MDEV-9606 Server crashes in fix_fields, main.null fails with ps-protocol #2

sql/item_cmpfunc.cc

@@ -2708,7 +2708,8 @@ Item_func_nullif::fix_length_and_dec()
     m_cache->setup(current_thd, args[0]);
     m_cache->store(args[0]);
     m_cache->set_used_tables(args[0]->used_tables());
-    args[0]= args[2]= m_cache;
+    thd->change_item_tree(&args[0], m_cache);
+    thd->change_item_tree(&args[2], m_cache);
   }
   set_handler_by_field_type(args[2]->field_type());
   collation.set(args[2]->collation);