Prepare statement with parameter substitution asserts in debug build

After the MariaDB 10.2 merge, a simple PREPARE statement with substitution causes assert:

MariaDB [tpch1]> create table t1 (x int, y int) engine=columnstore;
Query OK, 0 rows affected (1.08 sec)

MariaDB [tpch1]> insert into t1 values (1, 1), (2, 2), (3, null);
Query OK, 3 rows affected (0.79 sec)
Records: 3 Duplicates: 0 Warnings: 0

MariaDB [tpch1]> prepare stmt1 from "select count from t1 where x = ?";
Query OK, 0 rows affected (0.00 sec)
Statement prepared

MariaDB [tpch1]> set @parm1=1;
Query OK, 0 rows affected (0.00 sec)

MariaDB [tpch1]> execute stmt1 using @parm1;
ERROR 2013 (HY000): Lost connection to MySQL server during query
MariaDB [tpch1]>

In addition, this statement should have a return type of INT, yet the assert is occurring in Item_func_get_user_var::val_real(). This bug also affects InnoDB tables accessed by the Columnstore build.

I believe the problem occurred in earlier builds, but there was no assert then.