Server crashes with a subselect in parameter

DELIMITER $$

CREATE OR REPLACE PROCEDURE p1()

BEGIN

  DECLARE c sys_refcursor;

  OPEN c FOR 'SELECT ?' USING (SELECT 1);

  CLOSE c;

END;

$$

DELIMITER ;

CALL p1;

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)

    at pthread_kill.c:44

#1  0x00007ffff7080343 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89

#2  0x00007ffff7026cbe in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26

#3  0x00007ffff700e6d6 in __GI_abort () at abort.c:73

#4  0x00007ffff700e639 in __assert_fail_base (fmt=<optimized out>, assertion=<optimized out>, 

    file=<optimized out>, line=792, function=<optimized out>) at assert.c:118

#5  0x000055555577b6fe in sp_instr_set_ps_placeholder::save_in_param (this=0x7fffa4043058, thd=0x7fffa4000dc8, 

    dst=0x7fffa406fe38) at /home/bar/maria-git/12.3.m33830.curp/sql/sp_instr.h:792

#6  0x000055555577badc in Prepared_statement::set_placeholders_from_instr (this=0x7fffa40482c8, 

    instrs_set_placehorder=...) at /home/bar/maria-git/12.3.m33830.curp/sql/sql_prepare.cc:281

#7  0x0000555555774f91 in Prepared_statement::set_parameters (this=0x7fffa40482c8, 

    expanded_query=0x7ffff4189410, instrs_set_placeholder=..., packet=0x0, packet_end=0x0)

    at /home/bar/maria-git/12.3.m33830.curp/sql/sql_prepare.cc:4570

#8  0x00005555557752ef in Prepared_statement::execute_loop (this=0x7fffa40482c8, expanded_query=0x7ffff4189410, 

    open_cursor=true, result_arg=0x7fffa4047bc8, cursor_arg=0x7fffa4047c00, instrs_set_placeholder=..., 

    packet=0x0, packet_end=0x0) at /home/bar/maria-git/12.3.m33830.curp/sql/sql_prepare.cc:4665

#9  0x0000555555777ef1 in Prepared_statement::execute_immediate (this=0x7fffa40482c8, 

    query=0x7fffa40407c8 "SELECT ?", query_len=8, dynamic_open_cursor=true, result_arg=0x7fffa4047bc8, 

    cursor_arg=0x7fffa4047c00, instrs_set_placeholder=...)

    at /home/bar/maria-git/12.3.m33830.curp/sql/sql_prepare.cc:5509

#10 0x0000555555770aa8 in mysql_sql_stmt_execute_immediate (thd=0x7fffa4000dc8, dynamic_open_cursor=true, 

    result_arg=0x7fffa4047bc8, cursor_arg=0x7fffa4047c00, instrs_set_placeholder=...)

    at /home/bar/maria-git/12.3.m33830.curp/sql/sql_prepare.cc:2971

#11 0x0000555555770d0e in sp_cursor::open_from_dynamic_string (this=0x7fffa4047ba8, thd=0x7fffa4000dc8, 

    set_placeholder_instr_first=1, set_placeholder_instr_count=1)

    at /home/bar/maria-git/12.3.m33830.curp/sql/sql_prepare.cc:3004

#12 0x0000555555a33ccf in sp_instr_copen_by_ref::exec_core (this=0x7fffa4041060, thd=0x7fffa4000dc8, 

    nextp=0x7ffff41899ec) at /home/bar/maria-git/12.3.m33830.curp/sql/sp_instr.cc:2674

#13 0x0000555555a2d18f in sp_lex_keeper::reset_lex_and_exec_core (this=0x7fffa40410a0, thd=0x7fffa4000dc8, 

    nextp=0x7ffff41899ec, open_tables=false, instr=0x7fffa4041060, rerun_the_same_instr=false)

    at /home/bar/maria-git/12.3.m33830.curp/sql/sp_instr.cc:420

#14 0x0000555555a2d859 in sp_lex_keeper::validate_lex_and_exec_core (this=0x7fffa40410a0, thd=0x7fffa4000dc8, 

    nextp=0x7ffff41899ec, open_tables=false, instr=0x7fffa4041060)

    at /home/bar/maria-git/12.3.m33830.curp/sql/sp_instr.cc:599

#15 0x0000555555a2d9f5 in sp_lex_keeper::cursor_reset_lex_and_exec_core (this=0x7fffa40410a0, 

    thd=0x7fffa4000dc8, nextp=0x7ffff41899ec, open_tables=false, instr=0x7fffa4041060)

    at /home/bar/maria-git/12.3.m33830.curp/sql/sp_instr.cc:654

#16 0x0000555555a338a0 in sp_instr_copen_by_ref::execute (this=0x7fffa4041060, thd=0x7fffa4000dc8,