JSON_VALUE returns a value out of a document that is broken, when the break lies past the matched path

JSON_VALUE is documented to return NULL when it is not given a valid
JSON document. It stops at the matched path, so whether a broken
document is refused depends on where the break falls relative to the
match rather than on whether the document is valid.

SELECT JSON_VALUE('{"a":1 "b":2}', '$.a') AS v;

v

1

No warning. The same bytes through JSON_EXTRACT give NULL with
Warning 4038 at position 8.

How to repeat

-- the break is past the match: answered, silently

SELECT JSON_VALUE('{"a":1 "b":2}', '$.a') AS v;   -- 1

SELECT JSON_VALUE('{"a":1,"b":}', '$.a')  AS v;   -- 1

SELECT JSON_VALUE('{"a":1,', '$.a')       AS v;   -- 1

-- the same document, the break moved in front of the match: NULL

SELECT JSON_VALUE('{"b":,"a":1}', '$.a')  AS v;   -- NULL

The last two documents are equally broken and the answers differ only
in where the break sits.

Root cause

The search returns as soon as the path is found and the remainder of the
document is never read, so a parse failure beyond the match is never
raised. A break in front of the match is met by the search itself,
which is why that one is refused.

Contract, `scripts/fill_help_tables.sql:468` (topic 394): *"Given a JSON
document, returns the scalar specified by the path. Returns NULL if not
given a valid JSON document, or if there is no match."*

Affected versions

JSON_VALUE was added in 10.2.3.

Verified on 10.11 only (10.11.19-MariaDB-debug, commit 1dab253482d).
Other branches were not tested.

Note

Found while auditing the JSON functions against their documented
contracts. Partial, and it pins the defect:
func_json_invalid.result:226-228 records JSON_VALUE('{"a":1,', '$.a')
= 1 with no warning. The missing-comma shape is covered nowhere.