Server crashes in Item_field::used_tables/find_producing_item on condition pushdown into UNION derived table

CREATE TABLE t1 (a INT, j JSON);

CREATE TABLE t2 (a INT, j JSON);

INSERT INTO t1 VALUES (1,'[1,2]'),(3,'[1,2]');

INSERT INTO t2 VALUES (7,'[7]'),(8,'[1]');

SELECT * FROM (SELECT a, j FROM t1 UNION ALL SELECT a, j FROM t2) d WHERE a MEMBER OF (j);

DROP TABLE t1, t2;

#5  <signal handler called>

#6  0x00006503920c94fc in Item_field::used_tables (this=0x52d00032ac70) at /13/sql/item.cc:3769

#7  0x0000650392088faa in find_producing_item (item=item@entry=0x52d00032ac70, sel=<optimized out>) at /13/sql/item.cc:8524

#8  0x00006503920994ce in Item_field::derived_field_transformer_for_where (this=0x52d00032ac70, thd=0x52c000080220, arg=<optimized out>) at /13/sql/item.cc:8554

#9  0x00006503920889d9 in Item::transform (this=0x52d00032ac70, thd=0x52c000080220, transformer=<optimized out>, arg=<optimized out>) at /13/sql/item.cc:642

#10 0x00006503921b945c in Item_args::transform_args (this=this@entry=0x52d0000f7948, thd=thd@entry=0x52c000080220, transformer=&virtual table offset 1496, arg=arg@entry=0x52d0000f2458 "") at /13/sql/item_func.cc:532

#11 0x00006503921b95be in Item_func::transform (this=0x52d0000f78c0, thd=0x52c000080220, transformer=<optimized out>, argument=0x52d0000f2458 "") at /13/sql/item_func.cc:568

#12 0x00006503930097e2 in Item_func_member_of::transform (this=0x52d00032a580, thd=0x52c000080220, transformer=<optimized out>, arg=0x52d0000f2458 "") at /13/sql/item_jsonfunc.cc:6907

#13 0x00006503928416dd in transform_condition_or_part (thd=thd@entry=0x52c000080220, cond=cond@entry=0x52d00032a580, transformer=<optimized out>, arg=arg@entry=0x52d0000f2458 "") at /13/sql/sql_derived.cc:1482

#14 0x00006503928e9f8b in st_select_lex::pushdown_cond_into_where_clause (this=this@entry=0x52d0000f2458, thd=thd@entry=0x52c000080220, cond=cond@entry=0x52d00032a580, remaining_cond=remaining_cond@entry=0x76e6af621620, transformer=&virtual table offset 1496, arg=0x52d0000f2458 "") at /13/sql/sql_lex.cc:12386

#15 0x000065039284258b in pushdown_cond_for_derived (thd=<optimized out>, cond=<optimized out>, derived=derived@entry=0x52d0000f39d8) at /13/sql/sql_derived.cc:1676

#16 0x0000650392b2a505 in JOIN::optimize_inner (this=this@entry=0x52d0000f4f08) at /13/sql/sql_select.cc:2581

#17 0x0000650392b2c2b8 in JOIN::optimize (this=this@entry=0x52d0000f4f08) at /13/sql/sql_select.cc:2017

#18 0x0000650392b2ca90 in mysql_select (thd=thd@entry=0x52c000080220, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=<optimized out>, having=<optimized out>, proc_param=<optimized out>, select_options=<optimized out>, result=<optimized out>, unit=<optimized out>, select_lex=<optimized out>) at /13/sql/sql_select.cc:5426

#19 0x0000650392b2d3e3 in handle_select (thd=thd@entry=0x52c000080220, lex=lex@entry=0x52c0000846d8, result=result@entry=0x52d0000f4ed0, setup_tables_done_option=setup_tables_done_option@entry=0) at /13/sql/sql_select.cc:637

#20 0x0000650392954cf4 in execute_sqlcom_select (thd=thd@entry=0x52c000080220, all_tables=<optimized out>) at /13/sql/sql_parse.cc:6229

#21 0x00006503929750d1 in mysql_execute_command (thd=thd@entry=0x52c000080220, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /13/sql/sql_parse.cc:3997

#22 0x00006503929825a3 in mysql_parse (thd=thd@entry=0x52c000080220, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x76e6afb371b0) at /13/sql/sql_parse.cc:7968

#23 0x0000650392986257 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x52c000080220, packet=packet@entry=0x52900028f221 "SELECT * FROM (SELECT a, j FROM t1 UNION ALL SELECT a, j FROM t2) d WHERE a MEMBER OF (j)", packet_length=packet_length@entry=89, blocking=blocking@entry=true) at /13/sql/sql_parse.cc:1903

#24 0x000065039298abb6 in do_command (thd=thd@entry=0x52c000080220, blocking=blocking@entry=true) at /13/sql/sql_parse.cc:1437

#25 0x0000650392e7a8b9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x50b000004680, put_in_cache=put_in_cache@entry=true) at /13/sql/sql_connect.cc:1514

#26 0x0000650392e7acbf in handle_one_connection (arg=arg@entry=0x50b000004680) at /13/sql/sql_connect.cc:1426

#27 0x000076e6bc85ea42 in asan_thread_start (arg=0x76e6b8f00000) at ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

#28 0x000076e6bb89cb84 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447

#29 0x000076e6bb929ecc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78