ROLLBACK TO SAVEPOINT crashes the server

CREATE OR REPLACE TABLE t1 (a INT) ENGINE=InnoDB;

INSERT INTO t1 VALUES (10);

DELIMITER $$

CREATE OR REPLACE FUNCTION f1() RETURNS INT

BEGIN

  SAVEPOINT s;

  UPDATE t1 SET a=11;

  ROLLBACK TO SAVEPOINT s;

  RETURN 1;

END;

$$

CREATE OR REPLACE PROCEDURE p1()

BEGIN

  DECLARE a INT DEFAULT f1();

END;

$$

DELIMITER ;

START TRANSACTION;

CALL p1; -- This statement crashes

COMMIT;

#0  0x00007ffff7082e7c in __pthread_kill_implementation ()

   from /lib64/libc.so.6

#1  0x00007ffff7028f0e in raise () from /lib64/libc.so.6

#2  0x00007ffff70106d0 in abort () from /lib64/libc.so.6

#3  0x00007ffff7010639 in __assert_fail_base.cold () from /lib64/libc.so.6

#4  0x0000555555aa0cb7 in Ha_trx_info::ht (this=0x77ffa8003db0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/handler.h:2197

#5  0x0000555555c8b3ca in ha_rollback_to_savepoint (thd=0x77ffa8000dd0, 

    sv=0x77ffa803d350)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/handler.cc:3314

#6  0x00005555559d712f in trans_rollback_to_savepoint (thd=0x77ffa8000dd0, 

    name=...) at /home/bar/maria-git/13.1.m39518.fnc4/sql/transaction.cc:756

#7  0x0000555555770822 in mysql_execute_command (thd=0x77ffa8000dd0, 

    is_called_from_prepared_stmt=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:5633

#8  0x0000555555ac1647 in sp_instr_stmt::exec_core (this=0x77ffa80d1ed0, 

    thd=0x77ffa8000dd0, nextp=0x7fffe009ca2c)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:1281

#9  0x0000555555abf4d1 in sp_lex_keeper::reset_lex_and_exec_core (

    this=0x77ffa80d1f10, thd=0x77ffa8000dd0, nextp=0x7fffe009ca2c, 

    open_tables=false, instr=0x77ffa80d1ed0, rerun_the_same_instr=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:420

#10 0x0000555555abfb9b in sp_lex_keeper::validate_lex_and_exec_core (

    this=0x77ffa80d1f10, thd=0x77ffa8000dd0, nextp=0x7fffe009ca2c, 

    open_tables=false, instr=0x77ffa80d1ed0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:599

#11 0x0000555555ac1169 in sp_instr_stmt::execute (this=0x77ffa80d1ed0, 

    thd=0x77ffa8000dd0, nextp=0x7fffe009ca2c)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:1183

#12 0x0000555555626f26 in sp_head::execute (this=0x77ffa80cbc20, 

    thd=0x77ffa8000dd0, merge_da_on_success=true)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:1296

#13 0x00005555556291d0 in sp_head::execute_function (this=0x77ffa80cbc20, 

    thd=0x77ffa8000dd0, argp=0x0, argcount=0, return_value_fld=0x77ffa80a04c0, 

    func_ctx=0x77ffa80a0238, call_arena=0x77ffa80a3600)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:2073

#14 0x0000555555cb3c51 in Item_sp::execute_impl (this=0x77ffa80a01d0, 

    thd=0x77ffa8000dd0, args=0x0, arg_count=0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item.cc:3110

#15 0x0000555555cb375d in Item_sp::execute (this=0x77ffa80a01d0, 

    thd=0x77ffa8000dd0, null_value=0x77ffa80a0186, args=0x0, arg_count=0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item.cc:3012

#16 0x0000555555d445d9 in Item_func_sp::execute (this=0x77ffa80a0110)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item_func.cc:6768

#17 0x0000555555d4e114 in Item_func_sp::val_int (this=0x77ffa80a0110)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item_func.h:4358

#18 0x0000555555cc205e in Item::save_int_in_field (this=0x77ffa80a0110, 

    field=0x77ffa8037300, no_conversions=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item.cc:7340

#19 0x0000555555ade37c in Type_handler_int_result::Item_save_in_field (

    this=0x5555583c2300 <type_handler_slong>, item=0x77ffa80a0110, 

    field=0x77ffa8037300, no_conversions=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_type.cc:4512

#20 0x0000555555cc21ab in Item::save_in_field (this=0x77ffa80a0110, 

    field=0x77ffa8037300, no_conversions=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/item.cc:7367

#21 0x0000555555c3d910 in Field::sp_prepare_and_store_item (

    this=0x77ffa8037300, thd=0x77ffa8000dd0, value=0x77ffa80a0388)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/field.cc:1527

#22 0x0000555555623f64 in THD::sp_eval_expr (this=0x77ffa8000dd0, 

    result_field=0x77ffa8037300, expr_item_ptr=0x77ffa80a0388)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:452

#23 0x000055555563c9a1 in sp_rcontext::set_variable (this=0x77ffa80366f0, 

    thd=0x77ffa8000dd0, idx=0, value=0x77ffa80a0388)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_rcontext.cc:676

#24 0x0000555555ac17cd in sp_instr_set::exec_core (this=0x77ffa80a02d0, 

    thd=0x77ffa8000dd0, nextp=0x7fffe009d9cc)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:1314

#25 0x0000555555abf4d1 in sp_lex_keeper::reset_lex_and_exec_core (

    this=0x77ffa80a0310, thd=0x77ffa8000dd0, nextp=0x7fffe009d9cc, 

    open_tables=true, instr=0x77ffa80a02d0, rerun_the_same_instr=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:420

#26 0x0000555555abfb9b in sp_lex_keeper::validate_lex_and_exec_core (

    this=0x77ffa80a0310, thd=0x77ffa8000dd0, nextp=0x7fffe009d9cc, 

    open_tables=true, instr=0x77ffa80a02d0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:599

#27 0x0000555555ac170a in sp_instr_set::execute (this=0x77ffa80a02d0, 

    thd=0x77ffa8000dd0, nextp=0x7fffe009d9cc)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_instr.cc:1301

#28 0x0000555555626f26 in sp_head::execute (this=0x77ffa809eae0, 

    thd=0x77ffa8000dd0, merge_da_on_success=true)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:1296

#29 0x0000555555629feb in sp_head::execute_procedure (this=0x77ffa809eae0, 

    thd=0x77ffa8000dd0, args=0x77ffa80064f0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sp_head.cc:2341

#30 0x000055555576638d in do_execute_sp (thd=0x77ffa8000dd0, sp=0x77ffa809eae0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:3084

#31 0x00005555557670e0 in Sql_cmd_call::execute (this=0x77ffa8035570, 

    thd=0x77ffa8000dd0)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:3322

#32 0x000055555577185d in mysql_execute_command (thd=0x77ffa8000dd0, 

    is_called_from_prepared_stmt=false)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:5905

#33 0x0000555555777ec4 in mysql_parse (thd=0x77ffa8000dd0, 

    rawbuf=0x77ffa80352d0 "CALL p1", length=7, parser_state=0x7fffe009ef40)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:7945

#34 0x0000555555762a54 in dispatch_command (command=COM_QUERY, 

    thd=0x77ffa8000dd0, packet=0x77ffa800c3f1 "CALL p1", packet_length=7, 

    blocking=true)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:1903

#35 0x0000555555761161 in do_command (thd=0x77ffa8000dd0, blocking=true)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_parse.cc:1437

#36 0x00005555559ad2ea in do_handle_one_connection (connect=0x5555596ca160, 

    put_in_cache=true)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_connect.cc:1503

#37 0x00005555559ad037 in handle_one_connection (arg=0x5555596ca160)

    at /home/bar/maria-git/13.1.m39518.fnc4/sql/sql_connect.cc:1415

#38 0x00005555560461f8 in pfs_spawn_thread (arg=0x5555596ca400)

    at /home/bar/maria-git/13.1.m39518.fnc4/storage/perfschema/pfs.cc:2198

#39 0x00007ffff7080f34 in start_thread () from /lib64/libc.so.6

#40 0x00007ffff710436c in __clone3 () from /lib64/libc.so.6