Cross db package type inside a trigger crashes the server

SET sql_mode=ORACLE;

CREATE DATABASE db1;

CREATE DATABASE db2;

CREATE TABLE db2.t1 (id INT, note VARCHAR(40));

DELIMITER $$;

CREATE PACKAGE db1.pkg AS

  TYPE rec IS RECORD (a INT, b VARCHAR(20));

END;

$$

CREATE TRIGGER db2.trg BEFORE INSERT ON db2.t1

FOR EACH ROW

DECLARE

  r db1.pkg.rec;         

BEGIN

  r.a := :NEW.id;

  :NEW.note := 'x';

END;

$$

DELIMITER ;$$

INSERT INTO db2.t1 (id) VALUES (1);  

Core was generated by `/test/mtest/MDEV-39587/MD170726-mariadb-13.1.0-linux-x86_64-opt/bin/mariadbd --'.

Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 3069116)]

(gdb) bt

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

#1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78

#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89

#3  0x0000745bda84527e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26

#4  0x0000745bda8288ff in __GI_abort () at ./stdlib/abort.c:79

#5  0x0000745bda8297b6 in __libc_message_impl (fmt=fmt@entry=0x745bda9ce8d7 "%s\n") at ../sysdeps/posix/libc_fatal.c:134

#6  0x0000745bda8a8ff5 in malloc_printerr (str=str@entry=0x745bda9cc672 "free(): invalid pointer")at ./malloc/malloc.c:5772

#7  0x0000745bda8ab38c in _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at ./malloc/malloc.c:4507

#8  0x0000745bda8addae in __GI___libc_free (mem=0x6c392c0223c0)at ./malloc/malloc.c:3398

#9  0x00005edc7a11985a in THD::set_db (this=0x6c392c000c70, new_db=0x5edc7abd5fb8 <null_clex_str>)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_class.cc:1667

#10 0x00005edc7a12bf47 in mysql_change_db_impl (thd=0x6c392c000c70, new_db_name=0x745bd805f680, new_db_access=(SELECT_ACL | INSERT_ACL | UPDATE_ACL | DELETE_ACL | CREATE_ACL | DROP_ACL | GRANT_ACL | REFERENCES_ACL | INDEX_ACL | ALTER_ACL | CREATE_TMP_ACL | LOCK_TABLES_ACL | EXECUTE_ACL | CREATE_VIEW_ACL | SHOW_VIEW_ACL | CREATE_PROC_ACL | ALTER_PROC_ACL | EVENT_ACL | TRIGGER_ACL | DELETE_HISTORY_ACL | SHOW_CREATE_ROUTINE_ACL), new_db_charset=0x5edc9c924a98)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_db.cc:1597

#11 mysql_change_db (thd=0x6c392c000c70, new_db_name=<optimized out>, force=<optimized out>)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_db.cc:1848

#12 0x00005edc7a12c19f in mysql_opt_change_db (thd=thd@entry=0x6c392c000c70, new_db=@0x745bd8063c50: {str = 0x6c392c050c10 "db1", length = 3}, saved_db=saved_db@entry=0x745bd805f920, force_switch=true, cur_db_changed=cur_db_changed@entry=0x745bd805f977)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_db.cc:1891

#13 0x00005edc7a0c7c3f in Sp_handler::db_load_routine (this=this@entry=0x5edc7b4358e0 <sp_handler_package_spec>, thd=thd@entry=0x6c392c000c70, name=name@entry=0x745bd8063c50, sphp=sphp@entry=0x745bd8063c90, sql_mode=sql_mode@entry=8858427918, sql_path=@0x745bd8063168: {m_schemas = {{<Lex_ident_fs> = {<Lex_ident<Compare_table_names>> = {<Lex_cstring> = {<st_mysql_const_lex_string> = {str = 0x6c392c072bf0 "CURRENT_SCHEMA", length = 0}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, {<Lex_ident_fs> = {<Lex_ident<Compare_table_names>> = {<Lex_cstring> = {<st_mysql_const_lex_string> = {str = 0x0, length = 0}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>} <repeats 15 times>}, m_count = 1}, params=@0x745bd8061b60: {str = 0x5edc7abcc7d2 "", length = 0}, returns=@0x745bd8061bc0: {str = 0x5edc7abcc7d2 "", length = 0}, body=@0x745bd8061b70: {str = 0x6c392c050d00 "AS\n  TYPE rec IS RECORD (a INT, b VARCHAR(20));\nEND", length = 51}, chistics=@0x745bd8061ba0: {comment = {str = 0x5edc7abcc7d2 "", length = 0}, suid = SP_IS_SUID, detistic = false, daccess = SP_CONTAINS_SQL, agg_type = NOT_AGGREGATE}, definer=@0x745bd8061b80: {user = {str = 0x6c392c050cf0 "root", length = 4}, host = {str = 0x6c392c050cf5 "localhost", length = 9}}, created=20260717203739, modified=20260717203739, parent=0x0, creation_ctx=0x6c392c050db0)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sp.cc:1019

#14 0x00005edc7a0c7a4d in Sp_handler::db_find_routine (this=this@entry=0x5edc7b4358e0 <sp_handler_package_spec>, thd=thd@entry=0x6c392c000c70, name=name@entry=0x745bd8063c50, sphp=sphp@entry=0x745bd8063c90)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sp.cc:776

#15 0x00005edc7a0cb995 in Sp_handler::db_find_and_cache_routine (this=0x5edc7b4358e0 <sp_handler_package_spec>, thd=0x6c392c000c70, name=0x745bd8063c50, sp=0x745bd8063c90)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sp.cc:800

#16 Sp_handler::sp_cache_routine (this=0x5edc7b4358e0 <sp_handler_package_spec>, thd=0x6c392c000c70, name=0x745bd8063c50, sp=0x745bd8063c90)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sp.cc:3010

#17 0x00005edc7a0cae32 in Sp_handler::sp_cache_routine_reentrant (this=0x2ed4a8, thd=0x6c392c000c70, name=0x745bd8063c50, sp=0x745bd8063c90)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sp.cc:2524

#18 Sp_handler::sp_cache_routine_reentrant_suppress_errors (this=0x2ed4a8, thd=0x6c392c000c70, name=0x745bd8063c50, sp=0x745bd8063c90)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sp.cc:2540

#19 Sp_handler::find_package_spec (thd=0x6c392c000c70, db=<optimized out>, package=<optimized out>)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sp.cc:2560

#20 0x00005edc7a0d77c8 in sp_head::get_typedef_package_spec_or_error (this=0x6c392c04f5f0, thd=0x6c392c000c70, tdef=0x745bd8063ec0, db=<optimized out>, package=@0x745bd80641c8: {<st_mysql_const_lex_string> = {str = 0x6c392c050c30 "pkg", length = 3}, <Sql_alloc> = {<No data fields>}, <No data fields>}, type=@0x745bd80641f8: {<st_mysql_const_lex_string> = {str = 0x6c392c050c50 "rec", length = 3}, <Sql_alloc> = {<No data fields>}, <No data fields>})at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sp_head.cc:4551

#21 0x00005edc7a1656c8 in LEX::set_field_type_typedef_package_spec (this=0x6c392c042780, res=0x745bd8064b20, db=@0x745bda89eb2c: {<st_mysql_const_lex_string> = {str = 0x3ddef741c68941 <error: Cannot access memory at address 0x3ddef741c68941>, length = 3103784944}, <Sql_alloc> = {<No data fields>}, <No data fields>}, package=<error reading variable: Cannot access memory at address 0xffffffff>, type=<error reading variable: Cannot access memory at address 0x0>)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_lex.cc:13678

#22 0x00005edc7a3b0929 in ORAparse (thd=thd@entry=0x6c392c000c70)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_yacc.yy:6658

#23 0x00005edc7a17f62f in parse_sql (thd=thd@entry=0x6c392c000c70, parser_state=parser_state@entry=0x745bd8064c30, creation_ctx=creation_ctx@entry=0x6c392c019680, do_pfs_digest=false)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_parse.cc:10372

#24 0x00005edc7a23decf in Table_triggers_list::check_n_load (thd=0x6c392c000c70, db=0x6c392c022148, table_name=0x6c392c022158, table=0x6c392c03c3a0, names_only=false)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_trigger.cc:1846

#25 0x00005edc7a10401d in open_table_entry_fini (thd=thd@entry=0x6c392c000c70, share=share@entry=0x6c392c021ed0, entry=0x6c392c03c3a0)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_base.cc:3300

#26 0x00005edc7a10390d in open_table (thd=0x6c392c000c70, table_list=table_list@entry=0x6c392c017ca0, ot_ctx=ot_ctx@entry=0x745bd8067a68)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_base.cc:2337

#27 0x00005edc7a106387 in open_and_process_table (thd=0x6c392c000c70, tables=0x6c392c017ca0, counter=0x745bd8067b7c, flags=0, prelocking_strategy=0x745bd8067d60, ot_ctx=0x745bd8067a68, has_prelocking_list=<optimized out>)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_base.cc:4287

#28 open_tables (thd=thd@entry=0x6c392c000c70, options=@0x6c392c0067e4: {m_options = DDL_options_st::OPT_NONE}, start=start@entry=0x745bd8067b70, counter=counter@entry=0x745bd8067b7c, flags=flags@entry=0, prelocking_strategy=prelocking_strategy@entry=0x745bd8067d60)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_base.cc:4770

#29 0x00005edc7a107cb4 in open_and_lock_tables (thd=0x2ed4a8, thd@entry=0x6c392c000c70, options=<error reading variable: Cannot access memory at address 0x2ed4bc>, tables=0x6c392c017ca0, derived=true, flags=4294967295, flags@entry=0, prelocking_strategy=0x0, prelocking_strategy@entry=0x745bd8067d60)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_base.cc:5793

#30 0x00005edc7a1391f0 in open_and_lock_tables (thd=0x6c392c000c70, tables=0x6c392c017ca0, derived=true, flags=0)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_base.h:545

#31 mysql_insert (thd=thd@entry=0x6c392c000c70, table_list=0x6c392c017ca0, fields=@0x6c392c0061a0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6c392c018530, last = 0x6c392c018530, elements = 1}, <No data fields>}, values_list=@0x6c392c0061e8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6c392c018b10, last = 0x6c392c018b10, elements = 1}, <No data fields>}, update_fields=@0x6c392c0061d0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5edc7b43a3c8 <end_of_list>, last = 0x6c392c0061d0, elements = 0}, <No data fields>}, update_values=@0x6c392c0061b8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5edc7b43a3c8 <end_of_list>, last = 0x6c392c0061b8, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=<optimized out>, result=0x0)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_insert.cc:812

#32 0x00005edc7a17a917 in mysql_execute_command (thd=thd@entry=0x6c392c000c70, is_called_from_prepared_stmt=false)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_parse.cc:4502

#33 0x00005edc7a173342 in mysql_parse (thd=thd@entry=0x6c392c000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x745bd80684d0)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_parse.cc:7945

#34 0x00005edc7a171883 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x6c392c000c70, packet=packet@entry=0x6c392c008db1 "INSERT INTO db2.t1 (id) VALUES (1)", packet_length=packet_length@entry=34, blocking=true)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_parse.cc:1903

#35 0x00005edc7a1737c1 in do_command (thd=thd@entry=0x6c392c000c70, blocking=true)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_parse.cc:1437

#36 0x00005edc7a29bd8d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5edc9d188650, put_in_cache=true)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_connect.cc:1510

#37 0x00005edc7a29bbc2 in handle_one_connection (arg=arg@entry=0x5edc9d188650)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/sql/sql_connect.cc:1422

#38 0x00005edc7a63dcc3 in pfs_spawn_thread (arg=0x5edc9d1a8890)at /test/mtest/MDEV-39587/bb-13.1-bar-MDEV-39587_opt/storage/perfschema/pfs.cc:2198

#39 0x0000745bda89caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#40 0x0000745bda929c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78