MDEV-9137 MariaDB Crash on Query Using Aria Engine

Two bugs in Aria, related to 2-level fulltext indexes:

* REPAIR calculated the key number incorrectly

* CHECK copied the key into last_key too early and
  checking the second-level btree was overwriting it

2 files changed, 64 insertions, 0 deletions

diff --git a/mysql-test/suite/maria/fulltext2.result b/mysql-test/suite/maria/fulltext2.result
new file mode 100644
index 00000000000..1af52b3cbf1
--- /dev/null
+++ b/mysql-test/suite/maria/fulltext2.result
@@ -0,0 +1,21 @@
+CREATE TABLE t1 (
+i int(10) unsigned not null auto_increment primary key,
+a varchar(255) not null,
+FULLTEXT KEY (a)
+) ENGINE=Aria ROW_FORMAT=DYNAMIC MAX_ROWS=2000000000000;
+repair table t1 quick;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	status	OK
+check table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	check	status	OK
+repair table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	status	OK
+check table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	check	status	OK
+repair table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	status	OK
+drop table t1;
diff --git a/mysql-test/suite/maria/fulltext2.test b/mysql-test/suite/maria/fulltext2.test
new file mode 100644
index 00000000000..bbb5231d3c2
--- /dev/null
+++ b/mysql-test/suite/maria/fulltext2.test
@@ -0,0 +1,43 @@
+#
+# test of new fulltext search features
+#
+
+let collation=utf8_unicode_ci;
+source include/have_collation.inc;
+
+#
+# two-level tree
+#
+
+CREATE TABLE t1 (
+  i int(10) unsigned not null auto_increment primary key,
+  a varchar(255) not null,
+  FULLTEXT KEY (a)
+) ENGINE=Aria ROW_FORMAT=DYNAMIC MAX_ROWS=2000000000000;
+
+# two-level entry, second-level tree with depth 2
+disable_query_log;
+let $1=1024;
+while ($1)
+{
+  eval insert t1 (a) values ('aaaxxx');
+  dec $1;
+}
+
+# one-level entry (entries)
+let $1=150;
+while ($1)
+{
+  eval insert t1 (a) values ('aaayyy');
+  dec $1;
+}
+enable_query_log;
+
+repair table t1 quick;
+check table t1;
+repair table t1;
+check table t1;
+repair table t1;
+
+
+drop table t1;