MariaDB crash triggered by binary/string functions with GIS and JSON overlap

~~~sql
SELECT CAST( convert_tz ( '2003-10-26 02:59:59' , 'MET' , 'UTC' ) AS UNSIGNED INTEGER ) ; SELECT CAST( REPEAT ( 0 , 100 ) AS CHAR ) ; SELECT REPEAT ( 0 , 100 ) ; SELECT CAST( REPEAT ( 0 , 100 ) AS BINARY ) ; select SELECT repeat ( 0 , 10 ) ; SELECT select REPEAT ( ' ' , -100 ) ; SELECT LENGTH ( _ binary '' ) ; select cast ( concat ( repeat ( '00' , -1 ) , '1' ) as unsigned ) ; SELECT HEX ( TO_BASE64 ( REPEAT ( 0 , -1 ) ) ) ; SELECT NULL ; SELECT LENGTH ( ? ) FROM ( SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 UNION SELECT 4 UNION SELECT ST_ASTEXT ( ST_SIMPLIFY ( ST_GEOMFROMTEXT ( 'LINESTRING(0 0,1 1,2 0,3 -1,4 0,5 1,6 0,7 -1,8 0,9 1,10 0)' ) , 1 ) ) ) AS x ) AS x EXCEPT SELECT x FROM ( SELECT * FROM ( WITH RECURSIVE x ( x ) AS ( SELECT 0 AS x UNION SELECT 1 AS x FROM x INTERSECT SELECT 3 + 1 FROM x ) SELECT ST_ASTEXT ( ST_SIMPLIFY ( ST_GEOMFROMTEXT ( 'POINT(a 0)' ) , 1 ) ) ) AS x ) AS x WHERE json_overlaps ( x - '$[*]' , '[2,3,4, "asd"]' ) ) AS x ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:pthread_kill|raise|abort|_fsetlocking|timer_settime|_default_morecore|free|free_root
      ~~~

Top frames:
~~~
pthread_kill
raise
abort
__fsetlocking
timer_settime
__default_morecore
free
free_root
~~~