From 0c2f3de1a2d66fed61488388f5f3da212d582a80 Mon Sep 17 00:00:00 2001
From: ParadoxV5 <paradox.ver5@gmail.com>
Date: Sat, 30 May 2026 21:24:23 -0600
Subject: [PATCH] MDEV-24646/MDEV-39711: Fix System-Versioned UPDATE with
 VIRTUAL columns
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

UPDATEs on System-Versioned Tables used stale data for Row
Format Binary Logging’s after-image, which may be the before-
value (MDEV-39711) or even invalidated memory (MDEV-24646).
---
 .../r/versioning_row_virtual_text_blob.result | 15 ++++++++++
 .../t/versioning_row_virtual_text_blob.test   | 30 +++++++++++++++++++
 sql/table.cc                                  |  2 +-
 3 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 mysql-test/suite/rpl/r/versioning_row_virtual_text_blob.result
 create mode 100644 mysql-test/suite/rpl/t/versioning_row_virtual_text_blob.test

diff --git a/mysql-test/suite/rpl/r/versioning_row_virtual_text_blob.result b/mysql-test/suite/rpl/r/versioning_row_virtual_text_blob.result
new file mode 100644
index 0000000000000..d9674cd7dc3ab
--- /dev/null
+++ b/mysql-test/suite/rpl/r/versioning_row_virtual_text_blob.result
@@ -0,0 +1,15 @@
+include/master-slave.inc
+[connection master]
+CREATE OR REPLACE TABLE t (a TEXT, v BLOB AS (a) VIRTUAL)
+WITH SYSTEM VERSIONING AS SELECT 'foo' AS a;
+UPDATE t SET a='bar';
+CREATE OR REPLACE TABLE t (a TEXT, v TEXT AS (RIGHT(a, 1)) VIRTUAL)
+WITH SYSTEM VERSIONING AS SELECT 'before' AS a;
+UPDATE t SET a='after';
+connection slave;
+SELECT * FROM t;
+v	a
+r	after
+connection master;
+DROP TABLE t;
+include/rpl_end.inc
diff --git a/mysql-test/suite/rpl/t/versioning_row_virtual_text_blob.test b/mysql-test/suite/rpl/t/versioning_row_virtual_text_blob.test
new file mode 100644
index 0000000000000..539d2ece26195
--- /dev/null
+++ b/mysql-test/suite/rpl/t/versioning_row_virtual_text_blob.test
@@ -0,0 +1,30 @@
+--source include/have_binlog_format_row.inc
+--source include/master-slave.inc
+
+
+# MDEV-24646 ASAN heap-use-after-free in Field_blob::pack /
+#   THD::binlog_update_row upon DML on table with virtual column
+
+CREATE OR REPLACE TABLE t (a TEXT, v BLOB AS (a) VIRTUAL)
+  WITH SYSTEM VERSIONING AS SELECT 'foo' AS a;
+
+UPDATE t SET a='bar';
+
+
+# MDEV-39711 UPDATE on System-Versioned Tables uses the after-value in Row-
+#  format Binlog's before-image for non-trivial Text/Blob Virtual Columns
+
+CREATE OR REPLACE TABLE t (a TEXT, v TEXT AS (RIGHT(a, 1)) VIRTUAL)
+  WITH SYSTEM VERSIONING AS SELECT 'before' AS a;
+
+UPDATE t SET a='after';
+
+--sync_slave_with_master
+  SELECT * FROM t;
+--connection master
+
+
+# Cleanup
+DROP TABLE t;
+
+--source include/rpl_end.inc
diff --git a/sql/table.cc b/sql/table.cc
index 2b283fd93e1b8..d4c0389e4f450 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -9422,7 +9422,7 @@ bool TABLE::vers_update_fields()
   }
 
   if (vfield)
-    update_virtual_fields(file, VCOL_UPDATE_FOR_READ);
+    update_virtual_fields(file, VCOL_UPDATE_FOR_WRITE);
   return res;
 }