XMLISVALID crahes with XML sequence maxOccurs>1 loops over its elements

set @s='<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">

<xs:element name="root"><xs:complexType><xs:sequence maxOccurs="2"><xs:element name="n" type="xs:int"/></xs:sequence></xs:complexType></xs:element></xs:schema>';

select XMLISVALID('<root><n>1</n></root>', @s);

select XMLISVALID('<root><n>1</n><n>2</n></root>', @s);

Server version: 13.1.0-MariaDB-asan-debug-log source revision: 32774987aa6e32389f76555fe967cad7f5c1a2e2

#5  <signal handler called>

#6  0x00005a044828175b in XMLSchema_sequence::validate_tag_name (this=0x52d0001748c8, st=0x52d0001741a0, attr=0x52d000172a47 "n>2</n></root>", len=1) at /13/plugin/type_xmltype/item_func_xml_isvalid.cc:1891

#7  0x00005a0448280588 in XMLSchema_complexType::validate_tag_name (this=<optimized out>, st=<optimized out>, attr=<optimized out>, len=<optimized out>) at /13/plugin/type_xmltype/item_func_xml_isvalid.cc:1497

#8  0x00005a04482735c2 in XMLSchema_element_global::validate_tag (this=0x52d0001744a8, st=0x52d0001741a0, attr=<optimized out>, len=<optimized out>) at /13/plugin/type_xmltype/item_func_xml_isvalid.cc:3345

#9  0x00005a0448273127 in validation_enter (st=<optimized out>, attr=<optimized out>, len=<optimized out>) at /13/plugin/type_xmltype/item_func_xml_isvalid.cc:3811

#10 0x00005a04481819af in my_xml_enter (st=st@entry=0x77dfbdf27430, str=0x52d000172a47 "n>2</n></root>", len=1) at /13/strings/xml.c:381

#11 0x00005a0448182824 in my_xml_parse (p=0x77dfbdf27430, str=<optimized out>, len=<optimized out>) at /13/strings/xml.c:513

#12 0x00005a04482794d8 in validate_schema (xml=(const String *) 0x52d000172a90 _latin1 ..., user_data=0x52d0001741a0) at /13/plugin/type_xmltype/item_func_xml_isvalid.cc:3863

#13 0x00005a0448279719 in Item_func_xml_isvalid::val_bool (this=0x52d000172d70) at /13/plugin/type_xmltype/item_func_xml_isvalid.cc:3879

#14 0x00005a04460c0dbf in Item_bool_func::val_int (this=0x52d000172d70) at /13/sql/item_cmpfunc.h:245

#15 0x00005a04472c3873 in Type_handler::Item_send_long (this=<optimized out>, item=0x52d000172d70, protocol=0x52c0001a0900, buf=<optimized out>) at /13/sql/sql_type.cc:7698

#16 0x00005a04472dce63 in Type_handler_long::Item_send (this=<optimized out>, item=<optimized out>, protocol=<optimized out>, buf=<optimized out>) at /13/sql/sql_type.h:6033

#17 0x00005a04460bb8bd in Item::send (this=0x52d000172d70, protocol=0x52c0001a0900, buffer=0x77dfbe07e0a0) at /13/sql/item.h:1238

#18 0x00005a04467c951c in Protocol::send_result_set_row (this=this@entry=0x52c0001a0900, row_items=row_items@entry=(List<Item> *) 0x52d0001727e0 1 Item's) at /13/sql/protocol.cc:1358

#19 0x00005a044699c6fe in select_send::send_data (this=0x52d000173888, items=...) at /13/sql/sql_class.cc:3411

#20 0x00005a04469b0ccc in select_result_sink::send_data_with_check (this=0x52d000173888, items=..., u=<optimized out>, sent=sent@entry=0) at /13/sql/sql_class.cc:3309

#21 0x00005a0446ceb6e0 in JOIN::exec_inner (this=this@entry=0x52d0001738c0) at /13/sql/sql_select.cc:4996

#22 0x00005a0446cecb36 in JOIN::exec (this=this@entry=0x52d0001738c0) at /13/sql/sql_select.cc:4913

#23 0x00005a0446ce84b9 in mysql_select (thd=thd@entry=0x52c0001a0220, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=<optimized out>, having=<optimized out>, proc_param=<optimized out>, select_options=<optimized out>, result=<optimized out>, unit=<optimized out>, select_lex=<optimized out>) at /13/sql/sql_select.cc:5439

#24 0x00005a0446ce8cc5 in handle_select (thd=thd@entry=0x52c0001a0220, lex=lex@entry=0x52c0001a4660, result=result@entry=0x52d000173888, setup_tables_done_option=setup_tables_done_option@entry=0) at /13/sql/sql_select.cc:636

#25 0x00005a0446b1f9e9 in execute_sqlcom_select (thd=thd@entry=0x52c0001a0220, all_tables=<optimized out>) at /13/sql/sql_parse.cc:6217

#26 0x00005a0446b3e534 in mysql_execute_command (thd=thd@entry=0x52c0001a0220, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /13/sql/sql_parse.cc:3991

#27 0x00005a0446b4b933 in mysql_parse (thd=thd@entry=0x52c0001a0220, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x77dfbe3291a0) at /13/sql/sql_parse.cc:7945

#28 0x00005a0446b4f462 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x52c0001a0220, packet=packet@entry=0x5290002b7221 "", packet_length=packet_length@entry=54, blocking=blocking@entry=true) at /13/sql/sql_parse.cc:1903

#29 0x00005a0446b53d7e in do_command (thd=thd@entry=0x52c0001a0220, blocking=blocking@entry=true) at /13/sql/sql_parse.cc:1437

#30 0x00005a044702cbbb in do_handle_one_connection (connect=<optimized out>, connect@entry=0x50b000005b20, put_in_cache=put_in_cache@entry=true) at /13/sql/sql_connect.cc:1503

#31 0x00005a044702cfc1 in handle_one_connection (arg=arg@entry=0x50b000005b20) at /13/sql/sql_connect.cc:1415

#32 0x00007fdfd4e5ea42 in asan_thread_start (arg=0x77dfbf145000) at ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

#33 0x00007fdfd409cb84 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447

#34 0x00007fdfd4129ecc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78