Assertion `(longlong) global_tmp_space_used >= 0' failed in int temp_file_size_cb_func, UBSAN pointer-overflow in reinit_io_cache

--source include/have_innodb.inc 

--source include/have_log_bin.inc

CREATE TABLE t1 (a INT) ENGINE=INNODB;

CREATE TABLE t2 (f INT) ENGINE=ARIA;

SET gtid_seq_no=1;

XA START 'a';

INSERT INTO t1 VALUES (1);

SET GLOBAL gtid_strict_mode=true;

INSERT INTO t2 VALUES (1);

mariadbd: /test/12.2_dbg/sql/mysqld.cc:3847: int temp_file_size_cb_func(struct tmp_file_tracking *, int): Assertion `(longlong) global_tmp_space_used >= 0' failed.

Core was generated by `/test/MD070825-mariadb-12.2.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.

Program terminated with signal SIGABRT, Aborted.

Download failed: Invalid argument.  Continuing without source file ./nptl/./nptl/pthread_kill.c.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 3880957)]

(gdb) bt

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

#1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78

#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89

#3  0x000070dedca4527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26

#4  0x000070dedca288ff in __GI_abort () at ./stdlib/abort.c:79

#5  0x000070dedca2881b in __assert_fail_base (fmt=0x70dedcbd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x56c5a6ff51c3 "(longlong) global_tmp_space_used >= 0", file=file@entry=0x56c5a6fef5ab "/test/12.2_dbg/sql/mysqld.cc", line=line@entry=3847, function=function@entry=0x56c5a6ff514b "int temp_file_size_cb_func(struct tmp_file_tracking *, int)") at ./assert/assert.c:96

#6  0x000070dedca3b517 in __assert_fail (assertion=0x56c5a6ff51c3 "(longlong) global_tmp_space_used >= 0", file=0x56c5a6fef5ab "/test/12.2_dbg/sql/mysqld.cc", line=3847, function=0x56c5a6ff514b "int temp_file_size_cb_func(struct tmp_file_tracking *, int)") at ./assert/assert.c:105

#7  0x000056c5a5dd53b4 in temp_file_size_cb_func (track=0x70c3cc030bd0, no_error=1) at /test/12.2_dbg/sql/mysqld.cc:3847

#8  0x000056c5a6cc9679 in tmp_file_track (info=0x70c3cc030ac8, file_size=18446744073709551615) at /test/12.2_dbg/mysys/mf_iocache.c:86

#9  0x000056c5a6ccd8e2 in _my_b_cache_write (info=0x70c3cc030ac8, Buffer=0x70c3cc03b908 "\276ڙh\002d", Count=18446744073709551615)at /test/12.2_dbg/mysys/mf_iocache.c:1604

#10 0x000056c5a6ccb1aa in my_b_flush_io_cache (info=0x70c3cc030ac8, need_append_buffer_lock=0) at /test/12.2_dbg/mysys/mf_iocache.c:1810

#11 0x000056c5a6ccad0e in reinit_io_cache (info=0x70c3cc030ac8, type=WRITE_CACHE, seek_offset=18446744073709551615, use_async_io=0 '\000', clear_cache=0 '\000') at /test/12.2_dbg/mysys/mf_iocache.c:556

#12 0x000056c5a65787a5 in binlog_cache_data::truncate (this=0x70c3cc030ac8, pos=18446744073709551615, reset_cache=false)at /test/12.2_dbg/sql/log_cache.h:372

#13 0x000056c5a65786fe in binlog_cache_data::restore_prev_position (this=0x70c3cc030ac8) at /test/12.2_dbg/sql/log_cache.h:152

#14 0x000056c5a657426b in binlog_truncate_trx_cache (thd=0x70c3cc000d58, cache_mngr=0x70c3cc030908, all=false) at /test/12.2_dbg/sql/log.cc:2135

#15 0x000056c5a6555146 in binlog_rollback (thd=0x70c3cc000d58, all=false)at /test/12.2_dbg/sql/log.cc:2508

#16 0x000056c5a63c42e2 in ha_rollback_trans (thd=0x70c3cc000d58, all=false)at /test/12.2_dbg/sql/handler.cc:2373

#17 0x000056c5a63c63f1 in ha_commit_trans (thd=0x70c3cc000d58, all=false)at /test/12.2_dbg/sql/handler.cc:2113

#18 0x000056c5a6191189 in trans_commit_stmt (thd=0x70c3cc000d58)at /test/12.2_dbg/sql/transaction.cc:498

#19 0x000056c5a5f947bb in mysql_execute_command (thd=0x70c3cc000d58, is_called_from_prepared_stmt=false) at /test/12.2_dbg/sql/sql_parse.cc:5943

#20 0x000056c5a5f83664 in mysql_parse (thd=0x70c3cc000d58, rawbuf=0x70c3cc019f20 "INSERT INTO t2 VALUES (1)", length=25, parser_state=0x70ded8143a10) at /test/12.2_dbg/sql/sql_parse.cc:7883

#21 0x000056c5a5f80a38 in dispatch_command (command=COM_QUERY, thd=0x70c3cc000d58, packet=0x70c3cc00b299 "INSERT INTO t2 VALUES (1)", packet_length=25, blocking=true) at /test/12.2_dbg/sql/sql_parse.cc:1878

#22 0x000056c5a5f84213 in do_command (thd=0x70c3cc000d58, blocking=true)at /test/12.2_dbg/sql/sql_parse.cc:1417

#23 0x000056c5a61714b9 in do_handle_one_connection (connect=0x56c5a9bbdd58, put_in_cache=true) at /test/12.2_dbg/sql/sql_connect.cc:1414

#24 0x000056c5a617125e in handle_one_connection (arg=0x56c5a9afd928)at /test/12.2_dbg/sql/sql_connect.cc:1326

#25 0x000070dedca9caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#26 0x000070dedcb29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

    Rel    o/d  Build   Commit                                    UniqueID observed             

CS  10.6   dbg  080825  13f337ce1f295f4aac75db681e00c71f2bf8acaf  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

CS  10.6   opt  080825  13f337ce1f295f4aac75db681e00c71f2bf8acaf  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

CS  10.11  dbg  080825  c45a34b2fb10e4e8f768e7e5fe846e9592eb6ea8  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

CS  10.11  opt  080825  c45a34b2fb10e4e8f768e7e5fe846e9592eb6ea8  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

CS  11.4   dbg  080825  03b31c0bd99390c1984f19a19f22dd6e77b7692e  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

CS  11.4   opt  080825  03b31c0bd99390c1984f19a19f22dd6e77b7692e  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

CS  11.8   dbg  080825  1a446ccc48528e88a3cd6cd1d1ec9e7492d342ca  (longlong) global_tmp_space_used >= 0|SIGABRT|temp_file_size_cb_func|tmp_file_track|_my_b_cache_write|my_b_flush_io_cache

CS  11.8   opt  080825  1a446ccc48528e88a3cd6cd1d1ec9e7492d342ca  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

CS  12.0   dbg  080825  aab83aecdca15738d114cf5a2f223f1d12e4e6bd  (longlong) global_tmp_space_used >= 0|SIGABRT|temp_file_size_cb_func|tmp_file_track|_my_b_cache_write|my_b_flush_io_cache

CS  12.0   opt  080825  aab83aecdca15738d114cf5a2f223f1d12e4e6bd  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

CS  12.1   dbg  080825  033471a367b4c60b7262e64f43f46b02e95b9d74  (longlong) global_tmp_space_used >= 0|SIGABRT|temp_file_size_cb_func|tmp_file_track|_my_b_cache_write|my_b_flush_io_cache

CS  12.1   opt  080825  033471a367b4c60b7262e64f43f46b02e95b9d74  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

CS  12.2   dbg  080825  e02f4d7e311e214ea62ff2e59599849e229f4165  (longlong) global_tmp_space_used >= 0|SIGABRT|temp_file_size_cb_func|tmp_file_track|_my_b_cache_write|my_b_flush_io_cache

CS  12.2   opt  080825  e02f4d7e311e214ea62ff2e59599849e229f4165  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

ES  10.5   dbg  080825  70586522eacf09d04d49962072e14325a75d8155  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

ES  10.5   opt  080825  70586522eacf09d04d49962072e14325a75d8155  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

ES  10.6   dbg  080825  9b794f34b48fb7eee490b6da44edc0f33a947447  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

ES  10.6   opt  080825  9b794f34b48fb7eee490b6da44edc0f33a947447  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

ES  11.4   dbg  080825  a1c03ccd54b582e75506687ee19b273ca897f261  (longlong) global_tmp_space_used >= 0|SIGABRT|temp_file_size_cb_func|tmp_file_track|_my_b_cache_write|my_b_flush_io_cache

ES  11.4   opt  080825  a1c03ccd54b582e75506687ee19b273ca897f261  MARIADBD_ERROR|mariadbd: Error writing file 'qa-roel-2-bin' (errno: 1950 "Unknown error 1950")

ES  11.8   dbg  080825  4cdf75ab6ba37d4e7e208690785e880ed3176f2f  (longlong) global_tmp_space_used >= 0|SIGABRT|temp_file_size_cb_func|tmp_file_track|_my_b_cache_write|my_b_flush_io_cache

ES  11.8   opt  080825  4cdf75ab6ba37d4e7e208690785e880ed3176f2f  No bug found                  

MS  5.5    dbg  070123  bac287c315b1792e7ae33f91add6a60292f9bae8  No bug found                  

MS  5.5    opt  070123  bac287c315b1792e7ae33f91add6a60292f9bae8  No bug found                  

MS  5.6    dbg  070123  dab95781a1244104d6b87020ac2fc4d190ba2946  No bug found                  

MS  5.6    opt  070123  dab95781a1244104d6b87020ac2fc4d190ba2946  No bug found                  

MS  5.7    dbg  070525  f7680e98b6bbe3500399fbad465d08a6b75d7a5c  No bug found                  

MS  5.7    opt  070525  f7680e98b6bbe3500399fbad465d08a6b75d7a5c  No bug found                  

MS  8.0    dbg  060224  49ef33f7edadef3ae04665e73d1babd40179a4f1  No bug found                  

MS  8.0    opt  060224  49ef33f7edadef3ae04665e73d1babd40179a4f1  No bug found                  

MS  9.1    dbg  211024  61a3a1d8ef15512396b4c2af46e922a19bf2b174  No bug found                  

MS  9.1    opt  211024  61a3a1d8ef15512396b4c2af46e922a19bf2b174  No bug found