Server crash in stored procedure using JSON_KEY_VALUE() with HAVING IN expression

poc:

DROP DATABASE IF EXISTS t1;

CREATE DATABASE t1;

USE t1;

DELIMITER $$

CREATE PROCEDURE t2()

BEGIN

  DECLARE v INT DEFAULT 0;

  SELECT JSON_KEY_VALUE('{"a":1}', '$') AS x

    HAVING (x IN (JSON_KEY_VALUE('{"b":2}', '$'), ','));

  SET v = 1;

  SELECT v;

END$$

DELIMITER ;

CALL t2();

DROP PROCEDURE IF EXISTS t2;

DROP DATABASE IF EXISTS t1;

asan report：
Version: '13.1.0-MariaDB-asan' socket: '/tmp/mysql.sock' port: 3306 Source distribution
260623 15:10:37 [ERROR] mariadbd got signal 11 ;
Sorry, we probably made a mistake, and this is a bug.

Your assistance in bug reporting will enable us to fix this for the next release.
To report this bug, see https://mariadb.com/docs/general-resources/community/community/bug-tracking/reporting-bugs about how to report
a bug on https://jira.mariadb.org/.

Please include the information from the server start above, to the end of the
information below.

Server version: 13.1.0-MariaDB-asan source revision: c6e8dad6424d363ca6c3a58e47a6c6903a231962

The information page at https://mariadb.com/docs/server/reference/product-development/mariadb-fault-finding/how-to-produce-a-full-stack-trace-for-mariadbdcontains instructions to obtain a better version of the backtrace below.
Following these instructions will help MariaDB developers provide a fix quicker.

Attempting backtrace. Include this in the bug report.
(note: Retrieving this information may fail)

Thread pointer: 0x52c0001c0220
stack_bottom = 0x7596ab976000 thread_stack 0xb00000
/lib/x86_64-linux-gnu/libasan.so.8(+0x831e0)[0x7d96d46781e0]
Printing to addr2line failed
mariadbd(my_print_stacktrace+0xe9)[0x5f7e2283d6c9]
mariadbd(handle_fatal_signal+0x3f6)[0x5f7e2155f636]
/lib/x86_64-linux-gnu/libc.so.6(+0x45330)[0x7d96d3a60330]
mariadbd(_ZN6String6appendEPKcm+0xd9)[0x5f7e20e9d309]
mariadbd(_ZN24Item_func_json_key_value13get_key_valueEP16st_json_engine_tP6String+0x16e)[0x5f7e211debbe]
mariadbd(_ZN24Item_func_json_key_value7val_strEP6String+0x2cc)[0x5f7e211dfa1c]
mariadbd(_ZN9in_string3setEjP4Item+0x79)[0x5f7e2165d299]
mariadbd(_ZN12Item_func_in13fix_in_vectorEv+0x14b)[0x5f7e2169946b]
mariadbd(_ZNK26Type_handler_string_result44Item_func_in_fix_comparator_compatible_typesEP3THDP12Item_func_in+0x47c)[0x5f7e212b82cc]
mariadbd(_ZN12Item_func_in18fix_length_and_decEP3THD+0x25c)[0x5f7e216b002c]
mariadbd(_ZN9Item_func10fix_fieldsEP3THDPP4Item+0x50e)[0x5f7e21755ebe]
mariadbd(_ZN4JOIN7prepareEP10TABLE_LISTP4ItemjP8st_orderbS5_S3_S5_P13st_select_lexP18st_select_lex_unit+0x30ee)[0x5f7e20d7d55e]
mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x139a)[0x5f7e20de7b1a]
mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0x467)[0x5f7e20de87b7]
mariadbd(+0x14f53f4)[0x5f7e20bd93f4]
mariadbd(_Z21mysql_execute_commandP3THDb+0xcc61)[0x5f7e20c0a431]
mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x752)[0x5f7e20c0f852]
mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x3ba6)[0x5f7e20c16b16]
mariadbd(_Z10do_commandP3THDb+0x45e)[0x5f7e20c1cfde]
mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0xa35)[0x5f7e2108b0a5]
mariadbd(handle_one_connection+0x7d)[0x5f7e2108b8ad]
mariadbd(+0x280976b)[0x5f7e21eed76b]
/lib/x86_64-linux-gnu/libasan.so.8(+0x5ea42)[0x7d96d4653a42]
/lib/x86_64-linux-gnu/libc.so.6(+0x9caa4)[0x7d96d3ab7aa4]
/lib/x86_64-linux-gnu/libc.so.6(__clone+0x44)[0x7d96d3b44a64]

Connection ID (thread ID): 4
Status: NOT_KILLED
Query (0x52d0001866c8): SELECT JSON_KEY_VALUE('

', '$') AS x HAVING (x IN (JSON_KEY_VALUE('

', '$'), ','))

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,duplicateweedout=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=on,cset_narrowing=on,sargable_casefold=on,reorder_outer_joins=off

Writing a core file...
Working directory at /var/lib/mysql
Resource Limits (excludes unlimited resources):
Limit Soft Limit Hard Limit Units
Max stack size 8388608 unlimited bytes
Max core file size 0 unlimited bytes
Max processes 4127167 4127167 processes
Max open files 524288 524288 files
Max locked memory 8388608 8388608 bytes
Max pending signals 4127167 4127167 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 0 0
Max realtime priority 0 0
Core pattern: /var/lib/coredumps/core-%e-sig%s-user%u-group%g-pid%p-time%t

Kernel version: Linux version 6.5.13-5-pve (build@proxmox) (gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC PMX 6.5.13-5 (2024-04-05T11:03Z)