Run these queries in release build:

CREATE TABLE x ( x BOOLEAN UNIQUE ) ;
INSERT INTO x ( x ) VALUES ( 1 ) ;
UPDATE x SET x = 1 WHERE x = 1 ;
INSERT INTO x SELECT x * 1 + x FROM x WHERE x IN ( 1 , 1 ) ;
SELECT x * 1 + x FROM x WHERE CASE WHEN ( SELECT x AS x WHERE 1 > x GROUP BY x IS NULL ) LIKE x + x % x - 1 THEN ( 1 * x ) ELSE ( x >= 1.000000 OR x < 1 ) AND x IN ( 1 , x ) END IN ( WITH x ( x ) AS ( SELECT x + ( WITH x ( x ) AS ( SELECT 1 UNION SELECT x + 1 FROM x ) SELECT 1 EXCEPT SELECT x + 1 FROM ( SELECT ( SELECT * FROM x EXCEPT SELECT * FROM x ) BETWEEN ( SELECT x FROM x WHERE x = 1 AND x < 1 GROUP BY - 'x' >= x ) AND 1 FROM x UNION SELECT x FROM x ) AS x ) FROM x ) SELECT x FROM x AS x GROUP BY 'x' , x IN ( 1 , 1 , 1 ) , x , x ) ORDER BY ( 1 < x AND x = 1 ) ;

Will trigger Segmentation fault.
GDB info:
Thread 16 "mariadbd" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd242e300 (LWP 2543)]
0x0000000000ab5baa in st_select_lex_unit::save_union_explain (this=0x6290000b4238,
output=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:5998
5998 if (output->get_union(first->select_number))
(gdb) p first
$67 = (SELECT_LEX *) 0x0

#0 0x0000000000ab5baa in st_select_lex_unit::save_union_explain (this=0x6290000b9238, output=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:5998
#1 0x0000000000df0584 in st_select_lex_unit::exec_inner (this=0x6290000b9238) at /home/wx/mariadb-11.3.0/sql/sql_union.cc:2315
#2 0x00000000015d8bb5 in subselect_union_engine::exec (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:4187
#3 0x00000000015b3edc in Item_subselect::exec (this=0x6290000c42e0) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:812
#4 0x00000000015b9773 in Item_singlerow_subselect::val_int (this=0x6290000c42e0) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:1462
#5 0x00000000014620a4 in Item_func_plus::int_op (this=0x6290000c44c0) at /home/wx/mariadb-11.3.0/sql/item_func.cc:1117
#6 0x000000000138ddc2 in Item_direct_ref::val_int (this=0x62f000003808) at /home/wx/mariadb-11.3.0/sql/item.cc:8680
#7 Item_direct_view_ref::val_int (this=0x62f000003808) at /home/wx/mariadb-11.3.0/sql/item.h:6141
#8 0x00000000013ae2e1 in Arg_comparator::compare_int_signed (this=0x62f000004788) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:947
#9 0x00000000013b5ea2 in Arg_comparator::compare (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.h:104
#10 Item_func_eq::val_int (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:1780
#11 0x0000000000f99b40 in SQL_SELECT::skip_record (this=<optimized out>, thd=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/opt_range.h:1914
#12 JOIN_CACHE::check_match (this=this@entry=0x62f000008b50, rec_ptr=rec_ptr@entry=0x6070000d69b9 "") at /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2560
#13 0x0000000000f8f7d9 in JOIN_CACHE::generate_full_extensions (this=this@entry=0x62f000008b50, rec_ptr=rec_ptr@entry=0x6070000d69b9 "") at /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2503
#14 0x0000000000f8f322 in JOIN_CACHE::join_matching_records (this=0x62f000008b50, skip_last=false) at /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2403
#15 0x0000000000f8e695 in JOIN_CACHE::join_records (this=0x62f000008b50, skip_last=false) at /home/wx/mariadb-11.3.0/sql/sql_join_cache.cc:2158
#16 0x0000000000c9da17 in sub_select_cache (join=0x62d0000e7b00, join_tab=0x62f000007a90, end_of_records=false) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:23192
#17 0x0000000000c4536c in do_select (join=0x62d0000e7b00, procedure=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:22963
#18 JOIN::exec_inner (this=0x62d0000e7b00) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4941
#19 0x0000000000c428e9 in JOIN::exec (this=this@entry=0x62d0000e7b00) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:4718
#20 0x0000000000be5128 in mysql_select (thd=<optimized out>, thd@entry=0x62b00016c218, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x62d0000e7ad0, unit=0x62b0001704a8, select_lex=0x629000091720) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5249
#21 0x0000000000be4596 in handle_select (thd=thd@entry=0x62b00016c218, lex=<optimized out>, lex@entry=0x62b0001703c8, result=<optimized out>, result@entry=0x62d0000e7ad0, setup_tables_done_option=<optimized out>, setup_tables_done_option@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
#22 0x0000000000b3df18 in execute_sqlcom_select (thd=0x62b00016c218, all_tables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
#23 0x0000000000b2cd51 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
#24 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd242ca80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
#25 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
#26 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
#27 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
#28 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x6080005833b8) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
#29 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000005118) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
#30 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#31 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6