Server crashes at _Z8filesort

Poc：

CREATE TABLE v48048 (v48049 INT DEFAULT NULL, v48050 INT NOT NULL, PRIMARY KEY (v48049)) ENGINE=INNODB DEFAULT CHARACTER SET=utf32;

UPDATE v48048 AS x1 SET v48050 = TRUE WHERE v48050 = 'x' ORDER BY v48050 DESC, BIT_AND(v48049) LIMIT 39;

docker log:
Sorry, we probably made a mistake, and this is a bug.

Your assistance in bug reporting will enable us to fix this for the next release.
To report this bug, see https://mariadb.com/kb/en/reporting-bugs about how to report
a bug on https://jira.mariadb.org/.

Please include the information from the server start above, to the end of the
information below.

Server version: 12.2.1-MariaDB-ubu2404 source revision: 144dead8826f4a84008a76ef7fcc44e816f92930

The information page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/
contains instructions to obtain a better version of the backtrace below.
Following these instructions will help MariaDB developers provide a fix quicker.

Attempting backtrace. Include this in the bug report.
(note: Retrieving this information may fail)

Thread pointer: 0x7170b0000c68
stack_bottom = 0x7170f01d7000 thread_stack 0x49000
Printing to addr2line failed
mariadbd(my_print_stacktrace+0x30)[0x5a059c0931e0]
mariadbd(handle_fatal_signal+0x1f3)[0x5a059bbdf2e3]
/lib/x86_64-linux-gnu/libc.so.6(+0x45330)[0x7170f19d6330]
mariadbd(_Z8filesortP3THDP5TABLEP8FilesortP16Filesort_trackerP4JOINy+0x382)[0x5a059bbd8d12]
mariadbd(_ZN14Sql_cmd_update19update_single_tableEP3THD+0xbfb)[0x5a059b9e4b3b]
mariadbd(_ZN14Sql_cmd_update13execute_innerEP3THD+0x183)[0x5a059b9e68e3]
mariadbd(_ZN11Sql_cmd_dml7executeEP3THD+0xcd)[0x5a059b94929d]
mariadbd(_Z21mysql_execute_commandP3THDb+0xe43)[0x5a059b8b8d73]
mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x19a)[0x5a059b8c4e7a]
mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x1064)[0x5a059b8b61a4]
mariadbd(_Z10do_commandP3THDb+0x199)[0x5a059b8b76c9]
mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x6b3)[0x5a059ba536d3]
mariadbd(handle_one_connection+0x71)[0x5a059ba53b11]
mariadbd(+0xe1008e)[0x5a059be3008e]
/lib/x86_64-linux-gnu/libc.so.6(+0x9caa4)[0x7170f1a2daa4]
/lib/x86_64-linux-gnu/libc.so.6(__clone+0x44)[0x7170f1abaa64]

Connection ID (thread ID): 3
Status: NOT_KILLED
Query (0x7170b0035550): UPDATE v48048 AS x1 SET v48050 = TRUE WHERE v48050 = 'x' ORDER BY v48050 DESC, BIT_AND(v48049) LIMIT 39

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,duplicateweedout=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=on,cset_narrowing=on,sargable_casefold=on

Writing a core file...
Working directory at /var/lib/mysql
Resource Limits (excludes unlimited resources):
Limit Soft Limit Hard Limit Units
Max stack size 8388608 unlimited bytes
Max processes 4127167 4127167 processes
Max open files 524288 524288 files
Max locked memory 8388608 8388608 bytes
Max pending signals 4127167 4127167 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 0 0
Max realtime priority 0 0
Core pattern: /var/lib/coredumps/core-%e-sig%s-user%u-group%g-pid%p-time%t

Kernel version: Linux version 6.5.13-5-pve (build@proxmox) (gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC PMX 6.5.13-5 (2024-04-05T11:03Z)