Assertion `field_pos < field_count' failed in Protocol_text::store in maria-5.3-mwl34

[Philip Stoev]

Inserting a NULL into a blob causes future dynamic column operations to assert as follows:

mysqld: protocol.cc:908: virtual bool Protocol_text::store(const char*, size_t, const CHARSET_INFO*): Assertion `field_pos < field_count' failed.

backtrace:

#8 0x006b0d98 in __assert_fail () from /lib/libc.so.6
#9 0x0828431a in Protocol_text::store (this=0x9535200, from=0xae7fdc41 "2", length=1, fromcs=0x8ab1700) at protocol.cc:908
#10 0x081d0e38 in Item::send (this=0xae612a40, protocol=0x9535200, buffer=0xae7fdf50) at item.cc:5784
#11 0x08277910 in select_send::send_data (this=0xae612da0, items=...) at sql_class.cc:1918
#12 0x08330e0f in end_send (join=0xae625fc8, join_tab=0xae6133ac, end_of_records=false) at sql_select.cc:14934
#13 0x0832f312 in evaluate_join_record (join=0xae625fc8, join_tab=0xae6131c8, error=0) at sql_select.cc:14160
#14 0x0832eded in sub_select (join=0xae625fc8, join_tab=0xae6131c8, end_of_records=false) at sql_select.cc:14005
#15 0x0832e077 in do_select (join=0xae625fc8, fields=0x9536920, table=0x0, procedure=0x0) at sql_select.cc:13500
#16 0x083148e2 in JOIN::exec (this=0xae625fc8) at sql_select.cc:2482
#17 0x083150fe in mysql_select (thd=0x9534ef0, rref_pointer_array=0x9536990, tables=0xae612b20, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0,
    group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xae612da0, unit=0x95365f0, select_lex=0x953688c) at sql_select.cc:2701
#18 0x0830d95b in handle_select (thd=0x9534ef0, lex=0x9536594, result=0xae612da0, setup_tables_done_option=0) at sql_select.cc:282
#19 0x082aa308 in execute_sqlcom_select (thd=0x9534ef0, all_tables=0xae612b20) at sql_parse.cc:5094
#20 0x082a1152 in mysql_execute_command (thd=0x9534ef0) at sql_parse.cc:2239
#21 0x082ac8ab in mysql_parse (thd=0x9534ef0, rawbuf=0xae6125e0 "SELECT COLUMN_ADD(f1, 1, 'abc'), COLUMN_LIST(f1) FROM t1", length=57,
    found_semicolon=0xae7ff228) at sql_parse.cc:6094
#22 0x0829eddb in dispatch_command (command=COM_QUERY, thd=0x9534ef0, packet=0x958f869 "", packet_length=57) at sql_parse.cc:1215
#23 0x0829e239 in do_command (thd=0x9534ef0) at sql_parse.cc:904
#24 0x0829b2ec in handle_one_connection (arg=0x9534ef0) at sql_connect.cc:1154
#25 0x00821919 in start_thread () from /lib/libpthread.so.0
#26 0x0076acce in clone () from /lib/libc.so.6

test case:

CREATE TABLE t1 ( f1 blob );
INSERT INTO t1 VALUES (NULL);
INSERT INTO t1 SET f1 = COLUMN_CREATE( 2 , 'cde' );

SELECT COLUMN_ADD(f1, 1, 'abc'), COLUMN_LIST(f1) FROM t1;