MDEV-9137 MariaDB Crash on Query Using Aria Engine

Two bugs in Aria, related to 2-level fulltext indexes: * REPAIR calculated the key number incorrectly * CHECK copied the key into last_key too early and checking the second-level btree was overwriting it

Author: vuvova

mysql-test/suite/maria/fulltext2.result

@@ -0,0 +1,21 @@
+CREATE TABLE t1 (
+i int(10) unsigned not null auto_increment primary key,
+a varchar(255) not null,
+FULLTEXT KEY (a)
+) ENGINE=Aria ROW_FORMAT=DYNAMIC MAX_ROWS=2000000000000;
+repair table t1 quick;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	status	OK
+check table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	check	status	OK
+repair table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	status	OK
+check table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	check	status	OK
+repair table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	status	OK
+drop table t1;

mysql-test/suite/maria/fulltext2.test

@@ -0,0 +1,43 @@
+#
+# test of new fulltext search features
+#
+
+let collation=utf8_unicode_ci;
+source include/have_collation.inc;
+
+#
+# two-level tree
+#
+
+CREATE TABLE t1 (
+ i int(10) unsigned not null auto_increment primary key,
+ a varchar(255) not null,
+ FULLTEXT KEY (a)
+) ENGINE=Aria ROW_FORMAT=DYNAMIC MAX_ROWS=2000000000000;
+
+# two-level entry, second-level tree with depth 2
+disable_query_log;
+let $1=1024;
+while ($1)
+{
+ eval insert t1 (a) values ('aaaxxx');
+ dec $1;
+}
+
+# one-level entry (entries)
+let $1=150;
+while ($1)
+{
+ eval insert t1 (a) values ('aaayyy');
+ dec $1;
+}
+enable_query_log;
+
+repair table t1 quick;
+check table t1;
+repair table t1;
+check table t1;
+repair table t1;
+
+
+drop table t1;

storage/maria/ma_check.c

@@ -891,8 +891,7 @@ static int chk_index(HA_CHECK *param, MARIA_HA *info, MARIA_KEYDEF *keyinfo,
  if (level > param->max_level)
  param->max_level=level;
 
- if (_ma_get_keynr(share, anc_page->buff) !=
- (uint) (keyinfo - share->keyinfo))
+ if (_ma_get_keynr(share, anc_page->buff) != keyinfo->key_nr)
  _ma_check_print_error(param, "Page at %s is not marked for index %u",
  llstr(anc_page->pos, llbuff),
  (uint) (keyinfo - share->keyinfo));
@@ -916,7 +915,7 @@ static int chk_index(HA_CHECK *param, MARIA_HA *info, MARIA_KEYDEF *keyinfo,
  info->last_key.keyinfo= tmp_key.keyinfo= keyinfo;
  info->lastinx= ~0; /* Safety */
  tmp_key.data= tmp_key_buff;
- for ( ;; )
+ for ( ;; _ma_copy_key(&info->last_key, &tmp_key))
  {
  if (nod_flag)
  {
@@ -998,7 +997,6 @@ static int chk_index(HA_CHECK *param, MARIA_HA *info, MARIA_KEYDEF *keyinfo,
  tmp_key.data);
  }
  }
- _ma_copy_key(&info->last_key, &tmp_key);
  (*key_checksum)+= maria_byte_checksum(tmp_key.data, tmp_key.data_length);
  record= _ma_row_pos_from_key(&tmp_key);
 
@@ -5728,8 +5726,7 @@ static int sort_insert_key(MARIA_SORT_PARAM *sort_param,
  a_length= share->keypage_header + nod_flag;
  key_block->end_pos= anc_buff + share->keypage_header;
  bzero(anc_buff, share->keypage_header);
- _ma_store_keynr(share, anc_buff, (uint) (sort_param->keyinfo -
- share->keyinfo));
+ _ma_store_keynr(share, anc_buff, sort_param->keyinfo->key_nr);
  lastkey=0;/* No previous key in block */
  }
  else