SIGSEGV in JSON_OVERLAPS() on a truncated nested JSON object with different character sets/collations

SET collation_connection=ucs2_general_ci;

SELECT JSON_OVERLAPS ('{"B":{}}', '{"B":{') AS exp;

Core was generated by `/test/MD290726-mariadb-11.4.13-linux-x86_64-opt/bin/mariadbd --no-defaults --lo'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  my_mb_wc_ucs2_quick (pwc=0x79f326aca1f0, s=0x0, e=0x71f24c017a94 "")at /test/11.4_opt/strings/ctype-ucs2.h:27

27	  *pwc= ((uchar)s[0]) * 256  + ((uchar)s[1]);

[Current thread is 1 (LWP 1200748)]

(gdb) bt

#0  my_mb_wc_ucs2_quick (pwc=0x79f326aca1f0, s=0x0, e=0x71f24c017a94 "")at /test/11.4_opt/strings/ctype-ucs2.h:27

#1  my_ucs2_uni (cs=<optimized out>, pwc=0x79f326aca1f0, s=0x0, e=0x71f24c017a94 "") at /test/11.4_opt/strings/ctype-ucs2.c:3047

#2  0x000058acd511114e in get_first_nonspace (js=0x79f326aca1e0, c_len=0x79f326aca210, t_next=<optimized out>)at /test/11.4_opt/strings/json_lib.c:702

#3  json_scan_next (j=0x79f326aca1e0) at /test/11.4_opt/strings/json_lib.c:976

#4  0x000058acd4b31e86 in json_find_overlap_with_object (js=0x79f326aca0f0, value=0x79f326aca1e0, compare_whole=false)at /test/11.4_opt/sql/item_jsonfunc.cc:4905

#5  check_overlaps (js=0x79f326aca0f0, value=0x79f326aca1e0, compare_whole=false) at /test/11.4_opt/sql/item_jsonfunc.cc:5052

#6  Item_func_json_overlaps::val_bool (this=0x71f24c017b68)at /test/11.4_opt/sql/item_jsonfunc.cc:5096

#7  0x000058acd4900fbd in Item_bool_func::val_int (this=0x2)at /test/11.4_opt/sql/item_cmpfunc.h:249

#8  0x000058acd4b78f79 in Type_handler::Item_send_long (this=<optimized out>, item=0x79f326aca1f0, protocol=0x0, buf=0x71f24c017a94)at /test/11.4_opt/sql/sql_type.cc:7758

#9  Type_handler_long::Item_send (this=<optimized out>, item=0x79f326aca1f0, protocol=0x0, buf=0x71f24c017a94) at /test/11.4_opt/sql/sql_type.h:5856

#10 0x000058acd4909ff1 in Protocol::send_result_set_row (this=0x71f24c0011f8, row_items=<optimized out>) at /test/11.4_opt/sql/protocol.cc:1339

#11 0x000058acd4973e5f in select_send::send_data (this=0x71f24c018580, items=@0x71f24c017740: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x71f24c017c78, last = 0x71f24c017c78, elements = 1}, <No data fields>})at /test/11.4_opt/sql/sql_class.cc:3268

#12 0x000058acd4a163c9 in select_result_sink::send_data_with_check (this=0x2, items=@0x79f326aca1f0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x7b, last = 0xffffff9a, elements = 3586239368}, <No data fields>}, u=<optimized out>, sent=0) at /test/11.4_opt/sql/sql_class.h:6222

#13 JOIN::exec_inner (this=this@entry=0x71f24c0185a8)at /test/11.4_opt/sql/sql_select.cc:4976

#14 0x000058acd49fcfe0 in JOIN::exec (this=0x71f24c0185a8)at /test/11.4_opt/sql/sql_select.cc:4893

#15 mysql_select (thd=thd@entry=0x71f24c000c68, tables=<optimized out>, fields=@0x71f24c017740: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x71f24c017c78, last = 0x71f24c017c78, elements = 1}, <No data fields>}, conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x71f24c018580, unit=0x71f24c004f58, select_lex=0x71f24c017488)at /test/11.4_opt/sql/sql_select.cc:5416

#16 0x000058acd49fcc69 in handle_select (thd=thd@entry=0x71f24c000c68, lex=lex@entry=0x71f24c004e78, result=result@entry=0x71f24c018580, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/11.4_opt/sql/sql_select.cc:643

#17 0x000058acd49cbf34 in execute_sqlcom_select (thd=thd@entry=0x71f24c000c68, all_tables=0x0) at /test/11.4_opt/sql/sql_parse.cc:6222

#18 0x000058acd49c713d in mysql_execute_command (thd=thd@entry=0x71f24c000c68, is_called_from_prepared_stmt=false) at /test/11.4_opt/sql/sql_parse.cc:4010

#19 0x000058acd49c2aa2 in mysql_parse (thd=thd@entry=0x71f24c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x79f326acb600)at /test/11.4_opt/sql/sql_parse.cc:7941

#20 0x000058acd49c0f8e in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x71f24c000c68, packet=packet@entry=0x71f24c0087b9 "", packet_length=packet_length@entry=50, blocking=true)at /test/11.4_opt/sql/sql_parse.cc:1925

#21 0x000058acd49c2f21 in do_command (thd=thd@entry=0x71f24c000c68, blocking=true) at /test/11.4_opt/sql/sql_parse.cc:1433

#22 0x000058acd4adfefd in do_handle_one_connection (connect=<optimized out>, connect@entry=0x58ad08c1ad38, put_in_cache=true)at /test/11.4_opt/sql/sql_connect.cc:1508

#23 0x000058acd4adfd26 in handle_one_connection (arg=arg@entry=0x58ad08c1ad38)at /test/11.4_opt/sql/sql_connect.cc:1420

#24 0x000058acd4e3296e in pfs_spawn_thread (arg=0x58ad08ba9568)at /test/11.4_opt/storage/perfschema/pfs.cc:2201

#25 0x000079f32f89cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#26 0x000079f32f929d6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

    Rel    o/d  Build   Commit                                    UniqueID observed

CS  10.11  dbg  270726  cea98ec09dd9a226047b09bc1f8516003b416e1c  SIGSEGV|my_mb_wc_ucs2_quick|my_ucs2_uni|get_first_nonspace|json_scan_next

CS  10.11  opt  270726  cea98ec09dd9a226047b09bc1f8516003b416e1c  SIGSEGV|my_mb_wc_ucs2_quick|my_ucs2_uni|get_first_nonspace|json_scan_next

CS  11.4   dbg  290726  eccf9ca5f15bdca5b8e887396d9a570d580eb4ee  No bug found

CS  11.4   opt  290726  eccf9ca5f15bdca5b8e887396d9a570d580eb4ee  SIGSEGV|my_mb_wc_ucs2_quick|my_ucs2_uni|get_first_nonspace|json_scan_next

CS  11.8   dbg  310726  eaca80bf3208fb9657b7304b940a6726b4c86213  SIGSEGV|my_mb_wc_ucs2_quick|my_ucs2_uni|get_first_nonspace|json_scan_next

CS  11.8   opt  310726  eaca80bf3208fb9657b7304b940a6726b4c86213  SIGSEGV|my_mb_wc_ucs2_quick|my_ucs2_uni|get_first_nonspace|json_scan_next

CS  12.3   dbg  310726  33240f3c96c3ced4698b33d2c6d51a520a1d9613  No bug found

CS  12.3   opt  310726  33240f3c96c3ced4698b33d2c6d51a520a1d9613  SIGSEGV|my_mb_wc_ucs2_quick|my_ucs2_uni|get_first_nonspace|json_scan_next

CS  13.0   dbg  310726  1a4bb1bbfde5fa17ba148cb62678902f11c66a1a  No bug found

CS  13.0   opt  310726  1a4bb1bbfde5fa17ba148cb62678902f11c66a1a  SIGSEGV|my_mb_wc_ucs2_quick|my_ucs2_uni|get_first_nonspace|json_scan_next

CS  13.1   dbg  230726  7b89d04911b8a618da9ed76536313a351977d41d  No bug found

CS  13.1   opt  230726  7b89d04911b8a618da9ed76536313a351977d41d  No bug found

ES  11.4   dbg  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  No bug found

ES  11.4   opt  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  No bug found

ES  11.8   dbg  060526  1499789de285a8109d68d79347de0281865b28f4  No bug found

ES  11.8   opt  060526  1499789de285a8109d68d79347de0281865b28f4  No bug found