MariaDB crash triggered by JSON_CONTAINS and ExtractValue in EXCEPT query

~~~sql
SELECT JSON_CONTAINS ( '[]' , '

' ) AS x FROM ( SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 UNION SELECT 0.777778 UNION SELECT TIME ( UNIX_TIMESTAMP ( ) ) ) AS x GROUP BY x HAVING x = 'M' OR x = ExtractValue ( NULLIF ( x , 'abc' ) , '/a/or:or' ) AND x = 'b' OR x = 'tablespace' ) AS x WHERE x = ExtractValue ( NULLIF ( x , 'abc' ) , '/a/or:or' ) AND x >= x OR x = 'tablespace' EXCEPT SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 ) AS x ) AS x ) AS x ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:_ZNK10Item_field11used_tablesEv|_ZL12remove_constP4JOINP8st_orderP4ItembPb|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZL22mysql_derived_optimizeP3THDP3LEXP10TABLE_LIST|_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj|_ZN18st_select_lex_unit8optimizeEv|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
      ~~~

Top frames:
~~~
_ZNK10Item_field11used_tablesEv
_ZL12remove_constP4JOINP8st_orderP4ItembPb
_ZN4JOIN14optimize_innerEv
_ZN4JOIN8optimizeEv
_ZL22mysql_derived_optimizeP3THDP3LEXP10TABLE_LIST
_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj
_ZN18st_select_lex_unit8optimizeEv
_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
~~~