init_expr_cache_tracker: SEGV at /mariadb-11.3.0/sql/item_subselect.cc:7069

Run these queries in release build:

CREATE TABLE t0 ( c27 TEXT , INDEX i0 ( c27 ( 28 ) ) ) ;
INSERT INTO t0 VALUES ( 44 ) , ( -111 ) ;
ALTER TABLE t0 ADD COLUMN c60 INT AFTER c27 ;
INSERT INTO t0 VALUES ( -9 , 122 ) , ( -119 , -59 ) ;
SELECT t2 . c41 AS c58 FROM ( SELECT ~ SIGN ( SUBSTRING( c60 , 1 NOT BETWEEN 72 AND 26 IS NOT NULL , EXISTS ( SELECT t1 . c16 NOT IN ( TRIM( LEADING FROM t0 . c60 ) ) = + FLOOR ( c60 ) AS c40 FROM ( SELECT CASE c27 WHEN 'W{uBaX$lwk~r;Y7)1 Aqctw~c"Xk;.u1@=>@~ce
FslVdC<bzOg&' THEN 114 ELSE -61 END IS TRUE AS c16 FROM t0 ) AS t1 ) ) - ASCII ( c27 ) IS NOT NULL ) AS c41 FROM t0 ) AS t2 JOIN t0 ON t0 . c27 = t0 . c27 IN ( SELECT c60 AS c53 FROM t0 GROUP BY c60 , c60 , c41 WITH ROLLUP ) ;

Will trigger Segmentation fault.
GDB info:
Thread 16 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd242e300 (LWP 2659)]
0x00000000015bd63c in Item_subselect::init_expr_cache_tracker (this=<optimized out>, thd=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:7069
7069 Explain_node *node= qw->get_node(unit->first_select()->select_number);

#0 0x00000000015bd63c in Item_subselect::init_expr_cache_tracker (this=<optimized out>, thd=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:7069
#1 Item_exists_subselect::expr_cache_insert_transformer (this=<optimized out>, tmp_thd=<optimized out>, unused=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1803
#2 0x000000000145a403 in Item_args::transform_args (this=0x6290000b0490, thd=0x62b00016c218, transformer=<optimized out>, arg=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:473
#3 Item_func::transform (this=0x6290000b0418, thd=0x62b00016c218, transformer=<optimized out>, argument=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:509
#4 0x000000000145a403 in Item_args::transform_args (this=0x6290000b07a0, thd=0x62b00016c218, transformer=<optimized out>, arg=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:473
#5 Item_func::transform (this=0x6290000b0728, thd=0x62b00016c218, transformer=<optimized out>, argument=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:509
#6 0x000000000145a403 in Item_args::transform_args (this=0x6290000b0868, thd=0x62b00016c218, transformer=<optimized out>, arg=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:473
#7 Item_func::transform (this=0x6290000b07f0, thd=0x62b00016c218, transformer=<optimized out>, argument=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:509
#8 0x000000000145a403 in Item_args::transform_args (this=0x6290000b0a68, thd=0x62b00016c218, transformer=<optimized out>, arg=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:473
#9 Item_func::transform (this=0x6290000b09f0, thd=0x62b00016c218, transformer=<optimized out>, argument=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:509
#10 0x000000000145a403 in Item_args::transform_args (this=0x6290000b0b20, thd=0x62b00016c218, transformer=<optimized out>, arg=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:473
#11 Item_func::transform (this=0x6290000b0aa8, thd=0x62b00016c218, transformer=<optimized out>, argument=0x0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:509
#12 0x000000000136464d in Item_ref::transform (this=0x6290000bb8c0, thd=0x62b00016c218, transformer=&virtual Item::set_type_maybe_null(bool), arg=0x2d <error: Cannot access memory at address 0x2d>) at /home/wx/mariadb-11.3.0/sql/item.cc:8323
#13 0x0000000000c2cca8 in JOIN::setup_subquery_caches (this=<optimized out>, this@entry=0x6290000b6f50) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4437
#14 0x0000000000c085fe in JOIN::optimize_stage2 (this=0x6290000b6f50) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:3235
#15 0x0000000000c13911 in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
#16 0x0000000000bfc156 in JOIN::optimize (this=this@entry=0x6290000b6f50) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#17 0x0000000000be4fdf in mysql_select (thd=<optimized out>, thd@entry=0x62b00016c218, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x6290000b6f20, unit=0x62b0001704a8, select_lex=0x629000091678) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
#18 0x0000000000be4596 in handle_select (thd=thd@entry=0x62b00016c218, lex=<optimized out>, lex@entry=0x62b0001703c8, result=<optimized out>, result@entry=0x6290000b6f20, setup_tables_done_option=<optimized out>, setup_tables_done_option@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#19 0x0000000000b3df18 in execute_sqlcom_select (thd=0x62b00016c218, all_tables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#20 0x0000000000b2cd51 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#21 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd242ca80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#22 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#23 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#24 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#25 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x60800145c2b8) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#26 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000006618) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#27 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#28 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6