Related to MDEV-24176.

1. vcol_fix_expr() generates new tree changes:
Type_std_attributes::agg_item_set_converter() does change_item_tree().

The changes are allocated on expr_arena (via Vcol_expr_context as per
MDEV-24176).

2. vcol_cleanup_expr() doesn't remove these changes (can be a bug of
Type_std_attributes or per design).

3. Atomic CREATE OR REPLACE renames old table to backup
(finalize_atomic_replace()). It does that via
rename_table_and_triggers() and that closes table share and releases
expr_arena root. Hence now we have Item corpses in thd->change_list.

4. PS cleanup phase tries to rollback thd->change_list and accesses
already freed item corpses.

The fix saves and restores change_list on
vcol_fix_expr()/vcol_cleanup_expr().