MariaDB crash triggered by window aggregate with GIS/JSON set operation

~~~sql
SELECT * FROM x WHERE x = DATABASE ( ) ORDER BY x ; SELECT * FROM ( SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 UNION SELECT 4 UNION SELECT AVG ( 'e' ) OVER ( ROWS BETWEEN UNBOUNDED PRECEDING AND 3 FOLLOWING ) ) AS x ) AS x EXCEPT SELECT UNIX_TIMESTAMP ( LEAST ( 1.100000 , 'LineString(1 1,2 2)' , NULL , CONVERT_TZ ( '2050-07-10 17:32:01' , 'UTC' IN ( SELECT x FROM ( SELECT * FROM ( SELECT json_type ( 'true' ) AS x UNION SELECT '2018-11-02 12:34:56.78' UNION SELECT CONCAT ( 'MULTIPOLYGON(((' , REPEAT ( '-0.00000000001234567890123456789012 -0.123456789012345678,' , 1000 ) , '-0.00000000001234567890123456789012 -0.123456789012345678' , 7200 ) UNION SELECT '2018-11-02 12:34:56.78901234' ) AS x ) AS x ) , 'Europe/Helsinki' ) ) ) FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 ) AS x ) AS x ) AS x WHERE x LIKE 'temp%' ORDER BY x ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:pthread_kill|raise|abort|_fsetlocking|timer_settime|_default_morecore|malloc|my_malloc
      ~~~

Top frames:
~~~
pthread_kill
raise
abort
__fsetlocking
timer_settime
__default_morecore
malloc
my_malloc
~~~