Server crash in Charset::charset upon JSON operations

SELECT JSON_EQUALS('[]', JSON_ARRAY_INSERT(NULL,'$[0]',1)) AS x;

#4  <signal handler called>

#5  0x000056343ce4b9ff in Charset::charset (this=0x0) at /data/bld/10.11-asan-ubsan/sql/sql_string.h:156

#6  Item_func_json_equals::val_bool (this=0x62d0000650f8) at /data/bld/10.11-asan-ubsan/sql/item_jsonfunc.cc:657

#7  0x000056343bd3a886 in Item_bool_func::val_int (this=0x62d0000650f8) at /data/bld/10.11-asan-ubsan/sql/item_cmpfunc.h:248

#8  0x000056343cfa5b9b in Type_handler::Item_send_long (this=this@entry=0x56344904f9a0 <type_handler_bool>, item=item@entry=0x62d0000650f8, protocol=protocol@entry=0x62c0000b0838, buf=buf@entry=0x7ffbb5974a80) at /data/bld/10.11-asan-ubsan/sql/sql_type.cc:7746

#9  0x000056343d00a4aa in Type_handler_long::Item_send (this=0x56344904f9a0 <type_handler_bool>, item=0x62d0000650f8, protocol=0x62c0000b0838, buf=0x7ffbb5974a80) at /data/bld/10.11-asan-ubsan/sql/sql_type.h:5794

#10 0x000056343bc2a0ad in Item::send (this=0x62d0000650f8, protocol=0x62c0000b0838, buffer=0x7ffbb5974a80) at /data/bld/10.11-asan-ubsan/sql/item.h:1266

#11 0x000056343bd97d83 in Protocol::send_result_set_row (this=this@entry=0x62c0000b0838, row_items=row_items@entry=0x62d000064990) at /data/bld/10.11-asan-ubsan/sql/protocol.cc:1333

#12 0x000056343c0e1ba6 in select_send::send_data (this=0x62d000065ae0, items=...) at /data/bld/10.11-asan-ubsan/sql/sql_class.cc:3213

#13 0x000056343c6dcbd8 in select_result_sink::send_data_with_check (this=this@entry=0x62d000065ae0, items=..., u=0x62c0000b46e8, sent=sent@entry=0) at /data/bld/10.11-asan-ubsan/sql/sql_class.h:6077

#14 0x000056343c6c19f5 in JOIN::exec_inner (this=this@entry=0x62d000065b10) at /data/bld/10.11-asan-ubsan/sql/sql_select.cc:4890

#15 0x000056343c6c42bf in JOIN::exec (this=this@entry=0x62d000065b10) at /data/bld/10.11-asan-ubsan/sql/sql_select.cc:4807

#16 0x000056343c6bb3a9 in mysql_select (thd=thd@entry=0x62c0000b0218, tables=<optimized out>, fields=..., conds=conds@entry=0x0, og_num=og_num@entry=0, order=order@entry=0x0, group=<optimized out>, having=<optimized out>, proc_param=<optimized out>, select_options=<optimized out>, result=<optimized out>, unit=<optimized out>, select_lex=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/sql_select.cc:5285

#17 0x000056343c6bc346 in handle_select (thd=thd@entry=0x62c0000b0218, lex=lex@entry=0x62c0000b4610, result=result@entry=0x62d000065ae0, setup_tables_done_option=setup_tables_done_option@entry=0) at /data/bld/10.11-asan-ubsan/sql/sql_select.cc:601

#18 0x000056343c34d709 in execute_sqlcom_select (thd=thd@entry=0x62c0000b0218, all_tables=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:6461

#19 0x000056343c391bea in mysql_execute_command (thd=thd@entry=0x62c0000b0218, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:4040

#20 0x000056343c3b3b6e in mysql_parse (thd=thd@entry=0x62c0000b0218, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7ffbb59769f0) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:8219

#21 0x000056343c3bce3e in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x62c0000b0218, packet=packet@entry=0x62900024e219 "", packet_length=packet_length@entry=63, blocking=blocking@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1924

#22 0x000056343c3c91b1 in do_command (thd=thd@entry=0x62c0000b0218, blocking=blocking@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1434

#23 0x000056343cbbd2f8 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x608000003a38, put_in_cache=put_in_cache@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1482

#24 0x000056343cbbe455 in handle_one_connection (arg=0x608000003a38) at /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1394

#25 0x000056343e4fc443 in pfs_spawn_thread (arg=0x617000005f18) at /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201

#26 0x00007ffbc12a71f5 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#27 0x00007ffbc13278ec in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

commit 14c16e02b261ad8e41ea6f80ebd4f42403793aff (HEAD)

Commit:     Daniel Black

CommitDate: Tue Jul 14 11:59:00 2026 +1000

    MDEV-40165: JSON_EQUAL/JSON_NORMALIZE dont respect KILL QUERY