MariaDB crash triggered by recursive CTE with SHA/FROM_UNIXTIME and XML filter

~~~sql
SELECT LOWER ( ( SELECT x FROM x WHERE x IN ( SELECT x FROM x ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT x FROM ( WITH RECURSIVE x AS ( SELECT CAST( CONV ( '39323233333732303336383534373734383030' , 16 , 10 ) AS DOUBLE ) ) SELECT FROM_UNIXTIME ( SHA ( '+04:00' ) ) AS x FROM x WHERE extractValue ( '<a b="1">ab</a>' , '/a/@b[substring(.,2,1)="1"]' ) - TIMESTAMP ( '2003-05-16' , 0.700000 ) < '%_history' GROUP BY ( x ) ) AS x WINDOW win1 AS ( PARTITION BY MOD ( x , 2 ) , x ORDER BY MOD ( x , 10 ) ) , win2 AS ( win1 ROWS BETWEEN 4 PRECEDING AND UNBOUNDED FOLLOWING ) ) SELECT x FROM x WHERE ( x , 'enum' , IFNULL ( x , x ) ) IN ( SELECT x , x , x FROM x WHERE x >= 'd' ) ORDER BY x ) ) ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:_ZL13add_key_fieldP4JOINPP9KEY_FIELDjP14Item_bool_funcP5FieldbPP4ItemjyPP14SARGABLE_PARAMj|_ZN10Item_equal14add_key_fieldsEP4JOINPP9KEY_FIELDPjyPP14SARGABLE_PARAM|_ZN13Item_cond_and14add_key_fieldsEP4JOINPP9KEY_FIELDPjyPP14SARGABLE_PARAM|_ZL19update_ref_and_keysP3THDP16st_dynamic_arrayP13st_join_tablejP4ItemyP13st_select_lexPP14SARGABLE_PARAM|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZL22mysql_derived_optimizeP3THDP3LEXP10TABLE_LIST|_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj
      ~~~

Top frames:
~~~
_ZL13add_key_fieldP4JOINPP9KEY_FIELDjP14Item_bool_funcP5FieldbPP4ItemjyPP14SARGABLE_PARAMj
_ZN10Item_equal14add_key_fieldsEP4JOINPP9KEY_FIELDPjyPP14SARGABLE_PARAM
_ZN13Item_cond_and14add_key_fieldsEP4JOINPP9KEY_FIELDPjyPP14SARGABLE_PARAM
_ZL19update_ref_and_keysP3THDP16st_dynamic_arrayP13st_join_tablejP4ItemyP13st_select_lexPP14SARGABLE_PARAM
_ZN4JOIN14optimize_innerEv
_ZN4JOIN8optimizeEv
_ZL22mysql_derived_optimizeP3THDP3LEXP10TABLE_LIST
_Z27mysql_handle_single_derivedP3LEXP10TABLE_LISTj
~~~