Crash: UNION HAVING unresolved name crashes server

The resolver path appears to assume that each outer-context transition has an
owning subquery item. This fake/top-select shape violates that invariant. The query exits with client status 137; the server log shows signal 11 with `Item_ref::fix_fields(THD*, Item**)` in the backtrace.

DROP DATABASE IF EXISTS db;

CREATE DATABASE db;

USE db;

CREATE TABLE t (

  id INT PRIMARY KEY,

  p INT,

  o INT,

  v INT

);

SELECT 1

UNION

SELECT 2

UNION

SELECT ROW_NUMBER() OVER (ORDER BY t.id)

FROM t

JOIN t AS t_aux1

  ON (SELECT 1 FROM dual HAVING AAA);

Stack Trace:
mariadbd(my_print_stacktrace+0x30)[0x5a4feb2fb960]
mariadbd(handle_fatal_signal+0x1f3)[0x5a4feae47843]
/lib/x86_64-linux-gnu/libc.so.6(+0x45330)[0x716034ead330]
mariadbd(_ZN8Item_ref10fix_fieldsEP3THDPP4Item+0x1e0)[0x5a4feae860e0]
mariadbd(_ZN9Item_func10fix_fieldsEP3THDPP4Item+0x8d)[0x5a4feaeca96d]
mariadbd(+0x747e8c)[0x5a4fea9cfe8c]
mariadbd(_ZN4JOIN7prepareEP10TABLE_LISTP4ItemjP8st_orderbS5_S3_S5_P13st_select_lexP18st_select_lex_unit+0xcdc)[0x5a4feab7471c]
mariadbd(_ZN30subselect_single_select_engine7prepareEP3THD+0x691)[0x5a4feaf2fc51]
mariadbd(_ZN14Item_subselect10fix_fieldsEP3THDPP4Item+0x1af)[0x5a4feaf2a60f]
mariadbd(_Z13setup_on_exprP3THDP10TABLE_LISTb+0x95)[0x5a4feaa8b235] ...