Segmentation fault at /mariadb-11.3.0/sql/sql_select.cc:32270

Run these queries in release build:

CREATE TABLE t0 ( c11 INT , c25 INT ) ;
INSERT INTO t0 VALUES ( DEFAULT , DEFAULT ) , ( DEFAULT , DEFAULT ) ;
DELETE FROM t0 WHERE EXISTS ( SELECT c11 = RAND ( ) * RTRIM ( c11 ) / EXP ( c11 ) AS c35 FROM t0 WHERE -115 = + NULLIF ( 35 , 117 NOT IN ( RAND ( ) * TRUNCATE ( -59 , -2 ) - TRUNCATE ( 57 , 2 ) = 78 ) ) EXCEPT ALL SELECT c11 + 29 AS c47 FROM t0 WHERE c11 < 43 AND c25 < 48 GROUP BY c11 , c11 , c11 WITH ROLLUP ) = 84 OR SQRT ( ~ EXP ( t0 . c25 ) + CONVERT ( c11 , UNSIGNED ) % RAND ( ) ) - t0 . c25 ;

Will trigger Segmentation fault.
GDB info:
Thread 16 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd242e300 (LWP 3254)]
0x0000000000c9cdfc in AGGR_OP::end_send (this=this@entry=0x0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:32270
32270 TABLE *table= join_tab->table;
(gdb) p join_tab
Cannot access memory at address 0x0

#0 0x0000000000c9cdfc in AGGR_OP::end_send (this=this@entry=0x0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:32270
#1 0x0000000000c388f1 in sub_select_postjoin_aggr (join=0x6290000b5218, join_tab=0x6290000c07a8, end_of_records=true) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23128
#2 0x0000000000c4536c in do_select (join=0x6290000b5218, procedure=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#3 JOIN::exec_inner (this=0x6290000b5218) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#4 0x0000000000c428e9 in JOIN::exec (this=0x6290000b5218) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#5 0x0000000000df0df7 in st_select_lex_unit::exec_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:2389
#6 0x00000000015d8bb5 in subselect_union_engine::exec (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4187
#7 0x00000000015b3edc in Item_subselect::exec (this=0x6290000b19a8) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#8 0x00000000015bda3d in Item_exists_subselect::val_int (this=0x6290000b19a8) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1840
#9 0x00000000013ae22f in Arg_comparator::compare_int_signed (this=0x6290000b1cf0) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:944
#10 0x00000000013b5ea2 in Arg_comparator::compare (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#11 Item_func_eq::val_int (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#12 0x00000000010d6cd1 in Type_handler_int_result::Item_val_bool (this=<optimized out>, item=0x0) at /home/wx/mariadb-11.3.0/sql/sql_type.cc:5082
#13 0x00000000013dc493 in Item_cond_or::val_int (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5542
#14 0x0000000000c9dd1c in evaluate_join_record (join=join@entry=0x6290000b2bd8, join_tab=0x62b00016c218, join_tab@entry=0x6290000b9238, error=error@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23545
#15 0x0000000000be340f in sub_select (join=0x6290000b2bd8, join_tab=0x6290000b9238, end_of_records=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23481
#16 0x0000000000c45121 in do_select (join=0x6290000b2bd8, procedure=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22961
#17 JOIN::exec_inner (this=0x6290000b2bd8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#18 0x0000000000c428e9 in JOIN::exec (this=this@entry=0x6290000b2bd8) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#19 0x0000000000cc4813 in Sql_cmd_dml::execute_inner (this=<optimized out>, thd=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:33413
#20 0x0000000000a51126 in Sql_cmd_delete::execute_inner (this=<optimized out>, thd=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_delete.cc:1799
#21 0x0000000000cc40b2 in Sql_cmd_dml::execute (this=0x6290000b2ac8, thd=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:33350
#22 0x0000000000b2ce82 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:4361
#23 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd1c15a80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#24 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#25 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#26 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#27 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x608001b3bc38) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#28 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000005118) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#29 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#30 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6