MariaDB crash triggered by recursive CTE with REGEXP_REPLACE and ROW_NUMBER

~~~sql
SELECT DISTINCT REGEXP_REPLACE ( 'base:7 hidden:6 rebel:1 spaceship:2,33A,34B,35C,36D strike:3' , ROW_NUMBER ( ) OVER ( ) >= 4 , ' ' ) AS x FROM ( SELECT x FROM ( WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT x + 1 FROM x ) SELECT * FROM x WHERE CHAR_LENGTH ( '����������' ) ) AS x ) AS x GROUP BY x ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:ZN16Item_func_buffer11Transporter15add_edge_bufferEddbb|_ZN16Item_func_buffer11Transporter8completeEv|_ZN16Item_func_buffer11Transporter13complete_lineEv|_ZN16Item_func_buffer7val_strEP6String|_ZN16Item_func_as_wkt13val_str_asciiEP6String|_ZN9Item_func26val_str_from_val_str_asciiEP6StringS1|_ZN24Item_func_regexp_replace16val_str_internalEP6Stringb|_ZNK12Type_handler13Item_send_strEP4ItemP8ProtocolP8st_value
      ~~~

Top frames:
~~~
_ZN16Item_func_buffer11Transporter15add_edge_bufferEddbb
_ZN16Item_func_buffer11Transporter8completeEv
_ZN16Item_func_buffer11Transporter13complete_lineEv
_ZN16Item_func_buffer7val_strEP6String
_ZN16Item_func_as_wkt13val_str_asciiEP6String
ZN9Item_func26val_str_from_val_str_asciiEP6StringS1
_ZN24Item_func_regexp_replace16val_str_internalEP6Stringb
_ZNK12Type_handler13Item_send_strEP4ItemP8ProtocolP8st_value
~~~