Segmentation fault at /mariadb-11.3.0/sql/item_cmpfunc.cc:6552

Run these queries in release build:

CREATE TABLE x ( x INT ) ;
INSERT INTO x ( x ) VALUES ( 1 ) ;
UPDATE x SET x = 1 WHERE x = 1 ;
INSERT INTO x ( x ) VALUES ( 1 ) , ( 1 ) ;
SELECT x , x FROM ( SELECT x FROM x GROUP BY x ) AS x WHERE x = ( SELECT x FROM x WHERE ( SELECT x AS x WHERE 1 > x GROUP BY x HAVING ( x = ( SELECT x FROM x UNION SELECT 1 UNION SELECT 1 ) > 1 OR x = 'x' ) AND NOT x ) ) ORDER BY x ;

Will trigger Segmentation fault.
GDB info:
Thread 16 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd242e300 (LWP 2144)]
0x00000000013e745f in Item_func_not::fix_fields (this=<optimized out>,
thd=<optimized out>, ref=<optimized out>)
at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:6552
6552 rc= (*ref= new_item)->fix_fields(thd, ref);
(gdb) p ref
$55 = (Item **) 0x0

#0 0x00000000013e745f in Item_func_not::fix_fields (this=<optimized out>, thd=<optimized out>, ref=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:6552
#1 0x0000000000af0303 in st_select_lex::pushdown_from_having_into_where (this=0x6290000949d8, thd=0x62b00016c218, having=0x6290000b2790) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:11284
#2 0x0000000000c12af5 in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2381
#3 0x0000000000bfc156 in JOIN::optimize (this=0x6290000b9238) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#4 0x0000000000ab5421 in st_select_lex::optimize_unflattened_subqueries (this=<optimized out>, const_only=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
#5 0x0000000000c0856c in JOIN::optimize_stage2 (this=0x6290000b75c0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:3229
#6 0x0000000000c13911 in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
#7 0x0000000000bfc156 in JOIN::optimize (this=0x6290000b75c0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#8 0x0000000000ab5421 in st_select_lex::optimize_unflattened_subqueries (this=<optimized out>, const_only=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
#9 0x0000000000fdc56c in JOIN::optimize_constant_subqueries (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/opt_subselect.cc:5898
#10 0x0000000000c10dfb in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2274
#11 0x0000000000bfc156 in JOIN::optimize (this=this@entry=0x6290000b5e18) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
#12 0x0000000000be4fdf in mysql_select (thd=<optimized out>, thd@entry=0x62b00016c218, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x6290000b5de8, unit=0x62b0001704a8, select_lex=0x629000091470) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
#13 0x0000000000be4596 in handle_select (thd=thd@entry=0x62b00016c218, lex=<optimized out>, lex@entry=0x62b0001703c8, result=<optimized out>, result@entry=0x6290000b5de8, setup_tables_done_option=<optimized out>, setup_tables_done_option@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#14 0x0000000000b3df18 in execute_sqlcom_select (thd=0x62b00016c218, all_tables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#15 0x0000000000b2cd51 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#16 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd242ca80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#17 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#18 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#19 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#20 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x60800206f8b8) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#21 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000005498) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#22 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#23 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6