MDEV-22520 Assertion `gathered_length == thd->lex->comment.length` failed in binlog_defragment

The assert was caused by early cleanup of a user variable participant
in BINLOG @var,@var where it plays twice. That was unexpected by the base
code to clear its value prematurely.

Fixed with relocating the user var destruction after operations with
its value is over.

mysql-test/suite/binlog/r/binlog_mysqlbinlog_row_frag.result

@@ -20,5 +20,8 @@ ERROR 42000: You have an error in your SQL syntax; check the manual that corresp
 SET @binlog_fragment_0='012345';
 BINLOG @binlog_fragment_0, @binlog_fragment_not_exist;
 ERROR 42000: Incorrect argument type to variable 'binlog_fragment_not_exist'
+SET @a= '42';
+BINLOG @a, @a;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use
 # Cleanup
 DROP TABLE t;

mysql-test/suite/binlog/t/binlog_mysqlbinlog_row_frag.test

@@ -40,6 +40,11 @@ SET @binlog_fragment_0='012345';
 --error ER_WRONG_TYPE_FOR_VAR
 BINLOG @binlog_fragment_0, @binlog_fragment_not_exist;
 
+# MDEV-22520
+SET @a= '42';
+--error ER_SYNTAX_ERROR
+BINLOG @a, @a;
+
 --echo # Cleanup
 --remove_file $MYSQLTEST_VARDIR/tmp/mysqlbinlog.sql
 DROP TABLE t;

sql/sql_binlog.cc

@@ -78,8 +78,9 @@ int binlog_defragment(THD *thd)
     memcpy(thd->lex->comment.str + gathered_length, entry[k]->value,
            entry[k]->length);
     gathered_length += entry[k]->length;
-    update_hash(entry[k], true, NULL, 0, STRING_RESULT, &my_charset_bin, 0);
   }
+  for (uint k=0; k < 2; k++)
+    update_hash(entry[k], true, NULL, 0, STRING_RESULT, &my_charset_bin, 0);
 
   DBUG_ASSERT(gathered_length == thd->lex->comment.length);