SIGSEGV in BJSON::GetArray / TDBBSON::MakeNewDoc on INSERT into CONNECT BSON table with Object= option

INSTALL SONAME 'ha_connect';

CREATE TABLE t0 (FIRSTNAME CHAR,LASTNAME CHAR) ENGINE=CONNECT TABLE_TYPE=BSON FILE_NAME='biblio.json' OPTION_LIST='Object=$[0].AUTHOR';

INSERT INTO t0 VALUES (0,'a');

Core was generated by `/test/MD140926-mariadb-12.3.3-linux-x86_64-opt/bin/mariadbd --no-defaults --loo'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  BJSON::GetArray (this=0x71db73fff638, vlp=0x0)at /test/12.3_opt/storage/connect/bson.h:101

[Current thread is 1 (LWP 1323204)]

(gdb) bt

#0  BJSON::GetArray (this=0x71db73fff638, vlp=0x0)at /test/12.3_opt/storage/connect/bson.h:101

#1  BJSON::SetArrayValue (this=0x71db73fff638, bap=0x0, nvp=0x71db73fffb00, n=0) at /test/12.3_opt/storage/connect/bson.cpp:1208

#2  0x000079dc6536e590 in BTUTIL::MakeTopTree (this=0x71db73fff638, g=g@entry=0x71db7c038770, type=type@entry=10)at /test/12.3_opt/storage/connect/tabbson.cpp:725

#3  0x000079dc6536d673 in TDBBSON::MakeNewDoc (this=0x71db73fff4d0, g=0x71db7c038770) at /test/12.3_opt/storage/connect/tabbson.cpp:2233

#4  TDBBSON::MakeDocument (this=this@entry=0x71db73fff4d0, g=0x71db7c038770)at /test/12.3_opt/storage/connect/tabbson.cpp:2272

#5  0x000079dc65371e70 in TDBBSON::OpenDB (this=0x71db73fff4d0, g=0x0)at /test/12.3_opt/storage/connect/tabbson.cpp:2510

#6  0x000079dc652eab65 in CntOpenTable (g=0x71db7c038770, tdbp=0x71db73fff4d0, mode=MODE_INSERT, c1=<optimized out>, c2=<optimized out>, del=false)at /test/12.3_opt/storage/connect/connect.cc:349

#7  0x000079dc652dd453 in ha_connect::OpenTable (this=this@entry=0x71db7c0367b0, g=0x71db7c038770, del=false)at /test/12.3_opt/storage/connect/ha_connect.cc:2066

#8  0x000079dc652e13e6 in ha_connect::write_row (this=0x71db7c0367b0, buf=<optimized out>) at /test/12.3_opt/storage/connect/ha_connect.cc:3676

#9  0x000060da6a990218 in handler::ha_write_row (this=0x71db7c0367b0, buf=0x71db7c0371a0 "\3710   a   ") at /test/12.3_opt/sql/handler.cc:8584

#10 0x000060da6a6d86a2 in Write_record::single_insert (this=this@entry=0x79dc6788fb90, inserted=inserted@entry=0x79dc6788fb38)at /test/12.3_opt/sql/sql_insert.cc:2397

#11 0x000060da6a6d7277 in Write_record::write_record (this=this@entry=0x79dc6788fb90) at /test/12.3_opt/sql/sql_insert.cc:2439

#12 0x000060da6a6d579b in mysql_insert (thd=thd@entry=0x71db7c000c70, table_list=0x71db7c017ca0, fields=@0x71db7c006168: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x60da6b9c6398 <end_of_list>, last = 0x71db7c006168, elements = 0}, <No data fields>}, values_list=@0x71db7c0061b0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x71db7c018a50, last = 0x71db7c018a50, elements = 1}, <No data fields>}, update_fields=@0x71db7c006198: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x60da6b9c6398 <end_of_list>, last = 0x71db7c006198, elements = 0}, <No data fields>}, update_values=@0x71db7c006180: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x60da6b9c6398 <end_of_list>, last = 0x71db7c006180, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=<optimized out>, result=0x0)at /test/12.3_opt/sql/sql_insert.cc:1233

#13 0x000060da6a7131f8 in mysql_execute_command (thd=thd@entry=0x71db7c000c70, is_called_from_prepared_stmt=false) at /test/12.3_opt/sql/sql_parse.cc:4495

#14 0x000060da6a70bd02 in mysql_parse (thd=thd@entry=0x71db7c000c70, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x79dc67890590)at /test/12.3_opt/sql/sql_parse.cc:7932

#15 0x000060da6a70a24a in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x71db7c000c70, packet=packet@entry=0x71db7c008dc1 "INSERT INTO t0 VALUES (0,'a')", packet_length=packet_length@entry=29, blocking=true)at /test/12.3_opt/sql/sql_parse.cc:1903

#16 0x000060da6a70c181 in do_command (thd=thd@entry=0x71db7c000c70, blocking=true) at /test/12.3_opt/sql/sql_parse.cc:1437

#17 0x000060da6a83426d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x60da9b00be30, put_in_cache=true)at /test/12.3_opt/sql/sql_connect.cc:1514

#18 0x000060da6a8340a2 in handle_one_connection (arg=arg@entry=0x60da9b00be30)at /test/12.3_opt/sql/sql_connect.cc:1426

#19 0x000060da6abd3a13 in pfs_spawn_thread (arg=0x60da9b02c590)at /test/12.3_opt/storage/perfschema/pfs.cc:2198

#20 0x000079dc9509cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#21 0x000079dc95129ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Core was generated by `/test/MD140926-mariadb-12.3.3-linux-x86_64-dbg/bin/mariadbd --no-defaults --loo'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x00006f69c2f92b88 in BJSON::GetArray (this=0x6f68a7fff638, vlp=0x0)at /test/12.3_dbg/storage/connect/bson.h:101

[Current thread is 1 (LWP 1322197)]

(gdb) bt

#0  0x00006f69c2f92b88 in BJSON::GetArray (this=0x6f68a7fff638, vlp=0x0)at /test/12.3_dbg/storage/connect/bson.h:101

#1  0x00006f69c2f911f7 in BJSON::SetArrayValue (this=0x6f68a7fff638, bap=0x0, nvp=0x6f68a7fffb00, n=0) at /test/12.3_dbg/storage/connect/bson.cpp:1208

#2  0x00006f69c2fae555 in BTUTIL::MakeTopTree (this=0x6f68a7fff638, g=0x6f68b0048de0, type=10)at /test/12.3_dbg/storage/connect/tabbson.cpp:725

#3  0x00006f69c2fb35cc in TDBBSON::MakeNewDoc (this=0x6f68a7fff4d0, g=0x6f68b0048de0) at /test/12.3_dbg/storage/connect/tabbson.cpp:2233

#4  0x00006f69c2fac7af in TDBBSON::MakeDocument (this=0x6f68a7fff4d0, g=0x6f68b0048de0) at /test/12.3_dbg/storage/connect/tabbson.cpp:2272

#5  0x00006f69c2fb3905 in TDBBSON::OpenDB (this=0x6f68a7fff4d0, g=0x6f68b0048de0) at /test/12.3_dbg/storage/connect/tabbson.cpp:2510

#6  0x00006f69c2ee1d23 in CntOpenTable (g=0x6f68b0048de0, tdbp=0x6f68a7fff4d0, mode=MODE_INSERT, c1=0x0, c2=0x0, del=false)at /test/12.3_dbg/storage/connect/connect.cc:349

#7  0x00006f69c2ec2be2 in ha_connect::OpenTable (this=0x6f68b0045ba0, g=0x6f68b0048de0, del=false)at /test/12.3_dbg/storage/connect/ha_connect.cc:2066

#8  0x00006f69c2ec95f4 in ha_connect::write_row (this=0x6f68b0045ba0, buf=0x6f68b0046590 "\3710   a   ", '\245' <repeats 23 times>, "\360e\004\260ho") at /test/12.3_dbg/storage/connect/ha_connect.cc:3676

#9  0x00005ab35d2a22ff in handler::ha_write_row (this=0x6f68b0045ba0, buf=0x6f68b0046590 "\3710   a   ", '\245' <repeats 23 times>, "\360e\004\260ho") at /test/12.3_dbg/sql/handler.cc:8584

#10 0x00005ab35cdcb82e in Write_record::single_insert (this=0x7769e01ab020, inserted=0x7769e01aab50) at /test/12.3_dbg/sql/sql_insert.cc:2397

#11 0x00005ab35cdc9525 in Write_record::write_record (this=0x7769e01ab020)at /test/12.3_dbg/sql/sql_insert.cc:2439

#12 0x00005ab35cdc681f in mysql_insert (thd=0x6f68b0000d60, table_list=0x6f68b001a500, fields=@0x6f68b0006230: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5ab35ec47f10 <end_of_list>, last = 0x6f68b0006230, elements = 0}, <No data fields>}, values_list=@0x6f68b0006278: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6f68b001b2b0, last = 0x6f68b001b2b0, elements = 1}, <No data fields>}, update_fields=@0x6f68b0006260: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5ab35ec47f10 <end_of_list>, last = 0x6f68b0006260, elements = 0}, <No data fields>}, update_values=@0x6f68b0006248: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5ab35ec47f10 <end_of_list>, last = 0x6f68b0006248, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0)at /test/12.3_dbg/sql/sql_insert.cc:1233

#13 0x00005ab35ce327be in mysql_execute_command (thd=0x6f68b0000d60, is_called_from_prepared_stmt=false) at /test/12.3_dbg/sql/sql_parse.cc:4495

#14 0x00005ab35ce28474 in mysql_parse (thd=0x6f68b0000d60, rawbuf=0x6f68b001a3f0 "INSERT INTO t0 VALUES (0,'a')", length=29, parser_state=0x7769e01acab0) at /test/12.3_dbg/sql/sql_parse.cc:7932

#15 0x00005ab35ce2585d in dispatch_command (command=COM_QUERY, thd=0x6f68b0000d60, packet=0x6f68b000b621 "INSERT INTO t0 VALUES (0,'a')", packet_length=29, blocking=true) at /test/12.3_dbg/sql/sql_parse.cc:1903

#16 0x00005ab35ce29023 in do_command (thd=0x6f68b0000d60, blocking=true)at /test/12.3_dbg/sql/sql_parse.cc:1437

#17 0x00005ab35d0273c9 in do_handle_one_connection (connect=0x5ab38d715310, put_in_cache=true) at /test/12.3_dbg/sql/sql_connect.cc:1514

#18 0x00005ab35d02716e in handle_one_connection (arg=0x5ab38d776750)at /test/12.3_dbg/sql/sql_connect.cc:1426

#19 0x00007769eba9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#20 0x00007769ebb29ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

    Rel    o/d  Build   Commit                                    UniqueID observed

CS  10.11  dbg  280926  f24a3ef7edd4080d4cf6e109dac26e93872068dc  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  10.11  opt  280926  f24a3ef7edd4080d4cf6e109dac26e93872068dc  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  11.4   dbg  140926  03acdd67d599ab7136ef18c36f3479a306870290  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  11.4   opt  140926  03acdd67d599ab7136ef18c36f3479a306870290  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  11.8   dbg  140926  08c28e3fbd56c26fe0973bfcc807fa95c2b23ee3  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  11.8   opt  140926  08c28e3fbd56c26fe0973bfcc807fa95c2b23ee3  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  12.3   dbg  140926  0fcc374c2df8b9a7a5004b3afcc7cc42c3b7c13f  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  12.3   opt  140926  0fcc374c2df8b9a7a5004b3afcc7cc42c3b7c13f  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  13.1   dbg  140926  e30f2bd21e463d5f5f9f9210b75193a0257b8a8c  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  13.1   opt  140926  e30f2bd21e463d5f5f9f9210b75193a0257b8a8c  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  13.2   dbg  240926  45717ef4c736a6a92e0acf49399ce677bfcaea89  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

CS  13.2   opt  240926  45717ef4c736a6a92e0acf49399ce677bfcaea89  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

ES  11.4   dbg  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

ES  11.4   opt  060526  90f707057d44f1b5c013a0c3672fd12f32ea7085  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

ES  11.8   dbg  060526  1499789de285a8109d68d79347de0281865b28f4  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

ES  11.8   opt  060526  1499789de285a8109d68d79347de0281865b28f4  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

ES  12.3   dbg  280926  082387a5f3cbb877157998bb4baa95928f4aa121  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

ES  12.3   opt  280926  082387a5f3cbb877157998bb4baa95928f4aa121  SIGSEGV|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

10.11 opt: UBSAN|member access within null pointer of type 'struct _jvalue'|storage/connect/bson.h|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc

10.11 dbg: UBSAN|member access within null pointer of type 'struct _jvalue'|storage/connect/bson.h|BJSON::GetArray|BJSON::SetArrayValue|BTUTIL::MakeTopTree|TDBBSON::MakeNewDoc