SIGSEGV in Item_equal::val_int (from Item_equal::val_int and Type_handler_int_result::Item_val_bool) and UBSAN: downcast of address X which does not point to an object of type 'Item_field' on SELECT

CREATE TABLE t(c INT UNIQUE,c2 TEXT) ENGINE=InnoDB;

INSERT INTO t(c2) VALUES (1);

SELECT * FROM t GROUP BY c HAVING (SELECT c2 WHERE 0>c2 IS NULL=(1<c) OR c2='');

Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-opt/bin/mysqld --no-defaults --core'.

Program terminated with signal SIGSEGV, Segmentation fault.

[Current thread is 1 (Thread 0x14abf8097700 (LWP 4153582))]

(gdb) bt

#0  0x00005611eb67d1e1 in Item_equal::val_int (this=0x14ab8c049718) at /test/10.11_opt/sql/item_cmpfunc.cc:7196

#1  Item_equal::val_int (this=0x14ab8c049718) at /test/10.11_opt/sql/item_cmpfunc.cc:7179

#2  0x00005611eb58d164 in Type_handler_int_result::Item_val_bool (this=<optimized out>, item=<optimized out>) at /test/10.11_opt/sql/sql_type.cc:5091

#3  0x00005611eb67aa45 in Item_cond_or::val_int (this=0x14ab8c012b38) at /test/10.11_opt/sql/item_cmpfunc.cc:5448

#4  0x00005611eb476e58 in JOIN::exec_inner (this=0x14ab8c046bb8) at /test/10.11_opt/sql/sql_select.cc:4671

#5  0x00005611eb477b08 in JOIN::exec (this=0x14ab8c046bb8) at /test/10.11_opt/sql/sql_select.cc:4591

#6  0x00005611eb71bc06 in subselect_single_select_engine::exec (this=0x14ab8c0135c0) at /test/10.11_opt/sql/item_subselect.cc:4145

#7  0x00005611eb71b25c in Item_subselect::exec (this=0x14ab8c013438) at /test/10.11_opt/sql/item_subselect.cc:855

#8  0x00005611eb71ad44 in Item_singlerow_subselect::val_str (this=0x14ab8c013438, str=0x14ab8c049ba0) at /test/10.11_opt/sql/item_subselect.cc:1527

#9  0x00005611eb6581e5 in Item_cache_str::cache_value (this=0x14ab8c049ab0) at /test/10.11_opt/sql/item.cc:10476

#10 0x00005611eb66dd04 in Item_cache_wrapper::cache (this=0x14ab8c049a10) at /test/10.11_opt/sql/item.cc:8881

#11 Item_cache_wrapper::val_int (this=0x14ab8c049a10) at /test/10.11_opt/sql/item.cc:8935

#12 Item_cache_wrapper::val_int (this=0x14ab8c049a10) at /test/10.11_opt/sql/item.cc:8918

#13 0x00005611eb467f81 in end_send_group (join=0x14ab8c013ef0, join_tab=<optimized out>, end_of_records=<optimized out>) at /test/10.11_opt/sql/sql_select.cc:23150

#14 0x00005611eb47759f in do_select (procedure=<optimized out>, join=0x14ab8c013ef0) at /test/10.11_opt/sql/sql_select.cc:21311

#15 JOIN::exec_inner (this=0x14ab8c013ef0) at /test/10.11_opt/sql/sql_select.cc:4813

#16 0x00005611eb477b08 in JOIN::exec (this=this@entry=0x14ab8c013ef0) at /test/10.11_opt/sql/sql_select.cc:4591

#17 0x00005611eb475d11 in mysql_select (thd=0x14ab8c000c58, tables=0x14ab8c010f00, fields=@0x14ab8c010bc8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14ab8c010eb8, last = 0x14ab8c014740, elements = 2}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x14ab8c011720, having=0x14ab8c013438, proc_param=0x0, select_options=<optimized out>, result=0x14ab8c013ec8, unit=0x14ab8c004cd0, select_lex=0x14ab8c010928) at /test/10.11_opt/sql/sql_select.cc:5071

#18 0x00005611eb476457 in handle_select (thd=thd@entry=0x14ab8c000c58, lex=lex@entry=0x14ab8c004bf8, result=result@entry=0x14ab8c013ec8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_opt/sql/sql_select.cc:582

#19 0x00005611eb3f8051 in execute_sqlcom_select (thd=0x14ab8c000c58, all_tables=0x14ab8c010f00) at /test/10.11_opt/sql/sql_parse.cc:6261

#20 0x00005611eb405d48 in mysql_execute_command (thd=0x14ab8c000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:3945

#21 0x00005611eb3f3205 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x14ab8c000c58) at /test/10.11_opt/sql/sql_parse.cc:8037

#22 mysql_parse (thd=0x14ab8c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.11_opt/sql/sql_parse.cc:7959

#23 0x00005611eb3fed6a in dispatch_command (command=COM_QUERY, thd=0x14ab8c000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.11_opt/sql/sql_class.h:1345

#24 0x00005611eb400cb2 in do_command (thd=0x14ab8c000c58, blocking=blocking@entry=true) at /test/10.11_opt/sql/sql_parse.cc:1407

#25 0x00005611eb51a17f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5611ee5104e8, put_in_cache=put_in_cache@entry=true) at /test/10.11_opt/sql/sql_connect.cc:1416

#26 0x00005611eb51a45d in handle_one_connection (arg=0x5611ee5104e8) at /test/10.11_opt/sql/sql_connect.cc:1318

#27 0x000014ac0fb18609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#28 0x000014ac0f704133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Core was generated by `/test/MD190922-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.

Program terminated with signal SIGSEGV, Segmentation fault.

[Current thread is 1 (Thread 0x15488dad6700 (LWP 4152893))]

(gdb) bt

#0  0x0000564d95b3fbab in Item_equal::val_int (this=0x15482806ae10) at /test/10.11_dbg/sql/item_cmpfunc.cc:7196

#1  0x0000564d95a05eb0 in Type_handler_int_result::Item_val_bool (this=<optimized out>, item=<optimized out>) at /test/10.11_dbg/sql/sql_type.cc:5091

#2  0x0000564d956dde7a in Item::val_bool (this=0x15482806ae10) at /test/10.11_dbg/sql/item.h:1687

#3  0x0000564d95b4135f in Item_cond_or::val_int (this=0x154828015508) at /test/10.11_dbg/sql/item_cmpfunc.cc:5448

#4  0x0000564d9589a696 in JOIN::exec_inner (this=this@entry=0x154828068108) at /test/10.11_dbg/sql/sql_select.cc:4671

#5  0x0000564d9589b826 in JOIN::exec (this=0x154828068108) at /test/10.11_dbg/sql/sql_select.cc:4591

#6  0x0000564d95c07aec in subselect_single_select_engine::exec (this=0x154828015f90) at /test/10.11_dbg/sql/item_subselect.cc:4145

#7  0x0000564d95c0713a in Item_subselect::exec (this=0x154828015e08) at /test/10.11_dbg/sql/item_subselect.cc:855

#8  0x0000564d95c05864 in Item_singlerow_subselect::val_str (this=0x154828015e08, str=0x15482806b2a0) at /test/10.11_dbg/sql/item_subselect.cc:1527

#9  0x0000564d956ddf21 in Item::str_result (this=<optimized out>, tmp=<optimized out>) at /test/10.11_dbg/sql/item.h:1780

#10 0x0000564d95b16693 in Item_cache_str::cache_value (this=0x15482806b1b0) at /test/10.11_dbg/sql/item.cc:10476

#11 0x0000564d95b2ef26 in Item_cache_wrapper::cache (this=0x15482806b110) at /test/10.11_dbg/sql/item.cc:8881

#12 Item_cache_wrapper::val_int (this=0x15482806b110) at /test/10.11_dbg/sql/item.cc:8935

#13 0x0000564d95887b95 in end_send_group (join=0x1548280168c0, join_tab=<optimized out>, end_of_records=<optimized out>) at /test/10.11_dbg/sql/sql_select.cc:23150

#14 0x0000564d95864fa3 in sub_select (join=0x1548280168c0, join_tab=0x154828069e38, end_of_records=true) at /test/10.11_dbg/sql/sql_select.cc:21708

#15 0x0000564d9589b2c3 in do_select (procedure=<optimized out>, join=0x1548280168c0) at /test/10.11_dbg/sql/sql_select.cc:21311

#16 JOIN::exec_inner (this=this@entry=0x1548280168c0) at /test/10.11_dbg/sql/sql_select.cc:4813

#17 0x0000564d9589b826 in JOIN::exec (this=this@entry=0x1548280168c0) at /test/10.11_dbg/sql/sql_select.cc:4591

#18 0x0000564d958995aa in mysql_select (thd=thd@entry=0x154828000d48, tables=0x1548280138d0, fields=@0x154828013598: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x154828013888, last = 0x154828017118, elements = 2}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x1548280140f0, having=0x154828015e08, proc_param=0x0, select_options=2164525824, result=0x154828016898, unit=0x154828004f80, select_lex=0x1548280132f8) at /test/10.11_dbg/sql/sql_select.cc:5071

#19 0x0000564d95899da0 in handle_select (thd=thd@entry=0x154828000d48, lex=lex@entry=0x154828004ea8, result=result@entry=0x154828016898, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.11_dbg/sql/sql_select.cc:582

#20 0x0000564d95803d94 in execute_sqlcom_select (thd=thd@entry=0x154828000d48, all_tables=0x1548280138d0) at /test/10.11_dbg/sql/sql_parse.cc:6261

#21 0x0000564d95810109 in mysql_execute_command (thd=thd@entry=0x154828000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:3945

#22 0x0000564d957fe03c in mysql_parse (thd=thd@entry=0x154828000d48, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x15488dad5330) at /test/10.11_dbg/sql/sql_parse.cc:8037

#23 0x0000564d9580b66d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154828000d48, packet=packet@entry=0x15482800aed9 "", packet_length=packet_length@entry=79, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1345

#24 0x0000564d9580dd97 in do_command (thd=0x154828000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407

#25 0x0000564d95971fb9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x564d98fbaf98, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416

#26 0x0000564d959724c3 in handle_one_connection (arg=0x564d98fbaf98) at /test/10.11_dbg/sql/sql_connect.cc:1318

#27 0x00001548ab74e609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#28 0x00001548ab33a133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95