MariaDB crash triggered by recursive CTE with JSON_REMOVE and NULLIF predicates

~~~sql
SELECT LOWER ( ( SELECT x FROM x WHERE x IN ( SELECT x FROM x ) ORDER BY x LIMIT 1 ) ) ; SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT x + 1 FROM x ) SELECT JSON_REMOVE ( 46 , DATE ( NULL ) ) EXCEPT SELECT x FROM x UNION SELECT x FROM x GROUP BY x HAVING x = x AND x = 1 AND extractValue ( '<a b="b1" b="b2" b="b3"/>' , '/a/@b[2>=position()]' ) ORDER BY x ) SELECT x FROM x WHERE NOT ( avg ( 946684800 ) IS NOT NULL ) AND ( x < 1 OR x > 1 ) AND x IN ( NULLIF ( x + x , NULL ) ) AND x IN ( SELECT ceil ( x ) AS x FROM x GROUP BY x , x HAVING x = 1 ) ORDER BY x ) ) ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:json_find_path|_ZN21Item_func_json_remove7val_strEP6String|_ZN13Item_str_func11val_decimalEP10my_decimal|_ZN18Item_cache_decimal11cache_valueEv|_ZN18Item_cache_decimal11val_decimalEP10my_decimal|_ZN4VDecC2EP4Item|_ZN14Arg_comparator15compare_decimalEv|_ZN12Item_func_gt8val_boolEv
      ~~~

Top frames:
~~~
json_find_path
_ZN21Item_func_json_remove7val_strEP6String
_ZN13Item_str_func11val_decimalEP10my_decimal
_ZN18Item_cache_decimal11cache_valueEv
_ZN18Item_cache_decimal11val_decimalEP10my_decimal
_ZN4VDecC2EP4Item
_ZN14Arg_comparator15compare_decimalEv
_ZN12Item_func_gt8val_boolEv
~~~