Sever crashed with MEDIAN() window function

CREATE TABLE t ( pk int PRIMARY KEY, a1 int, a2 int);

SELECT MEDIAN(`a1`) OVER (),

       MEDIAN(`a2`) OVER (PARTITION BY `pk`)

FROM t;

==19377==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x55dbf0b11383 bp 0x7f4ee8cb6d40 sp 0x7f4ee8cb6d20 T5)

    #0 0x55dbf0b11382 in Item_window_func::check_result_type_of_order_item() /home/alice/git/10.3/sql/item_windowfunc.cc:176

    #1 0x55dbf0442100 in setup_windows(THD*, Bounds_checked_array<Item*>, TABLE_LIST*, List<Item>&, List<Item>&, List<Window_spec>&, List<Item_window_func>&) /home/alice/git/10.3/sql/sql_window.cc:320

    #2 0x55dbf0058aef in setup_without_group /home/alice/git/10.3/sql/sql_select.cc:670

    #3 0x55dbf005d202 in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /home/alice/git/10.3/sql/sql_select.cc:1097

    #4 0x55dbf007a83f in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/alice/git/10.3/sql/sql_select.cc:4130

    #5 0x55dbf005663b in handle_select(THD*, LEX*, select_result*, unsigned long) /home/alice/git/10.3/sql/sql_select.cc:382

    #6 0x55dbeffdd667 in execute_sqlcom_select /home/alice/git/10.3/sql/sql_parse.cc:6535

    #7 0x55dbeffcbc82 in mysql_execute_command(THD*) /home/alice/git/10.3/sql/sql_parse.cc:3764

    #8 0x55dbeffe569c in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/alice/git/10.3/sql/sql_parse.cc:7991

    #9 0x55dbeffc0802 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/alice/git/10.3/sql/sql_parse.cc:1841

    #10 0x55dbeffbd9a9 in do_command(THD*) /home/alice/git/10.3/sql/sql_parse.cc:1386

    #11 0x55dbf0307eaa in do_handle_one_connection(CONNECT*) /home/alice/git/10.3/sql/sql_connect.cc:1402

    #12 0x55dbf03078b2 in handle_one_connection /home/alice/git/10.3/sql/sql_connect.cc:1308

    #13 0x55dbf0bc0e3a in pfs_spawn_thread /home/alice/git/10.3/storage/perfschema/pfs.cc:1862

    #14 0x7f4ef36316b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

    #15 0x7f4ef2ac641c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

AddressSanitizer can not provide additional info.

SUMMARY: AddressSanitizer: SEGV /home/alice/git/10.3/sql/item_windowfunc.cc:176 Item_window_func::check_result_type_of_order_item()

Thread T5 created by T0 here:

    #0 0x7f4ef40d5253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)

    #1 0x55dbf0bc1227 in spawn_thread_v1 /home/alice/git/10.3/storage/perfschema/pfs.cc:1912

    #2 0x55dbefd48ea6 in inline_mysql_thread_create /home/alice/git/10.3/include/mysql/psi/mysql_thread.h:1268

    #3 0x55dbefd5e0b8 in create_thread_to_handle_connection(CONNECT*) /home/alice/git/10.3/sql/mysqld.cc:6534

    #4 0x55dbefd5e7b8 in create_new_thread /home/alice/git/10.3/sql/mysqld.cc:6604

    #5 0x55dbefd5f7e4 in handle_connections_sockets() /home/alice/git/10.3/sql/mysqld.cc:6879

    #6 0x55dbefd5d57d in mysqld_main(int, char**) /home/alice/git/10.3/sql/mysqld.cc:6156

    #7 0x55dbefd4783f in main /home/alice/git/10.3/sql/main.cc:25

    #8 0x7f4ef29df82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

==19377==ABORTING

----------SERVER LOG END-------------