MDEV-38410 segfault in std::function

Segfault from the standard library…
only memory corruption can explain it.

I have uncertain suspicions.

Author: ParadoxV5

sql/rpl_info_file.h

@@ -209,7 +209,6 @@ struct Info_file
   */
   struct Mem_fn: std::function<Persistent &(Info_file *self)>
   {
-    using List= const std::initializer_list<const Mem_fn>;
     /// Null Constructor
     Mem_fn(std::nullptr_t null= nullptr):
       std::function<Persistent &(Info_file *)>(null) {}
@@ -242,13 +241,19 @@ struct Info_file
       (either contains a `.` or is entirely empty) rather than an integer.
     @return `false` if the file has parsed successfully or `true` if error
   */
-  bool load_from_file(Mem_fn::List value_list, size_t default_line_count)
+  template<size_t size> bool load_from_file(
+    const Mem_fn (&value_list)[size],
+    size_t default_line_count= 0
+  ) { return load_from_file(value_list, size, default_line_count); }
+private:
+  bool
+  load_from_file(const Mem_fn *values, size_t size, size_t default_line_count)
   {
     /**
       The first row is temporarily stored in the first value. If it is a line
       count and not a log name (new format), the second row will overwrite it.
     */
-    auto &line1= dynamic_cast<String_value<> &>((*(value_list.begin()))(this));
+    auto &line1= dynamic_cast<String_value<> &>(values[0](this));
     if (line1.load_from(&file))
       return true;
     size_t line_count;
@@ -269,9 +274,9 @@ struct Info_file
     for (; i < line_count; ++i)
     {
       int c;
-      if (i < value_list.size()) // line known in the `value_list`
+      if (i < size) // line known in the `value_list`
       {
-        const Mem_fn &pm= value_list.begin()[i];
+        const Mem_fn &pm= values[i];
         if (pm)
         {
           if (pm(this).load_from(&file))
@@ -293,6 +298,7 @@ struct Info_file
     }
     return false;
   }
+protected:
 
   /**
     Flush the MySQL line-based section to the @ref file
@@ -304,9 +310,14 @@ struct Info_file
       This reservation provides compatibility with MySQL,
       who has added more old-style lines while MariaDB innovated.
   */
-  void save_to_file(Mem_fn::List value_list, size_t total_line_count)
+  template<size_t size> void save_to_file(
+    const Mem_fn (&value_list)[size],
+    size_t total_line_count= size + /* line count line */ 1
+  ) { return save_to_file(value_list, size, total_line_count); }
+private:
+  void save_to_file(const Mem_fn *values, size_t size, size_t total_line_count)
   {
-    DBUG_ASSERT(total_line_count > value_list.size());
+    DBUG_ASSERT(total_line_count > size);
     my_b_seek(&file, 0);
     /*
       If the new contents take less space than the previous file contents,
@@ -316,8 +327,9 @@ struct Info_file
     */
     Int_IO_CACHE::to_chars(&file, total_line_count);
     my_b_write_byte(&file, '\n');
-    for (const Mem_fn &pm: value_list)
+    for (size_t i= 0; i < size; ++i)
     {
+      const Mem_fn &pm= values[i];
       if (pm)
         pm(this).save_to(&file);
       my_b_write_byte(&file, '\n');
@@ -327,7 +339,7 @@ struct Info_file
       (1 for the line count line + line count) inclusive -> max line inclusive
        = line count exclusive <- max line inclusive
     */
-    for (; total_line_count > value_list.size(); --total_line_count)
+    for (; total_line_count > size; --total_line_count)
       my_b_write_byte(&file, '\n');
   }
 

sql/rpl_master_info_file.h

@@ -552,7 +552,7 @@ struct Master_info_file: Info_file
   /// }@
 
 
-  inline static Mem_fn::List VALUE_LIST= {
+  inline static const Mem_fn VALUE_LIST[] {
     &Master_info_file::master_log_file,
     &Master_info_file::master_log_pos,
     &Master_info_file::master_host,

sql/rpl_relay_log_info_file.h

@@ -36,7 +36,7 @@ struct Relay_log_info_file: Info_file
   Int_value<uint32_t> sql_delay;
   /// }@
 
-  inline static const Mem_fn::List VALUE_LIST= {
+  inline static const Mem_fn VALUE_LIST[] {
     &Relay_log_info_file::relay_log_file,
     &Relay_log_info_file::relay_log_pos,
     &Relay_log_info_file::read_master_log_file,
@@ -50,8 +50,7 @@ struct Relay_log_info_file: Info_file
   }
   void save_to_file() override
   {
-    return Info_file::save_to_file(VALUE_LIST,
-                            VALUE_LIST.size() + /* line count line */ 1);
+    return Info_file::save_to_file(VALUE_LIST);
   }
 };