Server crashes upon JSON_SCHEMA_VALID reading NULL from a user variable

SET @a= NULL;

SELECT JSON_SCHEMA_VALID(@a,'{}');

#3  <signal handler called>

#4  0x0000557c187ef941 in Binary_string::ptr (this=0x8) at /data/bld/11.1-asan/sql/sql_string.h:359

#5  0x0000557c19130bff in Item_func_json_schema_valid::fix_length_and_dec (this=0x6290000e69e8, thd=0x62c0000c0218) at /data/bld/11.1-asan/sql/item_jsonfunc.cc:4824

#6  0x0000557c195645fb in Item_func::fix_fields (this=0x6290000e69e8, thd=0x62c0000c0218, ref=0x6290000e6b30) at /data/bld/11.1-asan/sql/item_func.cc:367

#7  0x0000557c1884f1d9 in Item::fix_fields_if_needed (this=0x6290000e69e8, thd=0x62c0000c0218, ref=0x6290000e6b30) at /data/bld/11.1-asan/sql/item.h:1152

#8  0x0000557c1884f20f in Item::fix_fields_if_needed_for_scalar (this=0x6290000e69e8, thd=0x62c0000c0218, ref=0x6290000e6b30) at /data/bld/11.1-asan/sql/item.h:1161

#9  0x0000557c18977b90 in setup_fields (thd=0x62c0000c0218, ref_pointer_array=..., fields=..., column_usage=MARK_COLUMNS_READ, sum_func_list=0x6290000e7870, pre_fix=0x6290000e65b8, allow_sum_func=true) at /data/bld/11.1-asan/sql/sql_base.cc:8082

#10 0x0000557c18bffb03 in JOIN::prepare (this=0x6290000e74c0, tables_init=0x0, conds_init=0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x6290000e62e8, unit_arg=0x62c0000c46c0) at /data/bld/11.1-asan/sql/sql_select.cc:1549

#11 0x0000557c18c26f63 in mysql_select (thd=0x62c0000c0218, tables=0x0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x6290000e7490, unit=0x62c0000c46c0, select_lex=0x6290000e62e8) at /data/bld/11.1-asan/sql/sql_select.cc:5276

#12 0x0000557c18bf5fdd in handle_select (thd=0x62c0000c0218, lex=0x62c0000c45e0, result=0x6290000e7490, setup_tables_done_option=0) at /data/bld/11.1-asan/sql/sql_select.cc:630

#13 0x0000557c18b1de16 in execute_sqlcom_select (thd=0x62c0000c0218, all_tables=0x0) at /data/bld/11.1-asan/sql/sql_parse.cc:6041

#14 0x0000557c18b0e8ac in mysql_execute_command (thd=0x62c0000c0218, is_called_from_prepared_stmt=false) at /data/bld/11.1-asan/sql/sql_parse.cc:3956

#15 0x0000557c18b28947 in mysql_parse (thd=0x62c0000c0218, rawbuf=0x6290000e6238 "SELECT JSON_SCHEMA_VALID(@a,'{}')", length=33, parser_state=0x7fac2df1f9f0) at /data/bld/11.1-asan/sql/sql_parse.cc:7783

#16 0x0000557c18b00cca in dispatch_command (command=COM_QUERY, thd=0x62c0000c0218, packet=0x629000258219 "SELECT JSON_SCHEMA_VALID(@a,'{}')", packet_length=33, blocking=true) at /data/bld/11.1-asan/sql/sql_parse.cc:1892

#17 0x0000557c18afda07 in do_command (thd=0x62c0000c0218, blocking=true) at /data/bld/11.1-asan/sql/sql_parse.cc:1405

#18 0x0000557c18fc32fa in do_handle_one_connection (connect=0x608000002d38, put_in_cache=true) at /data/bld/11.1-asan/sql/sql_connect.cc:1416

#19 0x0000557c18fc2cbb in handle_one_connection (arg=0x608000002cb8) at /data/bld/11.1-asan/sql/sql_connect.cc:1318

#20 0x0000557c19bcac0c in pfs_spawn_thread (arg=0x617000005b98) at /data/bld/11.1-asan/storage/perfschema/pfs.cc:2201

#21 0x00007fac356a8044 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#22 0x00007fac3572861c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

commit 5d3e14d780a227d87ea2831481958ac4d5bbd905

Author: Rucha Deodhar

AuthorDate: Tue Sep 19 00:54:19 2023 +0530

CommitDate: Thu Nov 2 19:05:11 2023 +0530

    MDEV-31599: Assertion `0' failed in Item_param::can_return_value

    from Item::val_json, UBSAN: member access within null pointer of

    type 'struct String' in sql/item_jsonfunc.cc