MariaDB crash triggered by recursive CTE with JSON_ARRAY_APPEND and XML NOT IN

~~~sql
SELECT LOWER ( ( SELECT x FROM x WHERE x IN ( SELECT x FROM x ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT x + 1 FROM x ) SELECT ALL json_array_append ( '[[], [], []]' , NOT ( NULL LIKE 'ABC%' ) , 315 , '$[*]' , 4 ) EXCEPT SELECT x FROM x UNION SELECT x FROM x ORDER BY x ) SELECT x FROM x WHERE NOT ( NOT ( x > 10 ) ) AND ( x < 1 OR x > 1 ) AND x NOT IN ( SELECT extractValue ( '<a>a</a>' , '/a[true() or true()]' ) AS x FROM x WHERE x LIKE 'PRIMARY%' ) AND x IN ( SELECT JSON_EXTRACT ( '-1E+36181012216111515851075235238' , '$' ) * INTERVAL ( 0.000000 , CAST( NULL AS DECIMAL ) , CAST( NULL AS DECIMAL ) , CAST( extractValue ( '<a b="1">ab</a>' , '/a[concat(@b,"2")="12"]' ) - TIMESTAMP ( '2000-02-29' , 16777215 ) < '%_history' AS DECIMAL ) , CAST( NULL AS DECIMAL ) , CAST( NULL AS DECIMAL ) , CAST( NULL AS CHAR ( 20 ) ) , CAST( INET6_ATON ( '1.2.3' ) IS NULL AS DECIMAL ) , CAST( NULL AS DECIMAL ) ) / 2 ) ORDER BY x ) ) ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:json_find_path|_ZN27Item_func_json_array_append7val_strEP6String|_ZN13Item_str_func11val_decimalEP10my_decimal|_ZN18Item_cache_decimal11cache_valueEv|_ZN18Item_cache_decimal11val_decimalEP10my_decimal|_ZN4VDecC2EP4Item|_ZN14Arg_comparator15compare_decimalEv|_ZN12Item_func_gt8val_boolEv
      ~~~

Top frames:
~~~
json_find_path
_ZN27Item_func_json_array_append7val_strEP6String
_ZN13Item_str_func11val_decimalEP10my_decimal
_ZN18Item_cache_decimal11cache_valueEv
_ZN18Item_cache_decimal11val_decimalEP10my_decimal
_ZN4VDecC2EP4Item
_ZN14Arg_comparator15compare_decimalEv
_ZN12Item_func_gt8val_boolEv
~~~