Backported the fix and the test case for bug 59483 from the mysql-5.6 code line.

mysql-test/include/icp_tests.inc

@@ -574,6 +574,29 @@ SELECT pk FROM t1 WHERE c1 <> 1 HAVING pk = 3 ORDER BY pk LIMIT 5;
 
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#59483 "Crash on INSERT/REPLACE in
+--echo #            rec_convert_dtuple_to_rec_comp with ICP on"
+--echo #
+
+CREATE TABLE t1 (
+ pk INTEGER AUTO_INCREMENT PRIMARY KEY,
+ i1 INTEGER,
+ c1 CHAR(6),
+ i2 INTEGER NOT NULL,
+ KEY (i2)
+);
+
+INSERT INTO t1 VALUES
+ (NULL, 4, 'that', 8),
+ (NULL, 1, 'she', 6),
+ (NULL, 6, 'tell', 2);
+
+SELECT * FROM t1 WHERE i2 IN (3, 6) LIMIT 2 FOR UPDATE;
+INSERT INTO t1 (i2) VALUES (1);
+
+DROP TABLE t1;
+
 --echo #
 --echo # BUG#778434 Wrong result with in_to_exists=on in maria-5.3-mwl89
 --echo #

mysql-test/r/innodb_icp.result

@@ -538,6 +538,26 @@ pk
 3
 DROP TABLE t1;
 #
+# Bug#59483 "Crash on INSERT/REPLACE in
+#            rec_convert_dtuple_to_rec_comp with ICP on"
+#
+CREATE TABLE t1 (
+pk INTEGER AUTO_INCREMENT PRIMARY KEY,
+i1 INTEGER,
+c1 CHAR(6),
+i2 INTEGER NOT NULL,
+KEY (i2)
+);
+INSERT INTO t1 VALUES
+(NULL, 4, 'that', 8),
+(NULL, 1, 'she', 6),
+(NULL, 6, 'tell', 2);
+SELECT * FROM t1 WHERE i2 IN (3, 6) LIMIT 2 FOR UPDATE;
+pk	i1	c1	i2
+2	1	she	6
+INSERT INTO t1 (i2) VALUES (1);
+DROP TABLE t1;
+#
 # BUG#778434 Wrong result with in_to_exists=on in maria-5.3-mwl89
 #
 CREATE TABLE t1 ( f11 int) ;

mysql-test/r/maria_icp.result

@@ -544,6 +544,26 @@ pk
 3
 DROP TABLE t1;
 #
+# Bug#59483 "Crash on INSERT/REPLACE in
+#            rec_convert_dtuple_to_rec_comp with ICP on"
+#
+CREATE TABLE t1 (
+pk INTEGER AUTO_INCREMENT PRIMARY KEY,
+i1 INTEGER,
+c1 CHAR(6),
+i2 INTEGER NOT NULL,
+KEY (i2)
+);
+INSERT INTO t1 VALUES
+(NULL, 4, 'that', 8),
+(NULL, 1, 'she', 6),
+(NULL, 6, 'tell', 2);
+SELECT * FROM t1 WHERE i2 IN (3, 6) LIMIT 2 FOR UPDATE;
+pk	i1	c1	i2
+2	1	she	6
+INSERT INTO t1 (i2) VALUES (1);
+DROP TABLE t1;
+#
 # BUG#778434 Wrong result with in_to_exists=on in maria-5.3-mwl89
 #
 CREATE TABLE t1 ( f11 int) ;

mysql-test/r/myisam_icp.result

@@ -542,6 +542,26 @@ pk
 3
 DROP TABLE t1;
 #
+# Bug#59483 "Crash on INSERT/REPLACE in
+#            rec_convert_dtuple_to_rec_comp with ICP on"
+#
+CREATE TABLE t1 (
+pk INTEGER AUTO_INCREMENT PRIMARY KEY,
+i1 INTEGER,
+c1 CHAR(6),
+i2 INTEGER NOT NULL,
+KEY (i2)
+);
+INSERT INTO t1 VALUES
+(NULL, 4, 'that', 8),
+(NULL, 1, 'she', 6),
+(NULL, 6, 'tell', 2);
+SELECT * FROM t1 WHERE i2 IN (3, 6) LIMIT 2 FOR UPDATE;
+pk	i1	c1	i2
+2	1	she	6
+INSERT INTO t1 (i2) VALUES (1);
+DROP TABLE t1;
+#
 # BUG#778434 Wrong result with in_to_exists=on in maria-5.3-mwl89
 #
 CREATE TABLE t1 ( f11 int) ;

storage/xtradb/handler/ha_innodb.cc

@@ -2013,9 +2013,14 @@ ha_innobase::reset_template(void)
 
 	prebuilt->keep_other_fields_on_keyread = 0;
 	prebuilt->read_just_key = 0;
-	/* Reset index condition pushdown state */
+        /* Reset index condition pushdown state. */
-	prebuilt->idx_cond = NULL;
+        if (prebuilt->idx_cond) {
-	prebuilt->idx_cond_n_cols = 0;
+                prebuilt->idx_cond = NULL;
+                prebuilt->idx_cond_n_cols = 0;
+                /* Invalidate prebuilt->mysql_template
+                in ha_innobase::write_row(). */
+                prebuilt->template_type = ROW_MYSQL_NO_TEMPLATE;
+        }
 }
 
 /*****************************************************************//**