Server crashes in my_hash_sort_bin upon GROUP BY with geometry field

CREATE TABLE t (f GEOMETRY);

INSERT INTO t VALUES (POINT(1,1)),(POINT(2,2));

SELECT @x := f val, COUNT(*) FROM t GROUP BY val;

DROP TABLE t;

#3  <signal handler called>

#4  0x000055a275c3e062 in my_hash_sort_bin (cs=0x55a2769cccc0 <my_charset_bin>, key=0x1010000 <error: Cannot access memory at address 0x1010000>, len=25, nr1=0x7f901219dac0, nr2=0x7f901219dac8) at /data/bld/testing/bb-blob-monty-debug/strings/ctype-bin.c:303

#5  0x000055a2756535f6 in my_ci_hash_sort (ci=0x55a2769cccc0 <my_charset_bin>, key=0x1010000 <error: Cannot access memory at address 0x1010000>, len=25, nr1=0x7f901219dac0, nr2=0x7f901219dac8) at /data/bld/testing/bb-blob-monty-debug/include/m_ctype.h:1354

#6  0x000055a275654134 in hp_hashnr (keydef=0x7f8ff405dda0, key=0x7f901087bfa5 "") at /data/bld/testing/bb-blob-monty-debug/storage/heap/hp_hash.c:307

#7  0x000055a275653a2f in hp_search (info=0x7f8ff41206a8, keyinfo=0x7f8ff405dda0, key=0x7f901087bf98 "", nextflag=0) at /data/bld/testing/bb-blob-monty-debug/storage/heap/hp_hash.c:137

#8  0x000055a275657618 in heap_rkey (info=0x7f8ff41206a8, record=0x7f8ff4051d08 '\245' <repeats 32 times>, "\377", inx=0, key=0x7f901087bf98 "", keypart_map=18446744073709551615, find_flag=HA_READ_KEY_EXACT) at /data/bld/testing/bb-blob-monty-debug/storage/heap/hp_rkey.c:64

#9  0x000055a27564fe9e in ha_heap::index_read_map (this=0x7f8ff4051788, buf=0x7f8ff4051d08 '\245' <repeats 32 times>, "\377", key=0x7f901087bf98 "", keypart_map=18446744073709551615, find_flag=HA_READ_KEY_EXACT) at /data/bld/testing/bb-blob-monty-debug/storage/heap/ha_heap.cc:294

#10 0x000055a275233eca in handler::ha_index_read_map (this=0x7f8ff4051788, buf=0x7f8ff4051d08 '\245' <repeats 32 times>, "\377", key=0x7f901087bf98 "", keypart_map=18446744073709551615, find_flag=HA_READ_KEY_EXACT) at /data/bld/testing/bb-blob-monty-debug/sql/handler.cc:3670

#11 0x000055a274ed9861 in end_update (join=0x7f8ff4017468, join_tab=0x7f8ff4018e78, end_of_records=false) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.cc:24971

#12 0x000055a274eef15a in AGGR_OP::put_record (this=0x7f8ff4019c60, end_of_records=false) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.cc:32529

#13 0x000055a274ef6bed in AGGR_OP::put_record (this=0x7f8ff4019c60) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.h:1103

#14 0x000055a274ed46f0 in sub_select_postjoin_aggr (join=0x7f8ff4017468, join_tab=0x7f8ff4018e78, end_of_records=false) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.cc:22951

#15 0x000055a274ed5651 in evaluate_join_record (join=0x7f8ff4017468, join_tab=0x7f8ff4018ab0, error=0) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.cc:23487

#16 0x000055a274ed5002 in sub_select (join=0x7f8ff4017468, join_tab=0x7f8ff4018ab0, end_of_records=false) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.cc:23296

#17 0x000055a274ed40f8 in do_select (join=0x7f8ff4017468, procedure=0x0) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.cc:22780

#18 0x000055a274ea19d4 in JOIN::exec_inner (this=0x7f8ff4017468) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.cc:5023

#19 0x000055a274ea0ac4 in JOIN::exec (this=0x7f8ff4017468) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.cc:4807

#20 0x000055a274ea236d in mysql_select (thd=0x7f8ff4000dc8, tables=0x7f8ff4016268, fields=..., conds=0x0, og_num=1, order=0x0, group=0x7f8ff4016ab8, having=0x0, proc_param=0x0, select_options=2164525824, result=0x7f8ff4017440, unit=0x7f8ff4005298, select_lex=0x7f8ff40158f0) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.cc:5285

#21 0x000055a274e90470 in handle_select (thd=0x7f8ff4000dc8, lex=0x7f8ff40051c0, result=0x7f8ff4017440, setup_tables_done_option=0) at /data/bld/testing/bb-blob-monty-debug/sql/sql_select.cc:601

#22 0x000055a274e31bc7 in execute_sqlcom_select (thd=0x7f8ff4000dc8, all_tables=0x7f8ff4016268) at /data/bld/testing/bb-blob-monty-debug/sql/sql_parse.cc:6461

#23 0x000055a274e2884e in mysql_execute_command (thd=0x7f8ff4000dc8, is_called_from_prepared_stmt=false) at /data/bld/testing/bb-blob-monty-debug/sql/sql_parse.cc:4040

#24 0x000055a274e36c4f in mysql_parse (thd=0x7f8ff4000dc8, rawbuf=0x7f8ff4015830 "SELECT @x := f val, COUNT(*) FROM t GROUP BY val", length=48, parser_state=0x7f901219f2a0) at /data/bld/testing/bb-blob-monty-debug/sql/sql_parse.cc:8221

#25 0x000055a274e21f26 in dispatch_command (command=COM_QUERY, thd=0x7f8ff4000dc8, packet=0x7f8ff400bc29 "", packet_length=48, blocking=true) at /data/bld/testing/bb-blob-monty-debug/sql/sql_parse.cc:1924

#26 0x000055a274e20845 in do_command (thd=0x7f8ff4000dc8, blocking=true) at /data/bld/testing/bb-blob-monty-debug/sql/sql_parse.cc:1434

#27 0x000055a27501f5c5 in do_handle_one_connection (connect=0x55a2a59565a8, put_in_cache=true) at /data/bld/testing/bb-blob-monty-debug/sql/sql_connect.cc:1475

#28 0x000055a27501f346 in handle_one_connection (arg=0x55a2a5953fe8) at /data/bld/testing/bb-blob-monty-debug/sql/sql_connect.cc:1387

#29 0x000055a27556bb62 in pfs_spawn_thread (arg=0x55a2a5952548) at /data/bld/testing/bb-blob-monty-debug/storage/perfschema/pfs.cc:2201

#30 0x00007f90186a81c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#31 0x00007f901872885c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81