MDEV-11444 Server crashes in String::ptr / Item_func_json_depth::val_int.

        CAST AS JSON didn't set the null_value mark properly.

mysql-test/r/func_json.result

@@ -223,3 +223,6 @@ json_object("a", '{"b": "abcd"}')
 select json_object("a", cast('{"b": "abcd"}' as json));
 json_object("a", cast('{"b": "abcd"}' as json))
 {"a": {"b": "abcd"}}
+select json_depth(cast(NULL as JSON));
+json_depth(cast(NULL as JSON))
+NULL

mysql-test/t/func_json.test

@@ -98,3 +98,5 @@ select json_object("a", json_object("b", "abcd"));
 select json_object("a", '{"b": "abcd"}');
 select json_object("a", cast('{"b": "abcd"}' as json));
 
+select json_depth(cast(NULL as JSON));
+

sql/item_jsonfunc.cc

@@ -2073,3 +2073,10 @@ void Item_json_typecast::fix_length_and_dec()
 }
 
 
+String *Item_json_typecast::val_str(String *str)
+{
+  String *vs= args[0]->val_str(str);
+  null_value= args[0]->null_value;
+  return vs;
+}
+

sql/item_jsonfunc.h

@@ -420,11 +420,7 @@ class Item_json_typecast: public Item_str_func
   const char *func_name() const { return "cast_as_json"; }
   bool is_json_type() { return true; }
   void fix_length_and_dec();
-  String *val_str(String *str)
-  {
-    return args[0]->val_str(str);
-  }
-
+  String *val_str(String *str);
   Item *get_copy(THD *thd, MEM_ROOT *mem_root)
   { return get_item_copy<Item_json_typecast>(thd, mem_root, this); }
 };