MDEV-9137 MariaDB Crash on Query Using Aria Engine

Two bugs in Aria, related to 2-level fulltext indexes:

* REPAIR calculated the key number incorrectly

* CHECK copied the key into last_key too early and
  checking the second-level btree was overwriting it

mysql-test/suite/maria/fulltext2.result

+CREATE TABLE t1 (
+i int(10) unsigned not null auto_increment primary key,
+a varchar(255) not null,
+FULLTEXT KEY (a)
+) ENGINE=Aria ROW_FORMAT=DYNAMIC MAX_ROWS=2000000000000;
+repair table t1 quick;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	status	OK
+check table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	check	status	OK
+repair table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	status	OK
+check table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	check	status	OK
+repair table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	repair	status	OK
+drop table t1;

mysql-test/suite/maria/fulltext2.test

+#
+# test of new fulltext search features
+#
+
+let collation=utf8_unicode_ci;
+source include/have_collation.inc;
+
+#
+# two-level tree
+#
+
+CREATE TABLE t1 (
+  i int(10) unsigned not null auto_increment primary key,
+  a varchar(255) not null,
+  FULLTEXT KEY (a)
+) ENGINE=Aria ROW_FORMAT=DYNAMIC MAX_ROWS=2000000000000;
+
+# two-level entry, second-level tree with depth 2
+disable_query_log;
+let $1=1024;
+while ($1)
+{
+  eval insert t1 (a) values ('aaaxxx');
+  dec $1;
+}
+
+# one-level entry (entries)
+let $1=150;
+while ($1)
+{
+  eval insert t1 (a) values ('aaayyy');
+  dec $1;
+}
+enable_query_log;
+
+repair table t1 quick;
+check table t1;
+repair table t1;
+check table t1;
+repair table t1;
+
+
+drop table t1;

storage/maria/ma_check.c

@@ -891,8 +891,7 @@ static int chk_index(HA_CHECK *param, MARIA_HA *info, MARIA_KEYDEF *keyinfo,
   if (level > param->max_level)
     param->max_level=level;
 
-  if (_ma_get_keynr(share, anc_page->buff) !=
-      (uint) (keyinfo - share->keyinfo))
+  if (_ma_get_keynr(share, anc_page->buff) != keyinfo->key_nr)
     _ma_check_print_error(param, "Page at %s is not marked for index %u",
                           llstr(anc_page->pos, llbuff),
                           (uint) (keyinfo - share->keyinfo));
@@ -916,7 +915,7 @@ static int chk_index(HA_CHECK *param, MARIA_HA *info, MARIA_KEYDEF *keyinfo,
   info->last_key.keyinfo= tmp_key.keyinfo= keyinfo;
   info->lastinx= ~0;                            /* Safety */
   tmp_key.data= tmp_key_buff;
-  for ( ;; )
+  for ( ;; _ma_copy_key(&info->last_key, &tmp_key))
   {
     if (nod_flag)
     {
@@ -998,7 +997,6 @@ static int chk_index(HA_CHECK *param, MARIA_HA *info, MARIA_KEYDEF *keyinfo,
                                             tmp_key.data);
       }
     }
-    _ma_copy_key(&info->last_key, &tmp_key);
     (*key_checksum)+= maria_byte_checksum(tmp_key.data, tmp_key.data_length);
     record= _ma_row_pos_from_key(&tmp_key);
 
@@ -5728,8 +5726,7 @@ static int sort_insert_key(MARIA_SORT_PARAM *sort_param,
     a_length= share->keypage_header + nod_flag;
     key_block->end_pos= anc_buff + share->keypage_header;
     bzero(anc_buff, share->keypage_header);
-    _ma_store_keynr(share, anc_buff, (uint) (sort_param->keyinfo -
-                                            share->keyinfo));
+    _ma_store_keynr(share, anc_buff, sort_param->keyinfo->key_nr);
     lastkey=0;					/* No previous key in block */
   }
   else