MariaDB crash triggered by INFORMATION_SCHEMA query with ExtractValue and GIS predicate

~~~sql
SELECT TABLE_NAME FROM INFORMATION_SCHEMA . TABLES WHERE TABLE_SCHEMA = DATABASE ( ) AND TABLE_TYPE = 'BASE TABLE' AND extractvalue ( '<a>A<b>B1</b><b>B2</b></a>' , '/a/b[count(.)=1]' ) NOT IN ( SELECT * FROM ( SELECT 1 AS x UNION SELECT ST_AsText ( ST_LineFromText ( 'LINESTRING(.0 0,0 0,0 0)' ) ) UNION SELECT 3 UNION SELECT 1.300000 ) AS x GROUP BY x HAVING NOT ( NULL AND x ) ) ORDER BY 1 ;
~~~

1. 1. Expected result
      The server should either execute the query or return a normal SQL error without crashing.

1. 1. Actual result
      The fuzzing run observed a server crash. The deduplicated stack signature is:
      ~~~
      stack:_ZN13Item_func_not10fix_fieldsEP3THDPP4Item|_ZN13st_select_lex31pushdown_from_having_into_whereEP3THDP4Item|_ZN4JOIN14optimize_innerEv|_ZN4JOIN8optimizeEv|_ZN13st_select_lex31optimize_unflattened_subqueriesEb|_ZN4JOIN15optimize_stage2Ev|_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex|_Z13handle_selectP3THDP3LEXP13select_resulty
      ~~~

Top frames:
~~~
_ZN13Item_func_not10fix_fieldsEP3THDPP4Item
_ZN13st_select_lex31pushdown_from_having_into_whereEP3THDP4Item
_ZN4JOIN14optimize_innerEv
_ZN4JOIN8optimizeEv
_ZN13st_select_lex31optimize_unflattened_subqueriesEb
_ZN4JOIN15optimize_stage2Ev
_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex
_Z13handle_selectP3THDP3LEXP13select_resulty
~~~