UPDATEXML crashes the server on deeply nested unary XPath expression

UPDATEXML crashes the MariaDB server when it parses an XPath expression containing 100,000 consecutive unary minus operators. This occurs when UPDATEXML parses an XPath expression containing 100,000 consecutive unary minus operators.

Reproducer

Execute this statement on a healthy server:

SELECT UPDATEXML(NULL, REPEAT('-', 100000), 'x') AS xpath_result;

The statement creates no database objects and requires no cleanup.

Decisive observation

The recorded execution produced no SQL output and terminated the client with exit code 137. Immediately afterward, the previously healthy mariadbd process was no longer running. Runtime diagnostics reported:

Running: false

OOMKilled: false

ExitCode: 139

A second recorded execution also interrupted the server and required automatic recovery.

Semantic mismatch

The server should reject the deeply nested XPath with a controlled SQL error and remain available. Instead, parsing the expression terminates the server process.

The grammar production UnaryExpr ::= '-' UnaryExpr directly recurses for every minus operator. The behavior is consistent with that recursion exhausting the thread stack without stack-boundary enforcement, although no stack trace was retained to confirm the internal mechanism.