Fake changes assertion fail in row_ins_clust_index_entry_by_modify() | btr_store_big_rec_extern_fields ()

See bug 1188172.

Reduced testcase (crashes ~1 run in ~4)

source include/have_innodb.inc;
source include/have_debug.inc;
CREATE TABLE t1(id INT NOT NULL PRIMARY KEY, data text) Engine=InnoDB;

INSERT INTO t1 VALUES(1, '');
INSERT INTO t1 VALUES(2, '');
INSERT INTO t1 VALUES(3, '');
INSERT INTO t1 VALUES(4, '');

DELETE FROM t1 WHERE id = 4;
SET innodb_fake_changes=1;
--error ER_ERROR_DURING_COMMIT
INSERT INTO t1 VALUES (4, lpad('a',12000,'b'));
SET innodb_fake_changes=0;
SELECT * FROM t1;
DROP TABLE t1;

Crashes 5.5 too. My guess about this being 5.6 port regression (bug 1188172) was wrong.

130711 14:34:14 InnoDB: !!!!!!!! UNIV_DEBUG switched on !!!!!!!!!
130711 14:34:14 InnoDB: The InnoDB memory heap is disabled
130711 14:34:14 InnoDB: Mutexes and rw_locks use GCC atomic builtins
130711 14:34:14 InnoDB: Compressed tables use zlib 1.2.7
130711 14:34:14 InnoDB: Initializing buffer pool, size = 32.0M
130711 14:34:14 InnoDB: Completed initialization of buffer pool
130711 14:34:14 InnoDB: highest supported file format is Barracuda.
130711 14:34:14 InnoDB: Waiting for the background threads to start
130711 14:34:15 Percona XtraDB (http://www.percona.com) 5.5.31-29.3 started; log sequence number 1597945
130711 14:34:15 [Note] Event Scheduler: Loaded 0 events
130711 14:34:15 [Note] /home/laurynas/percona/src/fake-changes-from-fb/5.5/obj-debug/sql/mysqld: ready for connections.
Version: '5.5.31-debug-log' socket: '/home/laurynas/percona/src/fake-changes-from-fb/5.5/obj-debug/mysql-test/var/tmp/mysqld.1.sock' port: 13001 Source distribution
InnoDB: DEBUG: update_statistics for test/t1.
InnoDB: DEBUG: update_statistics for test/t1.
InnoDB: DEBUG: update_statistics for test/t1.
130711 14:34:15 InnoDB: Assertion failure in thread 140511718549248 in file btr0cur.c line 4388
InnoDB: Failing assertion: rec_offs_any_extern(offsets)
InnoDB: We intentionally generate a memory trap.
InnoDB: Submit a detailed bug report to http://bugs.mysql.com.
InnoDB: If you get repeated assertion failures or crashes, even
InnoDB: immediately after the mysqld startup, there may be
InnoDB: corruption in the InnoDB tablespace. Please refer to
InnoDB: http://dev.mysql.com/doc/refman/5.5/en/forcing-innodb-recovery.html
InnoDB: about forcing recovery.
11:34:15 UTC - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.
Please help us make Percona Server better by reporting any
bugs at http://bugs.percona.com/

key_buffer_size=1048576
read_buffer_size=131072
max_used_connections=1
max_threads=153
thread_count=1
connection_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 61693 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x33b1390
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7fcb6f121e00 thread_stack 0x40000
/home/laurynas/percona/src/fake-changes-from-fb/5.5/obj-debug/sql/mysqld(my_print_stacktrace+0x38)[0x8ff98e]
/home/laurynas/percona/src/fake-changes-from-fb/5.5/obj-debug/sql/mysqld(handle_fatal_signal+0x42d)[0x781885]
/lib/x86_64-linux-gnu/libpthread.so.0(+0xfbd0)[0x7fcb7b242bd0]
/lib/x86_64-linux-gnu/libc.so.6(gsignal+0x37)[0x7fcb7a45d037]
/lib/x86_64-linu...

Crashes 5.1 as well:

--source include/have_innodb_plugin.inc

--disable_warnings
DROP TABLE IF EXISTS t1;
--enable_warnings

CREATE TABLE t1(id INT NOT NULL PRIMARY KEY, data TEXT) ENGINE=InnoDB;

INSERT INTO t1 VALUES(1, '');
INSERT INTO t1 VALUES(2, '');
INSERT INTO t1 VALUES(3, '');
INSERT INTO t1 VALUES(4, '');

DELETE FROM t1 WHERE id = 4;

SET innodb_fake_changes=1;

--error ER_ERROR_DURING_COMMIT
INSERT INTO t1 VALUES (4, LPAD('a', 12000, 'b'));

SET innodb_fake_changes=0;

DROP TABLE t1;

130711 14:48:49 InnoDB: Assertion failure in thread 140660380555008 in file btr/btr0cur.c line 4277
InnoDB: Failing assertion: rec_offs_any_extern(offsets)
InnoDB: We intentionally generate a memory trap.
InnoDB: Submit a detailed bug report to http://bugs.mysql.com.
InnoDB: If you get repeated assertion failures or crashes, even
InnoDB: immediately after the mysqld startup, there may be
InnoDB: corruption in the InnoDB tablespace. Please refer to
InnoDB: http://dev.mysql.com/doc/refman/5.1/en/forcing-innodb-recovery.html
InnoDB: about forcing recovery.
11:48:49 UTC - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.
Please help us make Percona Server better by reporting any
bugs at http://bugs.percona.com/

key_buffer_size=1048576
read_buffer_size=131072
max_used_connections=1
max_threads=151
thread_count=1
connection_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 60723 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x1f5def8
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7fee0c044e78 thread_stack 0x40000
/home/laurynas/percona/src/percona-server/5.1/Percona-Server/sql/mysqld(my_print_stacktrace+0x38)[0xa888d7]
/home/laurynas/percona/src/percona-server/5.1/Percona-Server/sql/mysqld(handle_fatal_signal+0x3a9)[0x7ce305]
/lib/x86_64-linux-gnu/libpthread.so.0(+0xfbd0)[0x7fee0f3b0bd0]
/lib/x86_64-linux-gnu/libc.so.6(gsignal+0x37)[0x7fee0e6b7037]
/lib/x86_64-linux-gnu/libc.so.6(abort+0x148)[0x7fee0e6ba698]
/home/laurynas/percona/src/percona-server/5.1/Percona-Server/sql/mysqld[0x98f840]
/home/laurynas/percona/src/percona-server/5.1/Percona-Server/sql/mysqld[0x930a3c]
/home/laurynas/percona/src/percona-server/5.1/Percona-Server/sql/mysqld[0x931025]
/home/laurynas/percona/src/percona-server/5.1/Percona-Server/sql/mysqld[0x931320]
/home/laurynas/percona/src/percona-server/5.1/Percona-Server/sql/mysqld[0x9315ea]
/home/laurynas/percona/src/percona-server/5.1/Percona-Server/sql/mysqld[0x9318bb]
/home/laurynas/percona/src/percona-server/5.1/Percona-Server/sql/mysqld[0x938e3f]
/home/laurynas/percona/src/percona-server/5.1/Percona-Server/sql/m...

Percona now uses JIRA for bug reports so this bug report is migrated to: https://jira.percona.com/browse/PS-673