MariaDB crash triggered by GROUP BY/HAVING on derived SELECT

~~~sql
SELECT 1 AS x UNION SELECT 2.200000 ORDER BY ( SELECT x GROUP BY x HAVING x = 'hello' UNION SELECT x ) DESC ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:Z17setup_copy_fieldsP3THDP15TMP_TABLE_PARAM20Bounds_checked_arrayIP4ItemER4ListIS4_ES9_jS9|_ZN4JOIN21make_aggr_tables_infoEv|_ZN4JOIN15optimize_stage2Ev|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex|_ZN18st_select_lex_unit10exec_innerEv
      ~~~

Top frames:
~~~
Z17setup_copy_fieldsP3THDP15TMP_TABLE_PARAM20Bounds_checked_arrayIP4ItemER4ListIS4_ES9_jS9
_ZN4JOIN21make_aggr_tables_infoEv
_ZN4JOIN15optimize_stage2Ev
_ZN4JOIN14optimize_innerEv
_ZN4JOIN8optimizeEv
_ZN13st_select_lex31optimize_unflattened_subqueriesEb
_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
_ZN18st_select_lex_unit10exec_innerEv
~~~