MariaDB crash triggered by recursive CTE with GIS buffer and regexp replacement

~~~sql
SELECT LOWER ( ( SELECT x FROM x WHERE x IN ( SELECT x FROM x ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT FROM_UNIXTIME ( SHA ( '$.b[ 1 ].c' ) ) AS x GROUP BY x HAVING ( avg ( '' ) ) INTERSECT SELECT 0.995000 AS x FROM x INTERSECT SELECT x + 1 FROM x ) SELECT x FROM x WHERE x IN ( SELECT REGEXP_REPLACE ( ST_ASTEXT ( ST_BUFFER ( ST_GEOMFROMTEXT ( ST_ASTEXT ( ( ST_LINESTRINGFROMTEXT ( 'LINESTRING(1e308 1e308,-1e308 -1e308)' ) ) ) ) , 2 ) ) , '[[:<:]]spaceship[[:>:]]' , '' ) ) ORDER BY x ) ) ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:ZN16Item_func_buffer11Transporter15add_edge_bufferEddbb|_ZN16Item_func_buffer11Transporter8completeEv|_ZN16Item_func_buffer11Transporter13complete_lineEv|_ZN16Item_func_buffer7val_strEP6String|_ZN16Item_func_as_wkt13val_str_asciiEP6String|_ZN9Item_func26val_str_from_val_str_asciiEP6StringS1|_ZN24Item_func_regexp_replace16val_str_internalEP6Stringb|_ZN4Item20get_date_from_stringEP3THDP13st_mysql_time11date_mode_t
      ~~~

Top frames:
~~~
_ZN16Item_func_buffer11Transporter15add_edge_bufferEddbb
_ZN16Item_func_buffer11Transporter8completeEv
_ZN16Item_func_buffer11Transporter13complete_lineEv
_ZN16Item_func_buffer7val_strEP6String
_ZN16Item_func_as_wkt13val_str_asciiEP6String
ZN9Item_func26val_str_from_val_str_asciiEP6StringS1
_ZN24Item_func_regexp_replace16val_str_internalEP6Stringb
_ZN4Item20get_date_from_stringEP3THDP13st_mysql_time11date_mode_t
~~~