Assertion crash in `Item_func_nullif::fix_length_and_dec` — NULLIF in WHERE over a UNION ALL derived table

CREATE TABLE r (id BIGINT);

INSERT INTO r VALUES (0);

SELECT id FROM (SELECT id FROM r UNION ALL SELECT id FROM r WHERE 0) t

WHERE NULLIF('12', id) = id;

mysqld: sql/item_cmpfunc.cc:2758: virtual bool Item_func_nullif::fix_length_and_dec(THD*):

        Assertion `args[0] == args[2] || thd->stmt_arena->is_stmt_execute()' failed.

mysqld got signal 6 ;

mysys/stacktrace.c:216(my_print_stacktrace)

sql/signal_handler.cc:230(handle_fatal_signal)

libc.so.6(+0x94c6c)                                    <-- __kernel_rt_sigreturn

libc.so.6(gsignal+0x18)

libc.so.6(abort+0x28)

libc.so.6(+0x349fc)                                    <-- __assert_fail

                                                       (Item_func_nullif::fix_length_and_dec, item_cmpfunc.cc:2758 — inlined at the assert)

sql/item_func.cc:412(Item_func::fix_fields(THD*, Item**))

sql/item_func.cc:394(Item_func::fix_fields(THD*, Item**))

sql/sql_select.cc:2430(JOIN::optimize_inner())

sql/sql_select.cc:2016(JOIN::optimize())

sql/sql_union.cc:2320(st_select_lex_unit::optimize())

sql/sql_derived.cc:1092(mysql_derived_optimize(THD*, LEX*, TABLE_LIST*))

sql/sql_derived.cc:235(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))

sql/sql_select.cc:2583(JOIN::optimize_inner())

sql/sql_select.cc:2016(JOIN::optimize())

sql/sql_select.cc:5425(mysql_select(...))

sql/sql_select.cc:636(handle_select(THD*, LEX*, select_result*, unsigned long long))

sql/sql_parse.cc:6217(execute_sqlcom_select(THD*, TABLE_LIST*))

sql/sql_parse.cc:5530(mysql_execute_command(THD*, bool))

sql/sql_parse.cc:1916(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))

sql/sql_parse.cc:1437(do_command(THD*, bool))

sql/sql_connect.cc:1510(do_handle_one_connection(CONNECT*, bool))

sql/sql_connect.cc:1424(handle_one_connection)

perfschema/pfs.cc:2201(pfs_spawn_thread)

libc.so.6 (thread start)