MariaDB crash triggered by INFORMATION_SCHEMA query with GIS envelope and XML IN-subquery

~~~sql
SELECT TABLE_NAME FROM INFORMATION_SCHEMA . TABLES WHERE TABLE_SCHEMA = DATABASE ( ) AND ST_ASTEXT ( ST_ENVELOPE ( ST_GEOMFROMTEXT ( 'MULTIPOLYGON(((0 0,5 5)),((10 10)))' ) ) ) AND extractvalue ( '<a>A<b>B1</b><b>B2</b></a>' , '/a/b[count(.)=1]' ) IN ( SELECT * FROM ( SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 UNION SELECT 'LINESTRING(0 0,-0.00 0)' ) AS x GROUP BY x HAVING NOT ( NULL AND x ) ) ORDER BY 1 ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:ZN13Item_func_not10fix_fieldsEP3THDPP4Item|_ZN13st_select_lex31pushdown_from_having_into_whereEP3THDP4Item|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN17Item_in_subselect8optimizeEPdS0|_Z21setup_jtbm_semi_joinsP4JOINP4ListI10TABLE_LISTERS1_I4ItemE|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex|_Z13handle_selectP3THDP3LEXP13select_resulty
      ~~~