Server hangs when setting NEW=OLD on a multi-row table

CREATE TABLE t1 (a INT);

INSERT INTO t1 VALUES (1),(2),(3);

CREATE TRIGGER t1_bu BEFORE UPDATE ON t1 FOR EACH ROW SET NEW = OLD;

UPDATE t1 SET a = a + 100;   -- server hangs forever 

CREATE TABLE t1 (a INT);

INSERT INTO t1 VALUES (1);

CREATE TRIGGER t1_bu BEFORE UPDATE ON t1 FOR EACH ROW SET NEW = OLD;

UPDATE t1 SET a = a + 100; 

UPDATE t1 SET a = a + 100; 

Core was generated by `/test/mtest/MDEV-34723/MD190626-mariadb-13.0.0-linux-x86_64-opt/bin/mariadbd --'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  Item::fixed (this=0x0)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/item.h:1064

[Current thread is 1 (LWP 1694211)]

(gdb) bt

#0  Item::fixed (this=0x0)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/item.h:1064

#1  Item::fix_fields_if_needed (this=0x0, ref=0x74c020023d38, thd=<optimized out>)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/item.h:1147

#2  THD::sp_fix_func_item (this=0x74c020000c68, it_addr=0x74c020023d38)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sp_head.cc:395

#3  THD::sp_fix_func_item_for_assignment (this=0x74c020000c68, to=0x74c0200282d0, it_addr=0x74c020023d38)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sp_head.cc:424

#4  0x000058b9cf3ed7f5 in Item_trigger_field::set_value (this=0x74c02005f500, thd=0x74c020000c68, it=0x74c020023d38)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/item.cc:10655

#5  0x000058b9cf3ee2f9 in Item_trigger_field::set_value (this=0x74c02005f500, thd=0x74c020000c68, it=0x74c020023d38)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/item.h:7717

#6  Item_trigger_row::set_value (this=<optimized out>, thd=0x74c020000c68, ctx=<optimized out>, it=0x74c020023f88)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/item.cc:10908

#7  0x000058b9cf2f0699 in sp_instr_set_trigger_row::exec_core (this=0x74c020023eb8, thd=0x74c020000c68, nextp=0x74e2d910b234)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sp_instr.cc:1740

#8  0x000058b9cf2ed87f in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x74c020023ef0, thd=thd@entry=0x74c020000c68, nextp=nextp@entry=0x74e2d910b234, open_tables=true, instr=instr@entry=0x74c020023eb8, rerun_the_same_instr=<optimized out>)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sp_instr.cc:420

#9  0x000058b9cf2ede9b in sp_lex_keeper::validate_lex_and_exec_core (this=0x74c020023ef0, thd=0x74c020000c68, nextp=0x74e2d910b234, open_tables=<optimized out>, instr=0x74c020023eb8)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sp_instr.cc:599

#10 0x000058b9cf09095a in sp_head::execute (this=this@entry=0x74c020022aa0, thd=thd@entry=0x74c020000c68, merge_da_on_success=false)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sp_head.cc:1293

#11 0x000058b9cf091a27 in sp_head::execute_trigger (this=0x74c020022aa0, thd=0x74c020000c68, db_name=<optimized out>, table_name=<optimized out>, grant_info=<optimized out>)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sp_head.cc:1806

#12 0x000058b9cf20bae6 in Table_triggers_list::process_triggers (this=0x74c020028560, thd=0x74c020000c68, event=TRG_EVENT_UPDATE, time_type=<optimized out>, old_row_is_record1=<optimized out>, skip_row_indicator=0x74e2d910bab0, fields_in_update_stmt=0x74c020005ce8)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_trigger.cc:2880

#13 0x000058b9cf0cf271 in fill_record_n_invoke_before_triggers (thd=thd@entry=0x74c020000c68, table=table@entry=0x74c0200546d8, fields=@0x74c020005ce8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x74c020018520, last = 0x74c020018520, elements = 1}, <No data fields>}, values=@0x74c020006170: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x74c020018530, last = 0x74c020018530, elements = 1}, <No data fields>}, ignore_errors=<optimized out>, event=event@entry=TRG_EVENT_UPDATE, skip_row_indicator=0x74e2d910bab0)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_base.cc:9417

#14 0x000058b9cf21ebfd in Sql_cmd_update::update_single_table (this=this@entry=0x74c020018540, thd=thd@entry=0x74c020000c68)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_update.cc:991

#15 0x000058b9cf223bae in Sql_cmd_update::execute_inner (this=0x74c020018540, thd=0x74c020000c68)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_update.cc:3237

#16 0x000058b9cf1b772b in Sql_cmd_dml::execute (this=0x74c020018540, thd=0x74c020000c68)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_select.cc:34848

#17 0x000058b9cf13dabb in mysql_execute_command (thd=thd@entry=0x74c020000c68, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_parse.cc:4442

#18 0x000058b9cf138e41 in mysql_parse (thd=thd@entry=0x74c020000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x74e2d910c410)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_parse.cc:7937

#19 0x000058b9cf13725d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x74c020000c68, packet=packet@entry=0x74c020008cc9 "UPDATE t1 SET a = a + 100", packet_length=packet_length@entry=25, blocking=true)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_parse.cc:1896

#20 0x000058b9cf139251 in do_command (thd=thd@entry=0x74c020000c68, blocking=true)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_parse.cc:1432

#21 0x000058b9cf269fad in do_handle_one_connection (connect=<optimized out>, connect@entry=0x58ba02a77f88, put_in_cache=true)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_connect.cc:1503

#22 0x000058b9cf269d6f in handle_one_connection (arg=arg@entry=0x58ba02a77f88)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/sql/sql_connect.cc:1415

#23 0x000058b9cf62bbb3 in pfs_spawn_thread (arg=0x58ba02a1af18)at /test/mtest/MDEV-34723/bb-13.0-MDEV-34723_opt/storage/perfschema/pfs.cc:2198

#24 0x000074e2dc29caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#25 0x000074e2dc329c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78