Server crashes in XMLSchema_group_reference::validate_prepare

SELECT XMLISVALID('<root/>','<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"><xs:group name="g"/><xs:element name="root" type="t"/><xs:complexType name="t"><xs:group ref="g"/></xs:complexType></xs:schema>') AS r;

Version: '13.1.0-MariaDB-asan-debug-log'

260713 15:18:12 [ERROR] /13/sql/mariadbd got signal 11 ;

Server version: 13.1.0-MariaDB-asan-debug-log source revision: a4757c42741d75bc50f32ac3131815e545fd4435

Thread pointer: 0x52c0000b0220

stack_bottom = 0x75b07ea36000 thread_stack 0xb00000

type_xmltype/item_func_xml_isvalid.cc:1896(XMLSchema_group_reference::validate_prepare())[0x5e038f6093a2]

type_xmltype/item_func_xml_isvalid.cc:405(MY_XML_VALIDATION_DATA::push(XMLSchema_item*))[0x5e038f60fd67]

type_xmltype/item_func_xml_isvalid.cc:2314(XMLSchema_root::validate_tag(MY_XML_VALIDATION_DATA*, char const*, unsigned long))[0x5e038f60fdf3]

type_xmltype/item_func_xml_isvalid.cc:3498(validation_enter)[0x5e038f6096a3]

strings/xml.c:381(my_xml_enter)[0x5e038f5160c8]

strings/xml.c:513(my_xml_parse)[0x5e038f516f3d]

type_xmltype/item_func_xml_isvalid.cc:3550(validate_schema(String const*, MY_XML_VALIDATION_DATA*))[0x5e038f609a42]

type_xmltype/item_func_xml_isvalid.cc:3564(Item_func_xml_isvalid::val_bool())[0x5e038f609c5b]

sql/item_cmpfunc.h:245(Item_bool_func::val_int())[0x5e038d1de59f]

sql/sql_type.cc:7699(Type_handler::Item_send_long(Item*, Protocol*, st_value*) const)[0x5e038e410c77]

sql/sql_type.h:6034(Type_handler_long::Item_send(Item*, Protocol*, st_value*) const)[0x5e038e42a267]

sql/item.h:1239(Item::send(Protocol*, st_value*))[0x5e038d1d909d]

sql/protocol.cc:1358(Protocol::send_result_set_row(List<Item>*))[0x5e038d8fa730]

sql/sql_class.cc:3411(select_send::send_data(List<Item>&))[0x5e038dad741a]

sql/sql_class.cc:3309(select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long))[0x5e038dae623a]

sql/sql_select.cc:4996(JOIN::exec_inner())[0x5e038de26a3e]

sql/sql_select.cc:4913(JOIN::exec())[0x5e038de27e94]

sql/sql_select.cc:5439(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5e038de23817]

sql/sql_select.cc:636(handle_select(THD*, LEX*, select_result*, unsigned long long))[0x5e038de24023]

sql/sql_parse.cc:6217(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5e038dc584ea]

sql/sql_parse.cc:3991(mysql_execute_command(THD*, bool))[0x5e038dc77210]

sql/sql_parse.cc:7945(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x5e038dc848d4]

sql/sql_parse.cc:1903(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x5e038dc88684]

sql/sql_parse.cc:1437(do_command(THD*, bool))[0x5e038dc8d41e]

sql/sql_connect.cc:1503(do_handle_one_connection(CONNECT*, bool))[0x5e038e1711be]

sql/sql_connect.cc:1415(handle_one_connection)[0x5e038e1716a3]

perfschema/pfs.cc:2201(pfs_spawn_thread)[0x5e038e7769c4]

asan/asan_interceptors.cpp:234(asan_thread_start(void*))[0x75b08f65ea42]

nptl/pthread_create.c:447(start_thread)[0x75b08e89caa4]

x86_64/clone3.S:80(clone3)[0x75b08e929c6c]

Query (0x52d000104448): SELECT XMLISVALID('<root/>','<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"><xs:group name="g"/><xs:element name="root" type="t"/><xs:complexType name="t"><xs:group ref="g"/></xs:complexType></xs:schema>') AS r