbg/bin/mariadbd --no-defaults --co'.

Program terminated with signal SIGABRT, Aborted.

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

[Current thread is 1 (Thread 0x14d87ceac700 (LWP 2392110))]

(gdb) bt

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

#1  0x000014d897977859 in __GI_abort () at abort.c:79

#2  0x000014d897977729 in __assert_fail_base (fmt=0x14d897b0d588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55c18e9b1c48 "thd->transaction.stmt.is_empty() || thd->in_sub_stmt || (thd->state_flags & Open_tables_state::BACKUPS_AVAIL)", file=0x55c18e9b1570 "/test/10.4_dbg/sql/sql_base.cc", line=897, function=<optimized out>) at assert.c:92

#3  0x000014d897988fd6 in __GI___assert_fail (assertion=assertion@entry=0x55c18e9b1c48 "thd->transaction.stmt.is_empty() || thd->in_sub_stmt || (thd->state_flags & Open_tables_state::BACKUPS_AVAIL)", file=file@entry=0x55c18e9b1570 "/test/10.4_dbg/sql/sql_base.cc", line=line@entry=897, function=function@entry=0x55c18e9b1c28 "void close_thread_tables(THD*)") at assert.c:101

#4  0x000055c18dd3e683 in close_thread_tables (thd=thd@entry=0x14d838000d28) at /test/10.4_dbg/sql/handler.h:1712

#5  0x000055c18e228cf8 in Event_db_repository::create_event (this=<optimized out>, thd=thd@entry=0x14d838000d28, parse_data=parse_data@entry=0x14d8380125e8, event_already_exists=event_already_exists@entry=0x14d87cea961f) at /test/10.4_dbg/sql/event_db_repository.cc:748

#6  0x000055c18dec125d in Events::create_event (thd=thd@entry=0x14d838000d28, parse_data=0x14d8380125e8) at /test/10.4_dbg/sql/events.cc:364

#7  0x000055c18ddb5f7d in mysql_execute_command (thd=thd@entry=0x14d838000d28) at /test/10.4_dbg/sql/sql_parse.cc:5268

#8  0x000055c18ddbb262 in mysql_parse (thd=thd@entry=0x14d838000d28, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14d87ceab3b0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:8012

#9  0x000055c18ddbdd7d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14d838000d28, packet=packet@entry=0x14d838019509 "CREATE EVENT e_x2 ON SCHEDULE EVERY 1 SECOND DO DROP TABLE x_t", packet_length=packet_length@entry=62, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_class.h:1231

#10 0x000055c18ddc05a7 in do_command (thd=0x14d838000d28) at /test/10.4_dbg/sql/sql_parse.cc:1378

#11 0x000055c18dedd4e9 in do_handle_one_connection (connect=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1420

#12 0x000055c18dedd5a5 in handle_one_connection (arg=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1324

#13 0x000014d897e88609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#14 0x000014d897a74133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95