MariaDB crash triggered by recursive CTE with GIS/JSON IN-subquery

~~~sql
SELECT DISTINCT x FROM x WHERE x IN ( 1 , 2 , 3 ) ; SELECT * FROM ( WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT x + 1 FROM x ) SELECT x FROM x WHERE x = 'database_name' AND FROM_UNIXTIME ( 946684800 ) = '20123' GROUP BY x , x HAVING x = CASE WHEN ( SELECT ( 1 ) WHERE x IS NULL OR ST_LONGFROMGEOHASH ( ST_GEOHASH ( -180 , 0 , 20 ) ) GROUP BY 'x' ) - 1 THEN ( 1 ^ x ) ELSE CASE WHEN CASE WHEN extractvalue ( '<a>A<b>B1</b><b>B2</b></a>' , '/a/b[count(.)=1]' ) NOT IN ( SELECT * FROM ( SELECT 2 UNION SELECT 3 UNION SELECT 'LINESTRING(0 0,-0.00 0)' ) AS x GROUP BY x HAVING NOT NOT ( x ) ) THEN 1 ELSE 1 END THEN 1 WHEN 'x' LIKE 'x' THEN 1 END END ORDER BY x , hex ( x ) ) AS x WHERE ( x = 3 AND x = 2 AND x = 1 ) OR ( ( x , x ) IN ( ( x LIKE '%DEFAULT%' , '2022-02-25' ) , ( 'I' , '2022-02-25' ) ) AND x = 1 ) OR ( x = 1 AND x = 2 AND x = 3 ) OR ( ( x IN ( 1 , 2 ) OR 0 ) <= NULL AND 1 AND x = 3 ) ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:_ZL13add_key_fieldP4JOINPP9KEY_FIELDjP14Item_bool_funcP5FieldbPP4ItemjyPP14SARGABLE_PARAMj|_ZL20add_key_equal_fieldsP4JOINPP9KEY_FIELDjP14Item_bool_funcP4ItembPS7_jyPP14SARGABLE_PARAMj|_ZN15Item_func_truth14add_key_fieldsEP4JOINPP9KEY_FIELDPjyPP14SARGABLE_PARAM|_ZL19update_ref_and_keysP3THDP16st_dynamic_arrayP13st_join_tablejP4ItemyP13st_select_lexPP14SARGABLE_PARAM|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_ZN4JOIN15optimize_stage2Ev
      ~~~

Top frames:
~~~
_ZL13add_key_fieldP4JOINPP9KEY_FIELDjP14Item_bool_funcP5FieldbPP4ItemjyPP14SARGABLE_PARAMj
_ZL20add_key_equal_fieldsP4JOINPP9KEY_FIELDjP14Item_bool_funcP4ItembPS7_jyPP14SARGABLE_PARAMj
_ZN15Item_func_truth14add_key_fieldsEP4JOINPP9KEY_FIELDPjyPP14SARGABLE_PARAM
_ZL19update_ref_and_keysP3THDP16st_dynamic_arrayP13st_join_tablejP4ItemyP13st_select_lexPP14SARGABLE_PARAM
_ZN4JOIN14optimize_innerEv
_ZN4JOIN8optimizeEv
_ZN13st_select_lex31optimize_unflattened_subqueriesEb
_ZN4JOIN15optimize_stage2Ev
~~~