JSON_MERGE_PATCH blames argument 1 for a break in a later argument when the first argument is SQL NULL

On the path where a merge argument is adopted whole, the diagnostic
raised for a malformed later argument names argument 1 - which may be
SQL NULL, and therefore has neither text nor a position.

SELECT JSON_MERGE_PATCH(NULL,'[1 2]') AS v;

v

NULL

Warnings:

Warning  4038  Syntax error in JSON text in argument 1

              to function 'json_merge_patch' at position 4

Argument 1 is SQL NULL. The broken text is argument 2, and position 4
is a position within it.

How to repeat

SELECT JSON_MERGE_PATCH(NULL,'[1 2]')            AS v;

SELECT JSON_MERGE_PATCH(NULL,NULL,'[1 2]')       AS v;

SELECT JSON_MERGE_PATCH('{"a":1}',NULL,'[1 2]')  AS v;

-- all three: Warning 4038 ... in argument 1 ... at position 4

In the third, argument 1 is the perfectly good `

`.

The same function names the right argument on its other paths:

-- Warning 4037 ... argument 2

SELECT JSON_MERGE_PATCH(NULL,'"abc')      AS v;

-- Warning 4038 ... argument 2 position 4

SELECT JSON_MERGE_PATCH('{"a":1}','[1 2]') AS v;

Root cause

The adoption path takes the argument over by copying it, then reads the
copy back to check it. The read-back is reported against that copy with
a literal zero for the argument index, so the message names argument 1
and gives an offset into the copy.

Affected versions

JSON_MERGE_PATCH was added in 10.2.25.

Verified on 10.11 only (10.11.19-MariaDB-debug, commit 1dab253482d).
Other branches were not tested.

Note

Found while auditing the JSON functions against their documented
contracts. Pinned as expected output:
func_json_merge_broken.result:117-121 records the warning naming
argument 1 for text that is argument 2.