mariaDB crash triggered by recursive CTE with polygon buffer and REGEXP_REPLACE

~~~sql
SELECT LOWER ( ( SELECT x FROM x WHERE x IN ( SELECT x FROM x ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT FROM_UNIXTIME ( SHA ( '$.b[ 1 ].c' ) ) AS x GROUP BY x HAVING ( avg ( '' ) ) INTERSECT SELECT 0.995000 AS x FROM x INTERSECT SELECT x + 1 FROM x ) SELECT x FROM x WHERE x IN ( SELECT REGEXP_REPLACE ( ST_ASTEXT ( ST_BUFFER ( POLYGON ( LINESTRING ( POINT ( 6 , 3 ) , POINT ( 6 , 8 ) , POINT ( 6 , 3 ) ) , LINESTRING ( POINT ( 9 , 3 ) , POINT ( 0 , - 0.100000 ) , POINT ( 8 , truncate ( '1.7976931348623157E+308' , -12 ) AS x ) , POINT ( 2.400000 , 1 ) , POINT ( 9 , 2 ) , POINT ( 8 , 1.900000 ) , POINT ( 1 , 0 ) , POINT ( 5 , 9 ) , POINT ( 8.100000 , - 0.500000 ) , POINT ( 200012 , -4.300000 ) , POINT ( 8 , 3 ) , POINT ( 9 , 3 ) ) ) , 2 ) ) , '[[:<:]]spaceship[[:>:]]' , '' ) ) ORDER BY x ) ) ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:ZN16Item_func_buffer11Transporter15add_edge_bufferEddbb|_ZN16Item_func_buffer11Transporter9add_pointEdd|_ZNK11Gis_polygon12store_shapesEP23Gcalc_shape_transporter|_ZN16Item_func_buffer7val_strEP6String|_ZN16Item_func_as_wkt13val_str_asciiEP6String|_ZN9Item_func26val_str_from_val_str_asciiEP6StringS1|_ZN24Item_func_regexp_replace16val_str_internalEP6Stringb|_ZN4Item20get_date_from_stringEP3THDP13st_mysql_time11date_mode_t
      ~~~

Top frames:
~~~
_ZN16Item_func_buffer11Transporter15add_edge_bufferEddbb
_ZN16Item_func_buffer11Transporter9add_pointEdd
_ZNK11Gis_polygon12store_shapesEP23Gcalc_shape_transporter
_ZN16Item_func_buffer7val_strEP6String
_ZN16Item_func_as_wkt13val_str_asciiEP6String
ZN9Item_func26val_str_from_val_str_asciiEP6StringS1
_ZN24Item_func_regexp_replace16val_str_internalEP6Stringb
_ZN4Item20get_date_from_stringEP3THDP13st_mysql_time11date_mode_t
~~~