MariaDB crash triggered by ST_SIMPLIFY inside GROUP BY/HAVING set operation

~~~sql
SELECT * FROM ( SELECT AVG ( DISTINCT x ) AS x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 UNION SELECT 4 UNION SELECT ST_ASTEXT ( ST_SIMPLIFY ( ST_GEOMFROMTEXT ( 'LINESTRING(0 0,1 1,2 0,3 -1,4 0,5 1,6 0,7 -1,8 0,9 1,10 0)' ) , 1 ) ) ) AS x ) AS x INTERSECT SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 ) AS x ORDER BY x + 2 DESC , x , x , ( SELECT x GROUP BY x HAVING x < 2000 ORDER BY x + 2 DESC , x , x , ( SELECT x ORDER BY 1 ) ) ) AS x ) AS x ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:Z17setup_copy_fieldsP3THDP15TMP_TABLE_PARAM20Bounds_checked_arrayIP4ItemER4ListIS4_ES9_jS9|_ZN4JOIN21make_aggr_tables_infoEv|_ZN4JOIN15optimize_stage2Ev|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_ZL22mysql_derived_optimizeP3THDP3LEXP10TABLE_LIST|_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj
      ~~~

Top frames:
~~~
Z17setup_copy_fieldsP3THDP15TMP_TABLE_PARAM20Bounds_checked_arrayIP4ItemER4ListIS4_ES9_jS9
_ZN4JOIN21make_aggr_tables_infoEv
_ZN4JOIN15optimize_stage2Ev
_ZN4JOIN14optimize_innerEv
_ZN4JOIN8optimizeEv
_ZN13st_select_lex31optimize_unflattened_subqueriesEb
_ZL22mysql_derived_optimizeP3THDP3LEXP10TABLE_LIST
_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj
~~~