MariaDB crash triggered by recursive CTE with set operations and HAVING pushdown

~~~sql
SELECT DISTINCT x FROM ( SELECT * FROM ( SELECT x FROM ( SELECT 1 AS x UNION SELECT 2 ) AS x WHERE x IN ( SELECT ROW_NUMBER ( ) OVER ( ORDER BY AVG ( x ) ) FROM ( WITH RECURSIVE x ( x ) AS ( WITH RECURSIVE x ( x ) AS ( SELECT -1486618625 UNION SELECT '1.e3.e4' FROM x ) SELECT x FROM x WHERE x IN ( SELECT x FROM x ) AND x IN ( SELECT x FROM x ) AND x IN ( SELECT x FROM x ) ) SELECT * FROM x WHERE x < 456 GROUP BY x HAVING x = 'tbl' AND x = 'temp' AND x IS NULL ) AS x ORDER BY ABS ( x ) , lower ( x ) , lower ( x ) , lower ( x ) ) GROUP BY x HAVING x > 0 UNION SELECT * FROM ( SELECT ( TIMESTAMP ( RAND ( 0 ) ) ) UNION SELECT STR_TO_DATE ( 1 , 1 ) ) AS x EXCEPT SELECT 3 UNION SELECT 4 UNION SELECT ST_ASTEXT ( ST_SIMPLIFY ( ST_GEOMFROMTEXT ( 'LINESTRING(0 0,1 1,2 0,3 -1,4 0,5 1,6 0,7 -1,8 0,9 1,10 0)' ) , 1 ) ) ) AS x WHERE x IN ( tan ( radians ( x ) ) ) ORDER BY x DESC ) AS x WHERE x IN ( 1 , 2 , 3 ) ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:_Z33execute_degenerate_jtbm_semi_joinP3THDP10TABLE_LISTP17Item_in_subselectR4ListI4ItemE|_Z21setup_jtbm_semi_joinsP4JOINP4ListI10TABLE_LISTERS1_I4ItemE|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN18st_select_lex_unit8optimizeEv|_ZL22mysql_derived_optimizeP3THDP3LEXP10TABLE_LIST|_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
      ~~~