Crash in Item_func_json_key_value::val_str() from stored procedure using JSON_KEY_VALUE() in IN(...)

POC：

CREATE DATABASE IF NOT EXISTS t1;

USE t1;

DROP PROCEDURE IF EXISTS p1;

DELIMITER $$

CREATE PROCEDURE p1()

BEGIN

  SELECT JSON_SET('{"c":4}', '$.a', 5) AS x

  HAVING (x IN (JSON_KEY_VALUE(x, '$'), ','));

END$$

DELIMITER ;

CALL p1();

DROP PROCEDURE IF EXISTS p1;

DROP DATABASE IF EXISTS t1;

asan report：

Server version: 13.1.0-MariaDB-asan source revision: c6e8dad6424d363ca6c3a58e47a6c6903a231962

The information page at https://mariadb.com/docs/server/reference/product-development/mariadb-fault-finding/how-to-produce-a-full-stack-trace-for-mariadbdcontains instructions to obtain a better version of the backtrace below.
Following these instructions will help MariaDB developers provide a fix quicker.

Attempting backtrace. Include this in the bug report.
(note: Retrieving this information may fail)

Thread pointer: 0x52c0001b0220
stack_bottom = 0x6a0263d84000 thread_stack 0xb00000
/lib/x86_64-linux-gnu/libasan.so.8(+0x831e0)[0x72028ca2b1e0]
Printing to addr2line failed
mariadbd(my_print_stacktrace+0xe9)[0x5d43c980a6c9]
mariadbd(handle_fatal_signal+0x3f6)[0x5d43c852c636]
/lib/x86_64-linux-gnu/libc.so.6(+0x45330)[0x72028be13330]
mariadbd(_ZN6String6appendEPKcm+0xd9)[0x5d43c7e6a309]
mariadbd(_ZN24Item_func_json_key_value13get_key_valueEP16st_json_engine_tP6String+0x16e)[0x5d43c81abbbe]
mariadbd(_ZN24Item_func_json_key_value7val_strEP6String+0x2cc)[0x5d43c81aca1c]
mariadbd(_ZN9in_string3setEjP4Item+0x79)[0x5d43c862a299]
mariadbd(_ZN12Item_func_in13fix_in_vectorEv+0x14b)[0x5d43c866646b]
mariadbd(_ZNK26Type_handler_string_result44Item_func_in_fix_comparator_compatible_typesEP3THDP12Item_func_in+0x47c)[0x5d43c82852cc]
mariadbd(_ZN12Item_func_in18fix_length_and_decEP3THD+0x25c)[0x5d43c867d02c]
mariadbd(_ZN9Item_func10fix_fieldsEP3THDPP4Item+0x50e)[0x5d43c8722ebe]
mariadbd(_ZN4JOIN7prepareEP10TABLE_LISTP4ItemjP8st_orderbS5_S3_S5_P13st_select_lexP18st_select_lex_unit+0x30ee)[0x5d43c7d4a55e]
mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x139a)[0x5d43c7db4b1a]
mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0x467)[0x5d43c7db57b7]
mariadbd(+0x14f53f4)[0x5d43c7ba63f4]
mariadbd(_Z21mysql_execute_commandP3THDb+0xcc61)[0x5d43c7bd7431]
mariadbd(_ZN13sp_instr_stmt9exec_coreEP3THDPj+0x1b)[0x5d43c8240a1b]
mariadbd(_ZN13sp_lex_keeper23reset_lex_and_exec_coreEP3THDPjbP8sp_instrb+0x75b)[0x5d43c824ec7b]
mariadbd(_ZN13sp_lex_keeper26validate_lex_and_exec_coreEP3THDPjbP12sp_lex_instr+0x363)[0x5d43c8251d83]
mariadbd(_ZN13sp_instr_stmt7executeEP3THDPj+0x17fb)[0x5d43c825404b]
mariadbd(_ZN7sp_head7executeEP3THDb+0x2377)[0x5d43c7916b87]
mariadbd(_ZN7sp_head17execute_procedureEP3THDP4ListI4ItemE+0xab6)[0x5d43c791bd26]
mariadbd(+0x14f387d)[0x5d43c7ba487d]
mariadbd(_ZN12Sql_cmd_call7executeEP3THD+0x3c4)[0x5d43c7bb2154]
mariadbd(_Z21mysql_execute_commandP3THDb+0x2fab)[0x5d43c7bcd77b]
mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x752)[0x5d43c7bdc852]
mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x3ba6)[0x5d43c7be3b16]
mariadbd(_Z10do_commandP3THDb+0x45e)[0x5d43c7be9fde]
mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0xa35)[0x5d43c80580a5]
mariadbd(handle_one_connection+0x7d)[0x5d43c80588ad]
mariadbd(+0x280976b)[0x5d43c8eba76b]
/lib/x86_64-linux-gnu/libasan.so.8(+0x5ea42)[0x72028ca06a42]
/lib/x86_64-linux-gnu/libc.so.6(+0x9caa4)[0x72028be6aaa4]
/lib/x86_64-linux-gnu/libc.so.6(__clone+0x44)[0x72028bef7a64]

Connection ID (thread ID): 3
Status: NOT_KILLED
Query (0x5250003f7148): SELECT JSON_SET('

', '$.a', 5) AS x
HAVING (x IN (JSON_KEY_VALUE(x, '$'), ','))

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,duplicateweedout=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=on,cset_narrowing=on,sargable_casefold=on,reorder_outer_joins=off

Writing a core file...
Working directory at /var/lib/mysql
Resource Limits (excludes unlimited resources):
Limit Soft Limit Hard Limit Units
Max stack size 8388608 unlimited bytes
Max core file size 0 unlimited bytes
Max processes 4127167 4127167 processes
Max open files 524288 524288 files
Max locked memory 8388608 8388608 bytes
Max pending signals 4127167 4127167 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 0 0
Max realtime priority 0 0
Core pattern: /var/lib/coredumps/core-%e-sig%s-user%u-group%g-pid%p-time%t

Kernel version: Linux version 6.5.13-5-pve (build@proxmox) (gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC PMX 6.5.13-5 (2024-04-05T11:03Z)