MariaDB crash triggered by recursive CTE with SIGN and grouped scalar subquery

~~~sql
SELECT LOWER ( ( WITH RECURSIVE x ( x ) AS ( SELECT 1 UNION SELECT 1 - x FROM ( SELECT x FROM x GROUP BY 1.000000 ) AS x ) SELECT x FROM ( SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 1286608618 UNION SELECT 3 UNION SELECT 4 INTERSECT SELECT 5 ) AS x ) AS x EXCEPT SELECT x FROM ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 ) AS x ) AS x ) AS x WHERE x IN ( SELECT x FROM x WHERE x IN ( SELECT * FROM ( SELECT 0 AS x UNION SELECT SIGN ( 0 ) AS x UNION SELECT 90 UNION SELECT 135 UNION SELECT 180 UNION SELECT 225 UNION SELECT 270 UNION SELECT 315 GROUP BY 1.000000 UNION SELECT 360 ) AS x GROUP BY ( SELECT x GROUP BY x HAVING x > 50 ORDER BY x IN ( COALESCE ( x ) , x ) ) HAVING avg ( 946684800 ) IS NOT NULL ) ) ORDER BY x LIMIT 1 ) ) ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:Z17setup_copy_fieldsP3THDP15TMP_TABLE_PARAM20Bounds_checked_arrayIP4ItemER4ListIS4_ES9_jS9|ZN4JOIN21make_aggr_tables_infoEv|_ZN4JOIN15optimize_stage2Ev|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_ZN17Item_in_subselect8optimizeEPdS0|_Z21setup_jtbm_semi_joinsP4JOINP4ListI10TABLE_LISTERS1_I4ItemE
      ~~~

Top frames:
~~~
Z17setup_copy_fieldsP3THDP15TMP_TABLE_PARAM20Bounds_checked_arrayIP4ItemER4ListIS4_ES9_jS9
_ZN4JOIN21make_aggr_tables_infoEv
_ZN4JOIN15optimize_stage2Ev
_ZN4JOIN14optimize_innerEv
_ZN4JOIN8optimizeEv
_ZN13st_select_lex31optimize_unflattened_subqueriesEb
ZN17Item_in_subselect8optimizeEPdS0
_Z21setup_jtbm_semi_joinsP4JOINP4ListI10TABLE_LISTERS1_I4ItemE
~~~